{ "Event": { "published": true, "date": "2023-08-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-10", "timestamp": 1691712181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3d71e264-f740-48fa-93d4-8873a7eb84b3", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c32f500-378a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meterpreter)", "timestamp": 1691677788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691677788, "uuid": "17943f04-cfa6-4f5a-9858-85da886a6551", "comment": "Malware payload (Meterpreter)", "value": "657dc4f38e42f897d0591605cb20ee3e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691677788, "uuid": "10ffc4f1-e7fa-4780-a455-57612e446a7c", "comment": "Malware payload (Meterpreter)", "value": "00a69f8222c10b96f1b5826bcc718ee6cda420bcca779670c2395084e042db1c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691677788, "uuid": "22d9e1af-e9e5-4316-8919-335e0f3554bd", "comment": "Malware payload (Meterpreter)", "value": "c7cb23e9dc53a41baa54e73b0ba0c0eb118d78b1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691677788, "uuid": "61c11c7f-bc9a-4f16-a088-97649c289f0d", "comment": "Malware payload (Meterpreter)", "value": "c7b1cd2441b15278400257413c09d6e8abaed0286d60aa7be8ed9850733d5bff3f30636b5fb3a291de8a15d074f69cd9", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691677788, "uuid": "91ad18e6-0627-4aca-b3e1-c5c4daa3d851", "value": "T136E1B55337984EF2D87D093C0BD3EDA7A1988E3A2B2F82B28D14030328621247AA0944", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691677788, "uuid": "62eaa342-f8f9-443c-8237-5961c1350c3b", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691677788, "uuid": "f42d1960-42c9-414c-b4ec-3a7b3aba0f74", "value": "24:eFGStrJ9u0/6j/wdnZdkBQAVn1YjGKZqoeNDMSCvOXpmB:is00/wdkBQAqCKSD9C2kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691677788, "uuid": "2c536165-b181-48a6-a80a-4cbfbd4fc688", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691677788, "uuid": "c557ccd9-e4fe-477c-b888-28c1d18051d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691677788, "uuid": "9cc1d0ed-f385-494d-8416-0b191f37a6cd", "value": "657dc4f38e42f897d0591605cb20ee3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77896141-3779-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1691670533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670533, "uuid": "fac3f592-0fde-4ccf-839f-be5cb9b6d05d", "comment": "Malware payload (ModiLoader)", "value": "a46c2e5ca54f9d83107171d9474a5430", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670533, "uuid": "68ff441b-6672-41d4-ab33-c0077c06defb", "comment": "Malware payload (ModiLoader)", "value": "015b074372f96db4ceba665ead494eb19cdb1ffb69f260ba83e5248e303eea17", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670533, "uuid": "5113c881-0ba2-4cbd-af9a-cd7a4c09f176", "comment": "Malware payload (ModiLoader)", "value": "de0429abd1c4acdbbff0297cc221cd4d73e68caa", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670533, "uuid": "06d56e4c-39ef-4103-8650-2edf0053e8c9", "comment": "Malware payload (ModiLoader)", "value": "5baf5ca4288951553c3fc5c21ab34f4d51ad8b8ee2ccbaf43543e0c0061e1ff4e59c17fb3209ba010ee7c76f777bbefe", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670533, "uuid": "77e08dce-25be-4a00-b517-ee163c518c6e", "value": "T1F5E42313448D2186D4532EF4AAEED907149277289CF438FEBBF95D75CB9A8D1A06C83C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670533, "uuid": "c7ab6023-115c-4867-8a2c-989c7abe048d", "value": "12288:0ov/kwMxzTbAi4oiFj2AwmjEseprAfqBDk0sb9aNcaBqZXCp70BioHXOoj:v0jx8PoiFagjVDCBDk0m43BqZy2BioHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691670533, "uuid": "53a7901f-acc5-4779-84f4-6b61ae96321c", "value": 718562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691670533, "uuid": "f1aee648-3e48-4746-8f38-c1d52e168327", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670533, "uuid": "418e3853-3418-46c4-9607-4e30f006decd", "value": "Fatture di trasporto_Fatture di spedizione_125 KB_0000000000000000009.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85904a2a-377f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691673133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673133, "uuid": "ea2885a6-aab0-45ca-81b8-08f6416d0e12", "comment": "Malware payload (GuLoader)", "value": "a7d8d33f99face2d87ed4ac822f5828f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673133, "uuid": "bd3776d2-e3e1-4905-82cc-5c602976db68", "comment": "Malware payload (GuLoader)", "value": "02f9880f063d95ab677b80ea81797ff708e4cbc6111d8488fcb8df473e99cf69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673133, "uuid": "467d64f7-ff89-46ad-b3f0-bce77af641af", "comment": "Malware payload (GuLoader)", "value": "40a813d602c798c1688137214200646f796d9a3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673133, "uuid": "934c7c71-aa4c-4c8e-a14b-02cc682a4bce", "comment": "Malware payload (GuLoader)", "value": "db19ef18fd50fe2f0cf47548d741a6ec22431ed38a487419b6d04b9bacdbf0b59b798a726149cff8162e36b9792e03e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673133, "uuid": "c1cbf48b-80c7-415f-9c2a-4f3799b301db", "value": "T1FD5412253781D57BFBE3D9327E789376CF32AD4A1A1162673B68BFAA5830601415C383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673133, "uuid": "25589bb0-9ad0-46f3-ae86-3371f0b6f4ec", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673133, "uuid": "1d63dc6a-faa2-4c74-b7f9-faa26dd80b25", "value": "6144:oZ/qRr2UPl6xtg81RuDr8NTN5DXIMz0yxhE3AuR9xJ2DxnJ:oBM4xtODr8xDXHYQQEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691673133, "uuid": "a0f69b78-5e5c-4d93-88a9-bfc9fa21f527", "value": 304160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691673133, "uuid": "42364635-9e9e-482b-8451-7c6514993146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673133, "uuid": "81429756-3c05-45ba-8aa7-7b883185e905", "value": "List Material EPC Project.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f3e95d-3772-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RustyStealer)", "timestamp": 1691667423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667423, "uuid": "e2065ddd-3412-48fe-801d-6ceddf7c3c8c", "comment": "Malware payload (RustyStealer)", "value": "539796b3c5bfeecd94ad28751c257fd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667423, "uuid": "40a32782-107b-4b52-a8dc-2974e06666e5", "comment": "Malware payload (RustyStealer)", "value": "04e826b96233b7285ed00a6a964ae824086ed97483a98a051743494f27466005", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667423, "uuid": "7a6aa8d5-5b04-4231-ae3c-541d242031cc", "comment": "Malware payload (RustyStealer)", "value": "fa6282a8ed48d638b85f894951147376bd8e77fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667423, "uuid": "ce16dd6f-8b71-4f06-8282-49faf9f0e29e", "comment": "Malware payload (RustyStealer)", "value": "d886f94a46e9fb8aa5aa68a3866d333c34547e2f76763b3d74e93ed589796ff75133b6101932674bc237b5d770eaa68b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667423, "uuid": "daf6e46d-f6fe-4cd1-988a-b43bd0c4cbb5", "value": "T144E55B027E8A49E9C099C874C34B8BA34A2179CF0A36F6AF55C5611A3F7E6F51F2D344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667423, "uuid": "8f97afa7-d4d7-474f-ba9d-52154cee4858", "value": "3e14ebb453f1bba86f75349e9b49dfb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667423, "uuid": "3ec36046-fb87-4786-9f25-5d9670d77fec", "value": "49152:3Z9J2CPi88LzZOcgmbqBv22bDr50CmxTXm5VIU6ibh5z:y9BG2z3+bh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691667423, "uuid": "efa46358-2d3a-4d63-bba3-878343ded78d", "value": 3051008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691667423, "uuid": "d9d53f8b-fc1a-497f-8570-c38e910d6046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667423, "uuid": "4c99f2b9-214b-4b23-ad9c-87704156c4b6", "value": "SecuriteInfo.com.Trojan.Win64.Agentb.kwia.26015.17513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7509c5e9-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691685990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685990, "uuid": "17e36c32-0d9d-4d18-95f3-73a26402393d", "comment": "Malware payload (GuLoader)", "value": "3a3f615b9956334f87f25451cfcde1c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685990, "uuid": "d9d38a6f-411a-4396-a822-a5bd6c32d0b5", "comment": "Malware payload (GuLoader)", "value": "0567ac589b8bfc85e516230125e50821ea1da4d5ee55a645dfb8d73684cb79e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685990, "uuid": "a6715039-84d1-4448-be81-c348e5642914", "comment": "Malware payload (GuLoader)", "value": "283ceb5b2201bbc8afb25dc3e5d643a62e53ee39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685990, "uuid": "6f9c426d-53a2-4db4-a6b7-e5fb0a77159e", "comment": "Malware payload (GuLoader)", "value": "5ec8092f616ba05e87cf125360d12e94b3ce5c2143404301e7c53b43823b46d9eb3d8efe55757daa7952329b4364023f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685990, "uuid": "a5d0f535-dc2d-4317-a693-ff65e9ba921a", "value": "T1512501C3B9568623CFD4CBFD6B428E66145D7F314728EB06C6297B1B8D7D86231DA220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685990, "uuid": "a57f11ec-03c5-4c95-afd3-adde7fa1dd1a", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685990, "uuid": "5f6219d7-fddf-4617-8b45-f27b69e33db9", "value": "24576:iFiS4xOud9q3LAZZfEsk5bOZfLQjzJfFJx0g2fBR1X4v:9S4Y3LAzEswSZfLQh9Jx0zbRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685990, "uuid": "5114b1b3-e6fc-463d-aafb-0a35c5766de4", "value": 1026544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685990, "uuid": "453b2ae7-dc9a-46fc-9437-e7a94eb2e99f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685990, "uuid": "0a056d96-f5d6-4f76-ae3f-9ab0049cc712", "value": "Ord. N\u00b0 172-09-08-2023 Traslados\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a86d3a-373b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691643869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643869, "uuid": "012dd005-0b91-4e33-8090-13ff97f17c6d", "comment": "Malware payload (Mirai)", "value": "ff828d838b72b841f97639475ddd9fdc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643869, "uuid": "fb0c1b88-a8a5-4072-83b7-98cb340bbae1", "comment": "Malware payload (Mirai)", "value": "056b1f95f7e247cc5e4693a5ca88d58c2ad98bf372c8e0922ddaeb1b65370031", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643869, "uuid": "21c936bc-e9c4-4ff9-ba6e-648013943eb8", "comment": "Malware payload (Mirai)", "value": "ef7d589fe28c51d3e27d85fcc9b2b0c9fa06d6ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643869, "uuid": "fe597831-24b6-4355-8d53-21c842563bb6", "comment": "Malware payload (Mirai)", "value": "f7f3601ffe6ebb9ae717008d6bad07f61010521f92b43c3732062963c534aa141b4910171def14c17316a0c381cd31dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643869, "uuid": "bf5f80ef-b12c-4fa6-be61-7521fd138d64", "value": "T1C1B2D030B1A960F0CD316434F87DC847ABDB40FE90FD7B21366650E49A9658D15EC6D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643869, "uuid": "ef6df4bf-918b-4855-bdfe-80ce6c1e07db", "value": "384:4oBE5aNSS75BOI+ypZ5vTlYIwcvsdTf5MF1iAUgefoeDYbZXGcH1bihymdGUop59:IaNSq5sOHpTqncvsdDePiAUgefoeDeX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691643869, "uuid": "a3bc5d68-01d7-4df8-af16-428702203a31", "value": 23728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691643869, "uuid": "4b4be788-e386-43b4-ab6c-df9e51683297", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643869, "uuid": "4fed7cbe-ccdc-4215-b2c3-0370bf85f800", "value": "ff828d838b72b841f97639475ddd9fdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e9ab37-37c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691702657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702657, "uuid": "5810dbf3-c945-463d-9c94-54c7fcec50e4", "comment": "Malware payload", "value": "c09c83f83515248c4ced19880453312b", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702657, "uuid": "7b78d219-19ca-4907-b5d0-1ea6c7370a7b", "comment": "Malware payload", "value": "0693df434efc9c3cfc8384a5ff6dd1ea71ce3a7a1755ebc859d54485cf421c36", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702657, "uuid": "fb226205-448a-4c52-bada-aeccf10957bb", "comment": "Malware payload", "value": "be3ebc03bb46283c152c9f35c857465f15b8fa47", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702657, "uuid": "a4e6dc4f-ed26-4760-895d-a0e848287af1", "comment": "Malware payload", "value": "bf2a6f4e16edc9d499dcea670c0b283f3199c9071e359b6672f5ddc6fda4009d9ca295dde3111cea278dcf7504341c07", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702657, "uuid": "d3481028-cf97-4134-84d7-1e33caf91c6c", "value": "T1F1328E2FDD9445EDC30F81B751E16015D7A87767D224160EE9B0AF498CB338F4726399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702657, "uuid": "74b87456-5d30-4739-a787-a08c88969fcc", "value": "192:Zya0NvmGoWR4N5eNA2A+EnVs+mg1SoBfJYzO36Pv6KJX8mY9kcWeSdG1:ZyXvmGoWRu5+A2bkBdBfJYzOqPDsz9kG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691702657, "uuid": "af4737b2-a93b-4174-8827-45614424d507", "value": 11493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691702657, "uuid": "daae5979-fb8c-44f0-a505-139a192978cc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702657, "uuid": "c3e88ae3-d9bf-4f79-837a-f855da98e712", "value": "Payment Swift.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd8b783-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691685874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685874, "uuid": "69133c09-80f3-4e09-ab69-0d503a4cb198", "comment": "Malware payload (GuLoader)", "value": "c15b81d99f8367b4c4e8b4c2244f3df6", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685874, "uuid": "dd57903d-83f4-4589-81b8-20d7626214eb", "comment": "Malware payload (GuLoader)", "value": "09ec94c4b0172ceb189b7e15b36d82e70fef89a19d20856b5c60211a01693d48", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685874, "uuid": "b409c971-b8c5-47c3-aa2f-d596ebced70e", "comment": "Malware payload (GuLoader)", "value": "cb8277dc29360515d91a0228c41de01c22a75608", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685874, "uuid": "e2c3ad26-1862-49b1-8c60-7ccd2c85d952", "comment": "Malware payload (GuLoader)", "value": "779eac78ec6e3ff232cba8ff6fb21708a70e8c9281ec28258e67d1a0b988b749f6eb51561871b7843747d44348eb1c83", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685874, "uuid": "7fe649a2-a519-4335-941d-b8d5884cadb0", "value": "T155D4ADC5EA8455A0ED5AAB706A37CD3642237EFCA874941D29DD3E273FFB2931026053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685874, "uuid": "6864f6a8-1740-4a58-9c50-ab5e425192cd", "value": "3f91aceea750f765ef2ba5d9988e6a00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685874, "uuid": "cfb1e23f-4f77-4fe9-ab31-c12c39104fa3", "value": "12288:+fYzP7r9r/+ppppppppppppppppppppppppppppp0YcV22nNBdyn5/AT7ykJGP7t:AYz1Mc5nNm5/AT7LdL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685874, "uuid": "b8df5c91-d640-4947-a2b3-09af90bc2401", "value": 641696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685874, "uuid": "da27851d-ddb0-4f89-a97b-b7fb0d507ce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685874, "uuid": "4bd0a60f-a99d-4ba8-8219-47b91ee9e58f", "value": "DHL INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae3cb91-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691648473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648473, "uuid": "ec830534-21e4-4b34-8dec-07b519cdd370", "comment": "Malware payload (AgentTesla)", "value": "00d060c524fbb1666dbb4b37d7afed86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648473, "uuid": "cf2003f7-f69a-4ba2-ab6f-ee13cd2c271d", "comment": "Malware payload (AgentTesla)", "value": "0a18546482f62496eef5038ade2a04f749c8aad06e1a574f3a2ee9c361d12010", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648473, "uuid": "9b597f48-be25-414d-ab8f-17bedc339e7d", "comment": "Malware payload (AgentTesla)", "value": "0d169b8c9bdec8b127740abadac9497f50a95cfc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648473, "uuid": "4d733301-abe5-4ab5-8b2a-19f5a90b7ab2", "comment": "Malware payload (AgentTesla)", "value": "4d76bba13cf0949aae8d4c86c3a9c3fdc479d110ab3b83c7bfe9859a9fc398e3a9a0be37fd6968e0b3a51895e9ad1afb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648473, "uuid": "b178bac0-09c0-44ed-b0f5-62664bfefbac", "value": "T1F4250218214CE046E7EC76389FB1EEB41764ADCA6811A72279F52ECB37FF3574400A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648473, "uuid": "a9e8a04e-1cb6-4f34-9dc5-9ddbab15fa73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648473, "uuid": "70f2296a-7335-402f-b979-1a53775a1514", "value": "24576:L4jyS4w5m9y4Z0q0/as/hm0+3In/JrEqPrRpPFGuvVAjC:MjyS95m9y4Z0q0is/hm13ArESzsuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648473, "uuid": "6a126dd7-eea0-4723-afd0-c3243f8a42a8", "value": 990720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648473, "uuid": "0b7b0d13-7a2d-4d8b-87b0-1c7324e7cd6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648473, "uuid": "35c970aa-4691-4fc9-9009-bb405bd47129", "value": "List z podzi\u0119kowaniami.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242bb94b-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691685855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685855, "uuid": "1c318c52-487c-48e5-935b-0682085b9e9f", "comment": "Malware payload", "value": "ddaa192b24349c028bb0426b040488c8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685855, "uuid": "336de62a-b02a-42e3-97e4-6c3e7dc654cf", "comment": "Malware payload", "value": "0a31228461b354af6791bfc3cbf42a0c23892d7a8d56892536e88c7d36fede2e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685855, "uuid": "2e01dea7-ed69-4f61-b830-add6d0c660d8", "comment": "Malware payload", "value": "1ed6bc9d98dc5556a6cbcc15752188cfb998fc89", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685855, "uuid": "f2c7fbdc-ceb0-40ec-841b-8088e33af91a", "comment": "Malware payload", "value": "b95c4fb2b416a0e4052aebddd09eb9e90d2e74430a0694c1bbd22c6aaf7178f71335572d1d252f78a2cad30d445543a1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685855, "uuid": "6f091468-0c7e-4eeb-805a-d9d6d0868066", "value": "T171D4230455F1D696E81DB77B5CB2237B862CA813B90FA6D04723E67C160E7091CAC5F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685855, "uuid": "4d32ecba-3363-4680-b25f-5bcc98e2d6d9", "value": "12288:+bgNi0woHvqoUUyqJ2bJ8bnShwCLFGk8JhlXY3PQk+NR8cAJ:+bcvqestUnSOCLF2JrAPD+ocAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685855, "uuid": "a8d78711-bb24-4927-98ec-77bc80f38c3a", "value": 656527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685855, "uuid": "d3fb067c-fc2a-46ef-81cc-2b7028146831", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685855, "uuid": "c055026c-1f30-4966-ae44-987a8253ac1c", "value": "Purchase list.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86bbed4a-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691686020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686020, "uuid": "0e9ea9e1-e97b-41f1-bc02-cafd06968a5b", "comment": "Malware payload (GuLoader)", "value": "be9046720be02533b7ec801eaf187825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686020, "uuid": "961794b1-7a43-49c4-94ae-12a65c4fa86c", "comment": "Malware payload (GuLoader)", "value": "0b79b20a51df32b9100d9236641e24eadbb4bac5c02b4bc007c0ece455184695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686020, "uuid": "e6572b95-ea86-490a-a727-3e830ffe2aa8", "comment": "Malware payload (GuLoader)", "value": "3f899fb1142fbc9b06d2284ae0c07ffcbd51a902", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686020, "uuid": "7aba4cd8-3921-4e7d-9886-fad1df831318", "comment": "Malware payload (GuLoader)", "value": "50e7b37bac149098080e329fe1ff6677da88e761e0d0933907056fc47dd4454e2656f1bae066dc1e7d2f7bc478f219ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686020, "uuid": "c323293e-c4f4-4c83-87fa-1e6f9d5382dc", "value": "T1DB2501C3BA069203DFC8DBFC2A528E22295E7F310769E702D2687B578D7D5A131D6235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686020, "uuid": "70f21e4b-9912-4677-b503-577efa371b5c", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686020, "uuid": "a774b408-6fb9-4cf3-a2ea-e4c64a340859", "value": "24576:TFiS4yPN/ZH6Awv7l9lOXy0PcejwamIykoC:ASZNMAwv7l9UC0UekamvJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686020, "uuid": "22586c5b-b782-4feb-87ee-ef33d4fa0181", "value": 1000280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686020, "uuid": "2210df9d-02ef-4d1c-b3b5-97c65f270f64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686020, "uuid": "59e8e2c4-4527-4317-8415-a3acc01a309e", "value": "Zahtjev za ponudu cijene (UNIRI 202308-10HR)\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e34dbf-37b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691696731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691696731, "uuid": "fb2282e7-4f20-4f38-8c2d-5c5acb111e16", "comment": "Malware payload", "value": "39a3b5a48178b860ba3c69dfa191e974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691696731, "uuid": "43123eae-59d8-4576-ad8d-c59c04d5294c", "comment": "Malware payload", "value": "0b8e662e7e595ef56396a298c367b74721d66591d856e8a8241fcdd60d08373c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691696731, "uuid": "f5062668-6431-4654-b91d-3ddf4275890b", "comment": "Malware payload", "value": "83b1a7f8851aa095b00705c6876ff33419618b80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691696731, "uuid": "39bc820e-6d4a-4f0c-bfe7-a2c5a297748b", "comment": "Malware payload", "value": "5f40db47363a4181f9595f86892e3c5a49e4b564da98023229907bbdf1556365401a1810b7f44e648c418a699d2d1b01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691696731, "uuid": "d31c4665-69bd-4cc3-826a-e60dc82cbf6f", "value": "T11E048C25B5D3C072D473163214E897B15A7DB8710B664EFB73E80F7E8F206D19A30AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691696731, "uuid": "a1ff7780-b1d8-4509-8f61-7deab04a8ceb", "value": "e84e4993c2bc4df63d5fc80b1b577981", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691696731, "uuid": "2e3bd41b-4349-455f-a390-8844d7f80385", "value": "3072:9jD+r9R81DhTnVZ34NeOOHqB8q5YRtU2a7JhXl56GwOAg0FuD0SOVRxPn:JqrmhLVZzdjqYRtUj62AO/OJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691696731, "uuid": "0eb9207c-6858-4f61-b462-4da713623cd9", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691696731, "uuid": "f0c8cbdb-c055-4018-ba02-d544ad0ce842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691696731, "uuid": "f1d1ed6c-c798-414b-8263-76d978665127", "value": "getReasonData.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4031bd2d-37cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691706517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691706517, "uuid": "a9e37b50-f3a5-4f0c-a46f-02e770365704", "comment": "Malware payload", "value": "bd586513bd98cc425cb3a46cb87fee5e", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691706517, "uuid": "e332a608-1f50-4719-9729-9d824d5bfd99", "comment": "Malware payload", "value": "0cb8d046b8197f9ad5c5cad91fd6d4b843ff8a3d59a7c6b4eba4445192dfbc5e", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691706517, "uuid": "7e73ba12-7b0d-4b65-b6a9-f067c50516b9", "comment": "Malware payload", "value": "e71e42ebb04256fde09747cf4a0f2ed08b2dbd9e", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691706517, "uuid": "16d9d809-910a-40be-89f0-8892f61a5fec", "comment": "Malware payload", "value": "d1565398faf09b93726eb9e77aa8b5850d8de3f1b61a70e83fe25c266439c081075c65c1180a7bf991393ce7340faa5d", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691706517, "uuid": "dfccd1c5-6f9a-4670-b7bc-126bb5b1a81b", "value": "T18831413C8D31F4C0873DB750482B1D1213AC1A239BB25A68F9591CB53E09B89DB4EB4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691706517, "uuid": "3ea5ae99-84ed-481d-855a-b9114a9eece1", "value": "48:2adFelRm0i+mToKdxTh67hQmqVX0A/4CwO:79jQKnk+CAQ9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691706517, "uuid": "1952f03e-ed6b-4e7d-8d13-efb10a376a39", "value": 1760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691706517, "uuid": "56ca76de-7c56-4af6-b419-96cac683bf1b", "value": "application/x-setupscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691706517, "uuid": "ea6999ac-0326-4b94-b94a-5eb8ece1f933", "value": "CMSTP.inf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1e2c79-37d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691708254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691708254, "uuid": "d4f8f6dd-2192-4548-bda8-7d5ccb3fde75", "comment": "Malware payload", "value": "6f629c22c6dca16620726c780d44dceb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691708254, "uuid": "05aa4ab9-002f-4b36-8b3b-e05a9ffeb863", "comment": "Malware payload", "value": "0d5b2b8ecd7eb5b46fb06ea28a49194a125b5b269774ffd76e0a2d44fe106307", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691708254, "uuid": "2f04ed26-bf06-4335-8386-12ad46ffbdde", "comment": "Malware payload", "value": "b3acf1278ade676aa1f0b682d267f1c69903991e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691708254, "uuid": "96e1dc74-7a5f-4560-9a69-91603471127e", "comment": "Malware payload", "value": "eb97498af8a551f806d9618382bb67cbeaeb689962093e11dca7376201fc58fa263a3d1fd72bb177ebd62b9973aba93e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691708254, "uuid": "0ca9de12-4720-4fc2-97f9-7f112d73d234", "value": "T10AE3C8067C05C071DA60A1B22AF67FB2C59D5C29EAB445DFAB800E72DA112F77D60B3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691708254, "uuid": "9b2bba98-4982-46b2-8741-954a640c9a1e", "value": "3072:bMcp9RWtmpy0mbyjJAcrDT6suYAY51R9mhqW8NNboeED:bTp9RWtm0c7XT6sRJnR9PzbJED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691708254, "uuid": "838768c0-8303-4cfc-b882-480665d13b47", "value": 146906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691708254, "uuid": "35db3e5c-3f71-4e1f-8877-8ce3a49b9bda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691708254, "uuid": "83ad2234-3fb6-4f8c-8da8-b05dbd2a9683", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f12408-3726-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691634885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634885, "uuid": "3850283d-8267-4096-bfed-b1a077ef2947", "comment": "Malware payload", "value": "a015aadb432413027db7ea4ed02f41ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634885, "uuid": "63748e35-96ab-4959-b2a3-9c4dc03e359e", "comment": "Malware payload", "value": "0d99d9f6d3806b3d3cac679c037ef9c252f85159c6d905f668400a3f7726985d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634885, "uuid": "6171f4ef-6daa-458f-9c14-5dc886d1ec42", "comment": "Malware payload", "value": "e4ba154fa048c329da7b2c885c26842dca489fc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634885, "uuid": "89fd1bae-d785-4804-9087-6b9a636a781b", "comment": "Malware payload", "value": "b5dca6c506dcc6540f5c3f4f7f9b2d5e722ee099399ea5c6141e6e44324fcda491e549c3d44ba3280863adac640c5026", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634885, "uuid": "41ec365f-3a70-47b8-ab8d-28bec550b56c", "value": "T1774301642A0304CEC87728BBB88BD26729C72F29701F44685579D2BA6EF311CE9F9315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634885, "uuid": "3a551a4f-8a90-477e-a8d1-ee6c72f40026", "value": "768:TDoQtBTX941eYFDgNbl5PatCbYUmQAvv/wY24kDpg4AubAvQ3kuHYh87/q4j34Lf:XtBTX941eYF8NblpuvnwanQ3zWYq40Lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691634885, "uuid": "bd0eb93b-1c6b-4db7-9a97-afc071f96eb9", "value": 56940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691634885, "uuid": "0ac2660b-6141-4d7b-8938-03b9c12c1bfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634885, "uuid": "bcd3275d-af6e-4474-ac51-3275f04bd524", "value": "SecuriteInfo.com.Linux.Packed.1255.27555.2670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2a6f07-3745-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691648210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648210, "uuid": "f8df3341-e8c7-4dcf-8f44-82652a4d8609", "comment": "Malware payload (RemcosRAT)", "value": "865e1ea48db89d80c2167f6b02a3d5cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648210, "uuid": "cde8585c-e3b7-4293-975e-41a6b96ddad4", "comment": "Malware payload (RemcosRAT)", "value": "0fe9312c5237b767dc07de6296a5a7aaf8b7c7ec4540f1c65f158aba5079a283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648210, "uuid": "5cdf1419-aa6e-48d8-9c5c-7a9d2a85a33c", "comment": "Malware payload (RemcosRAT)", "value": "d9ab04e67846f3432af243c9614e0b4d12c77e7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648210, "uuid": "182576fd-826d-45aa-8c6e-5035de760901", "comment": "Malware payload (RemcosRAT)", "value": "469631e1d60f8c4b5b147eea298d218715e4aa7a8af8ba6f4534ef3439382cacab8c06de9b2fa93c711082f7f81c349d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648210, "uuid": "b2e8c267-c300-4af4-909c-26e742b29259", "value": "T1A32512FEFBF71E34CAA85532E26660142376E2966283E30A115062D3D76BF950335BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648210, "uuid": "b60a32ac-a082-40c3-baa7-d5c7c7477412", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648210, "uuid": "106c5932-d232-4875-9192-056c00f76425", "value": "24576:r8SxIYlVN23by4MRUOf1+5UPpLq42jBpRlfXLe0:r8jYldvUOf1+WPpW42dnty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648210, "uuid": "5033824e-887d-4695-8005-eccb798add66", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648210, "uuid": "8ef4add1-f0b3-4949-8a67-6999419d1b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648210, "uuid": "0894df5e-109a-4149-8fa0-a7f7d1b0ea48", "value": "865e1ea48db89d80c2167f6b02a3d5cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948bb0b8-37d0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691707947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691707947, "uuid": "78c162fb-be0e-4593-a7ac-e17a4be26be8", "comment": "Malware payload", "value": "b464437e09eabbcd0d22dd7e2f024dda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691707947, "uuid": "7251cbde-89b6-4486-806f-e2a38565a693", "comment": "Malware payload", "value": "100496b46f95f1400deb71deb6a706262401a2a9f7f6c56d30eb37297bacac88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691707947, "uuid": "f58344db-ac69-4748-a2df-690713c0978d", "comment": "Malware payload", "value": "073527bae8f496e95446d549787bc94c56c6b30f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691707947, "uuid": "63471ec8-1f4f-4624-9972-4ba2b4b8c6a8", "comment": "Malware payload", "value": "8768785e5196a6248c80cba1aaa8f5e2ee066f70356b021b6ec4e6a91f1340d457e9cab10140145181aec6654ddfff3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691707947, "uuid": "411301d7-009a-490c-8164-dfd9b39401f1", "value": "T1E59623C164CA90F8EAC05F70D65766CB17B5456B8EC88924ABC13C06A4D5FB271BACF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691707947, "uuid": "3c1440a3-8a64-4558-80c6-c5beeb3de536", "value": "80fb4762ce369ec9129cae7e9bc907c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691707947, "uuid": "bcd9c349-03a6-416e-ac72-6e662777f091", "value": "196608:aoWn4eH5sA9D3FATSndxPB2Dt8aS9YGuDcFMzfhAsrERS7TDh:xtChSTSdxp2GaSuGozfxco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691707947, "uuid": "9c6726eb-7b37-4509-bcc6-b6c5663b31eb", "value": 9016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691707947, "uuid": "20cfee9b-99cb-489e-a0b0-d2e1ace3916c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691707947, "uuid": "3b064e69-cf1e-4e89-b9e2-db4201c06249", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081470aa-3773-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.Generic)", "timestamp": 1691667769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667769, "uuid": "542b2c2a-edab-4c7a-a32b-0ed908e98450", "comment": "Malware payload (Adware.Generic)", "value": "77aaee61df8dda0a508ee180b44e401b", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troja", "colour": "#613DE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667769, "uuid": "ec849b52-bf64-46fc-88bd-9835dc9df2a2", "comment": "Malware payload (Adware.Generic)", "value": "1062b856e7580e1d5b19bdbe87a233343c39c5a41860358c854586f52dbf906f", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troja", "colour": "#613DE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667769, "uuid": "92d68c3c-d3d4-41aa-b6ca-421caf4c34bc", "comment": "Malware payload (Adware.Generic)", "value": "f14a96bf23f79371ac1015dc2eb7767d0ba047e6", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troja", "colour": "#613DE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667769, "uuid": "2a343587-3a56-46c2-a006-31d4b60adc6e", "comment": "Malware payload (Adware.Generic)", "value": "2d5906dbdb63164b7ac02bea9f6d4b9511644b5764c9430a6c3e88fa52d46297c157a8b829e99535c45a7640edcd75db", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troja", "colour": "#613DE5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667769, "uuid": "60fdf836-a62c-4956-a16b-f09f97a699d8", "value": "T1E5A6233FF258A13ED96A0B3245774210997B7A61781A8C1B07FC744DCF769700E3BA9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667769, "uuid": "34658c10-d5b7-421f-902c-a9cf7502df44", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667769, "uuid": "dfccc112-d184-4996-9c4c-7cc1f2569a68", "value": "196608:d5EIyjOUxxUQnKEfuGpKEIyjOUxxUQnKEfuG97Wt5o9b:HEnjOcuQnNPKEnjOcuQnNbCo9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691667769, "uuid": "773718b9-258b-468b-9650-5993385649fc", "value": 9898702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691667769, "uuid": "2df602e8-1b5e-4cdd-8c86-e859a52335aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667769, "uuid": "9e5e0f5b-221c-4ab3-ba6b-77c493debc0c", "value": "Wondershare Video Converter Ultimate v8.6.0 + Crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b664f24-379c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ShurkStealer)", "timestamp": 1691685598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685598, "uuid": "8c56ce64-f2a1-43d3-a7cb-ff984bb55b0d", "comment": "Malware payload (ShurkStealer)", "value": "78bc9c35531a7e1a31af3bdff4083df6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShurkStealer", "colour": "#D21E0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685598, "uuid": "6b1286f0-eb6a-407d-b82f-7e560aa19f4c", "comment": "Malware payload (ShurkStealer)", "value": "108dd8675ad26778748b563a1f590fef6f9875d484002e3d48adb7268358263d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShurkStealer", "colour": "#D21E0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685598, "uuid": "9551d911-1a06-4de7-ae45-ec186275cc89", "comment": "Malware payload (ShurkStealer)", "value": "a679051cff10c802a126c25c42f12fefac857a31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShurkStealer", "colour": "#D21E0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685598, "uuid": "99038910-5279-43f8-bf5a-cdb06795d9d0", "comment": "Malware payload (ShurkStealer)", "value": "1da47bc445963da6e8077d10f421b9fdbd0b2868ca9628dd9b21668dcad9b18a5853d636d098969682c39d6a83364fc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShurkStealer", "colour": "#D21E0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685598, "uuid": "11f77026-1a6a-4a76-8564-cd9f4c77abaf", "value": "T1C3863313F662626CD1A9C07A43946372F97A3C564E327E7E4BE07B331E21F489528F49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685598, "uuid": "098d429b-1755-4e34-84e4-ad67f7c15134", "value": "f703aa9b810df020d0dd2bd35bc21329", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685598, "uuid": "39c846de-9e62-4789-ba50-8560289d6f8d", "value": "196608:SdrOnwUbN9pdNqVWEwLnN+HDc/Up7sSpoVmPYYfW/:SVRUb5dN65ON+AMWS6VmlW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685598, "uuid": "206bdec0-66ab-43b4-a981-38d03b735023", "value": 8081920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685598, "uuid": "3f2bf6f4-8bbe-4b4f-a05e-e9749a336901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685598, "uuid": "b3f6c934-1d58-482b-bce5-7ec98f1c728b", "value": "78bc9c35531a7e1a31af3bdff4083df6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a673d42a-3726-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691634963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634963, "uuid": "50c5a850-e5fa-4e0e-84a9-c4810c4bf5a9", "comment": "Malware payload (Mirai)", "value": "b396510e09dce77314ece930d80e34d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634963, "uuid": "f93df1c2-8f95-4321-ac13-6e9b7fc747d0", "comment": "Malware payload (Mirai)", "value": "10ba0c0bbffcd92ea20b5479e65941ce031f247b845988d88fd2098d46db0d6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634963, "uuid": "62aa3c61-e322-4c61-abf2-594d2064471c", "comment": "Malware payload (Mirai)", "value": "032ca90aca857094aaa85fe02b56778ae21dc23a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634963, "uuid": "05dfd8c6-a341-4fa8-a31a-cdbbf8c57dbd", "comment": "Malware payload (Mirai)", "value": "73ad87fe0d49ac2e06e54d4b6ec6ee6fff8668804d51815b4499e83a712488e805e45839d132961b98e7daf746fa11c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634963, "uuid": "3ad06724-57d8-4227-ae98-7d54b8155164", "value": "T1FBC3B021E0A2ACF1C294423070F5DE795B72A88462571EB25A84C77E608BDECB15F7FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634963, "uuid": "2e648b2c-d9df-494f-abbf-3d8dbf9b2072", "value": "3072:k82GRGl7s2UckJQ5jUvgr6H0Zx/t+dV/N56Z0:k82GW7r++6vglxFkNgZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691634963, "uuid": "d2f3099d-ff1a-451d-8674-3d7fa2886607", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691634963, "uuid": "25ee2853-71c5-4edf-9c99-aecc46bd2d8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634963, "uuid": "150c2076-da14-4b90-a921-dd6b4f2aada3", "value": "b396510e09dce77314ece930d80e34d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069cb3df-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691648439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648439, "uuid": "45cd8922-0456-475b-932f-1ec1ca4faffd", "comment": "Malware payload (AgentTesla)", "value": "05d2b3c11cfa177346cd9bf722f93617", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648439, "uuid": "2ae8ab72-9664-42a9-bbbf-e22213aa63ad", "comment": "Malware payload (AgentTesla)", "value": "111955a5d7cb6b3059b043fd5cfd02827e0be24723c08133890836fc7b5c6121", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648439, "uuid": "a3e22193-7f6b-4e5e-ad6f-8a6a91431105", "comment": "Malware payload (AgentTesla)", "value": "76ff3c88e8e47ba832ac1351508186dc8e031205", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648439, "uuid": "12871587-7dca-4156-b654-998e12c07a71", "comment": "Malware payload (AgentTesla)", "value": "94fa685cd27f50fa55e75cb9db6a63e0c300e155dff501027d71ddf6436a3b63454042f2fdae4699a9af6c61ead13df9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648439, "uuid": "5b680a8f-bf1b-471f-9f71-f3f6e44cb1cb", "value": "T17AF412BEB2E78D21D7B55937EA5A19000333875A7463E30F284833D1952ABD953CABC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648439, "uuid": "89cc985c-32f9-407a-817b-50f94be00b2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648439, "uuid": "27cae223-ca75-41f5-99d7-1bf116325f92", "value": "12288:ncYFGGTIYlV2UwzPrJbJIKQt429aZaLVZ9oQSen4M7+W+yp2h0:cYFxIYlVNwTkF9aZaLtXL7+F90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648439, "uuid": "9579d66b-d3fa-4141-9ea3-64893e01249e", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648439, "uuid": "93ebc48f-ce53-45f6-b895-fc384af5fe0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648439, "uuid": "0c4af7c1-d2f7-436b-b243-fd8123f78ddd", "value": "Quotation 22001625.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d41bb1-37c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691704801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704801, "uuid": "e126a197-a2b2-4411-a8ca-f713c699c331", "comment": "Malware payload", "value": "f8247453077dd6c5c1471edd01733d7f", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704801, "uuid": "bd4c4bf0-77c4-496e-a161-fde94f3c8022", "comment": "Malware payload", "value": "133d3e070e30c94a591450b0930daf9f751debc0f4384fac6ace63f60a383818", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704801, "uuid": "8dedafbd-3e25-4188-8d40-1bb93b567e49", "comment": "Malware payload", "value": "783736e9274bd2bb90390bb9c23a62c387cde3ef", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704801, "uuid": "412dbcb4-a648-46ef-a62e-64dbaa87f87d", "comment": "Malware payload", "value": "86d0e4a8f084d5342e2849855a6eb521eaba4cef8d733aad01e382804bf4d591e33e41bdcf64a3978dba7adb229f48c9", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704801, "uuid": "e4f3ccd7-efd3-4808-9494-aa927e75880c", "value": "T11C224347FF96CA3AC178C73884EB82B0B2F3A5796226272B57055B706D227410F6F194", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704801, "uuid": "93705f5f-9d60-4f39-918c-3ec7315264be", "value": "96:GQT+C+4FWEK+0nUep+H1ijUP8AuHTOpIEz/BlNe7W/SUemRj:GQG4FWkqU4+COv9lA7W/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691704801, "uuid": "d236e3b7-c9e6-4eba-97e7-f45d84946d33", "value": 10416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691704801, "uuid": "3703b46e-88ce-487c-bf40-b5010ef4c6aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704801, "uuid": "9612498e-fe73-4f4a-95c6-f1428809475a", "value": "133d3e070e30c94a591450b0930daf9f751debc0f4384fac6ace63f60a383818.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff6ef5c-3789-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691677526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691677526, "uuid": "7b9da806-2bb6-4bc5-bdc3-1ecf345a3fa2", "comment": "Malware payload (RedLineStealer)", "value": "a797391a3990d426900e2f68d25df614", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691677526, "uuid": "9de26436-230b-42da-adb7-363cde537c99", "comment": "Malware payload (RedLineStealer)", "value": "1536c40c44d9e4d2f235abd2c5932fe7be534aaa321404d1d2cc12fdaba17742", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691677526, "uuid": "3699b66d-7a9b-41ce-bb28-5a5a38a48ce8", "comment": "Malware payload (RedLineStealer)", "value": "436b01b572842ec63990c70228f2a9e1a7126438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691677526, "uuid": "e02f2178-61b2-449a-9e49-4c865ccdad27", "comment": "Malware payload (RedLineStealer)", "value": "61f013be47e8c35e511378fb1362b53356666c8a7e2e31fddce7e18b4b47c1daaceacfa2d217ae015a3c9820665e35d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691677526, "uuid": "9571a2cb-6d02-4587-8a47-f1155fa6c7ac", "value": "T1BDA47C62E75AEB97F243C130D80FC2B4922ABC6E9207862725D13F477AF13C5125F996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691677526, "uuid": "efad1532-315a-4a61-87b3-79f269ac5599", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691677526, "uuid": "51063426-3cbd-4493-b864-336299378815", "value": "6144:ANFFc/yQrtwvvQpNVZjBTwFbt02PA65CGrdy04NIlomNKv7c+QTQ:Y6/yQCi/jBk02I5b0XloBcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691677526, "uuid": "0e1a8cc1-560b-4f67-8365-8dc9d6120ccc", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691677526, "uuid": "e816f0ca-a75f-4f77-a751-a0cb513976b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691677526, "uuid": "a2c99e6a-9489-4190-8681-115720f82de4", "value": "1536c40c44d9e4d2f235abd2c5932fe7be534aaa32140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d7d0bf-377d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691672463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691672463, "uuid": "e415ef82-7798-4759-931b-49690cd09026", "comment": "Malware payload", "value": "557e4508aaf4b7037d5cd7edc9224e96", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691672463, "uuid": "9b768185-c28e-4323-8c04-d13d4b79d565", "comment": "Malware payload", "value": "153c9ffe148909981900c59c2ccba8ef66f94688ce7ab5e01e3a541937a31294", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691672463, "uuid": "1daa6149-a0e3-4201-be36-b4683063b434", "comment": "Malware payload", "value": "7c877a697cb4b2efcb354b4601267eaabbba7160", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691672463, "uuid": "6c45e76f-001f-43e2-add1-9e15871ab4d7", "comment": "Malware payload", "value": "76bdc056600db22e8ab3da055ffbf5c7204bb20954a58f00a6f131f1a2a6618d8d4eb4ff1f4ee279b7aac1c4377eff67", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691672463, "uuid": "31a196bc-5c15-4978-9da8-322e49d0176e", "value": "T12A721B15B7D04B36DAFE8B31483343010732F68A9A53EF5F548C82A9AD63749E991B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691672463, "uuid": "d8e91749-e151-4643-a3a1-93616eba4baa", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691672463, "uuid": "dc8958f0-35d9-4409-ac35-22577f110282", "value": "384:GbmNzThIHN959t9hoz2x8+bODByqdEaWS5MZNop:GbsIHz5T9iCy+b0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691672463, "uuid": "83c357d4-fe9f-41a8-9b63-e25348ea5e48", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691672463, "uuid": "008fb2fa-ee3c-465d-b2ce-7a06453a045c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691672463, "uuid": "9758760c-9fde-4269-bf1d-4866268fd037", "value": "azzo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9d0d05-3734-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691640824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640824, "uuid": "b7d9d8f9-582d-45ef-95b8-649b344e1140", "comment": "Malware payload (Mirai)", "value": "553d3902af7a7cfb692c8969fabb7fcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640824, "uuid": "79888f27-873d-4472-989b-c285915a3f93", "comment": "Malware payload (Mirai)", "value": "15ca7e8ebbc544dfdf50da592dcefeb6d06b1df335d108faecde32b857b9fc94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640824, "uuid": "1c47548c-5f71-40ae-8ea3-50877a9a2522", "comment": "Malware payload (Mirai)", "value": "99ca7f8e7da5df207e7d3b9aa399ea2ce54293db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640824, "uuid": "f3762c40-8349-4d83-8be0-38c6fb03e080", "comment": "Malware payload (Mirai)", "value": "c0c0a52e6c5f8f821131108a4e80eb0d500fe4c251ab41729356bba1c94b7584479079eced40c30c364b17dd0e55bbda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640824, "uuid": "fff0f34f-7be3-4629-b299-4e903021ad91", "value": "T1DA832265AB61DE7BD85ECD3306998601208E554A16E93B2FBBB0C22CF79BD0F44D3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640824, "uuid": "ffdf7c0c-f601-43ed-967b-ee4720c8ee4d", "value": "1536:wJQhaOb16z265GbeXgp+onxlZ4Tg0FMfGHm9:UOzbew5lv+Hm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691640824, "uuid": "32433d04-955e-4cba-a308-b1f41b59486f", "value": 88680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691640824, "uuid": "1a164e24-d0b4-4baf-bc78-64803d9ad337", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640824, "uuid": "72282a5a-298d-4ac1-b885-16310411e591", "value": "553d3902af7a7cfb692c8969fabb7fcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c7c379-37c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691704727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704727, "uuid": "a58d2998-53be-4c09-9c18-2cf9e81126e3", "comment": "Malware payload", "value": "bb2a0bac5451f8acb229d17c97891eaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704727, "uuid": "54e58259-9a1a-4471-9e78-6deaca377eb2", "comment": "Malware payload", "value": "15e4e936b2f47eb3fa2455b7c22b2714bebe9f8c01b24bbf7cb5f9559999d292", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704727, "uuid": "3428f749-288e-4fb2-8c16-288d86b6f204", "comment": "Malware payload", "value": "ee295ec546158e425a3660a4a9402916087ccd97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704727, "uuid": "3f6e1dac-ef6d-499a-8694-95642423633c", "comment": "Malware payload", "value": "1c741fd74028692c016f4cdded26fbef2a7b5478d24adbf8c92739f2e01108039f9c94ce5832ca0761e34f0da44d189e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704727, "uuid": "857f7c2b-64bd-43db-9c73-ee56dca255a0", "value": "T12205F1EB8C5FD52ED4994CB5ECD912391B22C9C78B024E1276E8D8341CEB3537E5A4AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704727, "uuid": "edbc105d-32b7-4eb9-9991-fe4b901d230d", "value": "24576:27NLXpoDZ2Qu5prXPrvzDIE7sNunUyPC/:273oDZ2drXPDzl7sNkUyPC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691704727, "uuid": "d0c4a99c-cede-49bc-86cd-8be76313a6cd", "value": 802168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691704727, "uuid": "b8f0ae5b-2709-4144-bb53-aa3d38ca8e8d", "value": "application/x-object", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704727, "uuid": "f240a7b5-9e0b-4e55-ba49-22ec5a120939", "value": "15e4e936b2f47eb3fa2455b7c22b2714bebe9f8c01b24bbf7cb5f9559999d292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ace79a0-3780-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691673598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673598, "uuid": "798c2bad-c9a1-4621-bb47-1f519fd7499a", "comment": "Malware payload (AgentTesla)", "value": "4305b619026191e695e7f662ae11f5f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673598, "uuid": "664d3b67-6ce5-4c32-b18e-3481e184e6a0", "comment": "Malware payload (AgentTesla)", "value": "163fdfd91953364306bcf8c6d69cada7306f0452fe3373e3247b5641123a0251", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673598, "uuid": "cafb4a03-6259-45bb-8f05-2c3c90c04158", "comment": "Malware payload (AgentTesla)", "value": "9d91874cfa370a6049a7f5bbeea0f6e51c992657", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673598, "uuid": "abf2da8a-4201-4a5e-873e-eac7c1fd10ff", "comment": "Malware payload (AgentTesla)", "value": "64dc446661db597af58050d20a27e3c16c090ada45db73db3b20a949a0dc6bf91d96ebd42f7182d53620e30ebac05fc9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673598, "uuid": "225f8118-8fa8-4665-b150-fda2f56d0a41", "value": "T1DBE423092701795EDCF55BB138A37B13633CA74F75F0EAA35ADC70449E26A980A53F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673598, "uuid": "5414c2bf-8260-4542-9795-e16af629c23a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673598, "uuid": "b3a82847-ee4f-4937-a262-51a23b0b4e9d", "value": "12288:rML87+2ZPO+MG7NRTzCgyCgBoQeSvZ+NP/0dDfzcN9oSHLnvRz2ZL8:gg7+2tO+VvTzCgy/oQTZzzwVig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691673598, "uuid": "84477857-9ae5-4b22-8a3b-d2d7a55334d3", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691673598, "uuid": "3a725d25-5f51-4e5d-84b5-36389d472a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673598, "uuid": "53874e95-fef3-4ae6-bd56-bf5b563486d4", "value": "ORDER-SUNNY 10005916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cacdacf-379e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691686272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686272, "uuid": "57436294-c06e-4f2e-bd59-3dbbd556cfc3", "comment": "Malware payload (Formbook)", "value": "83708be2ed0baaf290878bb3b457c40a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686272, "uuid": "dc3d4a3f-1790-42d6-a3b0-9508953c8f3b", "comment": "Malware payload (Formbook)", "value": "168e72097cea76b8d996b129c02d7a1d9825f72ecb193317d5f5ab08fef5540b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686272, "uuid": "a34f03db-19cf-4182-9082-5f406054a825", "comment": "Malware payload (Formbook)", "value": "0fc7007362447011e0fde8d132052bf3f28fe558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686272, "uuid": "74367efa-7992-433c-b64f-7872755c6f81", "comment": "Malware payload (Formbook)", "value": "542097f6b0c0e6435d10260778dce6b5aab88524386f320848ef5412c63cab634ad384037d3c7f91bf5b455e210ac316", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686272, "uuid": "5c3841cd-3d6d-47c7-9cc9-527a9926bb06", "value": "T120D4238163F4CC28DFB9877999246410C736E14FEDE9DA1B090C292B6E317849685BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686272, "uuid": "15e16f6a-da42-4839-a4ab-dc21e078b99e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686272, "uuid": "f9894a83-ad31-4173-bf09-1343ce4aea7b", "value": "12288:wGTIYlV2ElZmC/aUJSoVRbDPQY1I4Gsy8gGyST/UqgXW9FAYJ:/IYlVVcC/lJSARF1I4Y8wST/vP9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686272, "uuid": "83275e4d-1ad1-41b1-8071-a49198efb638", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686272, "uuid": "65a36341-c519-4d1a-807c-268d60857aac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686272, "uuid": "8bddeeb7-482a-4b33-be85-3b46a5fe0fc7", "value": "83708be2ed0baaf290878bb3b457c40a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1391d4-3755-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691655023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691655023, "uuid": "73351ba3-2c6d-4a71-a575-3c97b6b39aad", "comment": "Malware payload (RedLineStealer)", "value": "b279aef934b71aad686d60e8d7664299", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691655023, "uuid": "46075840-5a22-4e20-bd69-5c43e4808530", "comment": "Malware payload (RedLineStealer)", "value": "16f378006036cc1d8a4a32b5cd74c1fc9e28944fa4e8df06845b564e0f847d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691655023, "uuid": "2b5fc646-86b6-4c2a-9ce6-0bfda9c3ce40", "comment": "Malware payload (RedLineStealer)", "value": "3f653f09eee4f7560f50ca52c48fcaf0a3a8a618", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691655023, "uuid": "86e1721e-df53-4869-9a78-bcbddb0693e5", "comment": "Malware payload (RedLineStealer)", "value": "4d91b43a429b01eda933ca5349ce4ca22b53815b473bffae4dc87cefedd1f8affc1b27604ba82e1f154538a69fe8a089", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691655023, "uuid": "74dcca42-b3bd-4c02-98b1-641880119f3b", "value": "T19527333D77156588FCB5FD3A50C4B839B9D5E833641B62230B81AF04AE0AE46FA521DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691655023, "uuid": "c646a218-76b1-41e1-8653-44b81523a4aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691655023, "uuid": "75712103-069d-4018-bd6d-2573c1a82134", "value": "393216:SgGV9FUcGPY+Ys9G9FlcBCRHHp0bQCVGqn3coEGMeRK9csCgBBELLs3kN:SdUcuY+Ys9G9F0sHYMJoOeUOkbwGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691655023, "uuid": "e1b870ea-2147-4fac-8ba0-505d972dfa37", "value": 21058048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691655023, "uuid": "fc8bc973-3209-4003-9c38-1c82d60098cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691655023, "uuid": "238f69c0-f3b7-4d08-9a0a-5d72087fdf84", "value": "b279aef934b71aad686d60e8d7664299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56cba937-37c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691704837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704837, "uuid": "294bfb11-e0bf-4356-88e5-1a9bd374eae8", "comment": "Malware payload", "value": "cb61b3624885deed6b2181b15db86f4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "RShell", "colour": "#0E8CA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704837, "uuid": "47ea62c9-b2ee-45bf-94fe-f1449530e7a0", "comment": "Malware payload", "value": "17bbebd7d8982d580cc3dea35d988ae2bfd62d708b69662419c41682274e0a14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "RShell", "colour": "#0E8CA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704837, "uuid": "2f2d9379-1aaa-43b2-9797-a1364b66f637", "comment": "Malware payload", "value": "a5f6162c6b6b6f0c177771a56a6b1eb5d7b593a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "RShell", "colour": "#0E8CA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704837, "uuid": "762fe9d2-d1e9-436e-bf36-5b97bca6616f", "comment": "Malware payload", "value": "f0dff39f8e9397d2c5de1a635ef82ba5c5e1e922c2ed46dc48b1c302a1b593da2367185d8da52dbe6c08cf54900a7ad8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "RShell", "colour": "#0E8CA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704837, "uuid": "bd5055e7-2686-4a3d-bb49-33339ab15d50", "value": "T12B437E8B9511CA7EC9F123346FAE2613E5277054BF8D331B39246B31393E6A71E21326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704837, "uuid": "0e6a1944-8e84-407f-a375-b65206a5b6be", "value": "1536:JeLPdFDGXg8Y48SKpkVyqexuM8AN/1uy:JeLPdFDGXLYrFpbqex2AN/1uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691704837, "uuid": "71317a74-f588-41c9-b462-2a74da24dbd3", "value": 55784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691704837, "uuid": "2e0a014b-f15a-4c14-b9cf-08778b1ba330", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704837, "uuid": "80787e55-af7d-4359-9a23-44bf3022d372", "value": "17bbebd7d8982d580cc3dea35d988ae2bfd62d708b69662419c41682274e0a14.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f5a384-3726-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691634887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634887, "uuid": "5e3dba27-9cba-4180-bfbd-06841293d40a", "comment": "Malware payload", "value": "d9748243342a437b2098ba9a8f89e7f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634887, "uuid": "6351c177-4154-43cd-a81e-5e0ca7e09490", "comment": "Malware payload", "value": "1806d1922d71759fddc0e8ad2936228bcc03f71c63a72d071e8c861d5c0bcbe8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634887, "uuid": "28841d26-6a1a-42e0-b013-15f8712c0c6f", "comment": "Malware payload", "value": "a7e93bd1426980928fde7b10a2da0a95b79955e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634887, "uuid": "0ca10c88-27ae-4f09-bd0a-583901d4bc83", "comment": "Malware payload", "value": "8db4824138b59ab4ac87c523b73cf5579d786fd61117847f76fcef9913792f4d49cdfb286f458a367aa78b223572cedd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634887, "uuid": "9f035d66-3cbb-4faa-b7ee-0eb218c9b1a9", "value": "T1703302A52A1304CEC833287BB88B86561DC72F29745F445811B6D2EAAEF311CE9F9309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634887, "uuid": "e49e2f05-e63e-46e4-8060-b829cfefc5ba", "value": "768:TDoQtBTX941eYFDgNbl5PatCbYUmQAvv/wY24kDpg4AubAvQ3kuHYh87/q4j3m:XtBTX941eYF8NblpuvnwanQ3zWYq4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691634887, "uuid": "41f261c6-dfb8-471d-918e-753a2a9b605a", "value": 54020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691634887, "uuid": "d9ecbc36-29c5-4b5e-b748-2a370d4922d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634887, "uuid": "a992cb2e-dbf6-4458-9202-cce11c34000d", "value": "SecuriteInfo.com.Linux.Packed.1255.25845.25042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dff6441-3782-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Moobot)", "timestamp": 1691674463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674463, "uuid": "1b5780b3-4d3f-4aa7-91cd-b6c290e650be", "comment": "Malware payload (Moobot)", "value": "d36fcffc3e7d896a21905227b706577a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674463, "uuid": "3adc8522-10cd-482b-9593-b4d1e77ad50c", "comment": "Malware payload (Moobot)", "value": "188f5c6eb7573be5bf4df13ef67942e0546d51b7c93aa09e09dfbac1275ead3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674463, "uuid": "fb3f01b5-be96-42b0-8a52-d6ed68e15685", "comment": "Malware payload (Moobot)", "value": "a9e19c429a2b80314ec0fca4b7fd8c79a962c0cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674463, "uuid": "54df27a5-6326-42ca-9b93-828aedce1880", "comment": "Malware payload (Moobot)", "value": "724463568330057a3412aab6cee422ec701e9d1dea259f6ae4009a7738f84bd8fe3aefe01a1aada4ecbe932a5ab7947c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674463, "uuid": "0a368d06-a3a9-47a2-b703-64bc6d308bc0", "value": "T133035C01E782E0BBE94301F66577971B0336E2795085DF6ED7989839EE66100E7333AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674463, "uuid": "6f0157e5-f03b-41e9-abbe-260667a68c5a", "value": "768:Hh/EBW3Lt5JlIDozX4tltGTq1Gi+8A8VySdIlE/:Hh/n3ZTtSXaoGDTSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691674463, "uuid": "a4399a46-072b-4fde-8f54-eb3ffe1bcf45", "value": 38004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691674463, "uuid": "7f48e950-4803-4540-8889-c1151f9f2d81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674463, "uuid": "0bedf3b9-5682-4004-949f-f76725f1d588", "value": "SecuriteInfo.com.Linux.Siggen.9999.15389.24005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647d7786-3780-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691673507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673507, "uuid": "309470bf-8803-4f5e-b085-7bc2e26a34aa", "comment": "Malware payload (Loki)", "value": "0b908f4e5134cca4692d7cd556419f75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673507, "uuid": "be668554-e7c2-4df8-843b-728a16409e87", "comment": "Malware payload (Loki)", "value": "19b698a9fc593354baf0aeb140f4a57e4e66bbdf8602bc4c2d18d706a06dd428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673507, "uuid": "8d80e9e3-84a3-46ab-9e0a-df9a954970d9", "comment": "Malware payload (Loki)", "value": "1b62d18384f072a9b785d9b38ee371a34e5fa746", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673507, "uuid": "8d6acfc8-ab23-4777-9113-bc1da8213166", "comment": "Malware payload (Loki)", "value": "624e4d0490a014231c0a708c0143422c9121fddb3f783a9463f8be712bcfa7133788d8d4b2bfb3cdee80a20ca5ec290c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673507, "uuid": "f06acac0-196b-479f-8577-d619e6370876", "value": "T140D47D7406AAC50FE46B1B34C8F2E2B17FA98FA092D6C7474FE4BCFBB44A15666410D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673507, "uuid": "46a42695-4292-4229-84cb-b5ef1cb694e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673507, "uuid": "fb511582-8f56-426c-bec9-ec26d77e3aa6", "value": "12288:wtBjvroojvO64heYqe34GPzBszh4pNSJ:EBjvMol4hGe34G+zA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691673507, "uuid": "a4f04339-d6aa-4ec1-a413-9ccc561e0d44", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691673507, "uuid": "9c718fe7-97ed-422c-98f4-8ccd568a8d37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673507, "uuid": "137f0eb0-7a7e-46ef-9569-7e9be8fa2c78", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10626ad-378d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1691679326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691679326, "uuid": "ae703444-b134-44c9-aa89-0825cdf54641", "comment": "Malware payload (RiseProStealer)", "value": "b898305476b4cee57c98401819a84e57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691679326, "uuid": "3a3fea05-7d82-40f9-a68e-8b4c2e4da62e", "comment": "Malware payload (RiseProStealer)", "value": "19e799b44a59412e8f9d66be8176fe6ee1fcd18ee7a740ce899edac3c2310639", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691679326, "uuid": "f913c227-d9a8-4134-b3b9-e8e1b1de6c58", "comment": "Malware payload (RiseProStealer)", "value": "7921f5db13c23d8b52634c555ded56dc1e1fea44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691679326, "uuid": "0143e7e4-b6ce-4ad9-a222-b3b88bf22dbd", "comment": "Malware payload (RiseProStealer)", "value": "bd7d99dadc0bc6c8b889e8bd262f827a3188ef0ab06cd55404abe45649c692f4e3ff3b06e1c7cbd03639dde15abc80e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691679326, "uuid": "5bd20092-f589-459e-9d05-a72e46853e71", "value": "T1BF05F1C2AEE07C21F552CE328E3E86E7763DFD618E683B591168FA6F05710E2D162341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691679326, "uuid": "06a02584-e223-4f00-809d-6e827af1f373", "value": "8801a5787fb0afca6c87d6856306680b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691679326, "uuid": "3623e14d-f007-4500-bb69-b053c6855b41", "value": "12288:1HFO1RkVLivZtXEYJjotQE177mWAOxyCVQCQzlwGe8E5GG5vNIKegI475sZi9VJI:1FOUVGt0ztQE1v6Ox7VRQ5o8xcTQoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691679326, "uuid": "e4a9aff3-21e1-442a-82d5-e2566508d75f", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691679326, "uuid": "f6eca898-96d4-453c-9cc9-1215c0749369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691679326, "uuid": "bf2330cd-063e-4a0d-99ed-e675af6ae3e2", "value": "b898305476b4cee57c98401819a84e57.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb43406-37b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Arechclient2)", "timestamp": 1691694752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691694752, "uuid": "c9ff98b0-ab67-41cf-9770-de0e8b0b3441", "comment": "Malware payload (Arechclient2)", "value": "1bf35ce85d9dabad107f0bbea91a0579", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691694752, "uuid": "4239279e-f633-4165-964f-c19d22b356a4", "comment": "Malware payload (Arechclient2)", "value": "19f301313e2b0cb48c422765f6306b7dd5ef26f1984eb9cad750546836aaa2fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691694752, "uuid": "237d34e5-bfc0-46af-ba1a-1083f01c5ebd", "comment": "Malware payload (Arechclient2)", "value": "d49600d21f743a82d8967c21e5c22a2c7f146bd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691694752, "uuid": "48adac9d-8be7-4d7f-a730-3f70d43c83b4", "comment": "Malware payload (Arechclient2)", "value": "188dfce8717ac2b2780185cf2f63b9c96a340fdd3e22ffec7d69035742326fbf1f012c771ab2e2e60be126407f59461b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691694752, "uuid": "c27a8292-6190-4997-9e05-95985a0a6689", "value": "T1E1C53305AB63C4FFC2B48A784D25D7378925AB94BB11C3C178A753AF7736D0C9A83482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691694752, "uuid": "c7d5541e-70e8-4e72-b9c7-6bd72a687fcf", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691694752, "uuid": "9cc82b66-2d9e-4f4c-9b17-897fcfc88ae7", "value": "49152:rpcDOPMLcBHulDAmyXX4gu+kP3I0GrKOKHHhKmYfAdHxX:rGOPMAGhyn4gu+kMAHHSoZxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691694752, "uuid": "4ffda5b7-624f-45fa-8bd6-dab75108ea15", "value": 2666496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691694752, "uuid": "838355b0-55eb-47c2-b395-7431afd7e06d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691694752, "uuid": "55f8587c-e932-4b5e-bf30-cc02135062e2", "value": "1bf35ce85d9dabad107f0bbea91a0579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5e45d9-3779-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691670626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670626, "uuid": "5fc85349-a399-4a33-babf-51b308d8c479", "comment": "Malware payload (Formbook)", "value": "66fd4814b25e93d2dc5618f6732bf1b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670626, "uuid": "5f03e9d1-9946-449b-8ed7-70408fcd175c", "comment": "Malware payload (Formbook)", "value": "1a93020a97c76213eb9336ee822ae9009d60a82fdcfaded1defdb4e7f649c963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670626, "uuid": "e7f40ada-2690-465e-b16a-88c8372ec3f7", "comment": "Malware payload (Formbook)", "value": "dae22631edc857743e6bfee011e6d8d1febee93e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670626, "uuid": "5cb7ae1c-89e6-4a80-a416-3ae91a18d950", "comment": "Malware payload (Formbook)", "value": "d03de77bb51a1a83ffe859b056b089f9801527098cc05609b24b71e8c4c515dede2f76cf91991f3df3f11018522b4027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670626, "uuid": "0e06133d-4b5f-45cf-b99b-56e772489cb7", "value": "T17AD423051F9421EBC9FC97BD6453279763F5234BA4B2EAEBBCC439E45825A8C0B02F45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670626, "uuid": "1e81f8cf-c4cb-4162-9a42-a25f7ea4e103", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670626, "uuid": "af1e2f7b-57b1-4178-b4a6-706e7e7eca46", "value": "12288:pqL87+28O09mVaMzUNqq4Va03a91Mium8z6GOZAb1QwSUID8eWW/L8:kg7+28L9OBwN703AumapOq17ID8edg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691670626, "uuid": "72b078d2-2fff-44be-b5a2-9eef32c5d373", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691670626, "uuid": "bda0d52b-6477-48bd-9bb9-bb6ae2e1c18a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670626, "uuid": "191f53d3-b678-48ae-9689-2872220167cc", "value": "Enquiry for Quotation-png-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8beed35-379c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691685701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685701, "uuid": "18b80cfd-aea4-4f48-93ab-8dc9cef81761", "comment": "Malware payload (AgentTesla)", "value": "f7423503a31781e15418aa4d9e8d522a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685701, "uuid": "35404524-2fc9-460e-9bdf-0ee2d827be9c", "comment": "Malware payload (AgentTesla)", "value": "1b16ab38f1808b6853077196891a181f1909607e522bc12535d3e39364055687", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685701, "uuid": "120faa7b-8524-4014-b45b-ca0750b56dc2", "comment": "Malware payload (AgentTesla)", "value": "bfd81bca68cc5982acc0c74b55d8bb7b806123f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685701, "uuid": "a05d5e6f-36b7-4886-9123-b4c740eb1d99", "comment": "Malware payload (AgentTesla)", "value": "dbeb86417cca8c3683cd43ef182e9940e8e75d05fc8b31fef39fa7794d1ea5d3b2aa0b9c6e197c8e02549cc1dfd055d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685701, "uuid": "29a62990-d2f6-41e5-a9e1-f7775454e10c", "value": "T1A1E423492368542AEEF14BB96473896242B8B74B60B1F7DB3DC621E4CB55F0C0F52E1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685701, "uuid": "00e2e7e7-c278-48fa-9bf1-6e665db19a84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685701, "uuid": "d8261d60-b965-4736-9acf-1ae15fbae8ad", "value": "12288:XqL87+2UuQ7K0syJRHVzi2tt4Ujc598z12qpy8D8lVL8:ag7+2UuiVi2tt5jc38zxpy8D8lVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685701, "uuid": "3121bd43-81cb-4fc4-a45d-30ba05b42df3", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685701, "uuid": "d93645f9-cdfd-4987-9874-0ba108630b1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685701, "uuid": "6ef97be2-2e0e-4931-86a0-78da4d1f7bec", "value": "MV GREAT HAN V6 CALLING FOR CARGO DISCHARGING_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eeeccad-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691648480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648480, "uuid": "a831f16a-13e1-4d2d-86a7-0f0393123c6a", "comment": "Malware payload (GuLoader)", "value": "4267367fe2f39a1b7f2af8b01bdc9a09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648480, "uuid": "c4d89b12-d2fd-4fc6-99ec-e03b9a4e5e04", "comment": "Malware payload (GuLoader)", "value": "1d3a4b188ed5f70862cf8dc67c9ccb1cae2b2f94ee847c3e1504ac13721eadd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648480, "uuid": "5576a595-7cae-44df-a407-dd84ef2886fd", "comment": "Malware payload (GuLoader)", "value": "a0157d55e861e23b41353a7093dbde6a2c8ed885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648480, "uuid": "e9fce91c-0f52-434a-96aa-d7ae134bfddf", "comment": "Malware payload (GuLoader)", "value": "9862227b7084a809a96d351566ff7ed4a3d2a6833d8f467248ae1e2af0a4a442dee0245a7bee7e1c957d17ace5694a4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648480, "uuid": "51a024e8-2407-4687-888e-60c7f64bd2e4", "value": "T1022501C3F9025253EFC8DBF91A968E92251D3F310B19EB01C1697B5B8DBD4A532C6236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648480, "uuid": "6eee68a8-ecfc-4713-a3dc-2e9276acb946", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648480, "uuid": "7420fb37-1c17-498f-9c58-ba52e2988aa3", "value": "24576:IFiS4QH1OeoVhlbP0HEjiCs0IcdNaI+TpZcOe26:/SpweiP5eTyNdypuOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648480, "uuid": "b90db5f1-8bbd-4df2-9a45-9e430bb2d4e8", "value": 1009568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648480, "uuid": "0dfa1921-9c3c-4c67-addf-209784df85c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648480, "uuid": "4a081772-13e1-445c-9c2b-058f6ee400ae", "value": "\u5831\u50f9\u8acb\u6c42 (NTU 202308-10TW)\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fb601c-3797-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691683552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691683552, "uuid": "db302f28-121e-434f-aea4-d18e3ae58fa7", "comment": "Malware payload (AgentTesla)", "value": "efce0021b5f9a8fe86ed43c4d404d6d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691683552, "uuid": "61b38bce-bbc6-426a-b2fc-2f7566957e4b", "comment": "Malware payload (AgentTesla)", "value": "1e5d0ecba17e0de6cf37f9a37e31c9c9a5883df357b0499592598d3921804b3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691683552, "uuid": "aba45a17-025a-41ca-bb1b-8bd20716011a", "comment": "Malware payload (AgentTesla)", "value": "a81270fcf6de50e67170e2ad8742baf5c905dc8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691683552, "uuid": "41126487-ddf0-45eb-87b2-e1130e50cf6b", "comment": "Malware payload (AgentTesla)", "value": "ef6c46da445b88a501212f9fee8255243a032b4a29cf3318840acfd85f87e3e1c9bb50be09c0bb2be961e0edbafbf5b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691683552, "uuid": "5f6cb98d-3331-4629-b5fd-65bde8f71a23", "value": "T104F412BF72F75D20C7A55536D7A3200153B26BAB6562E30F250832D4863ABE64346FCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691683552, "uuid": "9cc33dbc-d0e3-46c7-90f1-6b801300b801", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691683552, "uuid": "dedc8161-c5ba-48b2-bdd4-9808e0e764f8", "value": "12288:sqGGTIYlV2UwHkFCyLvw0493/OJE4MgXyF1keOjvkH+OHTSqJ7Nw7kW/:sqxIYlVNwEEg4b/g19QG5vrOHT3RwgW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691683552, "uuid": "70082802-d66f-4be1-b4ba-34904ccee692", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691683552, "uuid": "8cc88b32-c9e9-4f7b-85bf-4c8713980918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691683552, "uuid": "3285f8e0-716e-4ae9-83db-4a3698b7a60e", "value": "Transaction for USD137.000.jpg (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d75734-3726-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691634888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634888, "uuid": "2c6f6a12-5dd3-4ee4-b908-661caca6b256", "comment": "Malware payload (AgentTesla)", "value": "4135f44f099ce2fb8932c2122a304d52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634888, "uuid": "8366fb50-2511-4a19-91cf-aaf536dd0fdb", "comment": "Malware payload (AgentTesla)", "value": "1eba4559ea8e4c4a53804b0258ff3be6082861bd6f9b4b33876c4cb8bba5e407", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634888, "uuid": "781ca3c4-6066-4e91-a330-8578545969a6", "comment": "Malware payload (AgentTesla)", "value": "1a1f9fb26987478913d897be072bf06ed3e11611", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634888, "uuid": "35f92192-9b4d-4c3b-83bc-f5bb1c3012c5", "comment": "Malware payload (AgentTesla)", "value": "34f8715164b961c7c7a5e59dcade1e1a372cf6fc103ce862ffbd7eb3903bf719f7a0a2e10d4dc8b4c27773aa7c9cccd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634888, "uuid": "164e33ad-9cdd-4343-8050-c4bf7b6c23f3", "value": "T184F412BA77F79D34CB791231E25221055331A79B51B3F31E110837E6892EBE62352ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634888, "uuid": "8632eb1b-66a5-40df-b4e9-547b854b9ce9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634888, "uuid": "5dc2b239-d951-4b50-8e20-c4f0ff9f935b", "value": "12288:Dn/X/2GGTIYlV2LwaKADyoU31C+pyqMuJS9czAKQYIOv+GxAlwDTv2Fz3tI:Df/2xIYlVewQ+pyqMuJGiAwH+G4wDK1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691634888, "uuid": "740e61e8-5af8-483a-956a-d014c9e21e02", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691634888, "uuid": "f3eeae86-6c38-42f5-bb12-ddffb5eb306b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634888, "uuid": "e9efa21e-54c8-40e0-8dc4-b9453d819736", "value": "SecuriteInfo.com.Win32.PWSX-gen.819.30212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a655b0e2-379c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691685644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685644, "uuid": "305fe24e-1524-48c7-a2e8-ce1654a662eb", "comment": "Malware payload (SnakeKeylogger)", "value": "44d760f77eae7e9c7822c09e23d50eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685644, "uuid": "f9d2606b-8f74-4b14-bcbd-c3602ed1a5fb", "comment": "Malware payload (SnakeKeylogger)", "value": "2074307fedf8e749114664f0d8294c77eb4b01b3f1b8c782819ecad6c48c5298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685644, "uuid": "697e1e25-cf9e-44e2-a752-d94a06a27dba", "comment": "Malware payload (SnakeKeylogger)", "value": "5f7020bcb56ba72e5aca14aa7043248a1b3cdde6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685644, "uuid": "03e9c14c-1656-4e80-9555-fcf79d9d6863", "comment": "Malware payload (SnakeKeylogger)", "value": "74b8757cdb72da8a72b13aa8301e1f0504efa8c7a84b36622a99aad0b79c0ef236d00282e80da22f0b0d26fb24334f05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685644, "uuid": "e2676bf2-74d8-4abd-8d1d-69f63e5a421c", "value": "T15F441221F1E1C1FAD4A2563019BABD691FB6C32341AD052B67B456C87D33AE2CA1DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685644, "uuid": "866da83a-ed92-4424-a95f-69d817fce04e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685644, "uuid": "8aa17fcf-e32b-4ae9-be0b-3102ee969a43", "value": "6144:ZYa6sKiecHb94wOJ6uamBXW1j0U4v+zXk:ZYe9ecHKwOqzVVpzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685644, "uuid": "5de67015-6bcd-4088-a845-9d2e4f4e0457", "value": 278007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685644, "uuid": "2240402c-7135-4413-8078-f5683a2b8d41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685644, "uuid": "eb1ab3b1-8e07-415f-ad94-c3c9ba63d0a1", "value": "SDHG09876557.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa3bcf2-377e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691672497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691672497, "uuid": "97657538-8bdd-4285-972f-850581e7c275", "comment": "Malware payload (GuLoader)", "value": "e56ac1279828ba90de0ee78d75dbcbad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691672497, "uuid": "a4f84d31-0e7c-454d-9ac3-d70910e5d581", "comment": "Malware payload (GuLoader)", "value": "215a50e6fc04dd4027489c24d5df93b52e410583c5ca7d1c8e524321ff8dbc2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691672497, "uuid": "9de618e1-907e-47eb-ae86-a3282253dd26", "comment": "Malware payload (GuLoader)", "value": "c6d52ee26538bf8e6477789c32a471073bff10d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691672497, "uuid": "2009b061-8063-449f-9871-f82358a8240c", "comment": "Malware payload (GuLoader)", "value": "9d291c9122ff0a7dae9d534c68821719b24421a8f1dd84466b19f63d911453507ce043383465183a864322d55c9e28e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691672497, "uuid": "26fa1c66-3072-4c2f-9cc9-4111a333cb44", "value": "T1EBB4F18D7A84D846CC020B326172E1B26A73BD2E1DFD851ED23B7E6375F3681764D688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691672497, "uuid": "c4b4df11-a13d-4b86-8475-eefee8e4c67a", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691672497, "uuid": "371e3751-955d-41e4-9557-2ace80f1be78", "value": "12288:3UIW/llrrG1nMyuBHKISEtjuej6sP/KX:3UL/7rGxBCHKISEtiejI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691672497, "uuid": "e73237e9-9d99-43c3-8cf4-1c37cbd05197", "value": 518856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691672497, "uuid": "217a9b1c-b50d-4aee-a13e-7b8e983a76d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691672497, "uuid": "140a11b4-50b5-4608-b2bb-81a3e314130c", "value": "DOC AWB 1100771254.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eccaed4-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691685846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685846, "uuid": "656c5722-113f-4bf4-b601-d346af3c7a29", "comment": "Malware payload", "value": "c13c5925a8a0c7f63af33c38c4a815de", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685846, "uuid": "3a979fd8-c36d-4b6c-a662-c85fcc614e5e", "comment": "Malware payload", "value": "21621f9116f4ee2a958d59b8af1981cecbba7ca9b799f0d4489f103401ae20b3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685846, "uuid": "1d010b96-220a-4fb5-b3cc-927a4ca25d16", "comment": "Malware payload", "value": "0f75f21666d6bcce9583076c597c934342cab45c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685846, "uuid": "38a9d5ae-298a-4b11-bae4-5bc7196959ad", "comment": "Malware payload", "value": "11b607b36c6e17f727061cc078eb5be28d1f9126e2585a792dee355bfc66aeb2e6b92c192282aa9e883988188ea84e83", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685846, "uuid": "50fb4dc4-714a-42d4-99f1-a0c045cc7897", "value": "T1D3B533ACC1C56460E097F6B44F7F3631031076EA663E99D74A2DA020E0FF5AC6C95F1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685846, "uuid": "0b9ab4ee-252c-4889-99fb-9fa8486f90dc", "value": "49152:qvqycaagMWZe0ssbk9La169LwXTjxEu2aZJFCMOS8cUcw8uEfNYjpCwB3:qiiaB0ssuG0cTjxHH/ONcy0fmjp/B3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685846, "uuid": "880e1a95-ce8a-4874-999a-3322ffcc2637", "value": 2364709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685846, "uuid": "8beb5af5-a917-42cf-a094-5d98035200d9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685846, "uuid": "05efc111-4474-4181-841d-9763e7a87587", "value": "fiyat talebi.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800b4395-37ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691692451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691692451, "uuid": "e05ca30b-daf3-41f6-8a16-a75004f233a8", "comment": "Malware payload", "value": "4b29c67a00bcda2f4e861fd036b7dd2d", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691692451, "uuid": "87c7ea2b-b6a3-4172-b74a-90663dcb16cd", "comment": "Malware payload", "value": "21b3e304db526e2c80df1f2da2f69ab130bdad053cb6df1e05eb487a86a19b7c", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691692451, "uuid": "5958968c-254d-473b-9c0e-3a80a51fd409", "comment": "Malware payload", "value": "e50132c0168310123a928391d052087a5185faf5", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691692451, "uuid": "6c659482-abfb-47de-b339-b6a6e1cc1a07", "comment": "Malware payload", "value": "6b42b753a03f2ce17d32e4c30c93452a0bdebc6017d7cae9ca4ddf5bfb50daab6986c183c1106edb931bd5cb85fd48b4", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691692451, "uuid": "dea90e72-3ef4-42bb-a6f3-45abe3bccdc0", "value": "T1BF667C43F85150B9C1ADD2308A699292B731B898073227D73F60E6B53F67BE46FB8354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691692451, "uuid": "e5e53679-eb5b-4ff0-80fe-1a3289ace38d", "value": "98304:QTbvmvut3qy84Jif+r3HEtoEvNGsuw/GskejHre4HfV:NutTXUtocsJw/GsdLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691692451, "uuid": "88384696-3a2b-457c-a591-20dc2f6fe6fd", "value": 7117824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691692451, "uuid": "18d8518b-7a02-4f9d-b2fa-68ee9e7b1336", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691692451, "uuid": "3d09059e-8cb3-4a0d-92b2-1af4f93b498d", "value": "Mac_App", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a5d9ff-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691648457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648457, "uuid": "f71f93b3-3e84-41db-bed3-cbf5cba89f17", "comment": "Malware payload (GuLoader)", "value": "a2835129a81e34fe1ecef85326203893", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648457, "uuid": "f7ee2dbe-87eb-498f-b3da-dfbeb80db373", "comment": "Malware payload (GuLoader)", "value": "22469270ffe028b3181a811014d9c0793dd4df7b0dc1821c28d453d8084b5922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648457, "uuid": "b341d57f-5402-4bf8-9541-cbcbd0293faa", "comment": "Malware payload (GuLoader)", "value": "85797f5099aee0935684c33df31c3306e35155eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648457, "uuid": "c2090410-8612-47dd-b411-47be8d19cd98", "comment": "Malware payload (GuLoader)", "value": "bb4c189479e58168a1817aa9a334b392e473ff3d8e7987d5b0a5744625ccf3b967f2499902b99c25257cc89dfe63c86e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648457, "uuid": "1c1254fd-edcb-4381-9f3d-efa9e237e68d", "value": "T1D02501C3B9425213DFC8DBFD1B828E12695D7F324B19DB02D128BB1B8D7E56231DA225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648457, "uuid": "4bde6d69-bcae-4a3e-a407-7758657af691", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648457, "uuid": "317f2008-3e89-42ce-9d59-7fa767db6545", "value": "24576:XFiS45d7YLKjw5oR56QyCJCWuMf0fZO4d34Q8AAIN+:8SEnjWoRzMWulo4ahso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648457, "uuid": "2b2dfd94-1cc6-42af-8f35-7c5b536df1e0", "value": 1017544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648457, "uuid": "761cd9de-5675-4a48-a6af-a68c467801bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648457, "uuid": "6dbaaf2d-67c6-4b44-a6ba-4072dcdf23e8", "value": "(\uc11c\uc6b8\ub300\ud559\uad50) 230809QUOT - 0329KR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c78051c-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1691648663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648663, "uuid": "5619674e-046c-4c79-9534-5d55a11dff6d", "comment": "Malware payload (QuasarRAT)", "value": "3e91bff88a3cd28109bb2463666fc537", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648663, "uuid": "8062c789-d24b-4d1f-82d6-1c6f975c17de", "comment": "Malware payload (QuasarRAT)", "value": "2373051514c08af26704de34d18387632b72005f08d2ac2aff4b55666c1e617a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648663, "uuid": "62f08a1d-6870-403b-bb0f-f55337771c94", "comment": "Malware payload (QuasarRAT)", "value": "a310ce6fa9f166f5d0179f1950c54f0fbaffcb6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648663, "uuid": "cbfdf000-b576-46ac-a8c7-7d2d55c0eeab", "comment": "Malware payload (QuasarRAT)", "value": "35ba17db78d8569dae10540cc0cc2bda58d68b05685b9dc79775db6ae9f07fe94f0c0b437fa9f18966ea9ff91ae1f882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648663, "uuid": "eb662ba6-3518-490f-97c4-b1275ae3b01f", "value": "T1F465E04EFC022F55C331D87B0A8E9A203CAA12BF5F529F1772656987DF805C6B03566B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648663, "uuid": "640c5b95-9501-44fe-bb28-8929ad6b9d25", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648663, "uuid": "53a8c261-96ec-4337-8cc1-7fb43f32457a", "value": "24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648663, "uuid": "371471c3-a724-43a6-8b3e-ff809ae1252c", "value": 1443632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648663, "uuid": "8609ae99-4195-4ddc-a6a7-bc6b12c1e2ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648663, "uuid": "c32601f4-b489-456f-b210-0f5c62495f8a", "value": "3e91bff88a3cd28109bb2463666fc537.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cdae5e-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691685851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685851, "uuid": "66a4f0dd-2962-4a57-8585-6982b6241553", "comment": "Malware payload", "value": "0b4dfbeb77361852447ab5ba4bc70690", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685851, "uuid": "9b3d95e4-19f1-486e-944b-45bc77397367", "comment": "Malware payload", "value": "2426f2b02e5edb2d6ef698b37a7d3934b6c14b36fdf9e156b6ec353a4fe71fcb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685851, "uuid": "8a4b7000-52c5-4744-84f1-2179db08ea32", "comment": "Malware payload", "value": "ebc0a9dbcf3372cea0b60b621f2b97a3176e0adf", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685851, "uuid": "2682496c-881b-4dc9-a019-2aa324c4a307", "comment": "Malware payload", "value": "a787c077ebf625f3036e93ed739115129b439e51fb2e1d60d54542ff8e39e154129d66e0d266be67da4693792566f758", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685851, "uuid": "d993244a-94d3-4dc2-8530-bbf4349d6fe0", "value": "T132E42309C6D61022761B7E302246E4FD0B9BF5BD6D2F31651A6EC90AF2A3D1361D3E78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685851, "uuid": "574a966f-1c95-4870-91ed-aeab16c8eb16", "value": "12288:4dsGgjTujAytqhbLOPnQjGvElbHFHSTtHB9GtsZVsVfzjrSEIBGGFyvk:J9urGSQavExHFHWtHXGtsXshfGE/GFyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685851, "uuid": "09f9afe8-5222-4cd7-9976-2fc7ddfface3", "value": 707097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685851, "uuid": "e96c3a33-43ce-4ae0-b67d-a3aef3701f61", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685851, "uuid": "c2e8f222-7570-4550-97e6-0c374be76575", "value": "\u03c3\u03b7\u03bc\u03b1\u03bd\u03c4\u03b9\u03ba\u03ad\u03c2 \u03c0\u03bb\u03b7\u03c1\u03bf\u03c6\u03bf\u03c1\u03af\u03b5\u03c2 cava-divino.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4c8b0c-378c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691678865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678865, "uuid": "cd573bd7-7174-4241-b32e-3b9bdfabf590", "comment": "Malware payload (AgentTesla)", "value": "d49677b78535f5c9870cfa2f791e73b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678865, "uuid": "e33c73c4-9cf5-4673-8248-613af1dafb4c", "comment": "Malware payload (AgentTesla)", "value": "24700851caf95f65e558136999cb225a597b7d12aad83d9818fa4240adcc8137", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678865, "uuid": "a30167d2-724b-40a3-9511-d75722d983d1", "comment": "Malware payload (AgentTesla)", "value": "d088058f56803e929c10cd5c913643f43a3d0ed7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678865, "uuid": "20ca901e-15f1-49db-b833-4f605da5df67", "comment": "Malware payload (AgentTesla)", "value": "8575554a75a778b9352ca75600f8bb08d61a08466f95b63fc54c1fd7b11cb011240eea0faf7ff3a734b165a93c0ea807", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678865, "uuid": "e10ed145-727c-4355-a6d9-b467bdadd961", "value": "T190D423C1B3F98974CEB9933DB94A9904A722A44EDC5DDA0B1905253EFE3BB010141FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678865, "uuid": "c2001e60-34c8-4e2b-98c4-e78bac5c3a06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678865, "uuid": "ffe73b82-0eba-4038-ab9f-5f47b2670821", "value": "12288:QGTIYlV21CIJAIG1MiEFc4SiaYz2Ux/dSodG0EJZOH/erovg6YP8Oq:fIYlV+C0bGSix6xSoX802gf2l6YRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691678865, "uuid": "190935f2-9d0c-4a85-8ea1-6253e8837075", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691678865, "uuid": "d2f6ad2b-e9e7-4f39-918a-e1e6b71614e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678865, "uuid": "44ea0e21-225b-443e-853f-5aafe71df350", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da750a4-3792-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691681119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691681119, "uuid": "cc8bed31-5df6-4344-a85b-c79c17bff70b", "comment": "Malware payload (RedLineStealer)", "value": "220a068eded5f2db5d7eff197f9746f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691681119, "uuid": "d0184a63-3f61-46f7-9276-fafbae8f06a3", "comment": "Malware payload (RedLineStealer)", "value": "24a93ddf60120497dd5848ec03147621840eb5b371d81a999e8af55f959466db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691681119, "uuid": "1d4a4fe8-223c-494e-ac8a-f21d6a3d7f49", "comment": "Malware payload (RedLineStealer)", "value": "2a594149e2fb3406f079b4ad3f2f4c5519f62f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691681119, "uuid": "28202843-6038-434e-a70b-84f7efe3e9fe", "comment": "Malware payload (RedLineStealer)", "value": "68b0a23ef01d23ad01c0365cdf301aec53f39747bb21430ab9ca01e5d5d00fa2501c3a5171fae5af52082500ddde78af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691681119, "uuid": "5443a24e-f937-4494-88b2-705851cba4a1", "value": "T13885CF3FF268A13EC46A1B3245B39310997BBA61B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691681119, "uuid": "5871c8a8-eb0d-490e-a6fd-5eb98b7e7b4a", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691681119, "uuid": "6a1af67e-ae46-414f-b3f1-9dad14c5436b", "value": "24576:s7FUDowAyrTVE3U5F/EpqKn0hD1Kic6QL3E2vVsjECUAQT45deRV9RV:sBuZrEUm5wKIy029s4C1eH9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691681119, "uuid": "13bfae82-b494-464e-9bbb-31fb24acdbb9", "value": 1767251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691681119, "uuid": "793e4f73-caf7-4349-91bd-e669ab4602f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691681119, "uuid": "d18c91ee-5778-4e21-8fc0-b31adb57ec00", "value": "24a93ddf60120497dd5848ec03147621840eb5b371d81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8879cb-37c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691703589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691703589, "uuid": "289d9df9-9e09-41ec-a726-e2af0a50a839", "comment": "Malware payload", "value": "1645f7cf718ab103dc9674d093d981bd", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MoustachedBouncer", "colour": "#46DBE2", "exportable": true, "hide_tag": false }, { "name": "NightClub", "colour": "#602B55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691703589, "uuid": "37681687-d023-45bd-8063-d5bdf92871ef", "comment": "Malware payload", "value": "25412a1a41069d7c09a0b4968bdbc818155bfa02db696ea3c34350ef50fad933", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MoustachedBouncer", "colour": "#46DBE2", "exportable": true, "hide_tag": false }, { "name": "NightClub", "colour": "#602B55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691703589, "uuid": "8f5dc1a9-0b92-4781-9f99-c87f4c55ea14", "comment": "Malware payload", "value": "ce6329f20d514d40f06230537338755a1a5708fb", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MoustachedBouncer", "colour": "#46DBE2", "exportable": true, "hide_tag": false }, { "name": "NightClub", "colour": "#602B55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691703589, "uuid": "0a34c74b-5fbf-4730-9d8a-4c099bbe6e60", "comment": "Malware payload", "value": "5c0afce4dac8d69ff198dc88f2dd5ec4ebd6da73f7c9fa5e134b727e233cff1bb97a0ed2bc11df225d2c9d80ecc39bc0", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MoustachedBouncer", "colour": "#46DBE2", "exportable": true, "hide_tag": false }, { "name": "NightClub", "colour": "#602B55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691703589, "uuid": "7974613b-5baf-4b7e-b480-0ed982eb3c56", "value": "T1B8B33822364D8179E6CA217C143C2B6BD73FA471EF6831D3B394BA5A1EA91E32D31117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691703589, "uuid": "d9977a61-e85b-42cd-b232-ace35a140b74", "value": "72093c181ac0f7a289e462b70f8c131f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691703589, "uuid": "9dca4f49-d24b-4b1e-b65f-cab5d3718999", "value": "1536:nhrpv2WQ7qH4aItLwaEEWyfDZAm/6KaI2WKLvT0zfkLDYL:hrJ2D7qYaQLZppVJ6KaIPKP0zfkLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691703589, "uuid": "ff7117d4-1c0a-4ef3-99fd-8ba8d99ebb1b", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691703589, "uuid": "dfc45ffb-54c2-445d-861d-0ef48f406ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691703589, "uuid": "5e6712bb-56e9-406b-a649-df3e5543c1dd", "value": "25412a1a41069d7c09a0b4968bdbc818155bfa02db696ea3c34350ef50fad933.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6145729-3725-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691634667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634667, "uuid": "4056c79f-d8c1-48c2-ab1f-19706c0ae906", "comment": "Malware payload (Mirai)", "value": "93b6c8ab6364fdbe28529baa08bf5d28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634667, "uuid": "62fc9722-918d-4173-a76c-98055d5f5b51", "comment": "Malware payload (Mirai)", "value": "259038e525331fb9efb73f8fa3eb3c155eb04d187afcea54d8394f6b38ac32d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634667, "uuid": "3ad927ce-a1d1-4baf-9d62-e6592be1c0ca", "comment": "Malware payload (Mirai)", "value": "90f63c81df4a7a9de73080d5faad6e5fe115145c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634667, "uuid": "49264df4-1d36-4846-afcc-dffd1e93f74a", "comment": "Malware payload (Mirai)", "value": "26b371bd22430811e13b317f510c3f88775118f35e5b76fa091ca413ab111ae3f7161e33ea2787148cbf67f056aeb796", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634667, "uuid": "4885b490-38d1-428a-aeef-3cef2e133eb4", "value": "T16613F10B86E47729C31C85386E3E6ED42A21F61B620848FBEF9D32778C53F052875948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634667, "uuid": "c2cb7768-3dfb-4988-b0a9-1024c52ec6f5", "value": "768:6ESsa6kaDziRWDKY3kMjkoHhWUcvPZKHlFan4yBVcvZtJnbcuyD7UVyqa:6TsDOYyuhWUyPuUntcnJnouy8sqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691634667, "uuid": "1c27d7ef-9ffe-481b-823a-c3be3b38de61", "value": 44000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691634667, "uuid": "5148d318-e67c-4aab-addc-b8b50d1ff183", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634667, "uuid": "de614912-575c-4749-add9-dcbeef948ffc", "value": "93b6c8ab6364fdbe28529baa08bf5d28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148048fa-3735-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691641161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691641161, "uuid": "e21ebc76-50e8-474d-b6e9-9a7c98a194a3", "comment": "Malware payload (Mirai)", "value": "ac45cdd4c35d363f814448436c2db036", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691641161, "uuid": "e6eeac75-b29e-4ef2-916f-43d77ea69752", "comment": "Malware payload (Mirai)", "value": "26698822003ac8a7c3e28f52f3fd3f0dfae0c5a174a67e08e8b65e7cb2a18a97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691641161, "uuid": "0aff0c19-e95e-4695-b970-03c9aa00bb8f", "comment": "Malware payload (Mirai)", "value": "f8f34aa60a9849cac98f302df5d4cee304aa678a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691641161, "uuid": "5cb1b1a0-18ef-47aa-9fdc-a1c0a9542f7d", "comment": "Malware payload (Mirai)", "value": "c1ea5e31a75dab74a140d3fbc43d58cb7fee6d02960807f46c6593a66d55bbf285203a03576fa0e1fbe64fe41c4ee429", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691641161, "uuid": "6861317c-9631-44c8-bc16-ac017a241351", "value": "T19D8344B57B31ABAEE76C83300FF72B70D35522D236A19251E16CE61C5EB131C588E7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691641161, "uuid": "d5eabd8e-d55b-4847-be67-f097c49f37b1", "value": "1536:i+KnfvL1Z8bdPJzSzskkdjfdr+oj3XT/3uzuXvDwu0Dd3JUixry5jmePV6HIfj:r/eU+e5jD6HIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691641161, "uuid": "d2167843-f90b-47c9-9c70-8c0420a7a83d", "value": 88584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691641161, "uuid": "a6b6f7df-1550-4ec2-9919-fe8ad4daa2ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691641161, "uuid": "ea8834ad-8bf3-4488-ba0d-66f09406c144", "value": "ac45cdd4c35d363f814448436c2db036", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85e4611-3789-11ee-a6f9-42010a9c0055", "comment": "Malware payload (WSHRAT)", "timestamp": 1691677540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691677540, "uuid": "5c5cd4c2-c32e-4a02-acc9-100d7836b7a7", "comment": "Malware payload (WSHRAT)", "value": "70ebc4c266527efd8a70e6ff259d0ce1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691677540, "uuid": "a066b15b-ef6c-4b40-baa8-b8d80aa8c9a3", "comment": "Malware payload (WSHRAT)", "value": "284839414beba349dfacfb02f8da76431513a9f072877d6cd9b783c60d8510fb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691677540, "uuid": "e0e52135-9dc2-4abf-a4a8-06f502c98446", "comment": "Malware payload (WSHRAT)", "value": "44209fe366081d1a1191f7b7dbfd27f34e23d755", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691677540, "uuid": "cc168c47-e1dc-44a5-8c91-aad12f1f5baf", "comment": "Malware payload (WSHRAT)", "value": "2767cedb50ded94081a1eb14cfdaa86f2a277a7886023924665b755ced3492fadc1b849c40021f9ad97277b117d42b94", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691677540, "uuid": "89985434-5634-49c0-91e7-48e94c20d14c", "value": "T1B7250ACA25F87E1E23B3E56CC702DAA2AC34D5172CB769C279847D4EAD35C586D3DA00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691677540, "uuid": "dbaa1a64-e15b-4346-8b24-62c469507210", "value": "6144:QQ7Eqk/qylpe5u9cyON5Q5iOG7xKMBjEZcqjIfgSPyDlLnMC31I1lvERmcfbqPo5:TGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691677540, "uuid": "212d9e04-cfe4-44c6-8c69-0c8a4073df90", "value": 969700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691677540, "uuid": "453b8132-cef3-4cab-8938-e4799f73f28a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691677540, "uuid": "e66d9621-0d26-45e4-82d0-2002364843e6", "value": "Request For Quotation(RFQ).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd649b2-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691685844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685844, "uuid": "aa2919ca-e6bf-4ec9-8a17-c03d33c0b6b1", "comment": "Malware payload", "value": "82a847e98a0d3ff35ee049b49e6c048a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685844, "uuid": "7711630c-479b-440f-87a6-246e49bf801d", "comment": "Malware payload", "value": "28d58655a78513d15503e2fb4b899bb72073969dd71364d9a4e51298a094ad60", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685844, "uuid": "a58e262d-7994-4662-a47e-a34b59f2057d", "comment": "Malware payload", "value": "7c0cda324feb55176cdf15ddfe3e734c272205ca", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685844, "uuid": "c80a4e86-62e1-407c-948d-cc993af38c39", "comment": "Malware payload", "value": "6dbb8c081ae1d9ffafa2674ad7f9cc62134b30dd1ed52a5f9c4bf164a264c26eadb0408c501a875ad4d761828b28d8e8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685844, "uuid": "e55ba97e-2c77-40d2-96f1-149c833406b0", "value": "T125E423FFA29F0541B9A5ADE000E46C0D7D270AED39479B20860B75CE34FCA63592E97D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685844, "uuid": "ea9545e9-2175-49c7-a050-8e7ed80ffb75", "value": "12288:3dy3scJlfJGV0q6wvS/KEmWN20Toj8LdmQuwsoS4ldc0BQXqYTO97oYdifRudRtE:3ccQlfE0qDvS/KEmgvU+djuVgckCqf1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685844, "uuid": "0caea988-58e4-4343-89e2-04d1bb21a86b", "value": 674913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685844, "uuid": "34d15d07-e35a-41bd-af3f-c6c4d7c9749e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685844, "uuid": "982e517e-d050-4567-afb5-d2cee1596e92", "value": ".CN_86607433K.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5754967-37cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691707627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691707627, "uuid": "0debc23e-5e58-4e22-875d-e708c0cce280", "comment": "Malware payload", "value": "6f4d7bced76f7653bc05f7c64da9edce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691707627, "uuid": "e4214326-48a9-42c1-a239-e2208d740c7b", "comment": "Malware payload", "value": "292eb66bea876dfd5f031078192803e5861ad908d975ba3cb1d86b925616f758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691707627, "uuid": "8a2723e8-d43c-488f-a0c1-4afaadfec54b", "comment": "Malware payload", "value": "a975a08f1097cd663999cf3f3dd48fa229aa50d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691707627, "uuid": "e857c7f1-3d4b-4d4f-9ba4-83376b80d367", "comment": "Malware payload", "value": "f6ec92ca50638ae70f566acff5c3cb11cf021e983b33fcd3078e6e8b1e5ed7ddea01c6150d5e32e23f9497d2e5d41377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691707627, "uuid": "99a16ad3-892c-4e9a-90b4-5881321de5f5", "value": "T194F5BE27A295CE68D7555633A136C6645BE1E3903352E38FDF7B10732E933F01AA12CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691707627, "uuid": "e1038de0-99f1-43df-9846-b604d78497e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691707627, "uuid": "b7970e15-d4d2-4fe6-b02e-fc09a8d3d960", "value": "49152:hhQ7t/Sqntlb5VTNtN21D9GuQFz+APSVcWjPD8dhO//neFF8j0U6Y:hGDtNNtNeGuQ99PSV5PQDcj02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691707627, "uuid": "f1f91d85-7676-4e64-ac29-60abebef04f6", "value": 3572736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691707627, "uuid": "877c8a87-460f-4f63-9ef9-4a5bf6008710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691707627, "uuid": "485f8251-27de-469e-aa78-d1081e44a8c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d505c485-3773-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691668112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691668112, "uuid": "89e5d706-13c4-41db-82b1-a2c986f89994", "comment": "Malware payload (RedLineStealer)", "value": "b2c4b9d71bbfca301a3984095ef8e068", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691668112, "uuid": "55e30d5d-ea25-42b4-9f13-65290c8923ad", "comment": "Malware payload (RedLineStealer)", "value": "293be2c96ff7fe5dc951d0aa7ea8f6edd702c98cdc79a46d9611acdce3e06e0a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691668112, "uuid": "53790cf6-f8ff-4bf5-8a9d-4ff16215bc5b", "comment": "Malware payload (RedLineStealer)", "value": "01b79239e7bb12ed6fe10201c878c60d81b2f9ad", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691668112, "uuid": "a2cc558b-6575-4595-bec7-f3629b02be5a", "comment": "Malware payload (RedLineStealer)", "value": "6f8691cb578610cac280b4a55ddde45d2ae3199e4f156aacf25cb8f05ce8dc2650bbe2c94e1d8ff17668525986730d24", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691668112, "uuid": "10e285f7-66e8-4aa4-854d-18b92692f3e8", "value": "T13975BF3FF268A13EC56A1B3245B38320997BBA51B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691668112, "uuid": "379b564b-aa75-443a-97e8-17ff63a54cae", "value": "24576:Y7FUDowAyrTVE3U5F/QzKic6QL3E2vVsjECUAQT45deRV9R7:YBuZrEUcKIy029s4C1eH9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691668112, "uuid": "a301e9d2-6158-4b91-8218-e2a2df5657d1", "value": 1673273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691668112, "uuid": "5c96a279-3883-4e99-82de-219bfa2a20a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691668112, "uuid": "6a26fed4-b09d-4490-9e59-2d7a5812be30", "value": "vt_293be2c96ff7fe5dc951d0aa7ea8f6edd702c98cdc79a46d9611acdce3e06e0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe74f52-37a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1691691324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691324, "uuid": "0e2458ab-8fa2-4710-a72b-a819dfc36941", "comment": "Malware payload (AsyncRAT)", "value": "0a24c8801c77bd50129736697c265ff7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691324, "uuid": "29adb34b-b1c3-43f9-a9af-363e794883d4", "comment": "Malware payload (AsyncRAT)", "value": "2952dbb62323938ce2917b8b22fe5acd7ecd5c70b8956902bc520b23387b62e7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691324, "uuid": "f19c6f4b-6867-4759-ab56-dcc9aefa7581", "comment": "Malware payload (AsyncRAT)", "value": "dc4530dc13fe05fa3ec0e94d8e13605590a214e8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691324, "uuid": "5906a578-e86a-44e6-8f36-9b7b4dd8913d", "comment": "Malware payload (AsyncRAT)", "value": "74601d73f2fb87dde722d9abe810dcaf9b7d444ad9ed23465468a3d2739172896469abb0b8274bd6a577b02f9f6be705", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691324, "uuid": "5f23bc17-23a3-4c53-a00e-7d7e7e094290", "value": "T1856309053BE9802AF3BE8FB469F265854AF5F4AF2D12D55E1CC500CA0562B829941FFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691324, "uuid": "4786ccbd-18fa-495d-a1b4-7aa8575dc3b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691324, "uuid": "82325fb0-bcb5-4374-8f64-d9b0eb6411f0", "value": "1536:hCE1fl6TtkVX/KuhUYFZfypDQ6SibiHJNZ2S2+ermTGMx:hCKfsTtkVKuhUYFZqJJSibix29JEvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691691324, "uuid": "f5dc8ef2-3ba1-4cde-b2a7-e1571731ab60", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691691324, "uuid": "4a7c48ff-9859-4c20-b6a1-16e85d56ef7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691324, "uuid": "5030cf03-e382-48c4-930a-e074b9fbafab", "value": "0a24c8801c77bd50129736697c265ff7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6353d0-3720-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691632294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691632294, "uuid": "4ff708bc-4880-42ee-9afb-26458f832331", "comment": "Malware payload (Amadey)", "value": "8114ba980159be1d42a34feae22fe9c8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691632294, "uuid": "00e67142-ddd8-4f46-872f-80552a39deb2", "comment": "Malware payload (Amadey)", "value": "2989f734209150b35390b819940ff8fcdf5e5724a57daeea5d46fac039a0afcf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691632294, "uuid": "804a15d5-4d01-4da8-8e6e-a6a5ffec4995", "comment": "Malware payload (Amadey)", "value": "55529aa8b8f4edf71bf3a2fe4392fd8804447c72", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691632294, "uuid": "f72f1de1-4f98-4a01-ab6d-b40760fe4628", "comment": "Malware payload (Amadey)", "value": "4fad61afe3f5c7de8bb15e444548604b212ca9901e56df3327af10eeccd9edc98f69969edfca4efd95c191be1d030940", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691632294, "uuid": "341055a0-4e8c-4b39-9ebb-09b4fc702e65", "value": "T1A0C40242B6E850B3D9F107B05CFA47932B31BCB15E38475F666A988A1CB2BC4B531367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691632294, "uuid": "3d403c40-5191-4fc7-aec5-c083fc8b5f8f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691632294, "uuid": "04323f13-fdee-4846-aee6-9bfbb82f4840", "value": "12288:BMrey90VP60tx3vgrQijExihx0FvsgyrrxiPutAyFmY9:jyz0PYcijEx8x0FVy/xQutzR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691632294, "uuid": "6aa9c9ac-30cb-4d08-abdb-e07a133dc072", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691632294, "uuid": "7ccfed7e-ccea-4ca2-9cc6-b11557bd92fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691632294, "uuid": "58efb3f2-0843-4fcd-94a7-0c9c0ece6698", "value": "8114ba980159be1d42a34feae22fe9c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d94840-371f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691631694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691631694, "uuid": "430c3969-66bc-4690-bd14-a91e39439249", "comment": "Malware payload (Amadey)", "value": "5dd4a864d26994c11c8b17d5d4d599e4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691631694, "uuid": "d95b367e-195f-460f-9d02-5d6a9308f59b", "comment": "Malware payload (Amadey)", "value": "29aaf1ef97123de97de3d7b2aa408b7c0cd034b7fb108659fa09d6a08e1b923f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691631694, "uuid": "f24b721b-b2d4-43e9-a266-bc42221321eb", "comment": "Malware payload (Amadey)", "value": "cd773792126165be7fe16113bdff95caed0451c6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691631694, "uuid": "3143f11b-557c-4253-92ed-12758e425987", "comment": "Malware payload (Amadey)", "value": "48b18e458ab04544ae3acbb9d6a69e1d00d93e3e2f33876cb5d0151ef9307f575e059f5ae8dbae33520c6642b2d530b8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691631694, "uuid": "d5913e18-f416-4db8-93b4-1060a40f6c7a", "value": "T1DAC41243ABC89032DDB51BB05DF602930B39BCA36DB1426B2755990B0D736D0B6B276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691631694, "uuid": "628e0a7e-9819-4ad1-9e5b-fe37c1bccdb1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691631694, "uuid": "3fa8a102-487a-4427-9e7e-b1677f832dc3", "value": "12288:KMrIy90/8YCSqdNHiWc4pbUS8fgBYC7zRT8avWepfhyI:WyDYctUzYzV8avWeXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691631694, "uuid": "c7bc8248-108c-4cf1-afe7-d56dacbdd20e", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691631694, "uuid": "20a2b5fd-b1d6-423b-a69a-71260253d8ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691631694, "uuid": "5cdf0d21-a2c3-4a90-9a9f-d9f4e9dde602", "value": "5dd4a864d26994c11c8b17d5d4d599e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cbe1a6-379e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1691686283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686283, "uuid": "82744ffa-12f5-4f6d-a742-1e10e1b93c7c", "comment": "Malware payload (Fabookie)", "value": "a552eaa5d5755c90b925f9361417f74d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686283, "uuid": "a62a881d-c6a0-4f01-97b3-49a5151d09f2", "comment": "Malware payload (Fabookie)", "value": "2a4bbe018dc6c5d1af64a4773bd8a7fccba71d19780177308b29b2abea4d33e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686283, "uuid": "161806c7-49c0-4b97-82c4-11a368343970", "comment": "Malware payload (Fabookie)", "value": "bb341aa1cd9c4f2b63ca47765fcdea25c8695daa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686283, "uuid": "8fc78290-d4ab-46bb-be63-fcb68c004690", "comment": "Malware payload (Fabookie)", "value": "4d053de2d530b784302b7149fbcf64da5cbe4ec8fb93c202fbf8b4d0dcc0e9e19de7e46184f72952746313f3b993baf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686283, "uuid": "00175b11-dab5-4354-805e-32d0ffaa94b3", "value": "T13E940849FB7408B5D096C531CDBE8376E272BC831B25930B8641FF6E2FF36216969681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686283, "uuid": "da0ec2ff-088a-4f23-90aa-51f3ca594ca6", "value": "ff082fef3d15cdd142534440e54d6a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686283, "uuid": "e95a8ba2-67fa-44e1-84f6-2771946ed7af", "value": "6144:sywbsQLwciHaoiT4MKBz3I8JWGxerEhgVIXFM:sXfUcAaVrKi61erLIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686283, "uuid": "4bc44fdf-c6af-42ad-a0f5-0e172a797a0e", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686283, "uuid": "d039b825-3b17-4b4c-ae45-295eb1486589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686283, "uuid": "c4efd5f6-7e9a-420e-aba2-8bce84d56e01", "value": "a552eaa5d5755c90b925f9361417f74d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0b3067-3745-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691648424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648424, "uuid": "7a0a2bd1-39ca-4f32-88d5-564699dbf11d", "comment": "Malware payload (DCRat)", "value": "0b194e973266dbae85f9e1ca2eccd3bd", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648424, "uuid": "1abeb2b9-8294-4848-b2e1-0ee5ffd59a53", "comment": "Malware payload (DCRat)", "value": "2c4d5f8b2d4d1d62eb11213e90249677db2ca6546d82703325bdf9732e406ed8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648424, "uuid": "fe4ceec3-d229-4f36-a445-819283365cbc", "comment": "Malware payload (DCRat)", "value": "9fe6f137466511a9573a60847e6a2e87862d7317", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648424, "uuid": "3a2ca571-f756-49bd-94f5-88e87db95bc9", "comment": "Malware payload (DCRat)", "value": "b9db4540ac2decf8e358fa2a2a4d492f3a9e50401219aa17de7a14c6cef42509eac6b695e275f1894fe249f122c49e11", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648424, "uuid": "73065da7-7eba-4332-b4f0-e01573061015", "value": "T122453901BE44CA91F0191633C2EF494847B4AC512BA6E72B7EBA376D55123A37C1DECB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648424, "uuid": "83c34999-34d2-4962-94e9-0ca252843508", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648424, "uuid": "5731ca3c-9313-4262-9861-78d0dcf5c57a", "value": "24576:U2G/nvxW3Ww0tAEeKu3Apts9CmsAMPrlQkjnOiV:UbA30AwuC7pjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648424, "uuid": "a2c34fa8-619b-4286-bad8-7bce2e825b55", "value": 1164463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648424, "uuid": "86873fe1-653f-4bfe-a2a1-136619d8fa15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648424, "uuid": "91b7bc32-9cb7-478a-983e-87e2560626a1", "value": "2C4D5F8B2D4D1D62EB11213E90249677DB2CA6546D827.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134f24f8-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691648460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648460, "uuid": "d7f87032-b9b4-4244-94ed-7e79658c39b6", "comment": "Malware payload", "value": "d2f376d6acd3400985ad09fe1dcb5c68", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648460, "uuid": "f3d277b3-21e1-460a-a277-a3fe39791ff4", "comment": "Malware payload", "value": "2d7c22989be36de889866ad0fe58bc5993687d6d6b372dcc1b9f91343ec254e9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648460, "uuid": "a5070576-8e82-4090-b97f-d0d0c683cb05", "comment": "Malware payload", "value": "e3a0bb86749644f7ffa2618c7eb93d6f28de9647", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648460, "uuid": "34efd88c-da05-4091-a475-03e1610e25ba", "comment": "Malware payload", "value": "92f3930ee4b9bcfbd86513626471a59b535e91ff3e0b03f751bac64f69250e2c8ce535f5437c5575d92bf2de21d43c30", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648460, "uuid": "cdb6e8c9-4389-4546-a554-07f4d1e495da", "value": "T13DD423ECA3A99A50F0F37C7EA7D2186889B497F9CFC2005A5331524E4BCAFEC9B40455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648460, "uuid": "bee065de-4f22-49f4-987b-45f06ea77a62", "value": "12288:JOnaVGDlGh1zYyvruCuUFVXDyMbebR+cL0UEhA/m0LvxDtJvoN:8xJGzzXvkUFVyMbebgXyPLvxDLQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648460, "uuid": "a054ad42-c0c1-4502-b5c3-a5134e16b57c", "value": 623915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648460, "uuid": "6b8cebbf-32d9-4e7f-b983-c8466fa6e169", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648460, "uuid": "48218864-a4e0-4769-a147-3c02b155c339", "value": "PO-REF67340982.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838d82a9-3748-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691649507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649507, "uuid": "627d4e29-997a-4eb5-9424-5fcae2f6d533", "comment": "Malware payload (AveMariaRAT)", "value": "ed510b18fb4392be1c4aa57ba5249ca8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649507, "uuid": "52afe77a-d0e0-40b9-b337-7df8df60b623", "comment": "Malware payload (AveMariaRAT)", "value": "3034c4943a37220396e12c58a53560918c693e668ab2d2b23bb5db0c750ba096", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649507, "uuid": "cf7eb569-0e18-455e-ba1c-a67174794e03", "comment": "Malware payload (AveMariaRAT)", "value": "fd2473f9e3053fed579e6b2503d291465141433c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649507, "uuid": "2c7c1671-4d96-4393-95f1-b0616c713dee", "comment": "Malware payload (AveMariaRAT)", "value": "69dc043721f12782e6d74ce4cd606dd0cbda77695492d963368d9c076dbabfe4ed1d0f6edb1dadbd93d24a2a5a646e4d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649507, "uuid": "b44fd7e5-dd0f-43ce-a955-632ba3c9ec9b", "value": "T1AAC422000305960FDAB7BA74931273502379177F9490FA96FAB274EED619B1CF902B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649507, "uuid": "ff7d4d2c-736a-49dd-99ce-964404b83cd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649507, "uuid": "f8664549-48a0-4ba5-bdae-08587a90fee0", "value": "12288:QlL87+2pmI5TbpgIgHVil0uI7GI0sCE1tpz1Hn4wYx:Eg7+2pmGb7EGIGEnB1YwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691649507, "uuid": "c9faa2d4-ed90-43ee-8be7-9a08f5b191dc", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691649507, "uuid": "37e57101-4641-4036-845e-7459f508fce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649507, "uuid": "7f3d4649-3a9b-4e57-8471-47bf8aa7da42", "value": "ARASKARGO_GONDERI_RAPORU_GUNLUK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a201d49e-3745-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691648270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648270, "uuid": "7f1e8001-f7d2-47f7-9a86-54892684b511", "comment": "Malware payload (SnakeKeylogger)", "value": "368ce419f3d7096b7f357b88f1a35bf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648270, "uuid": "2074b546-7e32-4e0e-a0da-e3b2ad9c30f7", "comment": "Malware payload (SnakeKeylogger)", "value": "30648c0ee182936cffc123c0d03094be35f5cd6fcc246c2d173d649c2b68f132", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648270, "uuid": "a11d1995-78bd-491b-87f4-a6323366dccb", "comment": "Malware payload (SnakeKeylogger)", "value": "a71980b991c1b5f079a60fce39ec574084d5f646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648270, "uuid": "523e14f2-798d-4de7-8794-3cf93c3cbe2a", "comment": "Malware payload (SnakeKeylogger)", "value": "7392f10fbe4be43d09c94c914d48bb5a1f95bd8fafd12fea90dd02d1dbbb1d939e1f71117dcd3edc2bcd35265baf493a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648270, "uuid": "6f19e757-9cb7-4ba6-8862-ccba456941cb", "value": "T136D423C123E98818E9BC2ABF98E039448730E64DD5B6D21B16142A13BF36F155355FEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648270, "uuid": "56b0aebe-6b9e-42dd-9127-6bccd7249350", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648270, "uuid": "f36a7402-a22f-48f7-b4cd-4e8fad1af2f0", "value": "12288:DjGTIYlV2ITX0A4PXCfmLM2CxymfwkixxxcwN2Os8uGtq/IcMrJVrQZ:8IYlVvb0fXPLVBkizQf8Y/I7VZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648270, "uuid": "f8c5aa98-9f88-431a-8491-ef5d2f23e53f", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648270, "uuid": "5bd112d1-e44d-482c-979e-54581370320e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648270, "uuid": "b2d7f5a2-158f-4c5c-8cae-75172fa6a0c4", "value": "RA_20230810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f8e071-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691648807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648807, "uuid": "bdcf7e83-83db-4150-9031-8c050a401200", "comment": "Malware payload (Formbook)", "value": "cc49762a44aa21c9286ef83ff6c9c8ba", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648807, "uuid": "7227ffa7-7544-4c88-9e0f-8a94176b30b5", "comment": "Malware payload (Formbook)", "value": "3176e45e177667d58addf32bc05e76c63d3bd07876959e47e734d8cd67715342", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648807, "uuid": "9e8055b4-70bc-4469-a68c-8163bd462b2e", "comment": "Malware payload (Formbook)", "value": "1a302d4de0d73405554f9b1166b5d585aad11cd4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648807, "uuid": "d0cbdde9-7b9e-4b46-8931-0bfcac1faf6a", "comment": "Malware payload (Formbook)", "value": "7fd907500afea98611c1415a779c987115af65b9228b5766356e437a63ca9ba1a8e6a132a883cb74a934e4892235995a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648807, "uuid": "cac6153e-9289-48b9-86fc-b1e38f1c9370", "value": "T1A9442333A36C315EDE8AE96249C0AAD4CB413409433749C3F8766BED7C68B98EC57856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648807, "uuid": "4f300bd9-3010-4fdf-a675-85a8c3aaa5d2", "value": "6144:oxdT0Z39K25Yb2wlxi2LzzG0JRITgyeTbqpeXgiojbqj:mdMiJL+SyeTe0XgiYqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648807, "uuid": "5039a341-baff-4016-a8c4-0b1d1c8ee2e9", "value": 261082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648807, "uuid": "db6e1309-b069-4f4c-9760-be7f318471ab", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648807, "uuid": "91d7c3fc-fe13-4c84-b490-f24770d4cd8a", "value": "RFQ# 25-4275.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544e705c-3763-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691661025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691661025, "uuid": "c2dae457-f4e4-4b87-a90c-42f3d72db349", "comment": "Malware payload (RemcosRAT)", "value": "14aacb8a4c09970097f86cb034ce2f43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691661025, "uuid": "75c84588-087c-4398-a7d7-48a4382d3cb7", "comment": "Malware payload (RemcosRAT)", "value": "32638aedae80dbb34039811e9957d48bd5d2ea1fab784cd0734b86b7185716b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691661025, "uuid": "29f498be-7df7-4471-9e33-45c52511c740", "comment": "Malware payload (RemcosRAT)", "value": "57df362853efb89ef8c23941a3d20c68576af60d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691661025, "uuid": "562eeb93-f2c1-4f73-87d6-bdb64f9d0b0c", "comment": "Malware payload (RemcosRAT)", "value": "9aeece509c75529132670d6cb290f83bca8710769ec6c6a023bcb94475d46f385aa01334d0e8421b5d0e80451956431f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691661025, "uuid": "74dd5eb6-f504-4b88-b5a0-0b852f91dcf4", "value": "T1A335CF36F6B34833E1275E385C0A97599C397E536A3CA4429BE83D44EF3A24178291F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691661025, "uuid": "e2442cc7-251e-47fb-8eb0-d177fcc523d7", "value": "c5c13b456c94b845d5957ed6247b2c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691661025, "uuid": "d37f1428-58bb-419d-a43a-7513ab8141cb", "value": "12288:3gMuXgeXRSTiOKyYiYDIOOIFiPbeYR7re5Svqsb7oWjuHDzGtunlKliO+fvqx:38weROKBU0Qqhcvqm/kPXnl0iZ3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691661025, "uuid": "6e2dddac-10df-456f-ab58-7fba6a1733fb", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691661025, "uuid": "caf3986b-a3e8-44c8-b088-27c3f89b215e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691661025, "uuid": "3160a2d3-a53f-457e-bcb0-c05b5b284995", "value": "Scandoc2343.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc983212-377a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691671132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671132, "uuid": "d34be68f-0a07-4593-823f-8399034ef9dc", "comment": "Malware payload (Formbook)", "value": "d3a9ae0de027a95f8cd5f176e62f76af", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671132, "uuid": "7ebf9764-c3c2-4d4f-80af-e15f9c18da7d", "comment": "Malware payload (Formbook)", "value": "33e9ca550853438f59cf4a0ce2402d2cbf5811695e9e7eea05a3ec5d1ba894a1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671132, "uuid": "e4c0339c-9dbe-41a6-ace7-acbb87514ff2", "comment": "Malware payload (Formbook)", "value": "14637e13eaa586354763ccd34a20a7f2a6b0f267", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671132, "uuid": "48c7495f-0902-41cc-82e9-e60e5b207014", "comment": "Malware payload (Formbook)", "value": "ea2b530c57bececc401218660a3cf13d11ba79ce2b9bee813d7c1c5779e5a292186bd367645053fdaf799c9f68be7cb3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671132, "uuid": "76cbd4ac-afa1-4aab-8be1-affe1782cfcc", "value": "T1BAB438A12FDB20C8F9C7354B67AC3E94535BB1C4C8391546B48BA71833EF260589AFB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671132, "uuid": "136ff964-8582-44db-b1e9-978e9c6bbacb", "value": "3072:hQq/fQiejaFQv6OvQhyaNsa2F/nU/fBE4HzFh7:L/4iejaFQv6OvQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691671132, "uuid": "770bbabb-f20d-47c1-91c4-f30b0e691796", "value": 523446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691671132, "uuid": "8172c10b-fefa-49e4-9f8e-868e6688da22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671132, "uuid": "979eddfc-5d71-413d-b8b8-1f4e0e58ff40", "value": "azzo.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49245d8-3745-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691648382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648382, "uuid": "fc09f98a-fa91-43f8-ab30-f51a94ebe840", "comment": "Malware payload (AgentTesla)", "value": "79a451b52cfd37f3a7c5934cdb3d2a95", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648382, "uuid": "45df3af1-594e-4516-abc2-ed59404d35e5", "comment": "Malware payload (AgentTesla)", "value": "344461b75267cd218101263f89187a2b1ab88db9391bcb9efb6e3fc9b871fb39", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648382, "uuid": "eca920fc-0940-41c7-a627-c5bc764f756e", "comment": "Malware payload (AgentTesla)", "value": "559c5434ecf0a6da4f324c7aa742fc522751bf7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648382, "uuid": "4a43124b-1306-4cb8-ac7a-fa833a54a9b9", "comment": "Malware payload (AgentTesla)", "value": "efbca206302bcbbdec4eb923e2e4816361bc25af7e803fffaa369ab38db8cd96bd5a3398ed49cae5a0436dcdd9a15c9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648382, "uuid": "d5404eb9-c62d-4316-a135-857194d005f4", "value": "T16CF412BE72EB9D31C7A69536D26234005331BA9AA477F70F224422D4962EBC14357FCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648382, "uuid": "f6c2459d-eebd-41e1-adc6-5d54f8cdab85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648382, "uuid": "beb00152-4f17-4f7e-abb1-6dbba5aec9f0", "value": "12288:edrEGGTIYlV2Uw06Wak2Fg1Lu0YY6YkyeLhA4uHHxYs97g6LCkAbhH1W30bUFUf2:8ExIYlVNw06Rk2Uk1uhB3LCkeWUfaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648382, "uuid": "e91446a0-e827-4077-aad6-00d750b4db21", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648382, "uuid": "7fba2e70-6a15-411d-b55f-0da9a685a0f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648382, "uuid": "2cb949f9-d0bf-42d5-b516-5529819eb496", "value": "79a451b52cfd37f3a7c5934cdb3d2a95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd8f28f-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691648852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648852, "uuid": "fd70b0ec-a1d6-4d9f-b7fc-eb90f345fa24", "comment": "Malware payload (Formbook)", "value": "74ce82f2e3d9ba650a87ea40903e3304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648852, "uuid": "aaebbbe4-2268-44b6-9b9b-34530aef7ea5", "comment": "Malware payload (Formbook)", "value": "344b3c764a7075a0cdc2a9cd3f390c6b195fc0601077f68db9e8678a27c0c204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648852, "uuid": "1a521ec3-1fea-488a-a67b-e4c31dfb06be", "comment": "Malware payload (Formbook)", "value": "eafb2d9f66848845d31ea05b8d7be398b0ba2680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648852, "uuid": "2a5edd5b-efc2-40e7-b6d3-2b25532acc87", "comment": "Malware payload (Formbook)", "value": "bbf76e191ae494cc5978d54c3c804ff9e159828f50c0e605eac93187ca9f9a6302f82c2df644e6243298947a4438b32e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648852, "uuid": "5713a18c-b1f6-4333-b5a9-d8bd840da151", "value": "T198D41214317A5D6BD17C66F19B6809C14BFA616E5236DDC96CE920DFC2F2F00DA40E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648852, "uuid": "050c9db7-9d2a-48bd-9191-9f888c09a9c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648852, "uuid": "c2e63bbb-fec9-414d-b44b-5146a9292941", "value": "12288:VPOSLYTywEp7PpqDyyOk9XtUEp3LWEycB8+2Ru0XG7Vg9Uh:V26YTaJxqD6aJ13yci+2Ru0W7Vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648852, "uuid": "1e2c4deb-aa96-4746-9f6d-77498960b795", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648852, "uuid": "4ceddc60-e5b1-4d1b-ada2-474760e86da1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648852, "uuid": "47a709dd-809d-4a86-8f2a-ac337510a31b", "value": "74ce82f2e3d9ba650a87ea40903e3304.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73cd3953-3757-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1691655923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691655923, "uuid": "ee508c60-938b-4c58-bc08-f1f44a355d23", "comment": "Malware payload (Gh0stRAT)", "value": "2d7806950ba14460522c2552b26d8971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691655923, "uuid": "151fd053-7616-4175-a0fa-4efa239dab41", "comment": "Malware payload (Gh0stRAT)", "value": "36ea52a6037f300a607613e55575a247873d675961cbfe531470c9ef0bf5b7ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691655923, "uuid": "7c11f516-4f3a-417f-9714-d4d3464a02d3", "comment": "Malware payload (Gh0stRAT)", "value": "062660f94e500455b5d86788e50022728c0faa97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691655923, "uuid": "85323d38-315a-4853-b924-4a9fa2ff08da", "comment": "Malware payload (Gh0stRAT)", "value": "889c63b0d57f3d4cf40217392b597e7f1a3e9a4f5d3c5f89eb4cc1c4726a573016baee682690ae932c49004aca9040fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691655923, "uuid": "3ae4d300-9ab1-4d95-9713-4cfbb89ae63a", "value": "T1DD14010D6E934127D9848AB0C1E00ED80BFCEC47399275AFEF6098561E6409DA5FC9FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691655923, "uuid": "591aaf1e-ef87-4b8d-800a-d509fea95ddf", "value": "ef39d474ee88b9215814d74ee695b02b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691655923, "uuid": "fd061460-61d2-4dfc-92e9-e088fe38a411", "value": "6144:p6M96wgvRHCzOYtqlGyzcsX3KA0LQIQR:ci3gNCpOdn/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691655923, "uuid": "8d0b0808-1e18-48ab-984b-ac14c46559da", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691655923, "uuid": "6d0de9e7-b979-40a3-8be3-2567ff765a55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691655923, "uuid": "cf914f8b-1c43-4e2f-b463-d3123643417d", "value": "2d7806950ba14460522c2552b26d8971.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca4104c-3793-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691681681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691681681, "uuid": "90466050-bf8e-4174-84a4-35f349b86590", "comment": "Malware payload", "value": "0a4776884aeef806a0c770e836cc5441", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691681681, "uuid": "d55e64ec-8742-4d55-881c-68f82a714ee1", "comment": "Malware payload", "value": "38133a37857191a12c3bc10ea186743641825c8081bd9434d2c941370b3504a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691681681, "uuid": "eadd0f75-d8d9-47db-b7e8-5925dff14b0b", "comment": "Malware payload", "value": "b5cf845c924511d5dc8c69740aee7e652ccb6929", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691681681, "uuid": "0bdd6eb9-f302-4717-956b-cf8d84e06e88", "comment": "Malware payload", "value": "487ddf088222b77018f027a24db19fc9efe0e16b0f8f480708c72718a92cb6be392fa497ce54922a592bc4cb02b3c577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691681681, "uuid": "88bf5ea9-25d6-4a3c-bd97-f02be3198a85", "value": "T114653310F804DECAFB4D9776D1350CEB292FAFFCC5224A8047EFB5A939F1A099649254", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691681681, "uuid": "3c0ce647-e1e1-4981-b313-7b309fdc2e2e", "value": "5efd333698985e0c33bc01c25c971347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691681681, "uuid": "8ae5b77e-1fcf-4a2a-8877-e45d3ef6167b", "value": "24576:fYKmlZTPiaC6EZWYJocqBr5QebC+cHejLttEU2vle08BfbIlXszyZPc16L:fgZTW3JocqYgC/OwU2lgUlXsz2PL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691681681, "uuid": "aa5a0a2a-9058-44fd-a5c4-5ae4960f24f7", "value": 1547643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691681681, "uuid": "9ba880af-e76e-4029-9fc3-943c588b68ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691681681, "uuid": "4dfe35a2-103e-46fc-b6ee-40857e02f072", "value": "0a4776884aeef806a0c770e836cc5441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af608c69-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691648722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648722, "uuid": "5c86f27e-29eb-4959-a574-8aa6a7cc5fbe", "comment": "Malware payload", "value": "540d4c545bacabf03fcd3ce0aa4c2540", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648722, "uuid": "1df70a50-d7f2-4cf5-bf8e-cee6ad64e34b", "comment": "Malware payload", "value": "386b363251f0b5431df0015d16f360278821cab9f86f39b4434ed5dacef27446", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648722, "uuid": "22f431b4-c43a-4978-9fa3-af79ba805b06", "comment": "Malware payload", "value": "d1f1a82d1811eb45bb4cd878a59d38822b54418d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648722, "uuid": "3ec7b948-6af6-4dfc-833e-2c1933d2faf6", "comment": "Malware payload", "value": "31fd79aaaa024ad26e42e727587f85addcd0e31993723df1efa1175f08b99404b000e11f0d108386ac56fbc552482669", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648722, "uuid": "8e78acc0-fbb7-4647-b62c-cf0d32ca39f9", "value": "T1C5762311B681D037D1E3313146AAC7BAAABAAC311B6955C7BB950B3D4F346D16E3830F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648722, "uuid": "fc694a90-aac8-42b2-8adc-5640ebfe9fd8", "value": "196608:jdk7WnPzCeEnBjxQn4ir1XVZdLERR+wxpB1sTS:3GeERKnThVgR+M1s2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648722, "uuid": "5e952b34-b28f-43da-bf2a-2d90e4f696d6", "value": 7145894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648722, "uuid": "a0ccab8b-ce15-4336-8c4d-f512c9a98fd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648722, "uuid": "705c6b5d-b52d-498b-8aaf-163601b5c0e1", "value": "540d4c545bacabf03fcd3ce0aa4c2540.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a318eb1-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691686026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686026, "uuid": "c74f2b86-cd05-423f-b144-4dd80bc5be78", "comment": "Malware payload (GuLoader)", "value": "3e95463fcfe7e33216a5642e837c8156", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686026, "uuid": "a06e3443-9d6e-4d90-9dad-1de8519bb1c1", "comment": "Malware payload (GuLoader)", "value": "3944ad516cf265ae45e99c9f47e915385a59bfe58bb544c973604367d7207a47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686026, "uuid": "92d17746-da66-4338-b128-09a012433848", "comment": "Malware payload (GuLoader)", "value": "e3272ca1c91d219d7d4da7e9225d1ba1a17cc1e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686026, "uuid": "eaf27270-04ac-4f57-aac0-31dd47c79b64", "comment": "Malware payload (GuLoader)", "value": "1934ec1cf822d1019f02b99f5cb9d9b6222555959f57971bee846cae31650bf4ea6ea05e953afcf8329f5fae554e17c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686026, "uuid": "b36bf8f2-9715-4a5b-90e1-b86108642536", "value": "T1E12502C3B8426657DFC8CBF95B428D226A5D7F310728E706E1293B2B8D7D5A131DA132", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686026, "uuid": "8c1eb313-5da9-4533-8bdc-a399e5b8509c", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686026, "uuid": "c0500163-9d61-44b3-a351-603f843e590a", "value": "24576:cFiS445wGZ06GcTp6Rb38GDpXzZOhY+59Bn18+k7gP:LSTtZDn4h38GDVshY89Bn1zk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686026, "uuid": "c531c88b-f7ef-4968-9253-efd712702147", "value": 1046928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686026, "uuid": "abc8ae82-d559-4186-83d5-beae5cb3ef9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686026, "uuid": "a611cbd5-d4d1-4e6a-8c80-2c45e33ab96d", "value": "Solicitud de Oferta de Precio (UNLP 2308-09AR)\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21c39a4-37be-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691700293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691700293, "uuid": "b9277e0e-1502-482e-bca9-4b85651f8e20", "comment": "Malware payload", "value": "f08ef7cadee08ba4a0696c4fbfb4c04b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MoustachedBouncer", "colour": "#46DBE2", "exportable": true, "hide_tag": false }, { "name": "NightClub", "colour": "#602B55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691700293, "uuid": "ce5abfaa-cea2-455c-91ec-2150018de252", "comment": "Malware payload", "value": "39d534148fe7ac7f3e03da1ceeee556b2e1db9cf466f7e03c24c4f899aa0c407", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MoustachedBouncer", "colour": "#46DBE2", "exportable": true, "hide_tag": false }, { "name": "NightClub", "colour": "#602B55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691700293, "uuid": "a5ea7c4f-4796-4e64-bddd-5cbef6516084", "comment": "Malware payload", "value": "5b55250cc0da407201b5f042322cfdbf56041632", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MoustachedBouncer", "colour": "#46DBE2", "exportable": true, "hide_tag": false }, { "name": "NightClub", "colour": "#602B55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691700293, "uuid": "6183e88d-93c1-46ab-9813-81c409f6a925", "comment": "Malware payload", "value": "56d5fa97c843713e04f39302ae4551f0028b92bcdc2ec9bea7aa904dbfa627ef383506cf3a4ae3eb8a6c73734540af88", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MoustachedBouncer", "colour": "#46DBE2", "exportable": true, "hide_tag": false }, { "name": "NightClub", "colour": "#602B55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691700293, "uuid": "ca699aca-07ff-443f-9291-67c379c1cf79", "value": "T1EFB32722764C8279E6CA217C143C2B6BD73FA471EF6831D3B394BA5A1EA91D32D31117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691700293, "uuid": "babe5ec0-a453-433d-b8f0-3e2667702067", "value": "72093c181ac0f7a289e462b70f8c131f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691700293, "uuid": "1d39db22-2ef7-4041-857a-df5d98d6c941", "value": "1536:aJrpv2iQgOHQ+viM6dngDBl+fCKaI2WRbZGT0zf0Lo2Yj:SrJ2vgOw+aVdgdcCKaIPRs0zf0LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691700293, "uuid": "ec0ea8fd-dfdb-46fc-8086-b7c0cd4d9166", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691700293, "uuid": "b990abe4-adda-48e3-a4c8-68cc5cef90f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691700293, "uuid": "06b78814-13fd-442e-9596-42c54f01d3ba", "value": "39d534148fe7ac7f3e03da1ceeee556b2e1db9cf466f7e03c24c4f899aa0c407.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4940a6-3726-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691634970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634970, "uuid": "e596db7a-3a42-4e0b-b33d-80bc728b7395", "comment": "Malware payload (Mirai)", "value": "0068eaf0a6ff3e88a2bcd4dbd55b432e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634970, "uuid": "45d37f3a-0d01-46b3-8ebc-3f2d28243d99", "comment": "Malware payload (Mirai)", "value": "3b59065d4acf1a9803889d4d988965ea13293d273c1aa057e9fa2544aab3123e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634970, "uuid": "f2a9e5dd-a55b-4977-951e-9959bb0be245", "comment": "Malware payload (Mirai)", "value": "b0a055c39c14957ca8d1730f67eb65723ff45f4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634970, "uuid": "a1ba0cb9-4985-45ad-8651-43e0957775e9", "comment": "Malware payload (Mirai)", "value": "31d48a35b73724ba549871ddcc128d264253f61344ea994a0074a13cde625d5694ee3ef1d9e09091ba9efe7956735561", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634970, "uuid": "5d755c8f-3c3d-49fb-97bc-868bae85e9e1", "value": "T165D35B22ED762D27C1D6687A02B74321B1F213CA34B8CA2D7DB10E5DFF5866031579BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634970, "uuid": "d0148247-0c69-45c3-818e-adb65450f971", "value": "1536:ZOrnPQquPngUgL3SdY+8vk+gMTAAfvurJL/1UAlk5CyQttmVhWF4I61o4c:ZOTPvIgUTdIKEAAoUAlUQh16a4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691634970, "uuid": "ba8bf05c-b133-41de-a5a0-787942b76098", "value": 134112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691634970, "uuid": "37c763e6-21fc-43b4-a058-594530a5a4b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634970, "uuid": "eeeb7005-814d-41dc-a436-4ac23476e8b6", "value": "0068eaf0a6ff3e88a2bcd4dbd55b432e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b042be4b-3726-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691634980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634980, "uuid": "49291f6e-b118-4670-bd72-10e37140e9d8", "comment": "Malware payload (Mirai)", "value": "a90ea3321d857d6e55466e7a16bc1adc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634980, "uuid": "2c6355cb-7dce-4e10-a32b-746aa93d9235", "comment": "Malware payload (Mirai)", "value": "3bac860c5d0015787044eda4029c3e7c521cc0c01bbdaa1ee6cc7ecd2c7bac4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634980, "uuid": "637c05a6-d16e-4ecc-b7df-a5087f3bcab0", "comment": "Malware payload (Mirai)", "value": "f976d9129dd75a6070c58ce14d7874e7fc81960e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634980, "uuid": "12cb78bc-fc48-4075-8b9d-1f88dedff4de", "comment": "Malware payload (Mirai)", "value": "561d56934019565d8ecb739c1dcc5c09a5217ab536f36844d0009a804222ec07b7fab5c9bd95c9c6bf7aac5053d6c605", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634980, "uuid": "f074db4a-6cb0-4e0f-906d-cfc2009bc5ed", "value": "T16923F150DA74CB35B9F27637EA96C04771041A71D8DD34A3A380DED93767806B62B473", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634980, "uuid": "ee81a3e3-22a2-4ca9-a134-3c887573f4bf", "value": "768:y6DvhH3/CIF/guIJgSi6x74WjYlT7qsLVw94GuaNpAg8gjn1Tf5fq3UINH:zvCg/Ui6J/YlKsLyeSPRRfi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691634980, "uuid": "6c73107b-b984-4460-bddd-c6372766987a", "value": 49368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691634980, "uuid": "bd27db51-fe2e-4dcc-841d-424c31386e63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634980, "uuid": "562dbb22-78e4-4798-8d30-32d18d9e6723", "value": "a90ea3321d857d6e55466e7a16bc1adc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1e9b78-37b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691694758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691694758, "uuid": "a382c265-23e9-445f-a948-39565e99f407", "comment": "Malware payload", "value": "7b20822375127aaf2c2ec9d1f07a3007", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691694758, "uuid": "4b677377-bdff-4de8-bda5-7d811a5b72e1", "comment": "Malware payload", "value": "3bc9a13ed11a0da691a2b97ddd52168dbead463fd5371916a1d574184c422a3c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691694758, "uuid": "e8aa56c3-55c7-4bda-abd3-6bc456234c4b", "comment": "Malware payload", "value": "c6cc2246cb5fd04ea80c1256ceec10268b876a89", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691694758, "uuid": "e629c843-4b47-469e-ad5c-781802e7fc3f", "comment": "Malware payload", "value": "b2a65242b79a7b93c12c793e4eec823a13fa71f167cb2f9b7ed81ab308bc0cd05194453691cfd4e1a9961f26f89c77c8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691694758, "uuid": "5d969926-54c0-42cf-a0a1-4226bc419796", "value": "T1745622AD6190335CC01FC0386533FD49F2B25A3E13E9D56A76DBBAC077BA421E942B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691694758, "uuid": "a5388c4c-15f5-4fbd-aa72-9c76a188cd25", "value": "531372f8fed94a7a0e3b8ef647c7fcb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691694758, "uuid": "3d268eeb-3728-4873-8380-726184fd2769", "value": "98304:emB1kJ62BWOtIR7AzNS3mVmh/sxWruL0UUXoiEjCQYSRyEK0Upg328Vu2L8IooE:ekKI2BFBS3m0h/P/S2QYwyE13l4w5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691694758, "uuid": "ad868775-bce4-4d8b-8d85-84abefe3cee9", "value": 6051840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691694758, "uuid": "e267c215-5496-47e1-9a48-3b692a99a7aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691694758, "uuid": "ea41b14c-a914-4f8a-a6b0-17f9c8bbac9b", "value": "7b20822375127aaf2c2ec9d1f07a3007", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5b9c2f-379c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691685679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685679, "uuid": "42424376-ab4a-4f17-b149-2f6e17e1ac20", "comment": "Malware payload (Formbook)", "value": "14ef57e9ea139aebe1fb5a81d66d4f08", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685679, "uuid": "e2411008-b95e-467e-b219-1f523e68e10d", "comment": "Malware payload (Formbook)", "value": "3d05b9869dcf10fe7eba50fac1e81427d2699b5514ccf06b497830aef6b59c5b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685679, "uuid": "a7cb8bfb-62ea-4640-a775-afcc00cacc0c", "comment": "Malware payload (Formbook)", "value": "e4b24c475bcd3b4fccc4a60ac23d8d0464822b1a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685679, "uuid": "8a6444cc-201b-4790-be5f-b423382cc2bd", "comment": "Malware payload (Formbook)", "value": "f5da634e1f566cf810b476e33b77e9b6fe51759463cffc786b1b72f289c4d28cd82492ed50a79e5e2a8f7dc7944ac5f5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685679, "uuid": "70fceacb-483d-4a6c-8090-6687b1334ab3", "value": "T13F63F26DD78F01A9CF521337AB2A0A5442FCBB7AB39152B1346C437533EEC2D91252B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685679, "uuid": "933834a8-d16a-4cba-bcff-a9acd88af6ff", "value": "768:kwAbZSibMX9gRWjll+FqOzy7gMeTfNlWyOkhCKD0B0WSFzYVzWZYQ2:kwAlRW+bWKlWdFPvczYVwR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685679, "uuid": "40f9d333-3068-4a4b-a24f-accd669c2723", "value": 72444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685679, "uuid": "cb3c98b8-cb1b-41c6-a168-97785392b911", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685679, "uuid": "6eeb0fbc-22aa-43fd-88da-3e27be387e12", "value": "14ef57e9ea139aebe1fb5a81d66d4f08.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b937e02-37bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691698806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691698806, "uuid": "1d7efdd0-86bc-453d-9b7d-7f30352c3a57", "comment": "Malware payload", "value": "c4e82318d5f902c6dda61e2b00c4cac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sophos", "colour": "#46FC30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691698806, "uuid": "9bcc7223-9774-4294-9288-bcb58bb3e11b", "comment": "Malware payload", "value": "3da31ee0a6c6410b3c66aad41623d05aac61a4dbb85045eb89f5810ffdc93066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sophos", "colour": "#46FC30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691698806, "uuid": "e8480f4e-0da0-4577-ba53-49a3d388ce42", "comment": "Malware payload", "value": "5869cddb0f1ef9d0828618d01def805d7d6ed791", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sophos", "colour": "#46FC30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691698806, "uuid": "309ba238-0004-4580-b471-a0c2d225259b", "comment": "Malware payload", "value": "eff2ec5a940c85aa036008a58d6cc9081fd1c4b6f8c5c3103b6ac9eae11cc4c464e46897c0a8b07ebfb385015cfa930b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sophos", "colour": "#46FC30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691698806, "uuid": "b58ec01c-d161-45c2-9afe-f7c9b61aa852", "value": "T156369E01F9A52F30EAD72A71105FA36967310B1DC319CBE38B3ADBB49657362EE07509", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691698806, "uuid": "a5605643-c0bc-4a95-b607-08dca6486713", "value": "bf53b2b4fc842ae9135d9ee3b4ff11f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691698806, "uuid": "e1277c51-d69a-443b-8749-f889b518a963", "value": "98304:qnLej2lT382SsEHvH6uZcbMKvkZcuQMS+SUZ:qjlksEPR++QY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691698806, "uuid": "f8caeac9-d5be-4b70-acff-1137e450be94", "value": 5153366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691698806, "uuid": "b46bf3fa-fdfc-4d97-91cb-a74098873351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691698806, "uuid": "73986d1b-71a4-42b4-96ac-7f1513fdbc1c", "value": "c4e82318d5f902c6dda61e2b00c4cac8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d36bfe6-373b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691643860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643860, "uuid": "81c27734-657f-40ee-914b-153db8347e96", "comment": "Malware payload (Mirai)", "value": "b4624197d46e9c929ab3dfc7f9c435c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643860, "uuid": "321c4309-544f-45ab-8215-24cb1eab5be0", "comment": "Malware payload (Mirai)", "value": "3e6e357d2442ad6093a8448c9ada56cbb1a90c925e8ef0aca53ba9ab9200b269", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643860, "uuid": "c8bf4865-ddd6-403c-8819-590f03cd92ae", "comment": "Malware payload (Mirai)", "value": "a7023785bcf4339c6fa1a39ff7180f673fd79af3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643860, "uuid": "10b361d4-744f-465e-9c5f-15c218cdffc7", "comment": "Malware payload (Mirai)", "value": "ab967f58d187360df9c0ea86d084a99084db65f6cae7a91d2a203d3ea51597f733f1c4f78db262c33f4d92f970efc590", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643860, "uuid": "836481c8-0aa9-4b0b-8999-2b19131cd5e2", "value": "T10AC2E191E1F22EC6FB7A7EA01BA5C2C177B04E9EBB77CC92255D9F0404A721747096C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643860, "uuid": "15c67a2d-1800-461d-9c96-34d649e32808", "value": "768:yG959yM0HWubJsWDYcGg94uVcqgw09S0u:4M0HRJswYcGO4u+qgw09S0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691643860, "uuid": "40ab8726-209c-450c-af84-507c4df543ee", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691643860, "uuid": "3a9fa1c9-2394-4ade-ab0d-4ac7ba96920e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643860, "uuid": "d9f18c38-3a41-4740-a823-1b05949d7c37", "value": "b4624197d46e9c929ab3dfc7f9c435c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26600c94-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691685858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685858, "uuid": "13334d5f-f786-4863-8403-69f1ed3b3a80", "comment": "Malware payload (AgentTesla)", "value": "c54a1e116568bcc6e70ecef3d0fe4aed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685858, "uuid": "e9b9b719-6098-4466-b327-df03177fef13", "comment": "Malware payload (AgentTesla)", "value": "3f53c498838571bd3333fc44bda24180a57a37a5a1268f4cdb1d204212c29858", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685858, "uuid": "8ef51b33-c8b0-4cbb-8e9d-2ad6276229a0", "comment": "Malware payload (AgentTesla)", "value": "bc265c9dfc1d19564da6f9331ba9cbdc7872fd63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685858, "uuid": "91607586-2cad-483d-8785-b96993135246", "comment": "Malware payload (AgentTesla)", "value": "2d648612cfd5a429ef94c6aed02ea0e83895241da613aebd225976b1c942541cec9595bb97afc880e92d7a66ee992f30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685858, "uuid": "6b0ad0c4-1209-46f8-ade8-86e638c624e9", "value": "T1D2D422481766B06BC8F599B1B08B3A1063B2190F6CE4FED6B5CA70D49538F584B53FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685858, "uuid": "0f9e5e8f-a0f6-4202-99d2-0822b755697b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685858, "uuid": "b32e7b1a-5b8f-410b-8475-862a7ea80385", "value": "12288:GRL87+2RlKK7qpQTLt+CSKsm/KoIUc94rVK4aSL8:Sg7+2Tqc/SXmyeBro4Ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685858, "uuid": "79d6ef92-6824-4972-b910-d5ad17418aec", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685858, "uuid": "c64067c7-c346-499d-94c2-79f687271602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685858, "uuid": "d267cf86-1e6b-4805-9449-a7f63b4906e5", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346a1a52-37d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691708645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691708645, "uuid": "115983d1-1cdf-4843-b571-525de3dbf5c3", "comment": "Malware payload", "value": "6d1be0f5f8bd26f24836bbf2c4950bfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691708645, "uuid": "1efc91c6-3e35-42f9-8416-2e0cf3792bc8", "comment": "Malware payload", "value": "41648630b8dbcbb7eaade9a0b4b07c92ce25785cefe6f77b502f8705a7861517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691708645, "uuid": "af3213a7-08d0-47c1-8c7a-63d124782165", "comment": "Malware payload", "value": "fa0a5e6ca3db6c2193ad54cd17e5f4105438b88e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691708645, "uuid": "a8865179-5c7c-4cb7-a15d-24c867963a0c", "comment": "Malware payload", "value": "e630b33d252d7d1f9ac449c7487c268988f58d60b365273f28180877487ec228d22cbccffe6b2e8c7d1eb301f19416d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691708645, "uuid": "2c940993-ae0e-4232-88bf-c6f58e305d59", "value": "T1C1863385B6A009E9C913803DC581D495EAB7787B03B8E28703FC969B3F53992687FF15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691708645, "uuid": "7dad7947-c722-4e53-b1cf-e7ad7b8fb516", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691708645, "uuid": "f9647ebd-915f-4462-b364-072d1d971e0a", "value": "196608:LTYuKQHzlyX4FMIZETKwjPePdrQJ/BNOqAYPLt:wQTlIQETKwvJHOqAKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691708645, "uuid": "3a479bc4-fcb6-48df-95d6-14364698793b", "value": 8372193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691708645, "uuid": "9eac18d8-6f41-41a3-8696-2de212c0f4b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691708645, "uuid": "f45f8362-3d12-4053-b70a-939eb7b6fc2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e170e09d-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691648806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648806, "uuid": "6752ed35-f718-404d-8bd6-edec6e34dade", "comment": "Malware payload (Formbook)", "value": "872e10dcd9cbbf0c2a65edf2239248ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648806, "uuid": "2b69307b-bf9d-4430-b2c9-30506cc69747", "comment": "Malware payload (Formbook)", "value": "4246ac35e29b03cf4057457231abf222b88bf64cd65b59d7dc79d35b1953372b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648806, "uuid": "c2e495fc-5f15-4ad5-b6a8-b448df8c7e15", "comment": "Malware payload (Formbook)", "value": "e5d25bd8668ae18d55a4edf16c93cb1480779344", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648806, "uuid": "07da8455-d350-4d07-8f53-500b0e4a2c32", "comment": "Malware payload (Formbook)", "value": "23b9cedff8e0c153bbe5cca0b3c31e2bd6198eb2b32c043ca680c5803bd58834f5e94580ff365ac3c0ce2d500c9bf800", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648806, "uuid": "37dab8f7-714d-459e-b889-fd220b081beb", "value": "T105C4224633E98A78DEBDF67D99B610048632E50FD4B8C25B2B4C1139A636F8141D1BEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648806, "uuid": "e840ffdc-08d1-49a4-b5a5-8c5f8ca1fdca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648806, "uuid": "65dcdffc-7844-4dc7-8330-7ccbccc39cf0", "value": "12288:GGTIYlV2SRVMmWjPWY+/SB9/GOiWWh4SvWX9fHkUUS8:xIYlVwxASP/GOr01WX9fqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648806, "uuid": "dbb7cdfa-fbe6-40a3-ae3b-aee4c6aa5e96", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648806, "uuid": "a9072566-e0ae-49f5-9d76-b1a438a850fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648806, "uuid": "eaa82eac-7254-4bf0-86d7-5184b4ca271a", "value": "872e10dcd9cbbf0c2a65edf2239248ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81041321-37c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691704908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704908, "uuid": "cc43b0ff-c803-428b-bbca-6226c77f62f9", "comment": "Malware payload", "value": "c3c332627e68ce7673ca6f0d273b282e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "icmp", "colour": "#E51420", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704908, "uuid": "6dd7276c-ad4a-487d-a2f8-5455ff5a1246", "comment": "Malware payload", "value": "4305c04df40d3ac7966289cc0a81cedbdd4eee2f92324b26fe26f57f57265bca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "icmp", "colour": "#E51420", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704908, "uuid": "77508e0d-6c0c-443f-9137-f664aa5fa752", "comment": "Malware payload", "value": "3cc2d6bf5215de3c24fb194c232a0411cede78e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "icmp", "colour": "#E51420", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704908, "uuid": "3d324923-5b1d-4954-bd21-aeb4f18388af", "comment": "Malware payload", "value": "d6c488f95b44afd818a6fd3cb9484e601cd32e2852e1423d55bc7120ecccebd92e4700b6baf12a5f00d7a0a895e54973", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "icmp", "colour": "#E51420", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704908, "uuid": "25a46c19-c6cd-4a82-a76e-0fdf63c8baca", "value": "T1AA22B60FBA63973EC05AC73481A7423076B39931F723523B1915AA381DA27690F5F56A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704908, "uuid": "7ef168e0-3f1d-42a4-ab91-6fdfb22c299a", "value": "96:G0ErTM8YBC8cEFo4sW/GmS8yfyL1vA4f2V5j0Chkdg3dTnCKh/SXEXemKY:Gro8Y/vFoq49U1TKjVhG8TnNh/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691704908, "uuid": "5b8a4494-02ac-49dd-87c3-41f26e583108", "value": 10576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691704908, "uuid": "d49802e2-8c7f-4410-81dc-4e0221022b2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704908, "uuid": "3d58428a-42d0-4677-90ba-1deef6c6780a", "value": "4305c04df40d3ac7966289cc0a81cedbdd4eee2f92324b26fe26f57f57265bca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2867c122-3721-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691632604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691632604, "uuid": "1dac45bd-574f-4806-be4f-36aae564e649", "comment": "Malware payload (DCRat)", "value": "083e34f567cf3cda0a04145103519124", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691632604, "uuid": "08977128-1c40-4825-8ba1-78c8cf3d2b78", "comment": "Malware payload (DCRat)", "value": "434ad7155a06cf08102bbadb9b02a268a2cf66693bc849a34dbbb30c59d5e5a5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691632604, "uuid": "744cc951-a325-43c1-b1c1-dd5ed09f7500", "comment": "Malware payload (DCRat)", "value": "b583b1e03f094207c483c7e1b7c4b466d573d058", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691632604, "uuid": "f87e723d-533f-4e48-88aa-a94c402c1b15", "comment": "Malware payload (DCRat)", "value": "f4696e6b47b1cb1d7ed2746105db0dd7e4a86de2e6e4c3dd4ded4774223d3b0409e411d2eb8eb5ebe8b66ebc18a471d3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691632604, "uuid": "ed082f16-8d30-4f6c-8975-11d32a456c6d", "value": "T1B8658D027E54CE11F0082633E2EF494847B0A9556AE6E72B7DBA33AD55123A77C0D9CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691632604, "uuid": "9052bda0-aaf2-4990-b313-a6303e7be844", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691632604, "uuid": "f9ed295a-50a5-4bc4-970e-55dcdba08019", "value": "24576:d6/16VpovBLQonrdrcseFsaiM+hOMBrFfzNJR:I/wVpqjoiMKZp77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691632604, "uuid": "0e3a89c8-513a-46d0-b182-32a1d7abdbe8", "value": 1518592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691632604, "uuid": "ee225abc-7d9b-4c9e-b537-727547eae698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691632604, "uuid": "300b763d-9d56-400f-9b5e-382fc9112c13", "value": "083e34f567cf3cda0a04145103519124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1dac1c9-3711-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691625990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625990, "uuid": "c459325f-d5c9-441b-90f2-27350dc32b58", "comment": "Malware payload (RedLineStealer)", "value": "3fdd2daec795663f1cea7bcd87754255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625990, "uuid": "c143ac62-3cb2-4bc6-868a-41ac3fe44bff", "comment": "Malware payload (RedLineStealer)", "value": "45b2d422424bd122a12e54d5c8f0afc9401d5b869b42b0c3f11bd7d47f6cc8f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625990, "uuid": "22797f80-564d-464f-b5ca-b8361636fec1", "comment": "Malware payload (RedLineStealer)", "value": "de78725f7bce65b32577d56b3620f59221232a33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625990, "uuid": "ad73881c-eedb-43d1-bc61-bbd88684875c", "comment": "Malware payload (RedLineStealer)", "value": "5d5747d60242bca0100c06b19c7830469626d0baea12581a5ff944619aec5f173a6d4538e923bdd24bb0e285f8c712ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625990, "uuid": "591e6442-1ad7-43de-a95a-22a62fe6fb00", "value": "T1D3C41207BBD68072ECB4137169F712D31736BDA29C38822B5741A8661DF3AC5A87133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625990, "uuid": "d3f95a8c-759d-4239-b0b6-e1db0a75f35c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625990, "uuid": "da1feac9-4565-4e46-9a87-691b7974c88f", "value": "12288:5MrMy905XBGYZCPC4E/8p8Ugh8/gBYC2oDyuD0L7uI:tyMBGYUPK8p8tG4zdGuDK7uI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691625990, "uuid": "4f451896-11aa-45f4-b748-9364a70bae34", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691625990, "uuid": "13293747-5928-4b32-8b02-19ea633397d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625990, "uuid": "053bc65a-0b9a-410f-9dc6-740c37f9414e", "value": "45b2d422424bd122a12e54d5c8f0afc9401d5b869b42b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a283b3d7-3768-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691663303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663303, "uuid": "9858f4dc-7fbf-4f07-abfe-f42857c0f218", "comment": "Malware payload (Mirai)", "value": "2b9056e29b4382bb0759f358e03aebec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663303, "uuid": "08a5ae31-a92e-4884-a3ec-18f2eb1ece41", "comment": "Malware payload (Mirai)", "value": "464f653c5b15dc33b3179c1ca5de7f63f3a13011861bd23c7c39001a41f6fb99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663303, "uuid": "6cd8670a-8511-4f4b-998d-f777dc7d181a", "comment": "Malware payload (Mirai)", "value": "6afdad611f69d5f0a12dd1d878f84e6efe9abe41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663303, "uuid": "34e36e84-edc8-4c8f-b249-1711a4ea91bb", "comment": "Malware payload (Mirai)", "value": "02448ac649d46810ed7b5b7484b2345d6aa352cf8855bd26bf2d6d18ec03b2927f9fcd59882eb18bf76e8fa9245f55cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663303, "uuid": "66285657-7676-42a4-a9db-453d9650228a", "value": "T139D2D0CCB0A6F8ABCA5D6CF0526D13511DA096D072CA86EC5B118C8CB67A78BF01D4FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663303, "uuid": "2cd18559-48de-44ed-8274-6f5be5d308c0", "value": "384:InNMYvOlmmDlHtaYNor0CwBxN8ZJWc4t/N8+lNxW6x0jnUObIZU0WgLZRWGVCz09:I6YWsmDlIJcBxNPc45TxajUxy1gLXWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691663303, "uuid": "f0b3bf14-e51b-40a2-89f1-24a5bd14158d", "value": 29284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691663303, "uuid": "86aaa5c5-8afd-4799-bdc9-823320384cab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663303, "uuid": "578febe0-a515-49fd-847e-b0367daf9bff", "value": "SecuriteInfo.com.Linux.Siggen.9999.19382.23291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2c879e-374e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691652122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691652122, "uuid": "b7424327-faed-49d9-bfb5-dac85f7b5536", "comment": "Malware payload", "value": "1dcfe0f6db959427f8223dba60aafdd6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691652122, "uuid": "b9d268b0-b234-4b76-83f6-6f810b4d4f81", "comment": "Malware payload", "value": "46da5f6981b91e6d71ec7d4980a09f77ca12723762fa525ca01dc07a3bc19101", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691652122, "uuid": "5c48239f-2ff1-4836-a3ef-82272ff8615e", "comment": "Malware payload", "value": "534c82c8f4cf28a65d7c436ab94362a11b530e7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691652122, "uuid": "eba54fdc-b7db-42b1-a128-dbdd4f346242", "comment": "Malware payload", "value": "8c6e61bbe5d1e8edc55745e1c338a3c3cf12f56796c5624ee1130627c21781f5b933128dd0b724e2bf2d5f8377fbfbe7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691652122, "uuid": "25e65634-263f-447d-a0c5-aef1ae3826f6", "value": "T14CE34B46F6418B17C4E62779BBDF438633239B54D7EB23068528AFB43F8679A0E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691652122, "uuid": "54ad289a-838d-4e7a-a8e3-d4a0ff09be6b", "value": "3072:r8DBM3WBWrNJWBerBfQJUHZtu9AA9WZXYM/9OsHoN:YG38BerBfQGHZtkAMWZoM/9OsIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691652122, "uuid": "9328698c-ec9c-41df-bdac-7547d6d0336b", "value": 145140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691652122, "uuid": "0328cbd3-67b9-479e-beac-abb2b4638994", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691652122, "uuid": "4dd1ffdf-c38e-4ef8-b2ae-b4aff6bfc3ae", "value": "1dcfe0f6db959427f8223dba60aafdd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8ebbef-3741-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691646409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691646409, "uuid": "68c248d4-a912-496d-a9ba-35a9c5b2ed51", "comment": "Malware payload (Mirai)", "value": "964635254028df5ee92ef86811e0b55a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691646409, "uuid": "88f4eb47-d66a-40b5-ae9c-d5a5413ac746", "comment": "Malware payload (Mirai)", "value": "48767571825974a9f132a3b12efed2a4f2b94b1cab22bba1c96ece6c6ca35c6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691646409, "uuid": "901ee303-db44-4f65-bfac-7efb3051606a", "comment": "Malware payload (Mirai)", "value": "357c5ec4ce9c801e0428fcab050f587dd2cf200c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691646409, "uuid": "73ea830d-f3a2-4c87-a51c-1717b53777d3", "comment": "Malware payload (Mirai)", "value": "af886801c67d851c2e5cc35b3a74ee8a68f4fe4c42c0fc7e63f5d3a775c8358cf0ba4c283a6101fb824fb76733071891", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691646409, "uuid": "b29a46db-b238-40b0-abca-3514802bf92d", "value": "T1BD732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691646409, "uuid": "de9e7e1d-9a20-4aa1-b852-0f1148a7ba16", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9W/:927jqCt8v3GI/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691646409, "uuid": "c74f0916-8105-4940-892e-61e454b0b8d8", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691646409, "uuid": "91bfd725-e33d-44c1-9632-f22a299481aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691646409, "uuid": "76d3f497-ed5b-470f-94c9-a9557da07fcd", "value": "964635254028df5ee92ef86811e0b55a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d09a253-379c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691685628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685628, "uuid": "5495c234-7004-4446-a93e-819334ec4562", "comment": "Malware payload (AgentTesla)", "value": "9d71b184bdc953236a39b1f3b4e16f35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685628, "uuid": "c6da4c11-5469-46f6-9fc3-52a4a9ecab4d", "comment": "Malware payload (AgentTesla)", "value": "493ed6f4cb6ff69beb7e5eed15104335d9c94a250dbe5c52adce51b093fff100", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685628, "uuid": "647411be-8bf6-413a-a2c5-a639868b0053", "comment": "Malware payload (AgentTesla)", "value": "6d92994577c0ee69c7ef529a7c648643790d8a23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685628, "uuid": "5cb796ba-00a6-4352-bc00-29a3c55815dc", "comment": "Malware payload (AgentTesla)", "value": "47ecbbe67673e9ecf7dd909768636febee33126235f50ea329de8283b8ceddd989a562c9e9a9b2fe7cabf9f77b3c95e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685628, "uuid": "61efa641-7901-4121-9257-4bbab5f74943", "value": "T140641281F2E4C4B3EC724FB15EB41A675FBAE325A12911378724EB9839315C1DB0AF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685628, "uuid": "83b4dd73-27d1-4fca-a2cd-545b9fcf44de", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685628, "uuid": "9669ddad-dcde-4554-a356-8cc4e2bc3f4c", "value": "6144:ZYa6dOkfYmldN8fYEEBLBesjqXH0wSMBJAwEzbdnLVbksERZ6s3cF:ZYrhYm7NSY71iH06+bxLVwRjsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685628, "uuid": "9833b17c-72a8-477f-9aec-16b94991989e", "value": 309171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685628, "uuid": "89211cf8-7479-44f8-a216-32fcb56b2488", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685628, "uuid": "023be8da-defc-4be1-a04a-8071a59dc103", "value": "DFQSD0876789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85c0254-371a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691629893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691629893, "uuid": "c20ef88d-cba9-4e45-90ff-255712ab9521", "comment": "Malware payload (Amadey)", "value": "7fb8572dd4baabf58d3d27810ea743bd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691629893, "uuid": "346db191-9115-456f-b14d-66b7bab26f29", "comment": "Malware payload (Amadey)", "value": "49b9de76ecc9f50772e7b5136ad63768a1a350426b6b38b8ebb3136c172aff33", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691629893, "uuid": "b9517b81-6e9a-4d9b-a92a-0eacb2cb6dfb", "comment": "Malware payload (Amadey)", "value": "f56a00039fd37a763deb20a1eda0e9ce66748311", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691629893, "uuid": "26cc5985-eee5-4439-9cfa-216b8ebc938b", "comment": "Malware payload (Amadey)", "value": "c995a9a577ec45d58f1a913b901e580c2d1903be368a2b9bed7e3cf9e463abdfdf1cc25d1057013925a4a9a39659e449", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691629893, "uuid": "00e3cd0c-6254-4996-abeb-fa1262d5dc4e", "value": "T117C41212ABF55033E9792BB049F702C32A35BCA29D78831B1B55A9995DB2380F53532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691629893, "uuid": "29dcdda7-e304-49ef-bb77-1b38da4c99aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691629893, "uuid": "641a5e11-9189-4550-8862-dd71546137a9", "value": "12288:WMrWy90w9PadmIOwzh1uwfvmm89MXgBYCH2QIuwo44nJcD:UyV1I1zhnfvF8VzrIfSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691629893, "uuid": "db898673-7cbe-4b0d-8646-d6c039dda6f8", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691629893, "uuid": "3e7edb45-9bfb-481a-926f-d3ca38fccb65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691629893, "uuid": "6d144cd6-f9ef-485b-965e-f98befe1309b", "value": "7fb8572dd4baabf58d3d27810ea743bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ebc409-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691686019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686019, "uuid": "1e7da0fb-89d7-46e6-8753-52f5c7c7fa14", "comment": "Malware payload (GuLoader)", "value": "fc011bf240482266fa25f98ec7f18257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686019, "uuid": "c74c1f92-7797-488f-9bd3-67c7e10f4886", "comment": "Malware payload (GuLoader)", "value": "4ae4fe5a11c7586e5c108a031ada600b4b8bf2007ac6416918e054389b5ca251", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686019, "uuid": "24ab3cf3-5a1d-4e2e-ac87-77e0b0b03784", "comment": "Malware payload (GuLoader)", "value": "844d53ff3798d2205bdb7e673e7af960846f9b97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686019, "uuid": "86c03d02-708c-4e8e-9e54-d730b111379a", "comment": "Malware payload (GuLoader)", "value": "264366f6c286ec36daeb9a2f5c81b70db1bd189d802601a0aece55d889513256e87f9f375becff655f986474a38e915b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686019, "uuid": "9ddfd69b-d649-43ec-b906-eef59fdd8543", "value": "T1562501C3B9565253DFC8CBF92A428E221A6C3F300769D706D2287B178D7D564B6EB231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686019, "uuid": "4ad69a7a-a855-4c5f-a92d-aa22e25eb137", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686019, "uuid": "6e9adcf8-0fa5-4440-a7da-31a35a4cbae5", "value": "24576:OFiS4/YYBxh7BM2HVwK8kU0SKDFa7lQ59uO:hSq/zRHVD/SQFulQ5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686019, "uuid": "eb4f8721-beaa-4c83-809f-442bfebad9ad", "value": 1010784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686019, "uuid": "2a9ddf36-45e8-4109-820b-113955a1a51e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686019, "uuid": "f58cb6d3-526e-49b4-8b8b-56787d141093", "value": "\u017d\u00e1dost o cenovou nab\u00eddku (MUNI 1008-23CZ)\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11192f8d-377b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691671220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671220, "uuid": "c89b706c-ae2f-40ff-9826-332fcc6502da", "comment": "Malware payload (RedLineStealer)", "value": "23080b88704b0349f7de848da3176733", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671220, "uuid": "ec25d2a7-8b27-406e-b47f-d7c2463a1388", "comment": "Malware payload (RedLineStealer)", "value": "4bb47575141b146a46ec0d5faba84c73fd669a4d29ce9284fb0339ec7bc71515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671220, "uuid": "a9cd2fd4-df9d-4e12-8c89-aba18c71eed8", "comment": "Malware payload (RedLineStealer)", "value": "1a548d8541f8a40e4a6cfd8d19a3a997174ef85d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671220, "uuid": "663b086b-6384-44ae-a515-fa5dd71669db", "comment": "Malware payload (RedLineStealer)", "value": "b691540fe56c72fd73388af0d60c47d766d4fcbc731308c2ba6cd397b1e5e2ce6a8d949bfb9453603726bd4b0c5ba329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671220, "uuid": "55b42a84-fa43-480a-8ce8-9efaee395b02", "value": "T16D75BF3FF268A13EC56A1B3245738320997BBA51B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671220, "uuid": "8df5f354-e633-4bae-bc43-ce5cf4742795", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671220, "uuid": "4e4baf25-2311-4d5e-9ab5-d87932b83c0b", "value": "24576:s7FUDowAyrTVE3U5F/QzKic6QL3E2vVsjECUAQT45deRV9RZ:sBuZrEUcKIy029s4C1eH93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691671220, "uuid": "ef9ac24c-0c3d-4dbf-b4b9-60b07e6f3fde", "value": 1673089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691671220, "uuid": "0cc961e8-4a99-40e2-8834-5e77bd269f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671220, "uuid": "1141ff8d-4762-4859-bdb6-ae9a32fa9f45", "value": "php thetitle .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5200ced-37a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691689185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691689185, "uuid": "4833ea55-4bbe-4654-b8f1-4e780b735ea7", "comment": "Malware payload", "value": "c80da7a1c228d54fa588f3fcb3533c5d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691689185, "uuid": "e6ce2c46-d84b-4858-9ca4-38db61aa0bc4", "comment": "Malware payload", "value": "4ee64b6797fa8067c451a5a6ec463696b0236ad90feec635b8f5af948c620d0f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691689185, "uuid": "d54b4104-1b9d-42ac-8adc-a6583abcdcfc", "comment": "Malware payload", "value": "30b90519d0054a622e7fb505972aed52a4a59cf2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691689185, "uuid": "325d648b-2589-4db8-ac67-e0cdb7d34597", "comment": "Malware payload", "value": "e8037fdbb3193b69ab27067fc0d70777dd910f91eb06213bd723208baee4026499dbffc340fb8c9efcfdc626560eeaaa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691689185, "uuid": "2e80dcf2-9741-41f9-9251-53d631c16589", "value": "T18ED32A41339DCD74F066217E4154A9320DBA7C36B66F89DEAFC64C8E4278A8077A4F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691689185, "uuid": "be05708f-57ca-4a89-bd9d-8105ed52e2e0", "value": "0b8af3550b5710c15669b5b350fa662d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691689185, "uuid": "ca696ecc-76ba-41a6-bed1-668cb2f130f2", "value": "3072:UYQ1H6Th6jMzC5wGa8+hHtp+XIUwUHqhxCTL:UYQ10hTYS8+hHtIJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691689185, "uuid": "55b3668a-b1cf-4e61-a252-81ed6a601b05", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691689185, "uuid": "da245d91-7879-47f9-8297-cab5a8b290bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691689185, "uuid": "822a3425-1f94-48d2-98eb-aee66febb607", "value": "SecuriteInfo.com.Win32.PWSX-gen.10441.4286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e3c215-374c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691651422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691651422, "uuid": "9d6418c6-56e4-4142-ac59-7ae42eb35511", "comment": "Malware payload (RedLineStealer)", "value": "b09466557917f41e0cf71e5a1c2b727b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691651422, "uuid": "25ec01a3-2abe-46ee-b57a-3a744aaabf78", "comment": "Malware payload (RedLineStealer)", "value": "508a6847cc3c2a81052ee31d211130f367a52c1ef61d98716bc9d4c5571ec48a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691651422, "uuid": "de6ca4b5-d012-4118-a837-273ddf1d4d69", "comment": "Malware payload (RedLineStealer)", "value": "17f076aa0cba84bc2ec48073408c870df5b3f728", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691651422, "uuid": "85d53ad8-8ad0-4fa6-8cc2-636d799322a5", "comment": "Malware payload (RedLineStealer)", "value": "3034b6159ed99ac8ca2faba6352511fd30954b55e9cb8552a2ab7bcda2f56f5284c5cad15f6ab548fd517c3445111f42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691651422, "uuid": "1cadf616-233c-4961-acb7-fe7d0da3afd6", "value": "T1E2757E0AB6F1FD46C7A41E31915B45A94FB6FA026B67F34F1E2B2531BC023A44D4B6C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691651422, "uuid": "f64a74ed-9486-4f2f-85b8-8c0dabe9267e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691651422, "uuid": "5b114e4d-bb94-4892-9cf1-6b4529a4d546", "value": "24576:g+35PRhVY3d3+bl3peCvU1br8h4l2CPdtqvVXUkrfj7rnPbf1u:bR80Le8h9hl17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691651422, "uuid": "8ee95fff-aff0-433f-8fd1-eecf5b1c2ae3", "value": 1563136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691651422, "uuid": "fb4ed437-7abb-434d-9a92-953bf8faf125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691651422, "uuid": "71140f7e-4d6b-4668-9295-2b6386a7132c", "value": "b09466557917f41e0cf71e5a1c2b727b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e41aa8-372e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691638390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691638390, "uuid": "ee480368-1e6b-46ae-88e5-51e971a1dceb", "comment": "Malware payload (AgentTesla)", "value": "e6daa96e648447849b76e954af8006e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691638390, "uuid": "95d2e4a2-0a64-41aa-af7c-db55e57a0b52", "comment": "Malware payload (AgentTesla)", "value": "51f07741241cafeb5f72535e1b04f3b5e258a2587b5d2f1d8d67a180ec02ceee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691638390, "uuid": "4ac397a6-f29d-40d7-9be4-b03cccb3085f", "comment": "Malware payload (AgentTesla)", "value": "e4470d9ec10ec42e227ffb8ce9c9703e5b0dff53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691638390, "uuid": "83092a11-1516-431c-91ef-7938d8a3e793", "comment": "Malware payload (AgentTesla)", "value": "db00955191920dd4258b08062b152658120a4fd774828da6c916820a12728a906d2e72e5ce00b5ff450b2379eb2baf16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691638390, "uuid": "a361eafc-e01d-49c8-9567-6d954f8c6de7", "value": "T1FBD4234017BB0D38DB74EBBD5452044027B1758EE4BDD24F25095BBA6B39380AE86BEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691638390, "uuid": "0f8cbae5-a8f5-4870-a5ac-250ffc4a600d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691638390, "uuid": "9debd539-2ebb-4dba-bd31-5f02868ef9f9", "value": "12288:1GTIYlV2eRslVvxc2sdnJLAfLxlWeIn9sWVQEzoZN8fVxC8gycPvr3:WIYlVfRslEbAfWLn9sIfzojLT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691638390, "uuid": "b252b38e-6caf-43c1-8a22-37aec9335a72", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691638390, "uuid": "10888069-62b3-4745-8eb6-167e67f71f50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691638390, "uuid": "d17bd5aa-e42a-4b72-82ab-745c3d1b4f23", "value": "SecuriteInfo.com.Win32.PWSX-gen.18941.9823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd15b7e-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691648562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648562, "uuid": "4fec077d-3ca6-46e4-ae66-a60e30d25246", "comment": "Malware payload (GuLoader)", "value": "d2783bdb129d7bf4887ab5c26bfad482", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648562, "uuid": "8ce6be5c-4638-40f1-acc4-56deecbcf5f4", "comment": "Malware payload (GuLoader)", "value": "53d8050a5c3822f82e03a7104f46ae17439e7dc42c2dbb3de32d417dd5554da6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648562, "uuid": "4874dd36-79e8-46c5-a4ff-bb8923a3d023", "comment": "Malware payload (GuLoader)", "value": "ba241584accc038bd00e6027c853a92774b7dd82", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648562, "uuid": "15f6c999-9563-4fa7-8086-3ee5f58f15f6", "comment": "Malware payload (GuLoader)", "value": "0076944dd057c4129769fd3bbcb27cce08080ae56b19b034b2f6f47282e5c3e0e749ec776bc274780a81c91e9d61fc93", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648562, "uuid": "05834ed7-6668-44c4-8a14-0fc0372672b1", "value": "T1F4327D6F9DD196ACC30A70B940682015D7F87DB7EA24D30A6D70EBC9817B28F434131C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648562, "uuid": "a92dc916-28e3-4841-85da-a05c71cee2d1", "value": "192:hya0NfNYoqWt4N5eNA2A+EnVs+mg1SoB7JYnO36PvOK7CiY9McWe5W0Fx4l:hyXlYoqWtu5+A2bkBdB7JYnOqPFCv9M3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648562, "uuid": "b825020d-83ac-45f7-a6c3-80dc8d1dc4d3", "value": 11495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648562, "uuid": "1c7a3a56-0491-429e-bf99-6a9626b86cde", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648562, "uuid": "b93a6c3e-3349-4132-b853-4d1244ac849f", "value": "Catalogue.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe939a1-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691648642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648642, "uuid": "e651fddd-20c5-442e-a217-75cc91640b7e", "comment": "Malware payload (AgentTesla)", "value": "3ff943c648e9d754a6743fbd5e84142b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648642, "uuid": "1681ee43-8aa8-4d00-9bd4-afcc8cab68af", "comment": "Malware payload (AgentTesla)", "value": "5663ece6fe0853ed05168260dec24b90960bf3be5303bb6f3dead58f420a8c63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648642, "uuid": "e40bd701-b8b0-4b1c-9313-0d7cdd4bcaeb", "comment": "Malware payload (AgentTesla)", "value": "fe4ca112ae03cd62eb166db1922d5880ee104eec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648642, "uuid": "b2a20443-56cd-466d-99ef-35fa5fda15b0", "comment": "Malware payload (AgentTesla)", "value": "6d1c76b26a5c701adeec43bb36f4b20e290bbc6deec41b3132d55e6e0a37c8205a2cdba9787aaadc8ebf7692bbc3f106", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648642, "uuid": "c71cc9b0-b148-4481-b3ca-50766675c1d7", "value": "T12A326C29DD9570BDC30B52F5556060FDF7BCA5BEE314421AFDF09A64846AA8E83C1318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648642, "uuid": "05e6c88b-3b65-4eac-b4b5-367d14e02a0d", "value": "192:iya0NVjk7Wc4N5eNA2A+EnVs+mg1SoBSJYqO36PvtK/sbY9ncWeDV6+J:iyXVjk7Wcu5+A2bkBdBSJYqOqPGsc9nW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648642, "uuid": "f79cd941-d462-4d16-b880-55628da95451", "value": 11494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648642, "uuid": "64aa5c75-a278-4bb2-a3b7-de723dccb8c5", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648642, "uuid": "981490bc-7062-4d00-a5f6-69c7d8f50c4e", "value": "Swift_5.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692ec3e8-37b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691695419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691695419, "uuid": "8ac27561-9b33-4f4b-aa92-aa201f9b11e8", "comment": "Malware payload", "value": "031187efe012a333fdabb89ad0c5d411", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691695419, "uuid": "09c133a6-beec-4a9b-8c51-ac10e57bea56", "comment": "Malware payload", "value": "5790657ab5aa69e05dcbf56d1d202bcd11a0cdf197afabe5ec7b8586f6ddf0e8", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691695419, "uuid": "71f007e9-f5c0-447c-9e11-5c9348155bed", "comment": "Malware payload", "value": "25b37de55372d52291317f1a07d1ec0121994226", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691695419, "uuid": "8ac0ba7c-b502-477c-9e86-81d673df0c2f", "comment": "Malware payload", "value": "eaf8e97f3a825c605ea2bf406808a754240633fe83396595f30dc6edc9898a3fae8d748e471b9f0dfa8a0d5f54f0b109", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691695419, "uuid": "d641bbbc-c356-40e3-a13b-d246a81b997f", "value": "T179E62325B59BC932D22D067BF868FE5E06393F724B3105F776F839AA18B0CC15271A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691695419, "uuid": "713ee105-4ee7-464b-a20a-4d780c2be91f", "value": "393216:V2ajq5X3pHvX5Njc+p/w3/D4tmrzeOwExxAzT:IGaXdLcww3Vrzen3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691695419, "uuid": "ba249745-9ae2-42e8-a47a-f1850a7cc07e", "value": 14599168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691695419, "uuid": "2c6668a7-983a-417f-80f3-90848366a5f9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691695419, "uuid": "30bfb1da-9916-4ccb-8fe8-d5d41351f999", "value": "en-win-update.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcafa23-3745-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691648290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648290, "uuid": "f9887e57-19d9-4e87-b4c0-b8f9b8441ccb", "comment": "Malware payload (AgentTesla)", "value": "5d9c159b4f92258984669a10666c92e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648290, "uuid": "5512d13e-d62e-46b0-a6ef-376e1abe2b45", "comment": "Malware payload (AgentTesla)", "value": "57e5c265d656679c7c2ac2b0a255264a6a8dc01cf5205964afed49709f38560f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648290, "uuid": "e6c57895-0408-41d1-ace5-205aaa671c9c", "comment": "Malware payload (AgentTesla)", "value": "abd23d16580e3bee61b190c85a0eebcdbfb30bd4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648290, "uuid": "71a95fb2-453a-45cc-ac81-801006a9ee32", "comment": "Malware payload (AgentTesla)", "value": "ddc8ccda99e38d64fa08ada2e098268686d088ac24e7dc44e17afba72f9cdc61b38ad5a06b6608fbb9eb915706f32fb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648290, "uuid": "7109fc21-3a31-491c-8f7b-66b74dc81965", "value": "T12573242DD38F0269CF5252379B2A0E5502FDBB7EB34112B1306C933533EE92D916A679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648290, "uuid": "4e911c29-7d15-45f7-88f0-ab4e5c249121", "value": "768:ZwAbZSibMX9gRWj9FquGCYdWuR7bTYjILVH1ZcRqBCuWROXM/n9m:ZwAlR8FHGbYm7ojoVH0qUueOc/n9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648290, "uuid": "800bb0fe-f7ab-40f9-a791-11736b5a13d9", "value": 76510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648290, "uuid": "58ccc37c-b82b-4d0f-935c-96e0d298f813", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648290, "uuid": "3e177a71-4f48-4145-903d-16a4d91b8321", "value": "5d9c159b4f92258984669a10666c92e8.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66934f98-3779-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691670504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670504, "uuid": "e75ce8f2-e128-481d-a77d-cf5cb01cef65", "comment": "Malware payload (Mirai)", "value": "61a692839a53e9298ef37436858771c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670504, "uuid": "bc414179-42d3-465e-beb9-d41ae89dfac0", "comment": "Malware payload (Mirai)", "value": "59f98ee0a5cddd1819badc4ffadf15caf03886a4e7cd9fbf78ec241f7309cab1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670504, "uuid": "574f96d5-34aa-4e5a-99b4-631d6eda5b8f", "comment": "Malware payload (Mirai)", "value": "33f4cbbe9445205cfda40ff540187c4c19b4cf28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670504, "uuid": "6140a31f-c0a5-41f4-b44a-d77908621b56", "comment": "Malware payload (Mirai)", "value": "beff7e2ce23d90c5085f7c38b607bb04e50776b02d01fbff6d0aaf345669545f2bbb883b48e422deffab0cff62bc25c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670504, "uuid": "f876e106-ea31-4324-907d-1df75ff59438", "value": "T190C2D070011A9BA993B0D63FC4ACCAC097B7C479927E31FD52B090687C6A05B7D79A87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670504, "uuid": "d512a9fc-f72c-4b55-aea0-d77513f6c02a", "value": "768:gJ4yxVZId+Uje2D479EwyKvpmxEqYps3Uozz:Sbx/R0e2k7awpqNzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691670504, "uuid": "f472c330-7e75-4cb3-a73e-ab5df40b0362", "value": 26192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691670504, "uuid": "25539212-d8a5-4313-a0e1-90c6c4169974", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670504, "uuid": "1f542b46-5aa7-431b-b698-2bc47e957e3e", "value": "SecuriteInfo.com.Linux.Siggen.9999.11055.24166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19d1f48-378c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691678817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678817, "uuid": "15bd32b7-5a5b-4dc4-8685-95d4f96df99a", "comment": "Malware payload (AgentTesla)", "value": "40ae68a1fbe6b4f12cc3c6e48d82fff1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678817, "uuid": "b6769d0c-63fc-4ce0-9005-e24fbfc1bafd", "comment": "Malware payload (AgentTesla)", "value": "5aebac92125547ec3d79dac08bf20e1a990758cf2bace37672dca5adfe509aab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678817, "uuid": "3a04c3e2-3712-4c2e-a9b8-c22be36006c1", "comment": "Malware payload (AgentTesla)", "value": "76d380fb965afaccfbb46791757b76b83f90367c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678817, "uuid": "7765978f-2e85-42d5-b12e-875f2316301b", "comment": "Malware payload (AgentTesla)", "value": "3fbcfef2d6c030d27e9369aa44078e78ddc18af9e4bcba868a13274e4295a790dfce0d72846cee0008035b1bcf41e4ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678817, "uuid": "22ab11c4-0bf0-40d1-948d-55724599b6a3", "value": "T1A763CF2DC34F42AACB525233AB1A1E4502FDBB3EB38512B1346C933537EE83D51656B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678817, "uuid": "9e563fb0-1a23-4993-bee8-66f034a017bc", "value": "768:8wAbZSibMX9gRWjZb2xIxQ21QIcYpGmD95BGamvbGo24Oq:8wAlRF21N/DDBAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691678817, "uuid": "9e47c372-ae22-4be1-af37-df5373800761", "value": 72037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691678817, "uuid": "690e5539-3dac-41a6-8c34-d1fc237d51a9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678817, "uuid": "81444e71-456a-42df-b8f7-e77a55e073a6", "value": "40ae68a1fbe6b4f12cc3c6e48d82fff1.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32a5f8f-3745-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691648326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648326, "uuid": "b5d63b32-0ae3-434a-8a15-bd8ec5da5a19", "comment": "Malware payload (Loki)", "value": "919897e0feaaa42d2e1c76ab14d7cb7c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648326, "uuid": "1774576e-0816-48b0-8aaa-5e1b20d8333e", "comment": "Malware payload (Loki)", "value": "5b848695348fa9282ea099ab7306f53bb6c49a8ae238f95a870198d9e6abd332", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648326, "uuid": "341d18e6-ea69-4701-808e-4fcec1b40f8f", "comment": "Malware payload (Loki)", "value": "de067a7b64f66c11582f549a2d5533be59c00d26", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648326, "uuid": "f43292fb-3697-486f-ba91-648ce2a3e15b", "comment": "Malware payload (Loki)", "value": "649e2fcf5898bd09cf5319549b746de6ca36d75aabeeb1b6dbea6c7d33b63c0565a45c1fb7b746027b26bc14b1abe895", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648326, "uuid": "8a3aae70-1dee-43dd-bb75-23a3cff71272", "value": "T18DB412C113B98E28DBB9A3B5A95114048773A55FE03AD20F491C2625AF3ABD0B7507FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648326, "uuid": "5028f00d-8db3-4156-9639-77f63e0583b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648326, "uuid": "d3d5da24-448b-47cd-8b71-90f6835acdaf", "value": "12288:AGTIYlV2phoGei6MLhaLIQyUe4vX0jCIeGkv/WlsmFz3tdw:PIYlVZGeAIcQK4fU20lsmFz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648326, "uuid": "59c678f7-f038-4c2d-8784-68b58fc48d8f", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648326, "uuid": "ae71b240-7910-4351-a676-ba0a876f7b7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648326, "uuid": "866a8a32-ad42-4e22-9990-e077fd15dd7f", "value": "DHL Invoice_72143002501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb31c01-3782-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1691674464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674464, "uuid": "6259bf9c-20ea-422e-b3cc-6f643dec5ed5", "comment": "Malware payload (Gafgyt)", "value": "9bb33f16ce4979a88a7c0604a2968c5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674464, "uuid": "6c553ede-ca53-440a-b6b8-e59c453049eb", "comment": "Malware payload (Gafgyt)", "value": "5ba0920a9746c96806121656a05942884d0adb996c70ff607cf1b395bd3c0dc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674464, "uuid": "024d394b-9794-4711-b016-46899157098d", "comment": "Malware payload (Gafgyt)", "value": "cf3bb0769c3813052c879ec53fa7f98c76691a1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674464, "uuid": "db7267a2-f1b9-4929-ba28-49fa4979e45f", "comment": "Malware payload (Gafgyt)", "value": "572c6b9824531d59ff864184b9b64af096ca866513a610042adf0f6f9ff4a795c7a16a058dc12d1feb03649083599b75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674464, "uuid": "c77a433d-7276-4665-9c48-ea8d452c27c0", "value": "T11C637626AB62DEB7DC5ECD3305A8464230CDA15652D83B2F76B0C62CF75A90F49E3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674464, "uuid": "62f9f5e4-dd2b-4ff4-9ea1-9135fd0007dd", "value": "768:C4qW/xr6+p/5eYeeCex1AKLjwdLC8+t8EL7ZIFGXi3sT5xv1wfgnRSPIvm8:C4VrzpXCa0Q+i7ZIFov1wfgnYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691674464, "uuid": "6b42a906-e32c-449d-91fb-9fb8f1dddecd", "value": 66880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691674464, "uuid": "73101114-c1a8-48f1-a724-1cf5dbad5f6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674464, "uuid": "57e86aa0-fd11-40cc-83e6-40adf762dd3f", "value": "SecuriteInfo.com.Linux.Siggen.9999.31052.30825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39237318-3772-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691667421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667421, "uuid": "5f7c006f-08c8-4259-9c87-63f0111d88ce", "comment": "Malware payload", "value": "bd104f80b563c177aa40db780fcbfeb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667421, "uuid": "60de980f-d142-4be5-abe3-c505a4f7b0b1", "comment": "Malware payload", "value": "5bd0928834a24c55446c1d9f2796c318216fec07d1222f74da8ce60bbe5b4468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667421, "uuid": "32f94dd0-202a-4f12-849d-bd8aa7b4bd35", "comment": "Malware payload", "value": "0c5d011b5dd9772c0e2b5b0fce2a8998eb8c4567", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667421, "uuid": "a15c544d-3d34-4df7-944b-397362b45089", "comment": "Malware payload", "value": "6eb51920af58f32f94f9258a42e2659863df09ad0cb7683c2bea1856d63b5c858f57d32d8486db638be18fdf8a575655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667421, "uuid": "8e20fdfe-2272-42fd-9b62-cc34e63c95c1", "value": "T118376C5573F51A33C65762764E8F4041B734A0573A28DB13798C83A83F4EF385AB6BA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667421, "uuid": "8d411efe-8800-456c-90a8-77d25b3a6ecd", "value": "9a06fbd4755138af333436729460c562", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667421, "uuid": "874f8e17-7495-41e2-b2a8-e7084bc04ea5", "value": "98304:ihCTOi8sQrZwwpxTbG9KhCTOi8sQrZwwpxTbG9orsBHTjPDhYAQTG8BhZe6v66I:tB9lB9orsBH3PNQzm6v6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691667421, "uuid": "c162f213-1fef-40f1-892e-d1044d04b9b2", "value": 24303281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691667421, "uuid": "705f3fcb-6f96-455d-86e6-54195bea7d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667421, "uuid": "0e7e9e57-47a4-478b-bbcb-e66ad356cf12", "value": "SecuriteInfo.com.Trojan-Spy.CupCut.27794.8833", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884fee59-378c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691678721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678721, "uuid": "2db6282b-329c-4033-9fd4-77fbb5818668", "comment": "Malware payload (RedLineStealer)", "value": "d6448d3082b315cf8dfa2dbbd9962b2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678721, "uuid": "cec10ffe-2ab5-4b82-8dca-15c2a687cac7", "comment": "Malware payload (RedLineStealer)", "value": "5d6b4e79354059546f003225ed6a08bc4636d66876b714f24440f5568e5e7f81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678721, "uuid": "65e8b86b-a20d-422d-86d3-af666c93bd27", "comment": "Malware payload (RedLineStealer)", "value": "49bfd5dec78118eef7fb377328ef49bfe18063ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678721, "uuid": "1aa2ea77-1631-454c-a350-9be24969d7e5", "comment": "Malware payload (RedLineStealer)", "value": "96cb70b1e5371aac8582fbbb9235d315385e39af88319da134f997a4ef4804455a094ad88996a4d0d678d9a5bcc61f50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678721, "uuid": "3c2caaab-6907-4e16-885f-3a4f26c41a48", "value": "T1EA749ED2AE917C20F525CE328E3EC2E6363DFD518E29775A2228FA2F05B11E1C563751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678721, "uuid": "9da9e9fd-0df3-4b9e-b0a7-ba753048f14b", "value": "8801a5787fb0afca6c87d6856306680b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678721, "uuid": "6289dfad-dfe6-473c-9e2f-0ae0de6068f1", "value": "6144:2nK3ahuyufDH2Fgn2inVnJkRXIu9xf2/iwtf1:O+Nyu7WFM2UJMw/iO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691678721, "uuid": "8bd5069f-9e62-441c-8930-85e1ca5bfa04", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691678721, "uuid": "a357ebb7-b97f-4f83-848c-4359e378d16b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678721, "uuid": "b405f22b-1ddd-433a-abd6-7d24bab1629f", "value": "d6448d3082b315cf8dfa2dbbd9962b2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6516bcd4-3779-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691670502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670502, "uuid": "401a4839-d720-4adc-a6bb-8124d24c808e", "comment": "Malware payload (AgentTesla)", "value": "d4a8db86bb04b13d77bd4441aaab3544", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670502, "uuid": "eb90fdae-d18b-496c-a0fa-b0ad8d0291ac", "comment": "Malware payload (AgentTesla)", "value": "5de5abcd788af61be47ca63162f4c489b25f9903aea54b93729fe92914f17f6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670502, "uuid": "d8ae348b-01a7-4d5d-8c94-2478b9cf189b", "comment": "Malware payload (AgentTesla)", "value": "f6f2b13eed1e949578936b5a14c2b54e5859f6bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670502, "uuid": "91ce9ac8-3392-49a6-a499-72243c2dd738", "comment": "Malware payload (AgentTesla)", "value": "7c68401acbb1761fae50d8dbfa84d8cada72e6820374a105530a03cab6ef21e8581f811b8d0fa9a6296f79d10ca75de3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670502, "uuid": "f676a2c6-c4b4-43d3-a6a4-0e0ffa6dad4e", "value": "T1C0051726E77B645AEF19A5E88E1F853238D6DCC0F1B5C588A7E72C0385C23214D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670502, "uuid": "4ae9f990-3677-4bce-a058-2760efea5a69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670502, "uuid": "5def51e5-413c-49fb-9955-670b6294eff4", "value": "24576:wB0Rs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOmUF/3EFcr14TcZWOx9eu:60Rs6CE3jLbO9Rs6CE3jLbOms30csuPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691670502, "uuid": "346770e1-ec1f-4dfc-9e06-ea975e4d30cb", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691670502, "uuid": "96da8680-f8fe-475a-9b3d-5d1e96ef34ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670502, "uuid": "b794a065-3358-4277-b556-05d52a54bad7", "value": "SecuriteInfo.com.Trojan.PackedNET.2263.3530.14524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fba2fb3-3739-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691643005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643005, "uuid": "484cc487-cb5e-4c62-8dfc-0b8b6a8574ba", "comment": "Malware payload (Mirai)", "value": "576ee16fd1440f2de2e5733319d21c54", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643005, "uuid": "301cedf4-f93a-40b0-b623-9a15d32cda0c", "comment": "Malware payload (Mirai)", "value": "5fb33fe3469d12a0ff4a4eaf19c78e00f82634012e3d72a600fb7516c47d1c72", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643005, "uuid": "688083e0-8a87-4a3c-ad68-f2dce720cb42", "comment": "Malware payload (Mirai)", "value": "6d78f4f1a54fff6b95e635826502bf3fbdf2e0d5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643005, "uuid": "4b7455ea-c42c-4133-afff-8cbde1281bf4", "comment": "Malware payload (Mirai)", "value": "55fce71a3f0b15b42cf34ec759f442133ac4dfeaa31cb72b5edf7fa7419f797afd3cb489809e4f40a28c48f17fb4af95", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643005, "uuid": "a033b704-a355-4338-8c49-eeecc0aa1a4f", "value": "T13DC2E16360B5CE13C8F3837A6A3C5AA722605434A35EED2D77795BC473424E0567ACCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643005, "uuid": "126c4ff3-81ab-4c5c-b20d-7f3385fc477c", "value": "384:Ms79WXUx5+bkbRaliVErjrL9VD9jPwrSaf5CwTvDyLTwfflrTHOBFR0j/y5ZCA+j:X5+Kcrb9VDJee2KTgdTHOBcK5ZCAy7Vr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691643005, "uuid": "f51494f4-f073-4612-9456-ed49240ae344", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691643005, "uuid": "469d5521-e606-46b6-be41-bca59b944ddd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643005, "uuid": "3cce8151-eb39-4f20-9c71-6e87d3194e8d", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4eb9d6e-3768-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691663307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663307, "uuid": "39cb56be-5949-4d28-ae6f-be5ac2a495b2", "comment": "Malware payload (Mirai)", "value": "1414e1e0ebd281c8c77613978f732217", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663307, "uuid": "c9d4e28d-90dc-4259-b785-687029d6d83a", "comment": "Malware payload (Mirai)", "value": "5fdc9d8c8942bebdd5190f40244d0a0ce937097bac0a036c47557d095cf84284", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663307, "uuid": "149d3b62-88e5-48a1-b93c-746499ed228b", "comment": "Malware payload (Mirai)", "value": "59b5df72c6f88ff5f7ae8d8100f0e48f9ff1ce1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663307, "uuid": "c0a807a0-6c39-48e7-b6a7-905f892d7a36", "comment": "Malware payload (Mirai)", "value": "183eca490c66526ca9eb6bbeedf65804e627812fb02d0225bc13cc52bb6056ab1f6b66195a0a4bc6b5b37f2d65d2729f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663307, "uuid": "c6b517f2-b479-46b6-80b5-a7d1bfcaf8fd", "value": "T11BC2E1056669AD0EC67157BD8DB4CCA23D5E7C22B07A69C9834BCC4BB0E9F1D9C21DB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663307, "uuid": "a155efc1-c851-479f-8a72-853058c9514c", "value": "768:+NJVvpaAZ8C5nuErGqMsCG9aMBa9q/rNm:GJVP5nuErjWMw9qzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691663307, "uuid": "06b54485-9fa2-4bf1-9d6b-1529cab594e4", "value": 26712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691663307, "uuid": "c96b33a2-714a-477b-a449-d496a6d37a29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663307, "uuid": "e4e7fd25-80ab-4526-8c2c-5108f5a35669", "value": "SecuriteInfo.com.Linux.Siggen.9999.26278.24454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3899d29-3735-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691641401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691641401, "uuid": "d73264b2-7f2e-4975-a4cd-62d98b070c49", "comment": "Malware payload", "value": "c48025840829c73327b0b4b265e4cc26", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691641401, "uuid": "99baa27e-4fb9-496f-96ea-52631e82d91b", "comment": "Malware payload", "value": "5ffcd2d2575c95a031a6a2e8de23fdf0681b6cacbbc3cb1a222f6ed981a9b96e", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691641401, "uuid": "9e4068f3-33c3-408b-91e7-b9abfdc546d6", "comment": "Malware payload", "value": "0721f97ffbd0bc161b708914947db09a30aba3c7", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691641401, "uuid": "332b20e0-9775-428d-8973-119c1e48f14d", "comment": "Malware payload", "value": "8bbf5d98e3082e2714b3c08349853de666877262f93c0254ef6416aa67a063cb5278a9634d7a48d3bd154d5ea3cf069d", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691641401, "uuid": "b543a5c7-f89e-4aca-8a06-4e7690c68613", "value": "T1E7C4235D98F3EE7F198273A495E213EF4E0D8D90208DB8D14DD5225822D1D9B42E5BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691641401, "uuid": "4fa33a7a-f0d0-4e2a-8d00-4c6ae79f82ee", "value": "12288:Ldlr9lse+JL9K9FfsrkZXEspq+qwqgcfXoYi4MVOE8McStN:7xi/pipZX6+qwxQXojB0E8M7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691641401, "uuid": "1e11698d-88df-422b-8ba6-16bb9b0ba28b", "value": 547536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691641401, "uuid": "67f567a7-4112-4c68-9141-bf81341816de", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691641401, "uuid": "a42264b5-8cd9-40cf-a670-b29c5f725979", "value": "IMG_P-Order No.# P0004028 & REG 1605887902.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911f76e1-3747-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691649101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649101, "uuid": "81419c4b-001d-4649-a67c-5e1aa5a15ded", "comment": "Malware payload", "value": "bc778621f6bafcea09140e15f9e80ab6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649101, "uuid": "a9b7610b-3a8d-4485-a6e5-46ef4f7828c0", "comment": "Malware payload", "value": "6000dcd3c846051e258a8f5e6bf083c6be7d0a1793dc80e8e420b1c58cbca6d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649101, "uuid": "b1ac3891-526f-4a81-ad62-019d32677838", "comment": "Malware payload", "value": "6e4f334261d03bc3b4ba1d9d1b4d9cf8c02ad892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649101, "uuid": "fe7e0ef8-cc6e-4bd5-9a8c-7d9f942ed37f", "comment": "Malware payload", "value": "081377ddda8b403f8c8692f13f89dfadc1262b96f72d21b7ea050abdc1a8ac8a906dd2745828a90d269eb9025f1b6dc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649101, "uuid": "50d3fa48-2899-4965-a138-76bce3b3219a", "value": "T162752217F6C789F3C24C97B6C69B811007B1D1D4B633C20A799F23D607137AA9A5AE4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649101, "uuid": "b8aa6f66-1c78-46f0-b34e-4f37aa665735", "value": "49152:6TUAJdngF5N8tvx++6EiNaI0y5vHsBgZlfyQ41:uUUdWCtp+vjNaWtogZlKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691649101, "uuid": "259888e6-ed7f-4b9f-ae65-dbfe60e8eca6", "value": 1661952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691649101, "uuid": "1e095a24-228a-40f4-8828-951f5ba1e380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649101, "uuid": "31c39fb5-d611-4412-894d-2412ad2aa954", "value": "ProformaXInvoice.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b24bae5-3750-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1691652983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691652983, "uuid": "66dbbc45-e981-4086-82fd-069b5ce48bff", "comment": "Malware payload (ModiLoader)", "value": "e6c13b83b52cedf2ae142be62e5311bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691652983, "uuid": "50cd6a21-42f1-4616-b2df-04f2716c5b75", "comment": "Malware payload (ModiLoader)", "value": "60b1c6f0aab37f39ff6fe7b9c7ae4e24d4991fbc5424976802adf5dc7c3d794c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691652983, "uuid": "f73e993b-1a29-484d-ae22-e8eec7be9906", "comment": "Malware payload (ModiLoader)", "value": "805df9d492b5bcfb3d87bd555a576815e3d9abd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691652983, "uuid": "c9c16dc8-8fcb-4055-b571-9d5d31e9f32c", "comment": "Malware payload (ModiLoader)", "value": "3cafd14aca2ed9b48b8c227c53724c2aaec441358e20d4f2b80bad1a2a77ca18ecd063d8860a36db55a5da7074fcb66a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691652983, "uuid": "3662a6c1-870e-4aa3-b060-d006324089e6", "value": "T12835CF32E5B35873D0772D398C0EA3691C297E635A38A5469BE83D49BF36241782C1F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691652983, "uuid": "7de2db94-74ba-4ee2-b078-adfabcdc1c78", "value": "c5c13b456c94b845d5957ed6247b2c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691652983, "uuid": "a880c403-936f-4b57-b41c-b27b56244adf", "value": "12288:3gMuXgeXRSTiOKyYiYDIOOIFiPbeYR7re5Svqsb7oWjuHDzGtunlKlmO+fvqx:38weROKBU0Qqhcvqm/kPXnl0mZ3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691652983, "uuid": "fff8bfc3-fdf8-440b-862d-4e51c9496d83", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691652983, "uuid": "a445d442-4eaf-4c27-8b91-68157c906874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691652983, "uuid": "8d336068-8161-4cc1-bb48-2f31da0160b1", "value": "Epquijpwxrgjol.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1c171c-377b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691671507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671507, "uuid": "ab2aa9e1-9636-4d0c-aba0-704a9961c381", "comment": "Malware payload (Loki)", "value": "f3e92f6f37b53297903b1cbb9bbb951f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671507, "uuid": "7123c6a8-64f4-49e9-acdf-56feb801c92b", "comment": "Malware payload (Loki)", "value": "61b518f92271a13e79c0b0cfe2087bbe5de50ed76335afac98985f52e582f3ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671507, "uuid": "e5e95930-b780-49e8-b168-afcb8ce0d111", "comment": "Malware payload (Loki)", "value": "fb8e2cd1c07d6adef31b8a6477097408d6042819", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671507, "uuid": "533c074d-a254-4033-9cf0-d26a851fd035", "comment": "Malware payload (Loki)", "value": "4e63820b727db25448e3c2df906777a483408deaf128326eb7ab4a729bb82a10e3e1628ba92ee3a6f05a06a17c0707ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671507, "uuid": "55922500-5444-401e-9cfa-4f96c5df4e4a", "value": "T18704122437B4C467E8E34B311D7212676EFCCE1B186C571B13506BBD3664382861E76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671507, "uuid": "743fdee1-b2f0-458b-ada7-2dda49c1598f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671507, "uuid": "2d5eebad-9b17-48f1-be23-85da0bc701ae", "value": "3072:3fY/TU9fE9PEtubbsvw+HjvPjG5/aBy2ZVvTQCoCMWWkYnmu/+wHuri41XHFgO3e:vYa6tsvwO3G5J2bvT5oCTvMtOW41XXId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691671507, "uuid": "4c981de1-feff-4372-bb7f-70c982743fb4", "value": 187875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691671507, "uuid": "c7db38b9-8084-4bcc-a05e-60c28fbd0211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671507, "uuid": "2dac465d-2822-4238-a4d7-7e93cfd560ab", "value": "Original 3 - (for Shipper) - 180-38985892.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1538982b-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691648463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648463, "uuid": "fa260c78-9ea3-4229-ba0b-3ffb2a66bc48", "comment": "Malware payload", "value": "fef7f1d1742a596336b04a856d7ba170", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648463, "uuid": "be9b17c7-9ad6-423b-9ab5-a7730089b4b9", "comment": "Malware payload", "value": "62c4b0f2f1d004ada278cfc7be3a1d3754ceebaef53754cf91d6840f80c89d62", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648463, "uuid": "edfb455d-bf65-43fc-9808-a350465f22c9", "comment": "Malware payload", "value": "9ae59101b23b7b0b1c5a5b9234e570820da1f07e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648463, "uuid": "fea425a5-f995-472d-8b4e-771ccfaa0fdd", "comment": "Malware payload", "value": "0a5cd87f471bea0f650ec53f4babc5227bb9d73c56328faac68d2c31fb1323478ba20a55fd32643f4191a75b6269d648", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648463, "uuid": "fa9742c5-48a7-42ec-9080-eea4c6c3428e", "value": "T1B0D4232F2B05CCA86E69EC3245016B9B1DCFBAA97608269D555EF6230B1F6F52330173", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648463, "uuid": "f055bb37-0e1e-48f6-b11f-32369d0d184a", "value": "12288:pTJV3B2MQ/UVovd4VkUv9WQJyzDjeDo9IcOzGDZOq7/GoY0N2FIZeX+v3:B3xJQGSda9WQcqD0f6MY0NyIZk+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648463, "uuid": "598d0556-e696-44ce-8a37-ef65ee1ee54a", "value": 608101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648463, "uuid": "ddafdd5d-9031-43e7-a73b-95b46cc541e2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648463, "uuid": "1e6dc76f-10ec-43fa-9a18-f98e0a8fc3ee", "value": "Order Inquiry.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776183ba-3747-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691649058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649058, "uuid": "f70c4f01-81d1-40e5-9460-4cddf59bcbb9", "comment": "Malware payload (AgentTesla)", "value": "da1d6c35bc4bca23a8ced510b2c53166", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649058, "uuid": "821e01dd-2416-4b4f-92b8-04fc591eeb7f", "comment": "Malware payload (AgentTesla)", "value": "637f0e0b41a072ea198cdcfda147f482119bf25d8bedf39b4ed3822a1c4a6b75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649058, "uuid": "2e9bf83f-3b9c-4e56-ad15-5f398ae59ad8", "comment": "Malware payload (AgentTesla)", "value": "5bdb67a29e148017d8f13f1d390b8c6a5982beb4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649058, "uuid": "0cc0800a-264b-4edc-8a41-30631a114d8a", "comment": "Malware payload (AgentTesla)", "value": "2927f129fa5e84dc7c0681361b0edb650bb8fdf80653b3b930def60ad91e1505af3ffb45b80a3e6c2fc7f8ae8a033f9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649058, "uuid": "419529d2-86cb-402b-a750-ce67218d89fc", "value": "T1CC150822E77B6549EF29A6E84A2F847179D6DCC0F1B1C588B7E72C0385C23114E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649058, "uuid": "54d3f45a-5d49-4f32-b3b7-3ad11269e71b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649058, "uuid": "4282c739-233d-43c8-a723-a3ea445a83cf", "value": "24576:ftYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOROgu2C+5XtqUlr6B/fOb:fiRs6CE3jLbO9Rs6CE3jLbOvu28UQIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691649058, "uuid": "0d23aaf6-f217-4140-a779-399a8c25fd3e", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691649058, "uuid": "11d7e368-50bc-4211-b665-47aa784f3158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649058, "uuid": "ec4d14bd-4181-46f1-bef3-bae57264ca3f", "value": "Inquiry for ACK2-0230pcs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea2fbde-3745-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691648399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648399, "uuid": "ae933c2d-214d-44de-885a-722736cf26f0", "comment": "Malware payload (AgentTesla)", "value": "4a44c7da664d212102b25d4d475e9721", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648399, "uuid": "90fa750f-bacf-48d3-842e-352f51b8e32f", "comment": "Malware payload (AgentTesla)", "value": "63cf3e5bea889ee1908809093af3a904ad23bf5aa4222619a21aaef268c2bc6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648399, "uuid": "31271c10-70b8-4236-b51e-d4f342d457ef", "comment": "Malware payload (AgentTesla)", "value": "ad573f950970e63f7d0918c8c760954f12db69fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648399, "uuid": "12fae304-8283-4d23-8cd9-137dfaeba028", "comment": "Malware payload (AgentTesla)", "value": "7bbbaf1d2ccb04c7152a4f3c038d7533fb83533d5236dadf04e65db7a816c6f7c298d5366f4c689d61cb59d3c69a327c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648399, "uuid": "a33e23f7-810a-49ed-8446-04ce95af0427", "value": "T1ACF412FDB2FB9D32C7295136D292610093347B8A5467E31F190833D8DA2EBD61325ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648399, "uuid": "4f5040d0-1d68-4042-bc15-942454735f53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648399, "uuid": "b31942b9-6842-4126-bb54-a9662cc8a843", "value": "12288:VD3WmGGTIYlV2UwVfj3ACmynIs5bZogF0BpirukCKWyrZRW7RAiFGkUqkqwe3RsU:fxIYlVNwt3EbSVoHLhVO+d7/svBjEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648399, "uuid": "d617e9a8-34c4-4a23-b26b-a7fe39ecd2ec", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648399, "uuid": "2919e34f-79f0-4e47-b2f3-33bb2606d55d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648399, "uuid": "093fa6f4-6881-4eb0-93ac-e16a0d421919", "value": "Solicitud de cotizacion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5485d377-37ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691691949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691949, "uuid": "89b238d4-9796-4a98-be1a-0d963da510fb", "comment": "Malware payload", "value": "9ea7ddf91a9450ca1fed63ffc2c7286a", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691949, "uuid": "cb88e648-bf3e-4f35-a2e1-9ec7d00673b9", "comment": "Malware payload", "value": "645c6802c509e35c9d0392337bd7f4ab54cf3fb564c5a61c88aad68c2e5f54f5", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691949, "uuid": "7ae041e3-4cf2-4c20-9b21-aa80aa5f98b7", "comment": "Malware payload", "value": "030093987ad758a538808e436b68ddd0fabe31c0", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691949, "uuid": "b1f6d11c-9c4e-406a-94a5-55061878e93f", "comment": "Malware payload", "value": "cae8c0276f8f78d2d778600b9331d3d93720c21a4a7065832facfc55bf1606b49ea04223a923e7ac20fc04ea1e60a583", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691949, "uuid": "1391294f-20db-4992-89a5-cd5ab2f320c4", "value": "T1EE45D93439797C2443DBDA1334F14A962CED164FD1703A3B1A9AD8239A356C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691949, "uuid": "830b3946-df69-419d-9c4d-1e1de31c004c", "value": "3072:Ng3rU8+5+C5aBnOppEKpQiUzx1JydoHRD4whh/vZi6J3:Ngm5+CUBUpxpvU11E6D4wr/4+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691691949, "uuid": "78e7ab78-f624-4c4b-bb72-beacbf2877dd", "value": 1261937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691691949, "uuid": "335f5ab6-822b-4822-803d-b34702e3b641", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691949, "uuid": "f2a7958e-9d33-4610-a3cb-6dd8711d795b", "value": "relaxation.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1a3e9f-3782-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Moobot)", "timestamp": 1691674461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674461, "uuid": "905c35c0-2b38-4635-b06a-c0285e9f0701", "comment": "Malware payload (Moobot)", "value": "d3e186a26905d8e34202d993b49465f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674461, "uuid": "2fe72fdb-e4b9-483d-bf14-1f833751e1e0", "comment": "Malware payload (Moobot)", "value": "68439c9d22706b7de875783242bdb099410b15108335a9d5b2ae7eba7d4b68a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674461, "uuid": "2393aefd-4eb5-40be-b538-92094cb3a4e0", "comment": "Malware payload (Moobot)", "value": "2198974e4bcdb07de7144da4befd09b92abb98ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674461, "uuid": "d2550ecc-1e46-45ec-9534-b2ca30ac66c0", "comment": "Malware payload (Moobot)", "value": "f4f90c4812b6cc2ee5e07a714a713575b6ad560b2ca469940cc2505f5839430fe1ad5c74d206f3c3fafa49e971288e83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674461, "uuid": "8df78494-376c-4d70-a6a4-acf7a964e65b", "value": "T1B943084DF950A729D2D121BFFA4D128E73270B6CF3DE72365E345A2123C6A7B0A39815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674461, "uuid": "20ff1638-516d-4369-901c-c76c256fb572", "value": "1536:TVnUSG67y2f4Z9aPXNz5Ini3fkol28JAk5SYs:m67yc0atfkol28JAkoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691674461, "uuid": "9229f68c-004c-4bbf-8120-ac0d0c292cd3", "value": 58796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691674461, "uuid": "3f659746-cff0-45b5-ade1-db0e424378d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674461, "uuid": "cfd2efbf-0608-43a4-a71d-0e85c213a7f6", "value": "SecuriteInfo.com.Linux.Siggen.9999.18814.3050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6677ac6a-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691685966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685966, "uuid": "c752cf52-8a74-4bb8-b9b4-2665fbe6652b", "comment": "Malware payload (AgentTesla)", "value": "fc0147b851d65ed791868e8e754fc226", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685966, "uuid": "900ffb96-87dc-4260-a807-36b0932a90f8", "comment": "Malware payload (AgentTesla)", "value": "68d7bd6dc7ce2ada6af865682185e9f2c33c897ec3191f0d6127d3654e69b4a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685966, "uuid": "adf9f6a7-dcc8-40ec-a377-7e0be6478ce3", "comment": "Malware payload (AgentTesla)", "value": "7189124dd077110e239007acefdf635938e61cdd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685966, "uuid": "d4e250c1-2fe4-4019-b779-f16f5212f674", "comment": "Malware payload (AgentTesla)", "value": "976e67f63e1b098afc1cef0d737486957f9a5f0ad432277d8cca21538ce35029e543079f76ae83ddf0d8f5957c59f0a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685966, "uuid": "693efe9c-f07b-464b-8ac6-8a051396bcc0", "value": "T10BE4234417A03567D5B853FE14E32332A378570A30F2FAA6A8CE74D5891DF8C9B21F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685966, "uuid": "00962505-48f5-420c-b4dc-d3584a023bfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685966, "uuid": "f5d8c37e-3ddf-4699-9852-ac4526b0f445", "value": "12288:tLL87+2iAps3Yz/XXYFt/hsS3k2Q3+xOnz7uqUNN7hI0BhL8:pg7+2iAaIz/XC/g3wsz79UNN7lhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685966, "uuid": "31591855-d239-413b-a3e7-9a57a17df8ab", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685966, "uuid": "fd2e710b-8ee5-4d40-bc92-75bdf99e9ef0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685966, "uuid": "d4bbb3ed-f801-484e-8b14-84e021aad4ca", "value": "DRAWING.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab72f046-3761-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691660312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691660312, "uuid": "e2e0c6fc-e41d-4a23-959c-68835a408cb3", "comment": "Malware payload", "value": "6cd03432f32888d83f791d8cdadb37d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691660312, "uuid": "51def822-eda6-4a09-8b18-911d7b8b99f4", "comment": "Malware payload", "value": "69187df6762f37b558442a86aacf761c845e596671dd317689f776ccc4eb3f0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691660312, "uuid": "a2262869-b3c5-44b9-90c3-06622b4a0c0b", "comment": "Malware payload", "value": "3ebe3e7c5cf9674ed1622c82221c12b138ed2dd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691660312, "uuid": "e78938d3-ba94-4e69-b179-4aeff7dd4177", "comment": "Malware payload", "value": "19ab3b6525f10575b3a0d6c580b0447eeaf5245645e5e22f9ea0cfb0600f578d5d6bfac8d31b443c48ef15ebfa2615f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691660312, "uuid": "d7e006de-cc73-4950-a11c-1be0aa36f039", "value": "T107563399F680E032C892053193BA8BB7DE7DE925176954F3B3141F794E642C4BABC31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691660312, "uuid": "fb3b9dcd-67cd-4a85-be24-5097773e74d9", "value": "7be91589434ba32040231930833fe2de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691660312, "uuid": "848d5723-9532-440c-a360-f04fcbf0a2ff", "value": "196608:dPzCeEnBjxQn4ir1XVZdLERR+wxpB1sTS:5GeERKnThVgR+M1s2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691660312, "uuid": "17d23ecc-63ab-4ddc-a342-83f0082870c1", "value": 6424070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691660312, "uuid": "d8679fdd-0222-4e04-af6b-6ea9334bf428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691660312, "uuid": "19346e8d-50e6-4f26-bd45-28d7b7e98ac3", "value": "SecuriteInfo.com.Trojan.Siggen7.5589.29526.3246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a229ac5-3779-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691670483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670483, "uuid": "954beb87-faf2-42a1-be23-320907635894", "comment": "Malware payload (GuLoader)", "value": "362b64fbaa07251d5ed636e30a7e65d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670483, "uuid": "073fc0f7-d3c6-4d1d-abce-29e7534f491c", "comment": "Malware payload (GuLoader)", "value": "69500deae191ebb500e77084323ab933c68e8bee30bb766b165e53cc92e1e8d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670483, "uuid": "2ea435f6-630f-4463-9cee-e7824a62e51a", "comment": "Malware payload (GuLoader)", "value": "e41d335ffa10708ce2f1a2aeb2c39700a577253f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670483, "uuid": "fd293c63-76ff-4a81-9a4b-1d85feb64586", "comment": "Malware payload (GuLoader)", "value": "df4e943dc1645470c2408d407319f7beb9cb7b47bbd216bc5ea670aab69b6a8210788de341d754d4e2c99d18babf16ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670483, "uuid": "4c30ba1a-e227-415d-9582-588972aca006", "value": "T1CD44126026E0D45BF5E64FB16E71ABA7DB77FE06082002A33B147E3C3A30BD1456D91A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670483, "uuid": "fcf19723-043b-4da3-9492-b6fa48d2cc91", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670483, "uuid": "123c9297-4630-4a82-98fd-fb74d9a885f1", "value": "6144:RZ/qRr2UzqxHm36prnbpkZtypifNfNCtAMEosQRae+1E+2dsps59Z/:RBMWI36x9SyQNCtAMo1e02Sm9Z/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691670483, "uuid": "0ecf8678-f54c-4c32-9298-33d6b04f8432", "value": 267392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691670483, "uuid": "6a951db0-384d-44d7-8fbe-a5ce5cae9764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670483, "uuid": "b49e3d5f-4219-4cbe-b5af-ba0f7673fdff", "value": "Liveryman.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b1daed-3782-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691674467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674467, "uuid": "eb809d8c-e4cd-4bc7-b7af-8015e64091c1", "comment": "Malware payload (Mirai)", "value": "d4ef0d2978cf8b74ae1bf347634b9ee6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674467, "uuid": "147f7885-f653-4b50-be5c-261a3757a5b7", "comment": "Malware payload (Mirai)", "value": "695ee34bb87a6e55410bd4e40ed12fefb029f6a2574a3e73948fbd613f76769c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674467, "uuid": "c6bfaef6-b3b8-4a3b-ab8e-78d9fe6dac94", "comment": "Malware payload (Mirai)", "value": "ab22cd203722335b957a364c2d369bb8116a842d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674467, "uuid": "d637081f-8b48-48cc-9548-3ff9cff8fe81", "comment": "Malware payload (Mirai)", "value": "c2726cad6b7084dbd53e0ebda739e3121d137ecd36bd18dcc6ea335abc5237746f8467f3983aede23760a922c6f759cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674467, "uuid": "4225e75a-7434-4477-958e-5507283f9ff2", "value": "T1E933E13461223DD48FA06BB5F8350E1F79305BB807A5BABB1445873D188BA4DB2E54EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674467, "uuid": "1bec69b7-8b94-47b3-92f4-a616c5e269a5", "value": "768:0x2FxGv/8mDLNDIqbTpsbEPNkf79q3UELkrvJZH/Nas5zXkaA5DBU5:0K6kmfNzbUEPNkiLMJZks5zXkxrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691674467, "uuid": "ff4447d5-2c37-4c4b-bb3a-36bd32ddfd4e", "value": 50848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691674467, "uuid": "5ae3c19d-f6fb-48f4-a7cf-0ddfde3a31f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674467, "uuid": "9cfcfdf9-a513-4542-8ba7-5e6fc4a32e89", "value": "SecuriteInfo.com.Linux.Siggen.9999.7610.30130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4d4129-373e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691645279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691645279, "uuid": "ea7d633a-b4b6-467c-9dd4-6c07e57a4f9f", "comment": "Malware payload (AgentTesla)", "value": "ce221731ecdfe19bc189245941e3f25c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691645279, "uuid": "0eaeaa35-c1cb-4d4e-833c-fcb96882e62e", "comment": "Malware payload (AgentTesla)", "value": "6a6fae0edf96bedeedb582c143934610d1c0b23f45191095b1731cf85e23b17d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691645279, "uuid": "a78f5dc2-2cef-4c21-92b5-4eb555de98a6", "comment": "Malware payload (AgentTesla)", "value": "698361c158bdd46042289fb05cadb8ce65f9dc2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691645279, "uuid": "baf72a7a-dc2f-4db0-8c71-853f02cdf86e", "comment": "Malware payload (AgentTesla)", "value": "09ba4a5b52c44fed1ffce33964485d3586b3693982c09a771a47b33c072eceb9b48a1d258ffe10dc6cd668066b749e38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691645279, "uuid": "cf5debfa-cefe-435f-9e01-d1760123ff39", "value": "T108E4239563F84B30CD7EC47FD90685245722B10FD9FFE29F1A8812366632FA05781ADA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691645279, "uuid": "f563e509-39b5-4c52-97dd-e341bd805f6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691645279, "uuid": "400f7d3b-e727-4071-bbb2-d3678eb58483", "value": "12288:eGTIYlV2yMgiNCZuuowLlr8xIko635aGToOqeBf+u:5IYlVJiWuuos8iP635aabq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691645279, "uuid": "786ff4ea-4f2b-4d59-91ac-a2117c1ca9a6", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691645279, "uuid": "8b169409-4aac-4ca5-b3c3-e2dadab45949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691645279, "uuid": "d6d1b382-ff60-43f2-8c16-e1bbf8d203f3", "value": "SecuriteInfo.com.Win32.PWSX-gen.15773.3700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81fa483-371c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691630805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691630805, "uuid": "f595ea09-8aa7-4713-b22a-c3dce1bbc1f6", "comment": "Malware payload (DCRat)", "value": "02d301c9213dafe538113282f2610deb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691630805, "uuid": "6313f968-ddfb-48d5-a7f4-4190e16ac5b6", "comment": "Malware payload (DCRat)", "value": "6ae324c10f303f602db6922fbbeb687a5498e491496245b815eae038f3470d97", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691630805, "uuid": "3ec22514-a544-4ad4-a441-0435734860a0", "comment": "Malware payload (DCRat)", "value": "bb011d797af6100c73fda5ff1dd961c2ac496491", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691630805, "uuid": "c09a2067-6342-4611-95ff-2681e0ad69ba", "comment": "Malware payload (DCRat)", "value": "41929f4a16604c2646c8faf9e0ecdc5e534d91ff87f529795d0cf170cdc3e12d7653a334320d25c7838f1a39cde936ac", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691630805, "uuid": "7679e803-3ab3-4b93-b5e5-45476a70b8d1", "value": "T135455A027E44CA11F0491633D2EF458847B0A9516AE6E32B7DFA377D66523A37C0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691630805, "uuid": "66d61aa0-67bb-48ef-810c-d0c4821be598", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691630805, "uuid": "6103aa43-1d2a-4803-94fc-dc830b1f6309", "value": "24576:LDREskFYTLBCeqvafknc2c2lOvqjtj1Y3C24KJ:XGskF+yvaEHZj1YJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691630805, "uuid": "5da81ab5-e4d2-4d68-8ed5-e6e8e1130cd9", "value": 1242624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691630805, "uuid": "c7fd8fca-391d-4d96-98ce-0d552c65103a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691630805, "uuid": "151a1047-c45c-4fa2-8d46-510fbd67a862", "value": "02d301c9213dafe538113282f2610deb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1afcc4-3725-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1691634674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634674, "uuid": "99387897-ae7a-4863-91c5-bd8648486a16", "comment": "Malware payload (Rhadamanthys)", "value": "fbc04c52eb18b7db7206ef8cd0bbc1ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634674, "uuid": "e97f4f97-e9c9-4c19-b14e-0dece1f71494", "comment": "Malware payload (Rhadamanthys)", "value": "6b0494bef1b645ecf957f9f2b81c3aa985a9ebaaf29a2ecfb4d8aea023fcac13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634674, "uuid": "09c947f0-9b5b-4a8a-a04f-5a5af8a1103c", "comment": "Malware payload (Rhadamanthys)", "value": "b5453363acac6da97de5a8997a7483deb9f1beb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634674, "uuid": "d0114cf8-f72c-4324-b9fd-62efaaa8c096", "comment": "Malware payload (Rhadamanthys)", "value": "62c4e181a6dd29fd30f654dfd5948753840160521024e6c9cb3e382356a5bafd8259ca94ccb0781ae0d48f88c798a581", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634674, "uuid": "57de432d-e6ab-45b4-b057-0a872b7bcbf5", "value": "T18D259D217980C265CBF624FAB2EFB461126DB1B4373C19F362D846DAC5248C1953EFDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634674, "uuid": "4aea03ac-18a5-4b2b-a473-9e97eddd0fd4", "value": "283efa8b8b510b11551f297f9dcd33d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634674, "uuid": "f976c733-fa7b-4a31-815b-d2a0be1b5d41", "value": "12288:T0QZ/qYtu5LNSC5/lfiIDnqNlSuFZrtzm+Rbak+lAitGbNf4R0j2OJkZC5wqaMEa:wQzwRfiSniRLa5ahJQRIzJCywqaXdyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691634674, "uuid": "8d1056a7-eb21-4aa1-b508-8e3a7e4733ed", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691634674, "uuid": "92a25076-c32d-4422-9b8b-c5137e569f8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634674, "uuid": "0859dcb2-69ff-4f59-adf4-8d2fbf39a841", "value": "fbc04c52eb18b7db7206ef8cd0bbc1ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ade798-37c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691702658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702658, "uuid": "eb9db238-5e1b-4aa7-aa17-41ba0e0108f5", "comment": "Malware payload", "value": "7a84dcd43d88de5bad9827d95ca01d16", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702658, "uuid": "cfd95aa1-9509-4c23-a5b7-c5c743a78295", "comment": "Malware payload", "value": "6cb5fc4674e86f3eb4ed2fd2e8638c613473732896501920d71a455d535a8b48", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702658, "uuid": "3aa315ff-aebe-401f-97d8-e4ed0438e4eb", "comment": "Malware payload", "value": "da56c99278c7c3c107d1a463207e1abb041f1369", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702658, "uuid": "082eb7f7-bdd1-4460-af19-b7bd2b6f981f", "comment": "Malware payload", "value": "128f73ba7186197f5ac92deb3ace4dbf17e2b2c549fca9cfbca79d3a8ca727398969f4ce36b52a2287711e80c2850b2b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702658, "uuid": "aaeea894-c20e-46dc-aa78-9f0e3a6e6805", "value": "T13E24238574B61C376BF43A10EBBBFE105187733A88C6945739248368E61EE20E51E67D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702658, "uuid": "90475bfc-2db9-43f8-b7cb-08dbb4bd85c6", "value": "6144:jvFC394A0OJjuvXU+3hwcM3I+HzCbGU3QfU7a:r47ljuvZhwcM3dNc7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691702658, "uuid": "e2c45600-7643-4470-a037-26e76ea1e204", "value": 227458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691702658, "uuid": "6705a462-0daf-44a8-8d70-faea2be91160", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702658, "uuid": "4388e1fc-cba9-4508-802f-bcab3f19289f", "value": "Revised Invoice No_8562023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57bfe574-371f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1691631825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691631825, "uuid": "025efda7-3edb-433a-8429-2f3251da4a8a", "comment": "Malware payload (LummaStealer)", "value": "55cf389c5f0d6cd71d2f8e4052849e05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691631825, "uuid": "d24577d7-0d5c-4856-b98d-395e7771fbd4", "comment": "Malware payload (LummaStealer)", "value": "6cbc2518baeccb2e4f4377a999d99900dc173e6ecc64f630247e0ddc4258693f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691631825, "uuid": "1c64ceb3-bd56-4f14-8234-2b72e0cd5cad", "comment": "Malware payload (LummaStealer)", "value": "0ca2412ef3bf5253eef665e70991bc95530eb280", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691631825, "uuid": "e11b3489-3275-45c4-8d16-13c6873026ce", "comment": "Malware payload (LummaStealer)", "value": "dcbfdbfbdbe6f55e3962cf73718da64d542754d4e8de72bfa3514fc84a26fe94def2efd72bf251391ead4ef4baaf209e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691631825, "uuid": "aa09b952-3d2b-4a69-bd44-319d912d9ddc", "value": "T156940125B696C172C6CB1172463CEBA16BBFB8386530C58B3754076E5E307D29B7B30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691631825, "uuid": "c89adeb0-5521-485b-887e-2867576f04db", "value": "a595d661f58820d2ee9ed8c0dc92dfd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691631825, "uuid": "aa5825bb-5d8d-4b6c-be14-3ff98864fc14", "value": "6144:BhKGR+LgEWLCpo7UQcCZoEt0/39bFa32UT+9vS4ADWMn8gMd8Vn21LXroi5+UF:BhcbWLCcn/tgadr4ADWMn8DylyLXrxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691631825, "uuid": "371dc129-eaca-46b2-9d05-077dd50d9695", "value": 410624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691631825, "uuid": "dcd1c7b0-f05b-4278-8f87-521751e81209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691631825, "uuid": "68244da3-208f-47bc-891b-0ea31bd62560", "value": "55cf389c5f0d6cd71d2f8e4052849e05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b89ae8d-37c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691701517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691701517, "uuid": "0d4588b5-432c-4c8f-be97-0789e0a69586", "comment": "Malware payload (njrat)", "value": "0c85d19eabc20089e051e6864e5a3a63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691701517, "uuid": "b0204ba3-5047-4a2c-addb-425a0b6aa3e8", "comment": "Malware payload (njrat)", "value": "6e899ff7ef160d96787f505b7a9e17b789695bf3206a130c462b3820898257d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691701517, "uuid": "cab8261f-2ee5-4a37-ad5f-0c4db942b895", "comment": "Malware payload (njrat)", "value": "9d119e25ade98d3d03f659877ffc34eee360e8d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691701517, "uuid": "935d7979-76cd-44ec-a17a-9e46f863c42d", "comment": "Malware payload (njrat)", "value": "f7cfb1803046c8a0a9aa4ca7aa743668ec120e2aaed5e1490436f4030b5a131e50e68cfa57025424b5d446669a5f7273", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691701517, "uuid": "ae19c51b-3255-49a4-96ef-e89934ad9008", "value": "T178032A4D7FE18168D5FD057B05B2D41207BAE04B6E23D90E8EF664AA37636C18B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691701517, "uuid": "e7e67f13-1b7a-4d09-aaca-b3a9c2fa1fdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691701517, "uuid": "03f00346-c3a7-47d3-b063-fccad1be347b", "value": "384:Y0SvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzX2:bS7TZ38fvCv3E1c1rM+rMRa8NuFY91t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691701517, "uuid": "1d69fb1c-f9a3-4a84-802b-6eabbddfc31b", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691701517, "uuid": "970b5ed3-a803-4093-8cec-4335039469f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691701517, "uuid": "6054710a-97ef-4879-b4a3-15571ce3d2c1", "value": "0c85d19eabc20089e051e6864e5a3a63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d173165d-3747-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691649209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649209, "uuid": "b03a1093-74a2-4704-a141-7d17d60b2bfa", "comment": "Malware payload (Loki)", "value": "9cf5465ddf927f146b94ba5df10ea8cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649209, "uuid": "04cce77c-431b-46c2-8a54-48b4f049f3ae", "comment": "Malware payload (Loki)", "value": "6ed7143936ded11799657f88d0f54b6e39093b199c4da876230bb53ea92b1fd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649209, "uuid": "7a34968c-bde4-4f3b-a85f-479b6aeaae67", "comment": "Malware payload (Loki)", "value": "85cb544441a6de5a69f9e032bffdc3c695f1763f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649209, "uuid": "4a4e75d5-6f44-42f1-af94-ef89bab524f2", "comment": "Malware payload (Loki)", "value": "27b378d70a0540c141894c0d30754006175c6e68fcd1753b47e5bfa26be4568106ede6df2307d9f40fc81d2dc164cf03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649209, "uuid": "76e5433d-7bcc-47cd-b376-49a2fd018e3a", "value": "T137D47D7406AAC50BE41B1A34CCF2E3B57FAD8EA0A1D6C7474FE4BDFBB44A05666810D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649209, "uuid": "58937ae7-1766-444c-8db4-c7acb4af8006", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649209, "uuid": "095c3ff7-3e64-41ba-999b-b770757e1bd0", "value": "6144:5XtT+iT+sctDsCnseYGbyoooP/xljzPrNAu3oQEDKrO5I8EeD/rYQw07zSNkODzn:NtBHctUeYGnvNA/7DKXrqMQXEWpNkbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691649209, "uuid": "b8dc9eb8-c0d2-4970-8935-773ee9d8352a", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691649209, "uuid": "5be21ca1-4318-450d-94ef-b77f8db35981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649209, "uuid": "9bcef0e0-4b35-4378-be85-7053003e81b9", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347de361-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691685882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685882, "uuid": "47bcd91b-e504-476c-a477-6e2bd8025b54", "comment": "Malware payload (Formbook)", "value": "1069db64b919fb975462630465a8152e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685882, "uuid": "dc4eb969-85b3-4fdf-b535-31af248708cc", "comment": "Malware payload (Formbook)", "value": "71f17fcf7ab7d74c32f6a1ed20f4315805847ebc6402b808ffe3fd42d0950cb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685882, "uuid": "ec1355dc-3066-4367-b1a9-6ea5d3cd416c", "comment": "Malware payload (Formbook)", "value": "b6fbd94a169583020b5a87d5e8e33339aed2927f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685882, "uuid": "74e871cc-5c6c-4c5b-829e-03410834ee4a", "comment": "Malware payload (Formbook)", "value": "6c526bb75f75907437479d1d82b40f510336d061b5656e81435b5a192b9f4029c486be2cf50c904dfdcc1c39c2e0d9e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685882, "uuid": "e4702060-4653-4299-8f2e-78a5a64a28ce", "value": "T169D42380B3E88A1CDEBAA73DF47019045470A50E9476E60F541827662DBFF74AB027FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685882, "uuid": "53eaf1b8-251a-48fa-a501-1bb9429dc372", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685882, "uuid": "e68e9ccc-c957-4936-87c9-26251a37ff73", "value": "12288:cGTIYlV2FDqeE3j0NxQfqBbRWmjcCg+4s5kwmJPIf9k3jNB+xyljxrPMA6NetF:7IYlVsGp3jDyBFjjcC8s+FR7xBMMj5uN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685882, "uuid": "2ceb79d7-e4b6-4100-9eea-e71d4eac29c9", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685882, "uuid": "47dafc81-c6c6-4593-90f8-c88d9f2cd7a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685882, "uuid": "24bca6d7-367f-4065-832a-c4abfad8c670", "value": "Halkbank.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bbfbd3f-3718-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691628691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691628691, "uuid": "36ff2213-4c74-4685-b97a-e9bd95effac8", "comment": "Malware payload (Amadey)", "value": "182d579bc6764187320d989b742b05e0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691628691, "uuid": "0abf06be-0752-4825-ba1d-e6c3ee00efec", "comment": "Malware payload (Amadey)", "value": "72563d7db441d2c90e5ff1eea8116fcaf5c3a0867e6229918b4004b7f8a4ab1a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691628691, "uuid": "2a312219-e87d-4846-8f4d-c39c674a1064", "comment": "Malware payload (Amadey)", "value": "657310cfdc0cec6ff9180dece41c4b9e4b72aa05", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691628691, "uuid": "85114076-377d-4df5-ab40-6a25e27fa6a3", "comment": "Malware payload (Amadey)", "value": "562fe87d27bbfb47fe06492cce4269e007c2164b6760a53cb738600e3e61bb68db10a55c2d2415a77d1ef375f9e0ce26", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691628691, "uuid": "28ca3b27-d9fe-42ed-9178-4ac639378b72", "value": "T1D313F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691628691, "uuid": "75bce278-26d6-4919-99e3-270158eb9a7a", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691628691, "uuid": "4fc6780c-6f37-43c9-8958-ae7cd9430faa", "value": 42358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691628691, "uuid": "10ced908-076d-4300-bae8-9bdb010516e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691628691, "uuid": "072d1174-2981-40f1-aba3-8c10e70abea5", "value": "182d579bc6764187320d989b742b05e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad31073-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691685866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685866, "uuid": "b78a154d-5120-4ceb-acad-a41a2139ff9b", "comment": "Malware payload (GuLoader)", "value": "14c9f18a7d6ca7c4eec94d1bcf85f4bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685866, "uuid": "4f1feda2-2442-4327-b1b3-8fa662caa712", "comment": "Malware payload (GuLoader)", "value": "72b080a4d10c186a4375a46f3d3e3586b52e60560ed2fa8527c4af986ae7a730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685866, "uuid": "b019d584-d296-4dcc-a3ce-b6b486b530bd", "comment": "Malware payload (GuLoader)", "value": "ef7cbe35928f7385a69f7e9ae02ffd6ff72f9df4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685866, "uuid": "d1ff75e2-d7de-44d7-b0b9-5679727f67ea", "comment": "Malware payload (GuLoader)", "value": "ae2f9ba1045259480178973311636c726722aae4ac3a01d548cc62d613ae9029e0511aef3c78bd360289fd1601c74b7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685866, "uuid": "27bf7116-495e-47af-a15b-64da789ed186", "value": "T1F69412912EF2C52AE58A1270EC2AE7FDE37A4D68D031464B57907FE27D38B865D0F109", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685866, "uuid": "2980a26a-df11-477b-948c-f84055561782", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685866, "uuid": "6651407f-027e-4788-9959-bce745a9a4e2", "value": "12288:OTuK9McX8Apy9mtj5ohSLyrdRjsnPQ4INXtL6:OTu6X8As+5JyZ4uU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685866, "uuid": "15f4d3fa-5471-47c5-969a-0daf81c9719b", "value": 446736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685866, "uuid": "fa631976-c47b-4e47-83ad-9e150666ddba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685866, "uuid": "04389695-901d-4ed1-9738-8364f448e9fd", "value": "ORDEM EXPERIMENTAL N\u00ba 001-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ae27aa-37bd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691699606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691699606, "uuid": "9b7adbb5-dad8-49b3-8027-8e14fcaf5797", "comment": "Malware payload", "value": "d32736774d1228629076e139e2e8f436", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691699606, "uuid": "553e9053-44ab-41d8-9d36-6da766ba51ae", "comment": "Malware payload", "value": "73159f39eb305727b645fd77392deb7ad72687830cd20cc8f94db55bce8a85a6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691699606, "uuid": "3370b0d3-83c2-4167-a594-8c2b6da8195b", "comment": "Malware payload", "value": "d297bcf90addc447fb182b5df08b052a8bf109bc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691699606, "uuid": "cf1bfcc3-b219-4474-bc25-30e8466d929f", "comment": "Malware payload", "value": "d540dd94af5a1a5348c76c0e9397c6e8bf525ef8d45c06879875300302e591871804ca83d1b10037bc8f10fbc3de88fc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691699606, "uuid": "75e78063-7ab5-4f9e-956d-b1fbaedd51e5", "value": "T17A148D11B680E232E9F6153963FA57B25D39BA303724A0F777D40999CF702E1AA39347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691699606, "uuid": "255da158-e7f8-4edb-9a3d-b5db5735edf3", "value": "f2446e70194057c6d86e5807958fb117", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691699606, "uuid": "3c815c94-c8c3-4b14-9380-4350f4d80f2b", "value": "3072:Jquj3THroBGHnTKslI0rjxHTgLcbE/6z6e1eXW/T9CJg29LV4q9/:B3THkBGHTKLMtHTd4/DbXIT9X2rP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691699606, "uuid": "760651bf-d6b1-463d-9061-4b59078e83d5", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691699606, "uuid": "536c12e0-7774-45a9-9ff3-4416d3206b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691699606, "uuid": "8389c595-1696-4819-a6c3-77a3c744afb1", "value": "2023-08-09_d32736774d1228629076e139e2e8f436_torrentlocker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7b48f1-3762-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691660557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691660557, "uuid": "70ec71be-76e3-468b-91a3-bd6e75b23258", "comment": "Malware payload (GuLoader)", "value": "22a53781e8ed2786f7151db1d50cf9c1", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691660557, "uuid": "4f7a2df0-b12c-4b4a-87ac-02fb3c15ca56", "comment": "Malware payload (GuLoader)", "value": "74d115f0441627b9372d729dcdbc85bf224aceb165d655109f3b224eaab5668f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691660557, "uuid": "a8a11beb-c0e6-4553-82b0-f919f2c000b9", "comment": "Malware payload (GuLoader)", "value": "e1f7bfa1c0809a7c9776a9762f4d0ba058c1e595", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691660557, "uuid": "10a33471-8965-49a2-b4a0-11783a3ce5e1", "comment": "Malware payload (GuLoader)", "value": "ef11a579823ea24f809ce7c7b6ebcc0a98bb2e900d59e52d475e53d074f5689972841b4ca46f5ff28abe8c3cdc2b690b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691660557, "uuid": "735248e1-2520-4a0e-ab41-636bf0e69c87", "value": "T1DC73E069C74F01A9CF66623B9B671A4841FCBB7EF24411A1306C537533EEC2C66262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691660557, "uuid": "842ebb97-98fe-4fb8-b838-ea074128067e", "value": "768:X+wAbZSibMX9gRWjNYuDEtibCp56R8errwrYTeLd:X+wAlREAtyCp56KeXwr6eLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691660557, "uuid": "5e9090ee-1953-422b-9d17-f86c6d62eb5f", "value": 79774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691660557, "uuid": "bbbf2086-6cd7-4a7c-9bea-a533e1045393", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691660557, "uuid": "dec7a7e5-6f1e-48d3-ab8a-75ba43cb0e0c", "value": "22a53781e8ed2786f7151db1d50cf9c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8c1a94-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691648799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648799, "uuid": "d9f44d75-1e90-45c0-82b5-f400320dda30", "comment": "Malware payload", "value": "514be18bb5737aab8ee03dd5cd5ec4ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648799, "uuid": "fe1f8586-9be2-4649-aa11-89bf1cd7d547", "comment": "Malware payload", "value": "75f1950637b7545ea1adc5d582746ce5f6f7874d86b81d189dea8e58f52cc1bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648799, "uuid": "b42e499d-d60b-447d-8355-1e2c048fef34", "comment": "Malware payload", "value": "8f39e230a63a903df33fb2ecda0178113bf77caa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648799, "uuid": "a0939efa-26f3-4cdd-8d6a-06cd80cf7e19", "comment": "Malware payload", "value": "ad09f1521091fdced31b2d93bd46efa8f483b7c42c14b6d5159f09a01f2c4d95a16057fde1659241f282ca7634557d3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648799, "uuid": "4f08e5d8-8fc4-4c62-badd-30c5f1c95ddb", "value": "T17515E1F273C66884C0FE723A329159E873F56DAE0942961F2AF973B93F362007B56541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648799, "uuid": "c700355f-c52b-4ff8-9b03-1c6e972a00b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648799, "uuid": "709796b4-fdd5-412d-ac60-ce79fd692364", "value": "12288:BMlnlWn7QdjLuDx9887820fPtBlragPK/ogj7mH:AZaQK/ogj7mH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648799, "uuid": "d13e077a-fd37-4983-9017-43959562ee71", "value": 878685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648799, "uuid": "45494b27-0ae5-4bac-9c64-0ed622c0add5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648799, "uuid": "c1cfe10d-9810-44f9-bd4c-728b935e6e9c", "value": "514be18bb5737aab8ee03dd5cd5ec4ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94b6368-3744-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691647987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691647987, "uuid": "fe1a49e4-0a73-4fda-97b5-44e2a8e229d6", "comment": "Malware payload (RedLineStealer)", "value": "bebf03dcf33ea9d8d19a9543eda1985b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691647987, "uuid": "da9fdc12-99eb-41f5-8fd3-ceb8a17b3d89", "comment": "Malware payload (RedLineStealer)", "value": "7609fc9e50485e20d2dae97e84d95cfe69ae7fbaf107b2e6f96994ef116c5a71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691647987, "uuid": "e21e30f5-35f5-4f0a-9ce8-3e5e2054ce44", "comment": "Malware payload (RedLineStealer)", "value": "c7748615f9396629155099192b189dc1077accf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691647987, "uuid": "5df894d3-7739-4a87-b2be-351223e10906", "comment": "Malware payload (RedLineStealer)", "value": "da0a81a863df0af1f68e0d171f3c5e882d2ae1393231fee8fe23f73cbc694bfe8311f8105b4b5ed07ad0eaa24465b8f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691647987, "uuid": "a404e352-6146-454b-b2ed-ccba3d422135", "value": "T127C51C1176F95B59F6F30FB86ABAA612087AFC69CF11C2DF1251508E0C61BD09970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691647987, "uuid": "d506313f-dc09-4a82-aae5-8446d9b7dea4", "value": "e26c79bebc7d6792f0dcc8ea2f0d3e22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691647987, "uuid": "62689821-6167-46ed-b8b0-ef51607a09cd", "value": "24576:NmDQ7CDWwY8rHFdoG5wzUc6a9DhvhJDYC:NQWwY8rHMGRc6a3vMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691647987, "uuid": "34780fb8-a6ef-4e22-b303-f77277ff8de9", "value": 2621440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691647987, "uuid": "cf1b5285-2930-47d1-a221-a2ba1bc82ffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691647987, "uuid": "d64597d0-e7c9-4a0b-a017-dd806fa64023", "value": "bebf03dcf33ea9d8d19a9543eda1985b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3203384-3782-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691674471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674471, "uuid": "921cf766-c6bb-4e63-8964-a09da8017ff2", "comment": "Malware payload (Mirai)", "value": "9e6dac2c647f1491c5d472564fc437fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674471, "uuid": "68b65624-ce0b-40bc-a32f-3f99a9b6da2c", "comment": "Malware payload (Mirai)", "value": "76a75dfab207a8356b959f765e94452e4bc28ae00364c12f2186bb3805506195", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674471, "uuid": "c349ac9f-f400-41d1-9145-6923da878259", "comment": "Malware payload (Mirai)", "value": "733b47140b90162610354afc2ad768d739630d3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674471, "uuid": "3c3720fa-d137-46fd-9630-c8a680b641cf", "comment": "Malware payload (Mirai)", "value": "8d2b5a9d4132634f01798d762edfc16c31a3748903feeaedbbc46260bbfe111dfa10c77564abdd9e86541a73a69bc2c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674471, "uuid": "235fc5cf-ba81-4fbc-90dc-5e3c3046c559", "value": "T18FC2D1052569AD0DC57567FD4EB488A23D1A7C26B07AB8C9934BC84BA0E9F1C9C21DE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674471, "uuid": "9975a874-1178-4f8f-8946-f8aba6b61453", "value": "768:UNJVvpaAZ8C5nuErGqMsCG9aMBa9gXx5nIrN1:QJVP5nuErjWMw9gXx5nAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691674471, "uuid": "406b1d97-aa91-41a9-ad42-241e32c0dbd4", "value": 26712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691674471, "uuid": "74eca193-9676-4630-9458-328d90750609", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674471, "uuid": "91174f3a-62de-4a40-812f-38405252e851", "value": "SecuriteInfo.com.Linux.Siggen.9999.7152.4967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d64020-3745-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691648308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648308, "uuid": "90077b53-98e9-4b5e-935c-aa5910160098", "comment": "Malware payload (Formbook)", "value": "dea62c6c8b25914d04fdc25d95a61fc8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648308, "uuid": "448a9abf-50b8-44ee-86ef-b6affbcde313", "comment": "Malware payload (Formbook)", "value": "76c0b6dacffa84c683a078ee89c597f3997aac922c0fbac7e2fe1ae5c7748259", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648308, "uuid": "688bb043-375d-4832-8ce7-7e3050f7f0f1", "comment": "Malware payload (Formbook)", "value": "f1c5ee00938e725b711f7c054fe7386cd18e0087", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648308, "uuid": "eec8e329-1328-4671-90af-111e589beae1", "comment": "Malware payload (Formbook)", "value": "ba43d89ada6a3ab2a567d27f618d9772f14cae1d9792e7199ff8bd8c1b2700ff6c376c357854dee1d52e2272c5819807", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648308, "uuid": "49d19576-b37d-4127-aecf-524cba7cb533", "value": "T175C4124067F90E24DFBAD13E686001549270D58FA8BCE69F074C59A63F3AF800A58BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648308, "uuid": "4e627cdd-2e4b-4b0f-b063-caca45b87d37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648308, "uuid": "ebd71490-3570-4dc0-96a9-7ec6d978ca7b", "value": "12288:VGTIYlV2a2pglmryP5wkYyNqjheNiEERGKNIyntBuoyM3jrPqBT06q:2IYlVA4lLmWEcOIynHuopjryJ0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648308, "uuid": "fe05b00e-86c2-496b-abc8-a547e96aa811", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648308, "uuid": "7e9069a7-5fce-42a2-9439-3ec8d5b72be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648308, "uuid": "3feb6b62-a207-45ba-be6c-775dd950f152", "value": "DHL_AWB_907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef965be-373b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691643889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643889, "uuid": "cd8d1686-8a3e-4f71-9555-fbb7ecaa2a5d", "comment": "Malware payload", "value": "32ddd73ee13682371267896bac0179dd", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643889, "uuid": "66f23a8b-77de-4b16-9056-9c90280a03f7", "comment": "Malware payload", "value": "77266ad954491d5ad32d5063ff466f7c7fbf43c06ca776bf6a4015ff7a231e73", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643889, "uuid": "6a2a33f1-28e6-48e9-90f9-c2bade8e105f", "comment": "Malware payload", "value": "2cdb3e1d733d7f8686d24d25ec287b5766d0e7bd", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643889, "uuid": "4dcc1aa7-f794-48f8-951d-3093c061894a", "comment": "Malware payload", "value": "cbdab57fdf541c5171ba9d9dce8656201ffa4698d9bb7da374ac8a1a9109b16b69fcc0561f4e6dfb697d3c420a046daa", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643889, "uuid": "94337409-e9fb-47cf-b307-b9e7b879be48", "value": "T156C4235D98F3EE7F198273A499E213EF4E098D90208DB8D14DD5229822D1D9B42E5FF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643889, "uuid": "18292d54-51f5-4f1c-93e9-54ec424a7976", "value": "12288:3dlr9lse+JL9K9FfsrkZXEspq+qwqgcfXoYi4MVOE8McStN:Pxi/pipZX6+qwxQXojB0E8M7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691643889, "uuid": "ef2da698-4cda-4898-8a2d-2045530275d9", "value": 547552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691643889, "uuid": "2a18aecb-79c6-4021-b45c-3f634a16071e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643889, "uuid": "51ec182b-ebf2-434d-985f-56f0566ef544", "value": "Scan_SOA MAY-AUG_ Reconcillation AMENDMENTS CB13- Statment.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600a1253-373b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691643864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643864, "uuid": "a46acec5-99c5-4e98-9621-3968f7420197", "comment": "Malware payload (Mirai)", "value": "bee3c0f2a4067bc7093d145b9fd838cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643864, "uuid": "f88e556e-3987-40be-a9b6-079728f73535", "comment": "Malware payload (Mirai)", "value": "78f2cfc118373453c0739696c51d5eea05f9df83e0ed2294dd528b614c78b863", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643864, "uuid": "33af25d6-6f29-45af-aeae-76f2eafae121", "comment": "Malware payload (Mirai)", "value": "aded1022acdecb5ad4bd094315b7b94318a44c8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643864, "uuid": "70a3b50b-c5dd-484f-9b99-3bac26c63e0a", "comment": "Malware payload (Mirai)", "value": "3724723e170b17d43e605351090e373f1889a3a417257af3233869b600ea43ce7e3c7870d4063576b323651f072182ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643864, "uuid": "5e46289e-ee2f-4afb-8aab-d0e0975177f9", "value": "T171D2D0ADE1B542C5EC8E0C7DC4CC3BA10D19A681231BDB9667218C895736C5FF17A8B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643864, "uuid": "e87cb90f-b72f-461d-aee2-6f4dfce08d1a", "value": "384:i8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjU8MCRWGVCz0NvN:HMYHb62x4ahQ3CfdwLjv87W4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691643864, "uuid": "65283c03-376a-413c-a8d5-5a108f8133dc", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691643864, "uuid": "e7edae60-8337-4a3e-b04a-a0de60920272", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643864, "uuid": "8c71f751-31db-4928-8590-6dd871d5a848", "value": "bee3c0f2a4067bc7093d145b9fd838cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f496370-3734-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691640830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640830, "uuid": "e04fc115-a16d-4c6b-893d-124fbe180ccb", "comment": "Malware payload (Mirai)", "value": "04867a1a2f449159cc3eea7351ea049d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640830, "uuid": "ab5d5e8c-3d76-49a2-a3d6-b534abe7c408", "comment": "Malware payload (Mirai)", "value": "795f6fd335c9de3cb3944621b0fa80fceca326fdb6cfd7533a89c67eec55619b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640830, "uuid": "97c70c6c-c991-4982-a949-a72b8e309745", "comment": "Malware payload (Mirai)", "value": "794e5be6094401b0023b855effcc3ee71e05f89c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640830, "uuid": "398b230c-4ce1-4a42-a833-0598e5c948ac", "comment": "Malware payload (Mirai)", "value": "555f8569d9a0219c05c1de75ed46068ab5320c31ac0a795c9f886b5c39a46be03093632192951306f5507aea04c30c18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640830, "uuid": "92051db8-3be5-4940-93a2-a4878409b94e", "value": "T10143178BE71C0E83D0AB19B13D3737E4875EAA5111D852C8390BEED247B7930A653F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640830, "uuid": "065db582-e0d0-40dd-b0ac-4407d251258b", "value": "1536:76g8AetiGg+miwIRqDRWdcsujIIaA/DhbIHR7:X8AetiGvzwIwYsIIaqD5IHR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691640830, "uuid": "42b3574a-1efd-493e-98f4-8d9cd8e9bb5b", "value": 58788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691640830, "uuid": "a4c94e09-6d7b-44b8-bdcd-a68656ba09d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640830, "uuid": "73c156fc-242e-4448-8a88-68cdd936dc20", "value": "04867a1a2f449159cc3eea7351ea049d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315b0ec8-377e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691672562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691672562, "uuid": "0d73786d-ea20-485e-854d-4128d7e7c7a5", "comment": "Malware payload (GuLoader)", "value": "da6462a2badc56e1a7dcf4f9a5b0d697", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691672562, "uuid": "b72bc647-08d2-45ea-81dc-89828de66c46", "comment": "Malware payload (GuLoader)", "value": "79cbc156b5e40954f817a737de5cc6283c1fd4e69342cce8ae519da4070e1659", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691672562, "uuid": "70909a23-4121-4bfa-872a-661fc7aadfd6", "comment": "Malware payload (GuLoader)", "value": "127e0f11c7fc06802323195cc5e0e47636f45a8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691672562, "uuid": "addf773d-7a23-4f84-b1d2-14f0faaceac1", "comment": "Malware payload (GuLoader)", "value": "4cdee57d366de54a60d39897d26b55dc5f9f51f07ad36d29bcc74adc0fdd5cb5f2ff74eecd3d125836e5cd18264ca400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691672562, "uuid": "e2e8345a-ea80-4f3e-803a-ddcb838ff3ba", "value": "T1CBA423A4EA74B4A3C2294A3011BB47797BF6AD0B4E49EB0713D47A5A3C733D14B0D62D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691672562, "uuid": "4f63ee86-93d7-434c-9f3a-50a6bfa41046", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691672562, "uuid": "dc111ec8-68a3-43bb-a01e-045b0bfd1ce7", "value": "12288:kFJthHMCrY6XmTFw6t3NnqnDb2F9ET9jpAO7imdxAr:isCJXmTa6t3NnOeFapjpl7ijr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691672562, "uuid": "c4de7ab9-3382-47b3-afd4-4b5d320be59d", "value": 464736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691672562, "uuid": "62818c40-2257-4407-8976-84452102ba9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691672562, "uuid": "0ad26dbc-bad5-4660-95ef-3b569b574e3b", "value": "RFQ6175.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23245de8-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691685853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685853, "uuid": "0a1c8b9a-7951-42a9-aa11-b231012786cb", "comment": "Malware payload", "value": "4181ffcd9f52664e1799ecd17be0ecf1", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685853, "uuid": "6041aace-468c-4e52-8dbe-ef12cf6fb429", "comment": "Malware payload", "value": "7a8c9f448832158625b81208cd8b4b573d233d6c9c8b36759115662aa5de67a1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685853, "uuid": "3da8fd74-0d51-42bb-95c6-e622e51d317f", "comment": "Malware payload", "value": "345c99a845946147d4476580a5dae1bb163047d1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685853, "uuid": "de151b23-05ed-48ab-b55b-37785b0fc7c2", "comment": "Malware payload", "value": "a2864843478191c163eb53d2d427d02c51c5455ea5b9bddad880ae4579790bd8b5ad5c3368cd8e2e7d658c027643232c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685853, "uuid": "fbf19aa6-0470-46ec-afb7-b222ca4b9b4f", "value": "T1479533804EEED4ED5692F09475834125E842B171244F323BB9A4DF3D9EB37C7BA84E29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685853, "uuid": "faf22334-8b6b-43a8-a23a-bd3f8117004a", "value": "49152:fYJykZi31//hzRYYvNKsuBKfhPPOk/llDf:fCykQ31RCK3uBKf1//llDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685853, "uuid": "d3000877-35d9-43ff-b4e7-05c1baead0a2", "value": 1903502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685853, "uuid": "c37356f8-5ee5-45da-b7e7-6208b1143d63", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685853, "uuid": "1e6a302d-e693-4893-93a2-af99d0e092f2", "value": "REF#117300-100823.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628262d9-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691685959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685959, "uuid": "7f7d697e-c8b8-4204-bf13-77549d5e5971", "comment": "Malware payload (GuLoader)", "value": "96354aa4df074720aaacd2aa773587be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685959, "uuid": "96905459-24e7-4e03-9001-7f970d94d68e", "comment": "Malware payload (GuLoader)", "value": "7b53347cffa39b9146236cbcdcbf2c40be98ca5cb360bbe07e1f10b20e391b49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685959, "uuid": "a973946c-8ea0-47a2-a376-e93200d266a8", "comment": "Malware payload (GuLoader)", "value": "6d3e545d0cffbcdd7b0e55928643908d2f873d29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685959, "uuid": "c4c08733-b08d-4830-862c-a630b8fa8fa8", "comment": "Malware payload (GuLoader)", "value": "41d1cfbc76e94ee54596ba7022d6e2269f2f9304ee631b393223fa388d6c9fdb8e762157aca8b9626388a0bbdefd5212", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685959, "uuid": "a5442d30-82a7-4214-956d-11114c7ef63f", "value": "T1F02501C3B9524613DFC9DBF92A528E261A5D7F320719EB02D2283B078C7D8A571DB235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685959, "uuid": "3020a6a0-8e6f-43a8-b4d4-c984dd2da7d5", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685959, "uuid": "cf8d0c2c-cd58-42cf-81b0-692b9f5857bb", "value": "24576:MFiS4x4y7+3UlqMuypD77kTE0OerSzovxU:7SLytcMug/ATE9zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685959, "uuid": "927dc368-7a19-4223-9568-c17118a72378", "value": 1012944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685959, "uuid": "05b8286e-a44d-48f3-960f-0f7707088349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685959, "uuid": "773ba4bc-a96b-4c39-b14a-4299e40a6747", "value": "Request for Price Offer (\u041cSU 202308-10RU)\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f497e0-37c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691704703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704703, "uuid": "fefab9e7-c18f-4a56-87e5-00a73c5a62b3", "comment": "Malware payload", "value": "977bb7fa58e6dfe80f4bea1a04900276", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704703, "uuid": "08177e51-8714-4d39-825e-08d8f65a9b3f", "comment": "Malware payload", "value": "7ce7b914bd434f8a45db1cb3ec783237a5485b7abcee4df06275ea274e095295", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704703, "uuid": "0e5eebc9-b5fc-43b0-8fea-6daee6141417", "comment": "Malware payload", "value": "467ea946ac857471e2f01bbdc4258a0ff31c01ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704703, "uuid": "fb1340f7-7aa5-48e7-8a59-058b4e5b5d51", "comment": "Malware payload", "value": "37b09cc31017cf2eda93c7395eaf4bd544d41cfcea938a17e36bc6a4f19fc96c3ee041d4dd258af5438fda8c60fc599b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704703, "uuid": "e4c219a0-4c8b-4138-8370-f8f77ce95af8", "value": "T14B05F2DF4C6DD9AEC0858CBECDFF123A23B09C6D86229E2151E0E9760FD7011BD5A45A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704703, "uuid": "eb8240f5-655a-48ea-9890-f0658f6f6bd0", "value": "12288:G9L7RS+1p2ulSTDqec/i/MJnf0/oWRTFLN7zFkKhzSXxDxmULnOfjwtzlTr:gqucThv/M6/ldLHFtSLmNfEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691704703, "uuid": "2a8188c8-2844-47c0-ac3c-3440f2647fe5", "value": 799432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691704703, "uuid": "aa149438-81aa-4a71-b688-fd49a9cb5ec1", "value": "application/x-object", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704703, "uuid": "15fa6000-b071-4c51-8bcc-fcb8c7b96486", "value": "7ce7b914bd434f8a45db1cb3ec783237a5485b7abcee4df06275ea274e095295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e7ca5c-37b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691695593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691695593, "uuid": "72f89dfc-6a0b-4c3d-913c-061128a83b12", "comment": "Malware payload (AgentTesla)", "value": "214882a8a3a850bea2ffd8022c6ababf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691695593, "uuid": "20789ab7-2de9-458f-855e-79013025df7d", "comment": "Malware payload (AgentTesla)", "value": "7f05f950858cd8ca08ed3841cb0bc540ee3d88c6ce3a360a89d42ffa7ce0ff2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691695593, "uuid": "c94223be-4b28-4b61-808e-b0173f11db46", "comment": "Malware payload (AgentTesla)", "value": "c54363a307129aa68105fad0ad73d3e4465632de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691695593, "uuid": "ee3993a3-5693-4694-b80a-5b64ff3563a2", "comment": "Malware payload (AgentTesla)", "value": "8846d447038d20a3d0316da66194dcbb033f187956d22adc51d5f4ce261adfc7b14931e3f2dd5fc8ada1f47cc20bfd42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691695593, "uuid": "37290b13-1f10-4ef3-887b-9f4d12a22953", "value": "T12FD423962751956BCDF0B67C99020A6293B8760F28F2FFDFAE8B34D1A911D840703E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691695593, "uuid": "5b8a8802-56e6-4fa8-9d90-c46bf5549519", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691695593, "uuid": "1a997997-c566-41a2-9493-c9eec0394863", "value": "12288:y1L87+2nEAB3jcOllgVreTg5NI16tEgw0pH78GnL8:Cg7+2n7t1KVC05NIUd5Q2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691695593, "uuid": "4b845fb8-ef37-48a2-a670-dba2a70b74e1", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691695593, "uuid": "9525195d-e82b-4188-8181-1cdc4d23d1e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691695593, "uuid": "0301f4ee-2e80-49e1-b11e-8197ebd06921", "value": "stanzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa2657a-3717-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691628393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691628393, "uuid": "dbf30632-c70b-4f68-b4b9-bbb64b938c79", "comment": "Malware payload (Amadey)", "value": "d4894fe5a6bea8726550e349123a54f7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691628393, "uuid": "d82be9be-1b53-4d09-9f58-f0042905b216", "comment": "Malware payload (Amadey)", "value": "7f4b3467edd2274ae72b7de3897c2c44e972545ff26a72e8e5da9cb73ca35678", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691628393, "uuid": "393b6a00-36ad-47aa-9c47-b04462e4a123", "comment": "Malware payload (Amadey)", "value": "3482ab541feffffb58542616e1b431f91303eb4d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691628393, "uuid": "2fbf226c-5ea8-4bf1-a7ea-ba64397cf158", "comment": "Malware payload (Amadey)", "value": "898bf94bf24226cf9dd68c4b1b26df565da944537526c55a6da50ddc9ca4cf67e5a0c3f4dc6f51bcbb36558001d6a3b5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691628393, "uuid": "278274ef-ad56-4514-9f88-2686bc5b6ff8", "value": "T192C41212ABE89033EC7227B16DF60343193D7DA25CB893AB1745E84E0DB25D1A6B1377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691628393, "uuid": "674dfb3f-0852-4ee8-bc05-5c6db981d385", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691628393, "uuid": "b3727db7-0584-414c-9be5-6c50724633da", "value": "6144:Kay+bnr+Tp0yN90QE2n1itJ8eDA/jYLDTRdm8O9rE5gBZ+t4yVjxjGPW0ZIpIP+:qMrby90u8TG8bM90gBYCylNB0ZIpIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691628393, "uuid": "a9d986ec-d3e8-402d-b3ab-ae94ed1e555a", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691628393, "uuid": "ed5e782a-48a8-44a3-b997-a2934eae473e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691628393, "uuid": "2c1217d8-28a7-4061-a161-30100da3c68f", "value": "d4894fe5a6bea8726550e349123a54f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd8c17d-3747-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Phonk)", "timestamp": 1691648877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648877, "uuid": "d24b28c9-4bd1-4234-9ba3-678e70bc9731", "comment": "Malware payload (Phonk)", "value": "fa25607f384eb596bf1135e748f7703b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648877, "uuid": "9a809c58-4944-4727-af56-25445bc59867", "comment": "Malware payload (Phonk)", "value": "7f7eabc354b1b69f6c2031d612dca22166789b870c6400b46aa3ef6c4244afbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648877, "uuid": "6ce6258b-2d52-4d57-a773-b3d48f2f4209", "comment": "Malware payload (Phonk)", "value": "0041ff4c0e9101bcf2c33a07b780085823fdad2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648877, "uuid": "1289d675-5350-48ab-83ca-85373f9c49ed", "comment": "Malware payload (Phonk)", "value": "5db5ab50a5038a44c497a0ad0e15858f8af057a7b621ca649c3485614f8abd45ee94f86a6d6f61a50a3a10ec9278c243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648877, "uuid": "e492f805-2a2f-4506-b937-978119357084", "value": "T119C5A70E35085D6FDC2D04B2C91BA6158B25C7BE16839247394B54EC263F2876ECFBB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648877, "uuid": "2f2e8c45-9eae-406e-9ba3-45119a4735e8", "value": "49152:2zNl4brAhLwwbX8YxvgUkoNwwknrHWolRG8oMI2qBxXh9A7RAp+rKY2yySV:Y9quY2yZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648877, "uuid": "2ed7ddd7-4cfe-4023-884b-db89f344651c", "value": 2554368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648877, "uuid": "6f8f56cd-80ff-4102-9b80-23f85db96a39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648877, "uuid": "36618983-27b5-47ad-819d-e9c422211964", "value": "fa25607f384eb596bf1135e748f7703b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1824353-37a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1691691326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691326, "uuid": "a2221783-aa3e-46dd-8920-f0d851b21dba", "comment": "Malware payload (AsyncRAT)", "value": "25a06664d77a09c6ef8a512c8e9b1e43", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691326, "uuid": "6dab45d0-8a57-46ef-811e-bbfcae3d8807", "comment": "Malware payload (AsyncRAT)", "value": "7f9ff6d9c5b16dea4ce8a1b75fa31287bc711b3f11d2b841a5e67def87952c4e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691326, "uuid": "50ca2e01-ccd4-44dd-9938-7287463484c2", "comment": "Malware payload (AsyncRAT)", "value": "7b5060944f784d68f8febd6216f627efe668e214", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691326, "uuid": "81c98b74-05c0-48f2-914c-217d799faff7", "comment": "Malware payload (AsyncRAT)", "value": "2e3618414403fcc543da5f324d82d0c2c102478ecb8d33f13ba3c237f6fba0d9de49c2307f93921e0782b6d1c59234fc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691326, "uuid": "e7b15f55-1c2d-49ad-a3a2-9acc52a1b125", "value": "T143231B003BE8822BF2BE5F789CF26145467AF6A33603D64D2CC4519B5613FC696426FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691326, "uuid": "f631d39c-4455-4877-b350-782ba7ca1b59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691326, "uuid": "98a83ca4-adeb-493a-b2a5-9cc4639c220d", "value": "768:3uyRNTAoZjRWUJs9bmo2qL7KjGKG6PIyzjbFgX3in7dEPQMSBDZzx:3uyRNTAGo2WKYDy3bCXSnZcQfdzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691691326, "uuid": "2f3f451d-24d1-456e-b22b-767aeca00d15", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691691326, "uuid": "60248e81-b329-4d89-9bfb-19466014b172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691326, "uuid": "53b9a44c-b754-41b5-a959-1a04dd32d3b1", "value": "25a06664d77a09c6ef8a512c8e9b1e43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7cba69-3747-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691648986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648986, "uuid": "c84781ce-16b0-4230-8c57-f1df03c6e891", "comment": "Malware payload (Formbook)", "value": "fc3f858e64fb4d2b341672db3757e89c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648986, "uuid": "76a6c5f8-6fcf-4155-a509-3487096d3d34", "comment": "Malware payload (Formbook)", "value": "7fa04e3b789c281e7e5290c0a9a20fb0ee2d922da39f2079a71f16c9b109cb38", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648986, "uuid": "4fe6d3bf-c3ca-4302-937d-22472eab2f98", "comment": "Malware payload (Formbook)", "value": "e0329e1537a5816aa4540e62a202dc597c1132cf", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648986, "uuid": "0050442e-203f-4e57-9d35-cec884d30338", "comment": "Malware payload (Formbook)", "value": "8f4717dfc523864b9044603dbee2326beee2bc56fb6d86b63316d79ced5ab9194f8928cb89a5139321d44527c557a881", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648986, "uuid": "b843f2dc-10a5-4e55-928b-a9db96e537f9", "value": "T1B463E169C34F41AACF525237AA1B5A4442FCBB7EF34552B1306C433533EE92D92262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648986, "uuid": "1811f123-f239-407f-943d-8a85ee4f9353", "value": "768:TwAbZSibMX9gRWjVQ2chXuKlD87ixqR5slWVeLnEucm50S6eD7h:TwAlRs5AuKl4u2sn9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648986, "uuid": "ec349c91-5e90-4df8-a837-4284fa035ebd", "value": 68331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648986, "uuid": "32eac253-3791-45f2-ad99-836dc297e79b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648986, "uuid": "353b2583-c494-4108-939c-04358a8d9cb8", "value": "SecuriteInfo.com.Other.Malware-gen.30062.31205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c2d8df-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691648469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648469, "uuid": "0aa60f32-9567-448c-9875-6a684fbbd54d", "comment": "Malware payload", "value": "8930c8db79a0f2481fb29f12ff94e84c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648469, "uuid": "f05cc7cd-f88e-46a4-82d0-1cb783e358a1", "comment": "Malware payload", "value": "8333ca3a89c88586a7f04334a3146cec1f796f18d3c94a6c81a6e6e54e313f6a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648469, "uuid": "6774a400-b9cb-4879-bb13-2e72943b19f9", "comment": "Malware payload", "value": "fe2e7d0189e4c2dbca57822f7f1038af28771de8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648469, "uuid": "bfdb32f9-aeba-417e-b788-2f394c6d096b", "comment": "Malware payload", "value": "1ec501357bca003c4ca8c47da71e1858dd4e80fcaf3163ea82691fa48a238965f5ba9af1bee2a004d070df0079150b61", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648469, "uuid": "e8c3f93d-228b-43a3-b268-eacdf1798f13", "value": "T145E433AA59AB079DD7A802B0F51C11C9CAC53151070EF1CBED383ABE8DB99EB4904D7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648469, "uuid": "b97073f5-cad9-4949-a10e-da0e5c2e7cce", "value": "12288:nGnWh4I7oJtX7UKcnisU35T9zJLkwsD3Hj6HncpUNbKm++rb+A27oN5Hvys:G8kJLcZU3R9VLrsaHcUbKmLrqkN5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648469, "uuid": "6b21fffd-4ca2-45d1-bb45-9c3b758f25c6", "value": 711913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648469, "uuid": "f4d9ea51-bfde-4ec2-b347-36f9aad05d09", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648469, "uuid": "ad1e33b6-1623-42b6-919e-611bbb4e7e7d", "value": "Damaged goods.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6002520b-37ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691692397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691692397, "uuid": "d758e132-f749-4e4e-b949-8a0db6e41b52", "comment": "Malware payload", "value": "416eb366bde2537ebf88aaa8fcbb868c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691692397, "uuid": "5e561233-4a54-4d66-8931-15b7a4584459", "comment": "Malware payload", "value": "83d47e22c111e450eded98abc855449cf42ec1916c9b92b47d18bd951b74b890", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691692397, "uuid": "3ae65860-dae5-48e5-b7c7-136ecbe4a305", "comment": "Malware payload", "value": "6fcd8c1cce7acf7ace95dad8664e4acb934358b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691692397, "uuid": "76a3ea99-def3-4ec2-a7f1-38577b96004d", "comment": "Malware payload", "value": "3350f28deab5b7f729f8e52a4227781b9229d248b5d5a6e49db2e4d5cf76ce09050effa737ab4628b9bd018aff413d14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691692397, "uuid": "430f11b6-08e1-491e-b102-323d13e6749c", "value": "T18D336C05BBD88219D53F0FB52CF462E143B3FD56642AEE5E1D88128E592378CCE60B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691692397, "uuid": "6c9a646d-fd46-42f8-b9ec-3ff563e67789", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691692397, "uuid": "16e859e4-bd8c-440a-9824-df3debaf1247", "value": "1536:nlUfbiAzFes5b0k5bb/hemqM/En76Lbt69mNxNH:ifbbzEkLrJqM/En76t69mNxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691692397, "uuid": "d854da3c-0544-4934-9cd7-a0b45a3a4a9f", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691692397, "uuid": "f6249327-1b4c-4924-b139-add58404b882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691692397, "uuid": "79d35ef9-f931-4f5e-b877-b096497e4b2c", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1ace89-3758-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691656525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691656525, "uuid": "22eeb263-f5e5-42fe-bb0a-5a26af9daa60", "comment": "Malware payload (RedLineStealer)", "value": "decbed2a4a00555183db8582c876d910", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691656525, "uuid": "0bdab58c-0e34-4a2c-bc94-fbdd16a882cc", "comment": "Malware payload (RedLineStealer)", "value": "840aab7b17c1177c8f2f7afad33aeae5d32c69b56f0171575b4fe04317f3795c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691656525, "uuid": "9f8d26bd-23c2-477c-b555-7a86c6abed3f", "comment": "Malware payload (RedLineStealer)", "value": "0d5c2a3c39656005b6a0c99cc4e58f8d86dfe401", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691656525, "uuid": "e0fa6f98-d089-4401-ba0f-1a6e8cc240fb", "comment": "Malware payload (RedLineStealer)", "value": "dd54373b9fd4c69c0221c070d2315a96d84832256c42b25818a6734bde24d5ffbefdbe30dee71fc8e5e9817eb94d6eeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691656525, "uuid": "5a4e6c79-8489-4909-999a-ab9d149dcf67", "value": "T197352E9D325071DFC867C4728AA85D64FB60B4BB831F9613A41362EDAE0D99BCF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691656525, "uuid": "b44661c9-b931-43c7-a79f-4999dd798f58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691656525, "uuid": "47fd7a1e-5fee-48f6-ae8d-bff7d9ebab6e", "value": "12288:/3ldpU/+Cblb9c0yPQSZoQVCBlKJjwx21kbJUaSyRbh3nq1zDc31saA5QVNBFULk:fldpU/+CBWZP/1wTeEfHDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691656525, "uuid": "3626a86b-be8d-46f5-924f-284f09ad16a8", "value": 1072640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691656525, "uuid": "c28bee93-5cf5-4ccb-bd7c-b0a94c6b2139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691656525, "uuid": "e1bb6062-1f3a-449e-8425-afaf943c1ace", "value": "decbed2a4a00555183db8582c876d910.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d704319-3772-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691667375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667375, "uuid": "81b12111-0867-4a2a-bfc5-f9af43e24896", "comment": "Malware payload", "value": "ed1d8b84a60dcbfb2dd36530e4db162d", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667375, "uuid": "dd02c587-dbda-4f23-8995-32b0badf47db", "comment": "Malware payload", "value": "84b9d7147b4a316d2bdeabc5512be759ac11aa46b910647141415256ca5fc811", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667375, "uuid": "21bd0a9f-9ca5-48b0-9ef8-cac8f6f489c3", "comment": "Malware payload", "value": "2e0d16cf8cbdfecb8f8ceba80a090f146096acd2", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667375, "uuid": "ad371d2e-1530-4b03-b820-1e331dd8a67c", "comment": "Malware payload", "value": "24ac2d6e2efaecc48450386c9da15b5231417e574a023e57aebc6f49a1be24f5bdb407a6f173ed629c92d150e16becfa", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667375, "uuid": "c8c645e8-11ac-41f9-9716-7c637dc375e7", "value": "T12DB423A7F0EB615EE981D1B8370F3516D033EEA21174DE2EDE698BA910072F31B21A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667375, "uuid": "154b8f27-bbfd-469c-86bb-668b4f9af4f6", "value": "12288:DmslR2qz67EcVf8YWhY9kv/bZkSIT5Mo9CuABAooU+l7:DmsCFVEYWhQkv/bMFMAyAooP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691667375, "uuid": "abb5d2e6-8add-4843-aceb-d026fb595872", "value": 541051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691667375, "uuid": "f4f03f84-462d-4ee0-bcd7-f06b4991a98f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667375, "uuid": "e7f8bafd-fd84-4221-9f0f-784af24fc36c", "value": "IMG_Scanned POs AllComps EPDAs & comp POs, PSB-17398902, PSB-18384789.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2f546f-3748-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691649361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649361, "uuid": "1387830b-3fe7-4d4a-8a57-41a7c7a9f19b", "comment": "Malware payload", "value": "94bb4aa70f270aeeb3f53dfd9b7c9a3e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649361, "uuid": "84e762f1-1e2f-44de-b88b-a6a841b78012", "comment": "Malware payload", "value": "84eab515e95a0eb2eb1ab29c7213960983c103f8179d7e3125ea5cab29dfa59c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649361, "uuid": "acb2a013-daad-4f60-8222-049d9b4d51be", "comment": "Malware payload", "value": "83a94ba8432ff1dc9be0b04f9ff399cdadbe88e2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649361, "uuid": "d8416779-eba2-4c23-9899-67ac76427c3f", "comment": "Malware payload", "value": "f9cce76b5dd1a1b6ca6789c99c7647501a130f47d65651e56c831bd45e836067a9131930cceca590ee45326cb40a64c3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649361, "uuid": "dbe2274d-c83d-4b54-899f-fc775433102d", "value": "T129565C13B288603ED0AB1B3A4D7BF654683B7A603A26CC5B6BF4094C4F356427D3A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649361, "uuid": "72eaff05-2cbd-4c5c-9c0d-f8ef41036500", "value": "1055d989b28e356fde1fd793b5dff7fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649361, "uuid": "5eeaebeb-eb13-4e8b-9425-85dad760fa6e", "value": "98304:t8Yv5RIpRQCwysg7YvJR+izOfNDQSTjogjDHDJb6zU:K1RQhg7YxRdzgNksDIzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691649361, "uuid": "70244d68-bf75-4307-b696-1531acd3efae", "value": 6093312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691649361, "uuid": "4259ff5f-4ee5-4580-99e6-8b0d4f0be006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649361, "uuid": "904a9fc0-370a-4ea5-9d17-0f737a8f6be2", "value": "Lightshot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb1a8b1-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691685842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685842, "uuid": "b82f6bb1-b642-418e-969d-cef796ccdb9a", "comment": "Malware payload", "value": "712c1e0ff2310c2eba2c88bfa9b9a767", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685842, "uuid": "9ffb502a-e309-444b-aada-5b4abc8b2965", "comment": "Malware payload", "value": "84f4693d4a792a2abf963448708d46b0fae637c00197402763fda87574caf2a4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685842, "uuid": "3516c212-549b-4c1a-b2ba-491f66709e96", "comment": "Malware payload", "value": "0f43eeddb95688ec8ed98160b98118f34ddc022c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685842, "uuid": "8dd60533-aec6-466c-b424-cc30f8072a33", "comment": "Malware payload", "value": "b14b8287306c940d4498b0925497388945c248a891684c548fe4044b84f8a1f34d68bda0e314ac05690c57914aebfe4a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685842, "uuid": "3f25d7da-bb16-479e-97d7-4e85e7633dae", "value": "T1ACE42390336FBB1BB593FEDBDB586D4A0720A79841783817C1B4CC865CB46725E89B18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685842, "uuid": "0c921a82-831e-403b-804f-84266b410dc3", "value": "12288:rFnWr1OnmTbhg878qo991BrajmhasbVRBkFU873eNH3ETSbwGhQGyGAU2DpLp+y:JqkaFg8Iqo991BujjARR87U0TSorU2vr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685842, "uuid": "bacee3c6-9c5d-47a7-af6e-ceb547c124cd", "value": 665561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685842, "uuid": "00890555-b8e4-46cb-9333-1029195b53a5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685842, "uuid": "c659517b-ecff-4126-b432-c1e9084a7695", "value": "PO 27177.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5764da2-377b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691671495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671495, "uuid": "ed65b11a-69d4-4f5b-a6cf-43400b859400", "comment": "Malware payload", "value": "7176624037888882e54b6e8c1b312e4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671495, "uuid": "e53c2c4b-1ad5-4351-b5a0-6b8915193f56", "comment": "Malware payload", "value": "855234d97b8f4e3e2ffd3e456aa76d57d5ce56508870b2a36ab97bba47a695bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671495, "uuid": "a975ca24-02ed-45fa-a7a7-a5b17db18426", "comment": "Malware payload", "value": "e113c79702b804e7a2f1779a0c37f264be7a4c06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671495, "uuid": "e0cb1738-e6e2-464b-bf42-cadeea2626fd", "comment": "Malware payload", "value": "cb20108da8bbf92c4612f2ada3da04a9a3024158c2488b55eaf87912f8ccd69c781e4484b4f7d12f7ff23d8d35dbfc48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671495, "uuid": "22c88b56-5abd-4453-8611-8c65c2cf17e6", "value": "T174E6233BF258A43EC46A0B3205B39350997B7A61B41A8C1F17FC784DCF365711E3AA5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671495, "uuid": "c1af1940-f658-4b51-b9c7-9c556e3cea1d", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671495, "uuid": "bd366079-80a0-44b1-920e-2b570497e25d", "value": "393216:fmcCohWOqHd+YZkocO3XFK/RIZ9kBFvtue5:fjCoEyKXE/RIPSFvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691671495, "uuid": "b9c2ed29-ccbd-415a-a37c-3742ae1e7a19", "value": 14527088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691671495, "uuid": "a00ebdd5-53dd-4c63-8ab0-f9b603ab05cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671495, "uuid": "f132e940-375a-45a5-a8d5-c1481a36dbdf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c232bce-37cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691706538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691706538, "uuid": "3a603e80-98f9-4275-a511-f35137fdf6ed", "comment": "Malware payload", "value": "cd6fb366d044db3aa063ace3c97b0b66", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691706538, "uuid": "9b1bc5f1-487b-4344-b94e-02c2d3311dd3", "comment": "Malware payload", "value": "8625caf1c11b4e5842040d3858bee6ee49fe819abf972fb5920d6cc9ebf2b7fc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691706538, "uuid": "42e27f91-599b-4709-a83a-be3035806cf1", "comment": "Malware payload", "value": "2dcd66c401d6b69924005fead227d5daeed2272c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691706538, "uuid": "c4ab428a-fc96-4cce-96bc-dddb1d7ca00b", "comment": "Malware payload", "value": "cd931c1b8752bc22e1a988dc5328a0d1c310f9f2a6cfc4a375e338e6fa25b335aa97cedd5c1bb356cfd35a02c2bcd5aa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691706538, "uuid": "3a447bd6-60f2-48e8-af91-bbb133ef030d", "value": "T1EBD34B01339DCD74F066217A015569720DBA7C32B63F89DEAFCA8C8E467898177A4F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691706538, "uuid": "15eb9258-ec57-491d-a453-91f03fc4f223", "value": "0b8af3550b5710c15669b5b350fa662d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691706538, "uuid": "fb68cc43-09d6-455a-9dda-c4cfe56aa4d4", "value": "1536:+vWq4KdTKMQFVIvM0yWlCHYI0at28e5tWGldOXI4w/UHqGsuP/iUvw0KYDmF:+vSWTKMQqM0YHL/Qtp+XIz/UHqU/Q0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691706538, "uuid": "24b62ba9-96ee-4942-9c8c-33bc93e0a34f", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691706538, "uuid": "f7cf0495-561f-485c-bd4f-3b6f07d84e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691706538, "uuid": "0b3410be-19f3-4f0a-b531-93d8c68e731c", "value": "SecuriteInfo.com.Win32.PWSX-gen.10368.18305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4115c44-3726-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691634986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634986, "uuid": "36eb7787-156f-4c3c-b5ff-01404e9ea4f0", "comment": "Malware payload (Mirai)", "value": "7185ed42489eccc0e0f32bd8bb9190de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634986, "uuid": "8e042026-d3af-4cb6-a482-31e6d5713cde", "comment": "Malware payload (Mirai)", "value": "86d61262a4e59646768c517168ad4f7c4e4ba69fced2142b5f014e09cdc9ed2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634986, "uuid": "4ba9307d-f718-4526-adc8-4db4ba341fda", "comment": "Malware payload (Mirai)", "value": "b556dc6e9bbe2f1a0543e08ef2edf79deac83b58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634986, "uuid": "5fbf5a5e-2e82-446c-b0e5-b21e21e47ce2", "comment": "Malware payload (Mirai)", "value": "0886361f95d1687ac0a78aad4e62bd80288fbd00d3c6278f807e24837d7cee38a0355233e4faa04c9fc3aa8cf5c4be95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634986, "uuid": "2e60c0e5-53d3-48b5-bb66-b3716d0ca259", "value": "T13913F123676900B3C6B00A30FAB05E984638A1F9FADA75B0FF305156D583AC75578AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634986, "uuid": "f6400dde-a408-4414-9f85-fcda6d547623", "value": "768:irF2BMzvwgNwjO5WYScXewDW4B0gPad6+TcuXio3s8W1BUjy6W63Uh:+F2tKmO5WYzFCdPcGiVjUjpWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691634986, "uuid": "7f9c12b5-1151-441f-8c50-0dd89f6503c1", "value": 44920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691634986, "uuid": "f51f2044-ac32-422a-a66b-a82c110f5f5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634986, "uuid": "290296b2-c873-4655-b8bb-4fbf26b1178d", "value": "7185ed42489eccc0e0f32bd8bb9190de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc4b0bf-3762-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691660561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691660561, "uuid": "6406dd30-4a15-45e7-b865-56bf4e9aad7c", "comment": "Malware payload (GuLoader)", "value": "2894a2b884b3eae1a82c6203be7cb747", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691660561, "uuid": "fa15fe97-669d-4d62-8069-6bd265994d02", "comment": "Malware payload (GuLoader)", "value": "89ee19de620f1b39fc89626aa3047f8121acf434a1b0d3d57b5f31d6c05df465", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691660561, "uuid": "158f1408-9659-40ec-98a1-b36379b1bf68", "comment": "Malware payload (GuLoader)", "value": "17b171cb5c486e5915c6ddec0fb6453ee33fc997", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691660561, "uuid": "c7c6362e-a0c6-4667-840f-58e2fcdb5e08", "comment": "Malware payload (GuLoader)", "value": "730fcefd3e5a30338625ad54d32d2d2f80ac97730f5e86b033f978d8fdcd5124e5b449a6578b26d8fcd431035ea41b58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691660561, "uuid": "7173530c-ac20-4505-b6b7-7c2951e70cc0", "value": "T1B664E0577A6C476FE79A8EB2317942308A64EF9301243C9BB6D5FE2E497134DAD030C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691660561, "uuid": "b1001c61-c81e-4b9f-9e38-dea6cd335413", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691660561, "uuid": "7998c117-6f5a-4648-ac53-ac75e2cfd6b1", "value": "6144:kjV2Hj05/QVHmdkSEX8JFw2NXkYtm3/Yc/XNk3GMt1PDW:nD09oGTDfZ5tmvYWCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691660561, "uuid": "a8bc4463-cea6-4cf2-8f90-e0b752899759", "value": 319072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691660561, "uuid": "9f8b605a-31a5-46a3-91bd-5a7b3e4ab04a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691660561, "uuid": "4f5b949b-89d8-4f75-a095-eaa3f5548300", "value": "2894a2b884b3eae1a82c6203be7cb747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4724a0d-371d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691631094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691631094, "uuid": "24f1ce6e-0efb-4dc2-ab4f-fa21cdf6c3e3", "comment": "Malware payload (RedLineStealer)", "value": "63c8971949fd2f2424d89f3a67a3ccb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691631094, "uuid": "be1394eb-386d-4679-8062-50d12ee77589", "comment": "Malware payload (RedLineStealer)", "value": "8c09bc836e4db98205683c33a339ff7cddfcac9552edd2bc6947eb6ce1cf48c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691631094, "uuid": "8ea7bd8b-fe74-4867-8682-e26d55f3aa54", "comment": "Malware payload (RedLineStealer)", "value": "9e4d495ce7b64f4b50eaa89055525e34d4a4e626", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691631094, "uuid": "e3e8451c-4ac3-4ca2-aa68-26fd2f0d9261", "comment": "Malware payload (RedLineStealer)", "value": "5a373b0cc03ed136a1f376ee09a66b88e11686c39011dbe9e03e45783f8b80f41378805faa75c3431e13b22119b29965", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691631094, "uuid": "f9dd6126-02d9-400e-b570-da4c06b5bcdd", "value": "T146C41202AAEC8533D8B113B054F602D31F3ABDA06DB8976B3346685F4CB3695A57532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691631094, "uuid": "0e85b5ed-e060-4fd5-923a-e26c7bbb7253", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691631094, "uuid": "242b4d45-b34c-43dd-8056-3d617ef3d5e9", "value": "12288:LMr3y90a7zgHkFXHBz8KzOMkrXIJrxwbuiJn4gWTkP/:0yXVXHmKzOrXUVGuGwc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691631094, "uuid": "aea35b4b-3241-45d1-a946-fdf8d6435db0", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691631094, "uuid": "1eafb3c6-4425-487c-888d-ad470dc94e2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691631094, "uuid": "e2d0d2c5-bd5f-4555-9bcb-db4e3832073d", "value": "63c8971949fd2f2424d89f3a67a3ccb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31f6ed1-3768-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691663304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663304, "uuid": "42000795-bea0-46ee-b2f4-3cfdab94245e", "comment": "Malware payload", "value": "b0ba743c7dca4f57ad3c67d014e153c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663304, "uuid": "157e6d1e-ef6e-4f5d-ac8e-7681eb68af1f", "comment": "Malware payload", "value": "8c20180119d07486707e0eeed04be3e9e7fd0b874764cfd423f9393724afd436", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663304, "uuid": "b8c1c610-06a0-4d4c-8b5a-612aa1f380fc", "comment": "Malware payload", "value": "a9db94ed48c64ee6931a01d7ee7543091284d3cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663304, "uuid": "0e7b2260-40d2-4af3-a11a-903e86b2f772", "comment": "Malware payload", "value": "4eeb96b5da0ea7c19d06b803a824cd65f309944b0c477e6763c2ef07655e9025e7f839ffd7b603aa511b4b2ab5fb13b3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663304, "uuid": "11dc8a96-a782-49d5-83db-602c43a89342", "value": "T116238881179DDFEAF11A25BD41852D310DE468B8731FC4AACBC69C9FC419DC622A0E9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663304, "uuid": "042c0697-57f8-4e34-8d26-4c60fc8af48e", "value": "88d0c8baf81317c8274cc2cc88e50a41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663304, "uuid": "0c0acc7e-88ec-4ab2-87c0-9c9796682288", "value": "768:25ixYLvMnPhZhLDRHt+gQbTSXrB4EXxAcIL7Cke+N1sJhMzEvrA:2Ux6MPhZhLD7vQbW20AcIvZNOJUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691663304, "uuid": "cc52fcf8-1c61-41c3-b08a-1eaef65dd3b2", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691663304, "uuid": "e1c022a4-1125-45d8-a1f7-9aad3d92d444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663304, "uuid": "6341ae41-5308-4efb-b047-1ee1888560bf", "value": "SecuriteInfo.com.Win32.PWSX-gen.22514.24315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1484aef6-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691685828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685828, "uuid": "dbf05fad-a4ba-4732-a336-d74e517056c1", "comment": "Malware payload (AgentTesla)", "value": "1b5b03ea3e3a267e9ee28c50c26d29e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685828, "uuid": "788f84a8-c23f-463c-8799-7da0b30de654", "comment": "Malware payload (AgentTesla)", "value": "8c51d1cb1d28a45a81fca1a9f810215067cf815e19428debefcf9070491da053", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685828, "uuid": "a35ca542-15b9-4144-82d2-30300eee8484", "comment": "Malware payload (AgentTesla)", "value": "feafa22235d3fbc12079c53cd6cd77ba3de5061b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685828, "uuid": "d13f4c47-41df-4a04-9040-387e74cde64a", "comment": "Malware payload (AgentTesla)", "value": "70d40b5e3ba37d85b572ab42eefb704a67e56dd2035417bee5202be9bb801fb220b118f35b03fbd5d6571aebc3156334", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685828, "uuid": "76e9724f-2d33-486e-94df-69a3fc7c6834", "value": "T14CE4238A13A9275BD0B10BFDA4212613437DA74F54F6EF8BFCC564E98A6E9148F11F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685828, "uuid": "4601f8a8-43b3-46e3-bcbf-c114ba3c0d29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685828, "uuid": "95b48bb3-1ec1-4648-a8d0-f220ec5f62c4", "value": "12288:83L87+2lVqhrSEtPQabCvCFPOc8QOu3Mq2alg+PUrg2ZJmLm6bW47R2KELnnrCAs:yg7+2lVqhGYHrhn3722PUrJYy9KELn+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685828, "uuid": "cb56e49d-0da7-4ed9-a56d-7315dfdb7f6c", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685828, "uuid": "18cd028d-508b-4ef2-ab76-b65366c4eeff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685828, "uuid": "71733fe3-d7cb-4922-b404-550bac7327b1", "value": "List of order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06f93fb-3745-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691648402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648402, "uuid": "7581add6-33bb-4f1a-b57d-a8674155400d", "comment": "Malware payload (AgentTesla)", "value": "52497055682fb0d9a199749b03af41f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648402, "uuid": "ce7ebd3b-0c9f-4a25-b072-83493c390352", "comment": "Malware payload (AgentTesla)", "value": "8d83bca79f2bc2c8de276322813a9d775891c8445191f196c302f0965ba62ba3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648402, "uuid": "b7c2fd4f-ba4a-4527-a162-a5a3136025c0", "comment": "Malware payload (AgentTesla)", "value": "24265f628a5a89017e28988cdc60a0c893efe84d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648402, "uuid": "cc6abc43-78fa-46cf-b2ae-4806fe97251d", "comment": "Malware payload (AgentTesla)", "value": "86205d759d65e8c5ff0c8d78e33b69365309fe2966a5350e7a45bc6fb9c06355e5868c6cc266b0a6917a3802e8aa154f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648402, "uuid": "ab51868d-1d5a-4ba8-960e-4ba86f52f44a", "value": "T1B9F412FDB2EB9D30C376153BE76314005379634B6567EB8B140822E5982ABCA7345BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648402, "uuid": "0a6267f9-70b7-4e82-8a16-2d377144c327", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648402, "uuid": "6713eaf7-0fd8-49e6-abe1-eef918fb754e", "value": "12288:TmoGGTIYlV2UweHghGYlkFVCziwYUE8VcUQ0lOsZctluAH/Iru+q+fhzSxn:TmoxIYlVNweAhGVFgzPEMl7G/jHqu+qB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648402, "uuid": "95ee2a04-5e0f-4638-b31f-aed292779c6a", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648402, "uuid": "623bf865-dd5e-4f08-a900-c78e37edbf21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648402, "uuid": "bd59f64b-b6e9-4e5a-996c-8d057a00cbcd", "value": "00009721_scan -19pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70140c87-3767-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691662789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691662789, "uuid": "3fa34052-0784-409d-80d6-3f511cb7c2fd", "comment": "Malware payload", "value": "3d8ec0d4a78bcd79d1e9fc21aa465b1a", "object_relation": "md5", "Tag": [ { "name": "Stenography", "colour": "#6A6EC9", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691662789, "uuid": "1022517e-ac38-406f-9124-8096a2319815", "comment": "Malware payload", "value": "8e77dc02bcc71fef4bf397d264ed6ead11f19ed48cdd9483fa1a9ab292c3fbe8", "object_relation": "sha256", "Tag": [ { "name": "Stenography", "colour": "#6A6EC9", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691662789, "uuid": "7ab87230-5191-4681-a9bd-f4bf12395da2", "comment": "Malware payload", "value": "200a56ec3a42b4b1e5d66fef887e0d9d7d76c6f8", "object_relation": "sha1", "Tag": [ { "name": "Stenography", "colour": "#6A6EC9", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691662789, "uuid": "608b10d6-a112-4da1-8d0f-7cb68cbcc122", "comment": "Malware payload", "value": "9570971948782267129190e9665e1f32ff3406721c769bca943e83b30e992bc484ebe16b3d66949c83f647d01b9f48f2", "object_relation": "sha3-384", "Tag": [ { "name": "Stenography", "colour": "#6A6EC9", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691662789, "uuid": "5ca3a44c-2b4f-4f5e-8f43-ed77a0bf1d5a", "value": "T1BB76E07E0357BEAF677E0E84D00835445D9878ABB33091ECBF8407B656DBA44DE299B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691662789, "uuid": "5f1c2965-da9b-42d5-96eb-b1ee11d2db72", "value": "98304:MkBQYhtTEfuCH+FENi1BspPZi3cUbM9FV4:M3fuE+qNyEmcUOFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691662789, "uuid": "7e067902-c8a0-4960-ad66-d112cefc62cc", "value": 7285476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691662789, "uuid": "2576517a-e0c9-45a2-86f6-ddffc539c627", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691662789, "uuid": "db492fc5-6259-48c4-a4e3-4c1aaf5503f4", "value": "spiderman.jpeg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09dcd7ad-37cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691707285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691707285, "uuid": "76bcbefe-db4e-424a-b683-3ca13e998f18", "comment": "Malware payload", "value": "08091fc500980bad23c3ff4b90430ccc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691707285, "uuid": "01cf0948-4144-4326-a28b-f3ea6d444c61", "comment": "Malware payload", "value": "8f76c03b2e4c8808b16cd6b6dc21945b08dea2434044346b5cfff4fce499292d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691707285, "uuid": "04ddfb9c-7331-4240-91eb-c808cd559c13", "comment": "Malware payload", "value": "bcf94072101e1c7e8091cf68a3c5a0af99f90a16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691707285, "uuid": "2d85c6e8-ccd6-49d8-ad82-50bdf0005a1d", "comment": "Malware payload", "value": "5b1d99747534a20d698cff4e1a168dbcd9b4aeac25c8fe7e92eea83eb9de1ef1adc8040eb00000723777c1ff6d9f3278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691707285, "uuid": "c3878a7b-8605-45c3-8ee2-fe939763c8d9", "value": "T1CA4418DAF0A040F1C135FEBC9F145AE0066FAA6FBADEF41E6163B0599B803730156979", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691707285, "uuid": "be2c155e-ca84-4052-ac92-06b61e4b3c5f", "value": "7577c33a86c21dd2d165adab73f0c4b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691707285, "uuid": "f95c4f0b-67dd-4235-9414-5d633cb8d17e", "value": "3072:7dFvk5ghJj/MaTn3cfb5Omlr7q/UitdxfWvI9Dp2KDJN3tu+olCL6kFNkUppJ:7Q5oJjvwZ4MYH/pPJ++mCLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691707285, "uuid": "145ee00c-c11b-400c-8acc-45f017722a15", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691707285, "uuid": "58edd77a-976a-47d1-810f-a3a9f1577db5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691707285, "uuid": "afb49d91-7c3a-4e49-afc3-5f3523920ed7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bab606-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691648682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648682, "uuid": "9bafea41-3dce-4cc9-8732-160649155931", "comment": "Malware payload (Amadey)", "value": "c56d1b8c9d697b386a11b341b03d1f5f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648682, "uuid": "ac474331-8a66-4dd4-bbfb-d0e94383ed24", "comment": "Malware payload (Amadey)", "value": "906a13f839889760b8877efb93001e7ced546331b626adab473165dc3699e1c6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648682, "uuid": "f0843663-614d-4801-a3ec-027e5acc13c0", "comment": "Malware payload (Amadey)", "value": "9f2468e6f85cdc2a8788bedb40124c18a3920d37", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648682, "uuid": "8e962316-aff0-4ca3-b3e2-ddb45a19a08d", "comment": "Malware payload (Amadey)", "value": "150674cbd883bcc0be69b36efbaca5774d17c84098ca7efc4255a0573b57a93c1140754db7f4e0b01d3a5a32552e6f16", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648682, "uuid": "e5f21359-cdf3-4f2f-acc8-2348f3b9878c", "value": "T1B83408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648682, "uuid": "02b51981-179b-41ff-880e-8ae19784171a", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648682, "uuid": "d592212a-b914-4051-b94f-9311e101db8c", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648682, "uuid": "d33972e0-a3f5-455c-a441-67a65b9b50da", "value": 241143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648682, "uuid": "06753698-32b9-41a3-a946-46234b568f9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648682, "uuid": "524e1645-f6d9-4eee-8fb4-fd6d1d423d70", "value": "c56d1b8c9d697b386a11b341b03d1f5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c771fec3-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691648762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648762, "uuid": "31f1d846-08d9-4633-b93b-8b1e7254be58", "comment": "Malware payload", "value": "f8a254777e945603cf2891da3232568e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648762, "uuid": "34ddfaf6-1d25-4918-b502-87bc34c79f45", "comment": "Malware payload", "value": "9072769d0629d11d38290a8f9384fd6fd30015a08b15d3b644a444d0d1d37691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648762, "uuid": "3b1f6c2d-122f-439a-8983-95d0a8fc5b8e", "comment": "Malware payload", "value": "77fc9c6a2ec24f6e0c9163f91e11dbf1f0c6f59c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648762, "uuid": "9b9c5c87-61f5-4b70-903f-dd1b1754f407", "comment": "Malware payload", "value": "98afc903b70c1178d5d08247bc367780f568d60ea43702b22905feec2c13ac5fc99cc1ca4ec9cdb710e70716fc8065b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648762, "uuid": "14f6f6c7-ef21-44c7-bc18-fecacf4572ca", "value": "T1FB56E847F89540E481EED164C7269217BEA13489073433E76FB19AF11B27FE8A6BD324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648762, "uuid": "943ab6c6-8565-48f2-abab-2d1e4578c11d", "value": "49152:6p+LoXU1ThfwM9rb/TZvO90d7HjmAFd4A64nsfJMy+lJrrq0Lu6TnWMdiSmIC/xL:3dhoPCrdnW86vteEUQvgklCLgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648762, "uuid": "d4b7c2c7-538e-4dbd-9f26-91ed4d35fdf6", "value": 6264000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648762, "uuid": "21baa62f-3055-4673-aa0d-bbb7cf5bfd2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648762, "uuid": "61f571d8-c112-4adf-a3c4-f1a6624dc616", "value": "f8a254777e945603cf2891da3232568e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa67951e-3761-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691660310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691660310, "uuid": "bd705c87-a535-4731-8f90-d688924fcaa3", "comment": "Malware payload (Formbook)", "value": "4376fc75b70dfd7adcdc0aafd180fc80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691660310, "uuid": "2d03b1ab-dcb1-4f6b-a5c4-e1bff3bcc23b", "comment": "Malware payload (Formbook)", "value": "948f701cabece1a38d395dfa7c5ccaa4003b0693fc47b03085d7b5f2ec9b9e60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691660310, "uuid": "16077d82-5ad8-4d8d-ab7c-16f81fd3aaa0", "comment": "Malware payload (Formbook)", "value": "44c719630a03eea9ce6beb71fadd16f30f28d0ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691660310, "uuid": "d4d30643-5d55-45b7-a196-fd603d58492a", "comment": "Malware payload (Formbook)", "value": "e4d8b0a5709ed35c06336a6d61d881ebac2bf99a68edd015de414a9405326657a40d9a7ba1929d93dd15bf3ccd2407b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691660310, "uuid": "167d56f1-298e-47c3-a8f0-96f58c9200c6", "value": "T174D4230D174D1DAFEDF10ABA55833252A338A50B60F1FFEF2DD974502938A960A41F7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691660310, "uuid": "0cc21eb3-76e5-4750-988f-06a03c9b3164", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691660310, "uuid": "12f82973-8e70-40b6-88d9-e95ade0f6c4d", "value": "12288:V8L87+2GrxtexVTRe+FPw+cxmmDr2zdCj5zU0WmoL8:Cg7+2GabTRlPw+BmDSccg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691660310, "uuid": "62d3bfd9-b423-42ec-bd96-13dd7bc64cc6", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691660310, "uuid": "a79842b6-2672-4e10-afec-ad7da477849a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691660310, "uuid": "0834b70f-ba4c-434a-b280-640e6da84e93", "value": "SecuriteInfo.com.Win32.KeyloggerX-gen.12607.8507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8c1586-3780-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691673418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673418, "uuid": "1ef70005-b803-4c05-a2ac-b86f012d946c", "comment": "Malware payload (DarkCloud)", "value": "00faec4e3aedafea0ac284979f6147cc", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673418, "uuid": "571681a4-03e2-4526-948f-95c0bf7f5695", "comment": "Malware payload (DarkCloud)", "value": "95262d50dafe53089c62512ec422fb473e315e7a8cbf3b2441aaa78ed45fb46c", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673418, "uuid": "df00b8a6-6894-4da3-b2f3-97bb3a74dd1b", "comment": "Malware payload (DarkCloud)", "value": "65773836da64ff1655959e494e3bdfd3f21fbf32", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673418, "uuid": "d0ca852a-cefa-4352-be4e-6898b5e8d87a", "comment": "Malware payload (DarkCloud)", "value": "08c56d567f1df2db6770c9fc92aad1498f7567f50512b32e5545035ff1c79643c1a8c9e4758f497730b7df2aa7886aea", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673418, "uuid": "4497b7e2-68be-4230-b884-86c98c0f2f0c", "value": "T1D4354A26E77B645AEF19A5E88E2F847238D6DDC0F0B1C588A7E72C0385C23514D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673418, "uuid": "1e6ad236-483a-4f0c-a6a3-4d922b5cdf1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673418, "uuid": "35245993-b5bc-4ceb-be38-bf3fe4ca938a", "value": "24576:C0URs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOKUF//Eu0QAmPUERceZnR:lURs6CE3jLbO9Rs6CE3jLbOKqT0QPUE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691673418, "uuid": "23f34dc1-a781-4cef-ae74-f5f856b1835e", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691673418, "uuid": "6c26bb19-9531-4ed0-b6f2-e1f53e8ce5bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673418, "uuid": "ca4f8355-24ce-4088-aa21-3d14046670a5", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060ed0bf-379e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691686234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686234, "uuid": "884c6536-aade-4dec-b6bc-10da37af98d5", "comment": "Malware payload", "value": "e5b37a6a6bc59fee6ade615b389f839b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686234, "uuid": "c6e88843-29ab-4887-b3df-848e48038bbe", "comment": "Malware payload", "value": "96c960dff60bec777e5536a19b5fdbcbcb170e89986f175018435d0dcbe00288", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686234, "uuid": "82726231-e75d-450b-b3ae-7cdd214b27a2", "comment": "Malware payload", "value": "cbe934d5159e22a7aa4f8addadc1f4bef328b6d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686234, "uuid": "cc5a2b4f-d9b2-486b-8c1e-add49cf73fd6", "comment": "Malware payload", "value": "51479683a6b36e386a91846345595c854d9f4537c0a078d8ba85ded0611a97f9fc26edc79d2c11da25d430f9db998cd7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686234, "uuid": "a942667d-75f6-4530-be99-a7c2ba7ae423", "value": "T121F533CE989A69D5C304D03DBE60DF8B531014BE88BC1BB6A378B3C496B3850DDDA579", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686234, "uuid": "5bc0890d-a77b-4df7-a6b6-f8f0c7b6936a", "value": "98304:Nv79P4zrmQotbO6h2Pk1t+w6KMp1oXQclquyaSuxXe7FRw:NZwmQb62Pk1t+w69MCaSuxu7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686234, "uuid": "8da732f2-d60d-4485-873e-a77d21b94b61", "value": 3473413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686234, "uuid": "89b2e162-e95d-4de8-a843-90c510aabc9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686234, "uuid": "55991495-a0f6-48a8-ab0f-b9249c25fdff", "value": "e5b37a6a6bc59fee6ade615b389f839b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9922b272-3779-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691670589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670589, "uuid": "3d37f843-e3bc-461c-abb7-f24da39c0eb3", "comment": "Malware payload (GuLoader)", "value": "5c341f14f0b238753542b001992fc76c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670589, "uuid": "6e8b58da-3c66-47c2-89dd-a2e4d49da795", "comment": "Malware payload (GuLoader)", "value": "98aafb320c74b83acfc8ecaa84b232fdf49af42fe4871e879ccb83a2f81ee5e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670589, "uuid": "eb72d855-14ca-4b6f-8262-5675df9cef5b", "comment": "Malware payload (GuLoader)", "value": "6eb2f4c3d3d3a2c476bce5e320450a118ddfaa44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670589, "uuid": "8a1c2a57-4cf0-4adb-89b9-0d7f7a5e69b1", "comment": "Malware payload (GuLoader)", "value": "7c92a95e1cb5377572d057ed52470c3a900e0f827e60390451e43498075377a242c3920a57ecd7ae2b0d4fc7c53b3402", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670589, "uuid": "4498fd5f-18c6-4f45-8329-ba2427a04487", "value": "T16934121137D0D02BF5E187711FB6A9ABDB79AE231850462BB7043FA89E31223C65D353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670589, "uuid": "e898496d-2cc6-46f9-81c8-f80245d46170", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670589, "uuid": "90af2da1-98f6-43d2-89bd-65f0eeb210aa", "value": "6144:SZ/qRr2UoePUwcjMlLpzZVaRIj1WR2tXH0q+vS:SBMhP1mMlLpzjacQI6qAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691670589, "uuid": "6c6def11-3d4b-401f-96ea-38f8c8a45776", "value": 252576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691670589, "uuid": "04941e22-43a5-427c-8db5-f7fab5d6e40c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670589, "uuid": "192ab54d-3a23-4a1c-a07c-2189448d84ef", "value": "Slatne.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee13da9d-3725-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691634654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634654, "uuid": "b1974622-187a-4233-8134-05a12c1613c3", "comment": "Malware payload (Mirai)", "value": "7fa90f0eb70078f631ea6a552ff2679e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634654, "uuid": "405be40b-815f-4235-ad81-a43179213c35", "comment": "Malware payload (Mirai)", "value": "992fcfe9d0d2bb79523012c09da222d8cea508b9221b62cbf1d5d5aa597e8eb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634654, "uuid": "c943c135-577b-4332-ba24-3dc3294fcb98", "comment": "Malware payload (Mirai)", "value": "0d5ec24d252bc0e7418181464caf2e57fe80def3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634654, "uuid": "2f206a83-3d71-48df-ad8f-35fab9dd7366", "comment": "Malware payload (Mirai)", "value": "63739a88f1e4c88cbdad5dfadd3b75dd5a3b0d3049cf2df4232f74aedf563fe926a706e740e4cbfb35d6586c8a572961", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634654, "uuid": "64447842-d309-4473-8fb7-55e444708f08", "value": "T1F723F1D8FFE26F59FDAC5CB4956502840AC4B25A331B6B5E93007E2C2EA8E53B4458C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634654, "uuid": "d41e5ab0-66bd-49ec-81da-4e5e3cc33af3", "value": "768:SvssRfTVOXpQacaWVntsq1R7U6TFdb5jb8Db6gsoDBEYvum9uR62snJSbDieyLlT:SbRfSprodb1RvDRngsI2+uxR62iAniDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691634654, "uuid": "f23ed4d4-e503-4f6e-8fc3-902e4d14d8d1", "value": 48084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691634654, "uuid": "e5f1ea6e-e6f4-4131-80f7-4a35e0c0280b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634654, "uuid": "4d8c9feb-c5d6-430a-848d-9fc3bead5889", "value": "7fa90f0eb70078f631ea6a552ff2679e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b6736b-37a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691687688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691687688, "uuid": "8ad9acb0-e0f4-42fb-af21-b2c052678146", "comment": "Malware payload (GuLoader)", "value": "eff900a5b8f7bfdbc253a55fbe1f436a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691687688, "uuid": "dc2199f7-fab5-451e-aba0-cbc13797d277", "comment": "Malware payload (GuLoader)", "value": "99b9122362d9f45aab1b628367a112274a0c866bde1e458574a7134010296bf6", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691687688, "uuid": "b3736f8a-ee2c-45ec-9214-1a0206aebb52", "comment": "Malware payload (GuLoader)", "value": "cd32815bb619530a98ee4d41976ac9a8e9abfda6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691687688, "uuid": "ff6491b1-f2b9-43cb-ab88-a9ef92c5295d", "comment": "Malware payload (GuLoader)", "value": "5119e800b017e65efd30574c5c4c5e809a2efb8f10b1a3a905d6cb71c9aa1dd93ec9e2b76355fba020f0852c7796020d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691687688, "uuid": "10947faa-ded6-497c-b97c-f08ba217d589", "value": "T10845132366E6C03BF09D5770DA69A6F4E3B2AD6CD134054B336CBF963F356829808549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691687688, "uuid": "d3a78e0a-0662-4baa-889b-19a8ffdef7da", "value": "12288:1TuK9McXAlSMNk3EEABq664G2QPgeMQ4AttL:1Tu6XA2MB/edt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691687688, "uuid": "aabbf068-7100-4a89-81b9-4b897c02480e", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691687688, "uuid": "df490677-f272-43e6-99a9-a3609f8632c4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691687688, "uuid": "49a3eeb7-6cb3-4e7b-8d63-e155ee9fc66c", "value": "0543-pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1b5c76-37c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691704766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704766, "uuid": "b4e380f1-0319-4a82-baf3-41a345660bec", "comment": "Malware payload", "value": "246c5bec21c0a87657786d5d9b53fe38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704766, "uuid": "60239ed8-892a-423b-b104-1a55f4bf9d7a", "comment": "Malware payload", "value": "99ffc0099277bef59a37a4cfcf4cdd71df13ad33d1c7bf943dc87f803e75dd2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704766, "uuid": "822f06a6-09ac-413e-bb50-bb4cadbb78d9", "comment": "Malware payload", "value": "7d9eaefeb0c95473ad86abbdcffdbdf6950b8dd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704766, "uuid": "b0fe7dcc-560b-4e1a-ac4c-259618942f72", "comment": "Malware payload", "value": "9d600964b59e5cc0b2ccf00a702ca6256677dbd664f1bf90f47ebba783b627fd271207280429353339a5c229672a4bac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704766, "uuid": "ab75293d-4247-4780-9697-466782a82781", "value": "T1FBC4F1899CB3C63BE8485EF74CF812683B514BCAA5D5678B54E9F0BC09CB06B7D36148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704766, "uuid": "f1b9eca1-67c9-42f5-aa94-8411982d0588", "value": "12288:Xlv7SxafJ0ENoE0YiHWDaws2nxlBxPr+ysFILJIIxCT:Xl5GEKLOD+8tHqIxCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691704766, "uuid": "6b5f725a-ecbb-4d7c-9021-639075de9764", "value": 560980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691704766, "uuid": "caf25390-f396-4d27-bb15-ef32d2b736c0", "value": "application/x-object", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704766, "uuid": "8745356d-42f5-4048-b166-44f82e43affa", "value": "99ffc0099277bef59a37a4cfcf4cdd71df13ad33d1c7bf943dc87f803e75dd2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59325c9-3768-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691663308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663308, "uuid": "7bf5d2d5-e9b2-4325-994c-4d6a1fe70279", "comment": "Malware payload (AgentTesla)", "value": "07097792837315017f8625479427db66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663308, "uuid": "1838fbe6-d1fc-4094-b831-6faeb684d3a6", "comment": "Malware payload (AgentTesla)", "value": "9b67d73aba7b77eb7417aebecf9874b40192c2348304aff93f4008ebcc6a3fc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663308, "uuid": "0366e55a-0eb9-45d1-8eca-54857f34770a", "comment": "Malware payload (AgentTesla)", "value": "fc1798ab5b9380a65404299dbb049037ce845e9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663308, "uuid": "e6ab8f0c-99f8-468d-afe4-fe24a2559007", "comment": "Malware payload (AgentTesla)", "value": "2fc7f4a0d7446ecf7275702b84346b76c2ad5d46347f1e9e89dab2cc3b3bb4667b9360f00be6074592c1eade5c514bcb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663308, "uuid": "9aebdcee-0804-4841-9430-ec5a0268ab72", "value": "T1D6E422441B09A52AD9F4A57EA8766313A378A34FD5B1DEEEFEC538549B20F480740F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663308, "uuid": "046dc673-fcac-423b-8247-862662b70561", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663308, "uuid": "771c44a4-8979-4e54-84c4-6ecf90abd236", "value": "12288:vJL87+2jrb7vwuwXJna7U++Mqim1zp18eEErlQVPCHYL8:hg7+2Hb7h3+V1F1ZGVaHYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691663308, "uuid": "ca2c1933-3bf0-419d-8d21-db1f3d9ec6b9", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691663308, "uuid": "73a0c8a1-33c6-40d1-93ea-7b81a5bb487a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663308, "uuid": "77c43f83-7cac-423e-adad-16e07bc4a81f", "value": "SecuriteInfo.com.Win32.KeyloggerX-gen.7276.1670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6614f3e-378c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691678879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678879, "uuid": "bf4515d6-f6b9-4d98-a285-ed1c28c01d79", "comment": "Malware payload (Formbook)", "value": "e0551bbbadf33f57623855c451159856", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678879, "uuid": "04b36010-b89f-4455-946b-c187de822b21", "comment": "Malware payload (Formbook)", "value": "9bf562ff27545fff269188ca1a20488c8575886956550f41b328302db4257e80", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678879, "uuid": "1054f7aa-96c1-42a0-97cb-a915e8d26b74", "comment": "Malware payload (Formbook)", "value": "e5c67d69937ac28f91c3284f30a79f0c55e611d0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678879, "uuid": "268e37ed-1610-4078-959d-627d81cf0700", "comment": "Malware payload (Formbook)", "value": "40532d12332d7194d63f30990ea81dc8c7ac855176e4a3bbb869c2e32743c698c1963101b15d5c9af612a82687b7d127", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678879, "uuid": "9926f526-f66a-480a-8ed5-1b61372926ad", "value": "T18E55F103E900DBC3D41D83F87E530EE90F0A6F19E99569DB14667F9B3B70A72099A12D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678879, "uuid": "bb1999e6-c2a1-4694-a2b9-a0b012057d37", "value": "24576:yaZy0w6VgjKaWlEzp7aOZyaw6VJjKaWlEzp7ayzdbiMb7QA5Qp5E/kwnx:yE86VgjKjOzzy6VJjKjOzndd7/5X/kE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691678879, "uuid": "4ab581e1-f297-487a-b6d4-8ca6c8bb5ddb", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691678879, "uuid": "56453a8c-b08d-4f6a-8496-37cd29784935", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678879, "uuid": "ae51abd4-7d48-4eb1-a72b-bafe637bb7c7", "value": "\u00f6zellikler.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d5bb87-379e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691686238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686238, "uuid": "9c55cd56-b475-4d4f-b90d-010c2df406f3", "comment": "Malware payload (Formbook)", "value": "639f7cc13ef676dc11432dfb872f5ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686238, "uuid": "8775d597-1116-44ce-ab3b-662170e57d90", "comment": "Malware payload (Formbook)", "value": "9d0a05a5f2cd9f4ab18c167ee94b33669992d74140a0d334e84eb1b2efd4e313", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686238, "uuid": "bf16ad9c-2c47-4726-a0bf-dc87f83537db", "comment": "Malware payload (Formbook)", "value": "23a4da56a9742debab3f57229ffed9bf35ef7089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686238, "uuid": "66f9cac7-c4c6-45d1-8509-8f7c9c181490", "comment": "Malware payload (Formbook)", "value": "f7e6b34cd0c07e7b11ec1e68bbd53a0478a436cf5a52b22b600e11d79728692072e0e3823b116e2b116403a02c190a53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686238, "uuid": "de230a8b-83cd-4b80-9bfd-5431e4b298c5", "value": "T1CFD4228A2B59935BEC7142F966922761537E330F11A3FF8EF9C620C09964F949F44E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686238, "uuid": "6a0c8e9d-1a75-41ab-9716-d029c679a333", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686238, "uuid": "88779e45-a559-4527-8175-336d5c367059", "value": "12288:VbL87+2b/Sx8Is+mhg1S6Mnps0Pb59vKWKDOuPblYUKCvAXyYL8:pg7+2Lvt+cS8sAb59yWKpPblYUKCo3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686238, "uuid": "6b89a254-9d11-48c4-8bd2-c8353f2213c4", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686238, "uuid": "d9a47d13-b6c0-46f6-9b84-05d2d2538103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686238, "uuid": "72363dfd-d976-46ca-b8a1-09636e42f361", "value": "639f7cc13ef676dc11432dfb872f5ea5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a661f0f5-3735-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691641405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691641405, "uuid": "521656d9-3a80-4fe8-8c60-ca8fb90c38e1", "comment": "Malware payload (AgentTesla)", "value": "b9b220ca3041bdcfff880bedd519ab85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691641405, "uuid": "85593019-0787-4074-843d-e8bc32c5dadd", "comment": "Malware payload (AgentTesla)", "value": "9e5550baaff66b95e879eaec6b64570be212108120e8da8b6b7cc9e59d943475", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691641405, "uuid": "3abfe9d2-bf66-4d58-8d40-1a72b896b207", "comment": "Malware payload (AgentTesla)", "value": "632ae37779124a963e3155cc9b2aed3d21585f89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691641405, "uuid": "b5288098-8158-4710-80cf-71a2e12919e4", "comment": "Malware payload (AgentTesla)", "value": "db1eacb7415f98585070d48d0cb2a7c10e933672e448dec45047d801f26a906b6022e016ad27153aa9460ba156ef7ed4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691641405, "uuid": "4b8e6ea2-be94-4b0b-a8b4-50f160d065d4", "value": "T179D402AB2BEE5B74CB9E29773420305DA77684C7392AD7061C7E70C62E42FF6412415B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691641405, "uuid": "d4c5f590-cfdc-4a21-be5c-5ee14a9581e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691641405, "uuid": "a29af0db-91e6-4120-b253-bde0cdabd4f5", "value": "12288:rKIpWDVpFQ0Pp6Dno2Onm/enkTV0u11fU/i:OIpWDVpFTPp0n6nkJ0Y1fUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691641405, "uuid": "f60de09a-89e0-4c8a-b235-6beb712c7988", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691641405, "uuid": "96090df4-35f9-491e-a8e1-68379e277a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691641405, "uuid": "e6148a0b-dafd-4db6-a8dc-b3c5c9c19281", "value": "IMG_P-Order No.# P0004028 & REG 1605887902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653ab233-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691685964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685964, "uuid": "8d0f20a9-3676-47ad-8864-6f55b74286ba", "comment": "Malware payload (AgentTesla)", "value": "de0a0d1ec4d8179c2d1f85651cddd8df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685964, "uuid": "781e25fc-04dc-491f-9470-d940c6512093", "comment": "Malware payload (AgentTesla)", "value": "9e5571ed576a34d5cad9c0ea25ea755c97caa31d5aa40c455201ddc21bda3576", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685964, "uuid": "c47ae4a0-4a44-41ba-91b0-b9a80507c3a5", "comment": "Malware payload (AgentTesla)", "value": "82462e5e2fcfca7f0f7f27aeee397fcf749d6658", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685964, "uuid": "ed3fd40f-8548-4da8-b342-ce82820fa006", "comment": "Malware payload (AgentTesla)", "value": "bd37aa5b1e7517496bd79dbf3d98484bf0ff681c18ca00618dd3cc22fa5f10246b8db6a9d5abde7f4e81f5e5a900204f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685964, "uuid": "55a4e5cc-7fd4-42e9-a22e-e2ab5557405c", "value": "T1EF45E02676769472CD44CB35C5E7891082E7DE8966E6C90A34CA735C0B323BE8F276C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685964, "uuid": "6a9c08f0-4dbd-414a-b474-4d92581cbbb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685964, "uuid": "d53c549c-77c0-41db-b81c-0f9740284743", "value": "24576:+bcxt71Hf8C2WW0lXBXagmjlNaT/nao75ZLmxAEZY:nf8HWWmXR/ilkVfwAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685964, "uuid": "93e26aa5-a61d-482a-bb08-bdc7b71bd2f0", "value": 1259432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685964, "uuid": "9863349c-b3e5-48d3-8e67-30bc9f16e1e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685964, "uuid": "a5b8cdf1-6f2a-477f-9e0a-b9211d0689fa", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20d31ea-3725-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691634660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634660, "uuid": "6c850b32-0553-41ee-ab2f-6c6082f9b611", "comment": "Malware payload (Mirai)", "value": "fa93d9a2204d9dcfaf5c9729eaf034cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634660, "uuid": "39b9ce9a-349f-4b69-b67d-df99081c0033", "comment": "Malware payload (Mirai)", "value": "9f1d914e9284760bcd1906cf7f8617983f1d9993da5757d559b32d32369a4181", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634660, "uuid": "1d589d8b-9754-4f83-bf8b-f4e914e25db1", "comment": "Malware payload (Mirai)", "value": "fe42c6aa5c82b39043d8c0df287c563b6c12c9ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634660, "uuid": "0d2a0a3a-e2ac-49bc-980c-384aa0d9e221", "comment": "Malware payload (Mirai)", "value": "848edf321ddf867299fb5345ff7e83f8114f1b7fe313ac750cdf0c6ad0abf82a2531095eeb8d5bdc5a87c378edbfedc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634660, "uuid": "353473a8-ff97-42ab-8fec-61b06ce13d65", "value": "T133E2E0F8E08A9830C7D45C71AE26CC647B0D16F0B2C875F12B298D2CBDB5167896E94B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634660, "uuid": "61f8f8f2-9a5f-48f0-8f20-2426deab3eff", "value": "768:lPVC4AORNA1C6HrwczWlSQrXrIUGMU4NU/22wL/N2pfsX3UQo:xRAORchHrw3SirIUjNAj6NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691634660, "uuid": "6ea82e77-f010-41c9-85c7-c9bb9a3dbeb1", "value": 33284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691634660, "uuid": "fecb035f-8243-407f-b582-b1b98ac86c16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634660, "uuid": "0a865d0f-af96-48fb-9add-1409dcd44c54", "value": "fa93d9a2204d9dcfaf5c9729eaf034cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e81d85-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691648676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648676, "uuid": "1dc1a75a-a8b4-412c-b6c9-6911284c4418", "comment": "Malware payload", "value": "037fc58fc5b2f13f44c20ea104b15020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648676, "uuid": "5ca9e573-25dd-4310-b31f-797f5bef77cb", "comment": "Malware payload", "value": "9f8d8ee766fa761f22f4f77ead6e55d5165400db9ff50a32151e7bbc1f86ec32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648676, "uuid": "708c5678-8e7a-497d-9126-6aaa458eb98c", "comment": "Malware payload", "value": "71e8714f84a6135f4ba7bb6067c3c029b85f6b3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648676, "uuid": "5bbef70c-3d62-40c7-a028-90d71e0ff4e0", "comment": "Malware payload", "value": "02b2275fba40e1fdf2856796c0a8e7fb18e308aa63c1f5d647b5536212176be85fce86f91d1710f655a5a6e0b31e465e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648676, "uuid": "788d72c3-0691-4696-9103-93ad36d1fdb3", "value": "T191050825E77B645AEF19A5E88E2F847238D6DCC0F1B5C588A7E72C0385C23214D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648676, "uuid": "4b1e7aa1-cff7-4c3d-879c-d6ca4e42bf9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648676, "uuid": "f02d1e96-850c-4261-a734-f38ca86b912b", "value": "24576:W92KRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOH0zPdQMOaK0q+hpYlbM:tKRs6CE3jLbO9Rs6CE3jLbOUzF9Oj0J9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648676, "uuid": "7e1bc9b6-506f-45f3-a318-6c7de676677b", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648676, "uuid": "d5b21b06-08e6-4394-8dd1-176a1e9feb24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648676, "uuid": "78212af5-b775-4fd5-995e-d91db331b281", "value": "Request for quote_S020-230710.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369c3837-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691685886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685886, "uuid": "9b6ebdb7-383e-493b-9dc5-9c77426edbbb", "comment": "Malware payload (GuLoader)", "value": "3a4573d8d04df837bd32d2ef156e44aa", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685886, "uuid": "94de6c5f-e380-42a2-85eb-c4624ccf2332", "comment": "Malware payload (GuLoader)", "value": "a0ed9aa9fd74c33893155220c4467b83592ac8e7244475d5cbf7b37a7075af36", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685886, "uuid": "47b20428-2b55-412e-b6d9-6a3c88fbe48e", "comment": "Malware payload (GuLoader)", "value": "7c8d941ba5c89c9d7d4d36f3a41f3a2d3b0db847", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685886, "uuid": "b869e413-f517-406d-a42d-662bf848c40b", "comment": "Malware payload (GuLoader)", "value": "259059e5f2b0d4100d950611b4c55a99abe8d445a6e73fa034e7fb6fb84aaa866243ccf87c587cac13b6aab9a7e32a30", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685886, "uuid": "fee47969-ac7e-47b3-be2d-6ac6c18227ed", "value": "T1A7D4BEC5E94055A0ED1AAB706A37CD358623BEFDA874941D29DE3E273BFB3932025053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685886, "uuid": "68464be2-65e6-43ac-8bab-9edbb645f0a7", "value": "3f91aceea750f765ef2ba5d9988e6a00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685886, "uuid": "720960c9-3b36-4648-98fb-c1fde773ad32", "value": "12288:HfYzP7r9r/+ppppppppppppppppppppppppppppp0YcfOZIW3I5GSY7HwOUwaIqN:/Yz1McGZL45qzvqb5cPzzEroM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685886, "uuid": "f5b07652-705e-41dc-bf0d-e908decddb1a", "value": 651160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685886, "uuid": "449086a6-6e21-4e14-b47a-30cd1b9c92a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685886, "uuid": "2f8dc90d-2661-4950-9ca0-c1527f8d5f8c", "value": "DHL \u53d1\u7968.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf037da-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691648637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648637, "uuid": "a4104fb8-2701-4b33-a569-50eb9dc38338", "comment": "Malware payload (AgentTesla)", "value": "4da2a8576ba336431d9346e0cad37906", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648637, "uuid": "be98a4f1-912a-49f7-99c5-a31759a4322d", "comment": "Malware payload (AgentTesla)", "value": "a130859fe78063bd4167573fa4946db231d1f45a95fd2efd31848fe5787a3530", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648637, "uuid": "2c90aaf6-2484-4382-ae8d-6132a3222d61", "comment": "Malware payload (AgentTesla)", "value": "5f11f127e5a6228c9ae2a5414ef1734dbe16b735", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648637, "uuid": "c9242281-12cf-47a0-818e-c41cdb12b7e8", "comment": "Malware payload (AgentTesla)", "value": "e41119cb83174457ea2e28339f7516c536c57ea8b6a31ccfea84d7162888d63b38cbb276e7a7b2ba4efefc07ffa8db88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648637, "uuid": "05cb504e-6e87-4fbe-8788-e70554ce8c4f", "value": "T191C423D573F88F69DAF9E17E3C2148044331544EE87DE54F284C60B2BA7AF40A589BDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648637, "uuid": "507a50ff-b9c7-4f6f-8bef-9034a499dcfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648637, "uuid": "199237e0-e02c-47c8-badf-4ade05aee4a2", "value": "12288:QGTIYlV28mRGivPG6nRJdnw0R9hRhBX+DIsGoWd7z+h:fIYlVnm8iH9nHdnw0LplsGoI6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648637, "uuid": "e5ff6f37-e217-4cdb-879c-0114eeac9b9f", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648637, "uuid": "487cd175-0bf6-4496-b3f0-9f002aa50d0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648637, "uuid": "393a03d8-94ae-4dae-a472-ed160dab9a79", "value": "4da2a8576ba336431d9346e0cad37906.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f04392-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691648819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648819, "uuid": "de818eec-ee0f-4dac-a849-ea6488212ee8", "comment": "Malware payload (Formbook)", "value": "8e5b379cc724af633767d4c1032c59f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648819, "uuid": "f4bcc089-f604-445b-953c-28206553e028", "comment": "Malware payload (Formbook)", "value": "a16bbcd964ae89f1cae59ed66c22f1009830c91db528215972952d97433bfb71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648819, "uuid": "47af8033-3c4a-42cc-ba1c-fcd7e37e0fa5", "comment": "Malware payload (Formbook)", "value": "bac0040f399cee960c78c9e4e2491b0e9d353d06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648819, "uuid": "64fb8c5c-2e07-45d4-86b8-ad4166d335a0", "comment": "Malware payload (Formbook)", "value": "2b9b886e9c0d1f1bbda93b1d009aa9771b319cb741e7dfa55bae3f16a1f8f44c3804a00634df7286eaaccbfe1c9d1f06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648819, "uuid": "503114d0-32b8-43ae-9ac6-4b9945e01f51", "value": "T1CCC41345A3E9CB38DA7D92BF782411004B71A86EB4B1D75F6A4C24249D37F802AC5FE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648819, "uuid": "e5a53644-1bae-4720-97be-0816ad16a8ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648819, "uuid": "0d87022c-b009-48a2-aab5-b296cb910026", "value": "12288:nGTIYlV2JyweBi2WTkjNX5rj6sQ0ht5eI5QBYHWaD9JpThE7c:kIYlV8y1i2WYP6kht5iBI2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648819, "uuid": "b4e99a56-b79a-4a1e-a0df-e758007670f0", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648819, "uuid": "3fc51049-06cc-47b2-a39b-5fcfc7f7a9e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648819, "uuid": "9d1b7a2b-7e7a-4cad-8145-42d3e5288c1d", "value": "8e5b379cc724af633767d4c1032c59f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed8ba32-3739-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691643003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643003, "uuid": "faae9189-7d16-4694-8bdb-a9711fe59384", "comment": "Malware payload (Mirai)", "value": "c5d923b518bcfd53769f759b43f0a9fc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643003, "uuid": "b63498f8-a288-4c0f-afee-735672eac0cb", "comment": "Malware payload (Mirai)", "value": "a31416d697450b9550945b74daac7e3c1fcccf2e200e3927a8bf2ea0e6d4cfed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643003, "uuid": "f1bf300a-fad2-41da-9f11-884404869fcd", "comment": "Malware payload (Mirai)", "value": "df4e9b20daef71cb823aa53a05aec7358da01385", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643003, "uuid": "982c2b33-f4b1-4999-a534-1c4f9ace9d14", "comment": "Malware payload (Mirai)", "value": "ddb1549fe64b52849f135eb48b808443103f6db0c61bca79cee08a6594a3fb4974d706980f070191008aefab0e2befc3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643003, "uuid": "47dfdfed-032b-4be3-b072-c66f16fe4aa1", "value": "T1BE330213B655FD62DE752C3A76F98C8E3184026DE4ECA82239C858A062C315BFBE45D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643003, "uuid": "fd12bcaa-27b2-44b5-a992-476be56bf0ea", "value": "768:vfZYvZxNZ/SPjiUv0w0zyIvfgJy2LHRfbwB9q3UEL2qEK5J6OAsNTGjf2tl8XOYO:0PtQjiZVcykHRDPL15J6RN2tAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691643003, "uuid": "2cd3c39a-fb72-4dd1-8a3e-729278381142", "value": 51432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691643003, "uuid": "a8fa69b4-016f-427c-8894-d11bbc51dd0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643003, "uuid": "a8cdea7b-896d-40a2-a68c-6eeb4d57b026", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bbb3c2-3774-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691668541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691668541, "uuid": "0536bc84-af6a-4569-b633-ba379513621e", "comment": "Malware payload (GuLoader)", "value": "19e11d4c2dd38edd7edc25de803785c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691668541, "uuid": "86eb35b9-d7a3-41d6-9518-e03b4e746654", "comment": "Malware payload (GuLoader)", "value": "a44bbaa1a6edbdf6d0e0572429390286caf17b946f5976ccd79cb5402c07615d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691668541, "uuid": "d0f50853-495f-48f4-8516-3d88783ab9f6", "comment": "Malware payload (GuLoader)", "value": "c14aaefa2ff85b34407dec7a3d03d8541f772191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691668541, "uuid": "8f4d55df-321f-47d8-ba04-f45591ef45ab", "comment": "Malware payload (GuLoader)", "value": "949c8506b4372a8ce28c964795286f3df97fac18815eb4e47a29e78b40dd80dc1d70361bace78e0d66e6f7979a722ef5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691668541, "uuid": "0ad5ebed-771c-484f-a257-d748c7ef60cc", "value": "T171B48D9639CA35AFDC2F4578035FEAB62A795CE0B381496E4F40360E4C3664A80EDDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691668541, "uuid": "b85fbd1f-e12d-417c-9c5b-ace90b2c72fb", "value": "dd68e663380c71f66b512f005f1be7ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691668541, "uuid": "7e6f0b2f-7a8f-4c78-817f-e90b763cc074", "value": "6144:JcqNGUt5PZVheNA+ff0DIan6RcXe13gNxZDHY1MzYMfTvlzmvYgEXwuEEO29:q0nhe2eMd6RdduHYMLfblaw3guEBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691668541, "uuid": "c5ae02ed-f191-4b5a-b9e2-2a5f5737efed", "value": 495192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691668541, "uuid": "69971f45-953c-422c-8def-504d2268a83f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691668541, "uuid": "fca75731-5959-497f-9167-38e8b647eb8d", "value": "Scan_20230810_0326419.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97bcdc5-37a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691689192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691689192, "uuid": "71fd7b8b-c282-42ed-a5f1-2d839e0aa77e", "comment": "Malware payload", "value": "228f3b042d432eb4ffa95a97ca6eea4a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691689192, "uuid": "88f2b19c-c26f-4352-9ae5-38715fca786a", "comment": "Malware payload", "value": "a5ac36f6a99ec92dedf0f7540aca80496e33a976e9a74f74f81c46dd0b6daab7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691689192, "uuid": "25bf4502-722e-43ae-961d-f3d39f7144d6", "comment": "Malware payload", "value": "677e75d0a274b8bf9f71e01c6de0d10761338b35", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691689192, "uuid": "a9b0733e-35a3-485d-b7c9-939c8988e411", "comment": "Malware payload", "value": "d825c98c0083dcda222707d4f057f0393ce6c5f8253bcc54d0ee56d182e81465ff5eb68ddcb9c13f58a56293e40b9818", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691689192, "uuid": "d2898587-6de7-42f4-a12f-f3f6f96f685f", "value": "T10EA2CF67CD104C3CE336C132A6DA2204D71C6547912B6C8EBB32F31D8E79ACE9DBA548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691689192, "uuid": "06abe7b9-50eb-4c4d-9a3a-5f00d448a93e", "value": "384:3I+R9SfG6f59UORfqNy4Y0Fivd7ZMM4EUS9rDhCl0mppOkFzO7Y7E:3IzXomfsRYKiAMx9Xg0mptRaY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691689192, "uuid": "8866423b-df0e-4208-9397-0e0d9f4f21dd", "value": 23256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691689192, "uuid": "67b351a2-afb4-43a0-be81-f1756abafcad", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691689192, "uuid": "2626c4e4-767a-48d2-99c2-d8edaf87440d", "value": "Orders.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e147920b-378c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691678870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678870, "uuid": "b898ff50-b907-4b35-b543-19411fec7c15", "comment": "Malware payload (SnakeKeylogger)", "value": "cb3ead33bab78e6104cee8dd36e0940c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678870, "uuid": "d3e7af6d-8d79-400c-854e-9285dd418f69", "comment": "Malware payload (SnakeKeylogger)", "value": "a5dcaf9bfcba856c3a83a9e7803408a53f61bebf5ec213ecedf90fc14893f8c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678870, "uuid": "552b3374-db08-464a-bce6-d48d6f6194c9", "comment": "Malware payload (SnakeKeylogger)", "value": "ab126e8ec82c27dd9a852d9fb84cb484860ab292", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678870, "uuid": "a09c58f1-a028-49a4-b95d-064ecd18a5e1", "comment": "Malware payload (SnakeKeylogger)", "value": "5cb6247c9f2b6eb25041729b726dae8b79f1344dead006ee7a8e6a01efedf32639c23639834004127748595b487a43dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678870, "uuid": "3fb2eddd-74f2-4fad-bbf7-af7aaa283b5c", "value": "T1B944012A2891C42BC5D17BF459B5525B1E3A7C811264C14B9BF03F65BE32163DCCB3AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678870, "uuid": "3d318e80-2bb0-47c9-8da4-8cc5d1506ec5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678870, "uuid": "552069a9-e440-4d57-bcdd-4abae374c9ab", "value": "6144:wYa6JEVDOwgFc9nP3/x4Vb4ujkMWsNDZZg5U3O:wY7/wgFc9nPw3kMrl3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691678870, "uuid": "e3b5698d-5e62-4161-b052-e3898e0200a1", "value": 270253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691678870, "uuid": "2c603134-f136-4983-a61d-7ee697f88fdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678870, "uuid": "c2165cb4-6690-41e8-9fa8-8b2dadb179f6", "value": "SDF-865433567890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e405c6e-3734-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691640855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640855, "uuid": "8fa486a1-0f78-42b8-9c39-2080dd31cef8", "comment": "Malware payload (Mirai)", "value": "acde349bf1f727e275bfdc9c82f64c38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640855, "uuid": "9175211b-7710-413c-aa81-6904431cbaf8", "comment": "Malware payload (Mirai)", "value": "a6ae6ffbaa233a0c676227fa95ede79fda699adcbbd42c8e34cb21de4c906d50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640855, "uuid": "5785bffb-4734-47d9-8d3c-1ad8d5e824a4", "comment": "Malware payload (Mirai)", "value": "c42a8315a80a6c375aa1ef4694aa6519312d688b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640855, "uuid": "82f8c940-e43c-4d82-b353-fb8c280ee4e1", "comment": "Malware payload (Mirai)", "value": "2f2143396aa0ec72962e36fc7cbdbdcd93896fabdbab2cfd01ca3be19603854ee847a33b6289538a0445eb8edf578ea1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640855, "uuid": "4cb05bc5-40ae-4593-8427-fe6c07444d30", "value": "T129333BCDC862AEBAC004E070B8796AB56329B4417A8F0ED92479C751479F5DFF00F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640855, "uuid": "982be9ca-24e9-42bf-a2e3-3ce812974a1e", "value": "1536:2BC4pELiYxiqd90Op6X5XV7K9zwLKqviClBu1Hc:2BXnY8qshX5Xw9Lqvi/1Hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691640855, "uuid": "3c6a35b2-6b57-45e7-b833-1240ef48e14d", "value": 52796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691640855, "uuid": "3dc12207-b45f-4d7d-bd9d-c4db05b8f559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640855, "uuid": "39bcae0f-d5cb-4cad-be7c-dca103a4b782", "value": "acde349bf1f727e275bfdc9c82f64c38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afccd4a5-3797-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691683512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691683512, "uuid": "80ae1cb1-09b5-4d78-8b2e-67585482b31e", "comment": "Malware payload (AgentTesla)", "value": "369a9320253fbc649d049beaa688b54d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691683512, "uuid": "de25361d-d1b7-4352-a72c-50bb23bc4ea3", "comment": "Malware payload (AgentTesla)", "value": "a9711eb5fd52e614e38de823166fe2789c360ea3b98feb91fc2cbdbe8f6f1d14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691683512, "uuid": "efe7fcc1-a264-4701-a3e9-4c4c9eca495f", "comment": "Malware payload (AgentTesla)", "value": "7f68907442bbb4ee545e1acef38a58e5cf6cf2db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691683512, "uuid": "daf4a3d0-17a1-4755-b2ad-fdaf6391e894", "comment": "Malware payload (AgentTesla)", "value": "e4062146537a4d5c678be08d6c0a7a810c534407033b4adca87fa3e6c02dec50dd27077271146cafbf2a1b971417e048", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691683512, "uuid": "b4f6119c-903d-44a9-b7f5-073fa54a14d0", "value": "T1C943F1E5F80F945D4D2697C864D3F5C1D82EEF714839B8EA24099E1E35BE9CE02D04E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691683512, "uuid": "16f38f2f-74ae-4c66-ad28-bcf231d8bf27", "value": "768:Z7zEemtzrQvT+husucEFMD2nXNj+YJ2FicpxU88rVb1qdjStZz1a3TsBsD+wxVyx:Z3EPtY1suWmk1/xTWvqMZi0sKUVp0YWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691683512, "uuid": "72bf775e-937b-4a6e-8c17-b23b1888c4d3", "value": 56461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691683512, "uuid": "08f62f79-0ac2-4325-9101-4d29f64f1e0f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691683512, "uuid": "d8756da0-f3c6-4aee-98e5-ed988c8eeed2", "value": "\u00d6deme \u0130\u00e7in Proforma2 Fatura_10.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e25ecfe-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691685871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685871, "uuid": "ab579af7-4d4a-405b-a2fa-8aed076ff502", "comment": "Malware payload (AgentTesla)", "value": "e5de1625c9e06a6431390bde3745cc32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685871, "uuid": "e736ea1e-6648-458c-aa10-d2acf02d17c9", "comment": "Malware payload (AgentTesla)", "value": "aa28b13f66f7deffe58a15858419073c109c0ea6b50945d0f05aeaa474307b3e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685871, "uuid": "399eef83-fc41-451f-89b1-dbda1871ddfc", "comment": "Malware payload (AgentTesla)", "value": "c8929695c8d3c46a7e0c14f3fc082e26bd19fa1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685871, "uuid": "26bded1c-ed97-4aad-8eba-a46c99e148c5", "comment": "Malware payload (AgentTesla)", "value": "6f208ce63ba00c48952598a7159079cead40ff88d50992d6dd35f154facb29f080f57769888ca080e2637a26ea486260", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685871, "uuid": "eeb78d8a-17c8-4ca3-ae64-1091150e2cc2", "value": "T1FCF402BEB3E7CD34C7B8613AD66261104330565BA253E70E160833D9992EBD36265BCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685871, "uuid": "90fd969f-5a53-4c4f-bef2-79a4e323c7fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685871, "uuid": "8e87d8dc-9898-4320-a288-e980f599c4d2", "value": "12288:GjHGGTIYlV2Kw0gcJKB4SsIi4wHcGrY36wIy/VQGSTUqwjQD/ccx13PhXXNGn2D:WxIYlV/w0gcJiseIc4S6E9Q2qwA/91/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685871, "uuid": "4181c27a-ce6d-42ae-be41-f582dbe538c9", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685871, "uuid": "de8d46c0-046b-4868-93b4-3d9b1b9ce209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685871, "uuid": "3c74fda4-3e18-403c-b11d-46ff62c72239", "value": "AVISO DE COBRO DHL - 1606695713.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205a301c-379b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691684989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691684989, "uuid": "3db91c97-d070-47a6-90b5-ab4fd6341b8d", "comment": "Malware payload", "value": "ee0fc396514705c3ac2b0a87f10ab637", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691684989, "uuid": "e534c372-aaea-44d7-b085-74cbd6f96f7c", "comment": "Malware payload", "value": "ac55dbd8dfbe7745c4bdb14fb56cb47ba85ca63dad2c0f6233efb66aaa916e6b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691684989, "uuid": "871deb5e-beda-4f19-b3ea-c1a3b2ad9029", "comment": "Malware payload", "value": "8c1d985da3e04ba2faf8ee5e821f055ef5ca65c0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691684989, "uuid": "55b9df70-778b-442d-ba80-ef2a616f82cf", "comment": "Malware payload", "value": "c61cb838d718e3e5a58388dc14c31e207a47e3083a3ee79b03236953c97e3a39902afa5e1eae94b74db6838ed9b7ab2b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691684989, "uuid": "2f29daff-063f-43fd-8b76-0db28498104b", "value": "T14DD34B00239CC9B5F177117A0640A5720DBA3C75BB7F899EAFC65C9E82789D07364BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691684989, "uuid": "6800a842-f4c1-4b39-8e4f-055944f95469", "value": "0b8af3550b5710c15669b5b350fa662d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691684989, "uuid": "ce917ff4-a85b-4ee8-9315-6f3632e194fb", "value": "3072:su6UAGK3cYPlCUnXDYT4bpuXYeRUHSvceI/BE:sLiScYPUUW4b4LR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691684989, "uuid": "47b9398f-6be9-4b99-9a79-eb84602bab9b", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691684989, "uuid": "82069113-eb78-4a0f-b333-7f31073d7695", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691684989, "uuid": "f4e28afb-ea8a-4d8d-ad00-b8e45b467056", "value": "SecuriteInfo.com.Win32.PWSX-gen.29294.7204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90448ef-378c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691678910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678910, "uuid": "c4ae403e-2135-4b92-b4d7-965a0c543461", "comment": "Malware payload (AgentTesla)", "value": "e7f4aa44f86f971f0920852c368c40bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678910, "uuid": "3b6ecae4-5a21-4d86-987b-1605f035bc4f", "comment": "Malware payload (AgentTesla)", "value": "ac9e25f541065a26fb3dcb26ac76ca5c5ffd44a03973a07f049730f0760d4b04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678910, "uuid": "87438c9e-5fe1-439f-a0f4-96897ab702c1", "comment": "Malware payload (AgentTesla)", "value": "c8f76762db9569d881e5dac95139e766b8f3ee62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691678910, "uuid": "f873fcaf-872c-4494-892c-1f51c3e25993", "comment": "Malware payload (AgentTesla)", "value": "1ed1750050e2c36e5ff9af412b11bba8cdebd2fa3fc7823957b579535f50cc6c8fa800f5edbe947db5d899e66f28ba8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678910, "uuid": "46a1fc57-ef95-4085-bce5-485ac88da495", "value": "T16734BC1162EF258CB1B37F5207EE69E98F2BB7E51A3A645D214C030B9BA7D40CE54732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678910, "uuid": "33cdb598-1495-4850-82fd-103ca63fd1c0", "value": "3072:65ATFpVDwuwfw0wdwgwhwawPwvvYPx0mLreIH:RD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691678910, "uuid": "cf5ad899-463c-4131-90a4-8c6a7769762d", "value": 251534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691678910, "uuid": "526c4942-2501-434d-9277-6b7df55e7301", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691678910, "uuid": "e2e569c0-9643-44b7-8b8c-30f419950081", "value": "\u03a4\u0399\u039c\u039f\u039b\u039f\u0393\u0399\u039f 7406_22 09 2023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1928419-3782-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691674469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674469, "uuid": "3dcf4e52-8f90-4857-a95a-1f216fe29cac", "comment": "Malware payload", "value": "9566b289e697783babb089d7e5ca8def", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674469, "uuid": "e553c569-1e4d-4391-acc5-388d04ae2fd8", "comment": "Malware payload", "value": "acdc07112705fec50079867c8bcf345a51d2be70a97db00a2070e25ccf9c6c9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674469, "uuid": "e3d1d651-ed75-482a-b706-e50606648c36", "comment": "Malware payload", "value": "844d7a04c921eb1c4a6a778356e2afc85e877e9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674469, "uuid": "37126c00-24f9-45a6-82bb-da79232d434e", "comment": "Malware payload", "value": "0dcebaf3863c60a563f99a1b46d09dd13d5ffff0c6b7b4c95541e663dc9d786521ce1cd845a74122bee26701fda26072", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674469, "uuid": "738d2615-d2d8-4a1c-898e-c6711fb4a7cb", "value": "T1D9133B57A71C0747C1AB6BB43D3B23E0D36EBA6112D481C4610ADEC557B6A31E263FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674469, "uuid": "ac1716df-81b8-4f65-aa10-cd59370635c7", "value": "768:vfYy3khbYuDtqZlG9Eut+bFoOtiRFZFw+tBmBIb:vfYy0hbJawEQ+JoOtgE+Tuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691674469, "uuid": "1363df23-7c40-475a-b226-1fc77a3aa1b7", "value": 44644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691674469, "uuid": "c33e3f6f-ff93-47a2-b43b-ff959a70a8ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674469, "uuid": "d6cd6d44-0cd3-46be-80e0-7f8bb505cb1a", "value": "SecuriteInfo.com.Linux.Siggen.9999.7690.15126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f3f889-3745-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691648272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648272, "uuid": "3ce3a5eb-78c0-4678-8e6c-19ce32f5353a", "comment": "Malware payload (AgentTesla)", "value": "a46372aed0b1f8c7566ec005e988d1ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648272, "uuid": "06502e3b-917b-4b04-ad15-49c80f8d2173", "comment": "Malware payload (AgentTesla)", "value": "ad1c10c027bc166ee2c44c5c041680e71b56818b3ede8acffe20e94c4e754997", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648272, "uuid": "828bc87c-e73e-4a4b-a9b6-df59a7216c60", "comment": "Malware payload (AgentTesla)", "value": "b9f7152e6e028d28c4d8b440ed80dff4ddf055d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648272, "uuid": "5d95f226-e341-488c-a15e-12c11638696a", "comment": "Malware payload (AgentTesla)", "value": "15387cedd5bd52febb5277086533c8d6fcdaa6868af92a49c617b441f47204149df0f197251608e7c35469925e0245c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648272, "uuid": "92860086-0f8b-4bbf-aab9-89525033e619", "value": "T1A1D4238263F14E94DE7B6BFD65120480AB21790FD81FE64A295C3102AF76F611690FEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648272, "uuid": "b8183276-625a-40ac-a091-20142821e0eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648272, "uuid": "f2658ade-4642-4da8-a37a-0bfb20e4cc69", "value": "12288:NGTIYlV22rPq5BFpGkDFfo6/6i9iGNyMQXwIx3NHy8L:+IYlVTm5BFpGk1/6miWy/xNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648272, "uuid": "54142222-dc11-4c79-b6c6-56585d941f9e", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648272, "uuid": "9ed8c6b1-f859-4236-8934-6b3e740a893f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648272, "uuid": "362c4e2c-80b0-4a25-8540-612cda4f8123", "value": "PQR2101-23-pages-2-3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fce78ae-3772-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691667379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667379, "uuid": "bdc37879-e440-446c-8598-94d78a11c035", "comment": "Malware payload (AgentTesla)", "value": "212f2907fd0685c500acdd6fcbff894a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667379, "uuid": "427533a5-4fd3-4498-923d-6e1dfb79ac05", "comment": "Malware payload (AgentTesla)", "value": "ad67a54eaf179539edf3c7949fd5a2b0939b52eea4512a9f16840fdaf9b43f03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667379, "uuid": "337f6298-c9bc-479c-ac36-f156c3705291", "comment": "Malware payload (AgentTesla)", "value": "344c174b2c068eaa68ef3896984d9799be397035", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691667379, "uuid": "8d3dee13-c915-4a55-9c3c-1ae6231a7feb", "comment": "Malware payload (AgentTesla)", "value": "05b059aad981651a91211479fcc6220aa1db204e8b3d222afd62c273c29a7f6731ca501aee7ba38ebb7b644c008722f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667379, "uuid": "1cac801a-f738-465c-a760-2a9089d18919", "value": "T1C7D402AB0BEE6B75CFAE283B302231AD63B584CA3515F7861C7C70D62986FB54131197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667379, "uuid": "dad5764f-5c2e-488b-838d-d60f5a32092b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667379, "uuid": "46d2091c-c0c2-4c24-9376-a53c1b3bf530", "value": "12288:1LIpWDT3FQo7cPUrjoTtcqj+F09pCo9p9qGdne/NIV5kIYd:1IpWDTuoh3ScYD19NqNuk/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691667379, "uuid": "740629d3-0ea7-4376-bcd0-bff827ce5c83", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691667379, "uuid": "232369e1-5511-48c1-96f7-0bc7134bd4f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691667379, "uuid": "e947822b-7744-4df6-b9a4-51af33df6fec", "value": "IMG_Scanned POs AllComps EPDAs & comp POs, PSB-17398902, PSB-18384789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a8ab6f-379e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691686240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686240, "uuid": "bc61a951-6f36-4884-bbc1-3b2117f78429", "comment": "Malware payload", "value": "c03af23c91ad91a8b608f9e6d5a35773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686240, "uuid": "f9055744-ec6d-4d25-9d3f-d2d3f2a8d107", "comment": "Malware payload", "value": "ad6b1dc35e7ae440713d9487a911f751d8501c21d10f96680339ef1d6530f78f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686240, "uuid": "cfdc8cd5-dbd9-4a06-bc61-52fc77a5b78a", "comment": "Malware payload", "value": "bdebd44b9536752aca94aa3331d8cfba4bc5525c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686240, "uuid": "fb025920-541e-4619-8435-0cf7606021ae", "comment": "Malware payload", "value": "da8c68142efe20d13121b0a5876bf04821cfdcd6530c178241ddf6b38728db16eaf5e92cce441fb884cdc7a92ab37af6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686240, "uuid": "5e3199ad-0c81-4f61-a9fa-d920db128590", "value": "T13D048CA9A18100EBED45397192F4D736483AB27E23746AC7BBA43DB119711C3F93874E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686240, "uuid": "be61902d-73ca-43be-8d70-304c8805321e", "value": "3072:XR8mjI1jFzf9mxDjsAXUkJAyRK9VD/AlPAkMdyWnd:Xn4TmxnlXpuN9VDoljJWnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686240, "uuid": "ac9439d9-a30f-41b1-9465-484925f2aa6d", "value": 182663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686240, "uuid": "bda0ced1-dd04-4392-9a72-805b8eddc3a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686240, "uuid": "7f9992e4-a9c7-41c9-a157-0837aaf74f91", "value": "c03af23c91ad91a8b608f9e6d5a35773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e6339c-37c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691702662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702662, "uuid": "459a5993-58e0-4036-946a-782a0ab3c995", "comment": "Malware payload", "value": "e9aac2d2f532b465dc6f56aa878fc4a8", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702662, "uuid": "a3d5371b-0832-4282-911c-0a2ecc796b0b", "comment": "Malware payload", "value": "ad78a2fa81c643392188cffb02b64ca78de8c7190d6df8acc8ecdb9438e2ed02", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702662, "uuid": "f28db2cc-ecfe-4fc6-a2c8-a46c1f02006b", "comment": "Malware payload", "value": "54085ee2a429fe401689c70b3462cff5e0cf2b22", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702662, "uuid": "be263bee-0cc7-4a42-b120-e8b94fdc354b", "comment": "Malware payload", "value": "00e05444677de7c122f260c5f36bc973f4e0e1c3d3bd2255f0546899a7ddd10c8158aaca872d2159180528d7b6460059", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702662, "uuid": "05361a08-6a3b-4ba9-9267-75a6bb713b9c", "value": "T124E42371F2A1DF45F7DB920A0E049A272F8AE7CF4A95B8E08E7361DE672FDD44418214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702662, "uuid": "8ed3cc02-77a8-4fa2-abb8-c375aca20c69", "value": "12288:BN5I5TbK3eM7fXTHA/LLf53vRlRKML67BC8FiEHKJgNky071:BnItuuMbM/Xn1384K8gNkH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691702662, "uuid": "eb2c212c-c9ce-48e7-82e4-b4e6928fb657", "value": 671425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691702662, "uuid": "52fc0200-c9c6-4e72-8a4d-035faabf90e5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702662, "uuid": "5180ffce-c519-417d-b929-90b54ce258c2", "value": "Transaction for USD197.000.pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61457144-3734-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691640860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640860, "uuid": "d81dd3e0-3ae2-4291-8760-bb505472ea28", "comment": "Malware payload (Mirai)", "value": "ef7225a7b4dec02214edff4bd6cfd2e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640860, "uuid": "3675609c-520e-4df6-9a78-8bf55e1222f3", "comment": "Malware payload (Mirai)", "value": "adbe8d22f6436e345483532935f0f7da63af072bd6d53e490adf3e4abe6cef94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640860, "uuid": "825d5b0f-9d10-4193-94ce-42187ffb5e3a", "comment": "Malware payload (Mirai)", "value": "d58faf98ce281664a4a793950c12a52549b54a35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640860, "uuid": "4fdae188-6412-42e5-b90f-9bf69c06b64d", "comment": "Malware payload (Mirai)", "value": "c7bf6c808a24738933f840dbb4d8ef2131ee7453ab6e8d807d9fb1d6d9730bc608b467ccb179d4164591efdd1814c37e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640860, "uuid": "92fa303e-d21d-4da6-bde3-39a1e51b325c", "value": "T157C2E193A0A8CD05C863423B6E1F15AB613C2539138DFE1E373AEBDC62464B59139DD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640860, "uuid": "a03a853d-f083-4814-8464-12bce59cfe69", "value": "384:MRSx9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5dwapDyCTYHHJC8oytPFnAqV/Llg3:t5+Kcrb9VDJe5FLTYTlPFnz/mdKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691640860, "uuid": "eba73cdb-d46e-40f3-ab62-2de1c7a9779f", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691640860, "uuid": "74b30342-1de8-41f8-9ca0-1d875f7de870", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640860, "uuid": "085495a3-bd85-4adb-affe-dccd9cdb885e", "value": "ef7225a7b4dec02214edff4bd6cfd2e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af6f2aa-379e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691686296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686296, "uuid": "23be4a01-a0a4-4680-9ca5-2b6a0033f9bc", "comment": "Malware payload (AgentTesla)", "value": "c232cfbe659bf2926f6c1c446a5033b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686296, "uuid": "84ff731e-0bb7-41ec-8925-cf6b6ea7891d", "comment": "Malware payload (AgentTesla)", "value": "adfa401cdfaac06df0e529bc9d54b74cea9a28d4266a49edafa5b8e04e3b3594", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686296, "uuid": "d0f98fb8-761c-4569-9e63-be5a8f45ea6c", "comment": "Malware payload (AgentTesla)", "value": "16e8bf12dc37c6f34bdfdb1609b0e69df30b4606", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686296, "uuid": "86cb9f15-7fbb-4c5f-b294-329c090b19fc", "comment": "Malware payload (AgentTesla)", "value": "9e22e538c2b5dc4b766fd547c9a13189d7b462005a30732c4cabb553c3f0b2774d35187cb3ba7828c0b63e4890ebda33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686296, "uuid": "0fe95078-8bd1-4fc6-9c9f-89b548106da9", "value": "T17BD42289075460AAD8F0EF39A407226213B5770BA0B0FFD5B9D5B0C65A39F885747F2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686296, "uuid": "859988f8-8567-48dd-963a-f49615edec76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686296, "uuid": "6e601404-d000-4e2e-bbaa-fcb5089aa17a", "value": "12288:PPL87+2sXTwthcJS0kXAO1lJH59U9XTAy6pYOSfqvpxWQ/yGQZWgL8:Xg7+2GBJ9O1fHI9DAyKYZqvPqGHgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686296, "uuid": "bb9c4268-3ea5-42ee-ad42-8916c3202c7a", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686296, "uuid": "e5bd7fbf-c125-491e-8f76-a0dd6e17e829", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686296, "uuid": "b157ca3a-eb34-4355-a976-aec50b886d64", "value": "c232cfbe659bf2926f6c1c446a5033b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bfd6fd-3768-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691663305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663305, "uuid": "5da26d50-273f-4a0d-8338-afd6f24c9402", "comment": "Malware payload (Mirai)", "value": "3a1e05b0c62df37f7e3142b3908a6f5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663305, "uuid": "ff91b772-6070-4214-8f67-b522172f3c90", "comment": "Malware payload (Mirai)", "value": "aef38d0cfb419aba0047bf8f6a7856cead1ff046bec83cf64c2d86c38bfe3237", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663305, "uuid": "3269d5ec-b870-42df-8759-963bdaba8825", "comment": "Malware payload (Mirai)", "value": "cd1625b9d6a3f5ee29b57798c73907300ddebb39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663305, "uuid": "d3a3e6e2-ee5a-4562-9280-ef44b4feb687", "comment": "Malware payload (Mirai)", "value": "b0ab715547cd5c7f5bde71245a0201dca172439e88dd82c61bb05c64ced2e31f341dbf5708188cf1e3f8b4660cebaf05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663305, "uuid": "f63d1e79-af90-4b5b-a2ae-c7ab8092c483", "value": "T1BE33F134B1233C948FA05AB5F8350E1F7C7156B403A5BABB2485863D088BA4DB1E94FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663305, "uuid": "232d395b-b47a-44ce-945e-e22c5bf5ed25", "value": "768:Rx2FxGv/8mDLNDIqbTpsbEPN49q3UELkrvJZH/Nas5zXkaA5DBUR:RK6kmfNzbUEPNhLMJZks5zXkxrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691663305, "uuid": "e152ebd7-5ee6-4f00-84e1-2ae4ffdb37fb", "value": 50848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691663305, "uuid": "76b49f33-b5e5-4d28-9366-c13585202729", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663305, "uuid": "6b1f37a3-6af4-4adc-a218-096daa5d502a", "value": "SecuriteInfo.com.Linux.Siggen.9999.12566.16327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6b7499-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691648454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648454, "uuid": "b644b3c4-b073-4fa7-9c41-a51c1e331979", "comment": "Malware payload (AgentTesla)", "value": "a4c99fcdcea9d3b9e49ed6970c291e2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648454, "uuid": "cbaeb8f3-b798-4a2b-9046-ac3012193bae", "comment": "Malware payload (AgentTesla)", "value": "afaeeb8f276bbc3a0e313afd63200cc6437d4c344a658ce3ee0582a8b68a7a1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648454, "uuid": "aaff4498-5315-4638-8b87-f642538e9fb1", "comment": "Malware payload (AgentTesla)", "value": "2976b0c250e998f4aa3fceeed01e06c7f01f1225", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648454, "uuid": "239116d5-ea9b-42c5-8229-4016491e6e73", "comment": "Malware payload (AgentTesla)", "value": "59422838c51882ed181def00ec4861afb897678263ee2addc50f20d8caefa4859c0fae028b881b7156f7b2fe9cc183b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648454, "uuid": "92dd9297-e801-484a-a5c1-352ebc48c8ce", "value": "T186D423C523FCCE68DFBA927E547114005A11E54F55B9E24F03282B686A3BBD42A427FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648454, "uuid": "19d08a43-98ee-4bec-8d62-e5689f45abad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648454, "uuid": "1c15b558-48b7-4344-b406-4e5caceff990", "value": "12288:A2GTIYlV2MPDTyvcU2RzQ600mVqG9a8YP1QX2AlOrUmAzyOOE18p3k:8IYlV9PDycUEzvRyqG94QPgrlOApU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648454, "uuid": "2938e103-14da-4aaa-b366-89e44fafdea8", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648454, "uuid": "483fa935-1fa9-4371-823a-7f07976056e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648454, "uuid": "df596aeb-9334-4b25-a1c6-9b917b12cbe0", "value": "FedEx_AWB#503519274643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0b88d7-37ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691693329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691693329, "uuid": "0642a20b-6145-4956-a563-bc9adcbf3903", "comment": "Malware payload (AgentTesla)", "value": "6de05ad93daca1b6caf769826a404975", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691693329, "uuid": "dc22b9a6-706f-4f88-b848-a02f91170e21", "comment": "Malware payload (AgentTesla)", "value": "b299c276e1ba44a84bc6150b96323929e76db0db1dda3f31867734c3bdb68b06", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691693329, "uuid": "d0267b68-8e6e-4ac0-9866-3403593a2408", "comment": "Malware payload (AgentTesla)", "value": "30ad486ba2ae467028c18d1dc6827549030c73f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691693329, "uuid": "610d37f7-8149-4bfe-be98-563adb4cce35", "comment": "Malware payload (AgentTesla)", "value": "e9535d11e44758872c8bd05e2ce1d0d1e74247ca077dee3017dc914e83860f27bdebe277a31afb06e5fea9f0c0e76369", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691693329, "uuid": "de15bf45-3f0a-4fa1-b52f-751213bbbf28", "value": "T10934EE527E48EB15D658393BC2EF6C2453F1A0C70673AA4BAF48EE6529413436D6E33C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691693329, "uuid": "d26630b3-b014-4b62-a89a-d27ffadf6f3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691693329, "uuid": "0f6e413e-9893-4acd-b11b-48690ecd9db5", "value": "3072:4rILGNTkxg+2TrHw3yztbHpov6FcCYKjlTPQTe:Jy2g+IrHw3yxbHpQKcCYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691693329, "uuid": "45e660e0-64aa-4d8c-b952-4b2cccec8e02", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691693329, "uuid": "58011ed7-d867-4169-9e24-9abe2fb0daf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691693329, "uuid": "18833ab3-f34a-4060-a615-404001f68329", "value": "b612ae4d-24cb-4e1a-9777-ca6cf36aed04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38cfd4fb-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691685889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685889, "uuid": "1e840dfc-78cd-4ce1-9e9a-6b7383b2cbc0", "comment": "Malware payload (Formbook)", "value": "c838612bb7fda9ca74dabc27b0cdbd10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685889, "uuid": "0bbbeb0e-10a7-4ac9-b132-edc4ed2dac37", "comment": "Malware payload (Formbook)", "value": "b2baed540a0184e1f60d3907197acaa3ab96e8ed9cf8b0550dfa5b414ceefdbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685889, "uuid": "a1fdf414-80bb-4acf-92d7-a4e0f5369d6e", "comment": "Malware payload (Formbook)", "value": "66f7177cfd230798a398c0979a3a0fcd5a9f992f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685889, "uuid": "94ef203b-c5e2-4f8f-8037-fbf055861074", "comment": "Malware payload (Formbook)", "value": "3c800ad06e4839c2207c58a03a0f9771b75cda940bddbe31a619530a2953d755a98910111fc67c867f96928cf2d40207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685889, "uuid": "a0855e97-57f6-4a59-b285-d89a766ad495", "value": "T135E412BEB1F79C31D69D2932D27324112371A64BA077F31D020422D9992EFC5A75AECB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685889, "uuid": "dbca0a9d-ae7f-4808-a5be-ee28d510a019", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685889, "uuid": "dea3c0c5-9325-470f-b52a-ccb4aa8e575c", "value": "12288:EMXOFGGTIYlV2UYFkhCKRnwUbhtqn3VR11K3J63gBg4bEfIqKzY0:FXWxIYlVNYsCAnwCtu311RwTbQIjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685889, "uuid": "ff8b3c72-8236-43d0-8eaa-7f7e8311b62c", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685889, "uuid": "465fbadb-85ac-47f7-9362-526ae285d652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685889, "uuid": "9ebde144-b360-43a1-9dca-d1ebe2cd8b8b", "value": "FEDEX SVIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b0b26b-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691648785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648785, "uuid": "9ed98595-e6b4-40d5-aefd-e656ed52cec7", "comment": "Malware payload", "value": "a449aa3971e54d072641e91c37037308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648785, "uuid": "cd7bb5a5-c40a-44fb-91b8-8a2944a0436d", "comment": "Malware payload", "value": "b32a3a86c30974f1307ac3204e6bf9ba6f2880d9a09482a6bd2e7c60a8c98c9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648785, "uuid": "31c60474-6e9b-4a96-a7cd-0d0f0b55b855", "comment": "Malware payload", "value": "aa526e650ae821f599eda9d53fb8b363d141f430", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648785, "uuid": "d8261c48-d5e7-468d-abb5-a228edb28435", "comment": "Malware payload", "value": "e5b1e8e9fe0e4efaae0381f25fc2cf9ad59a7b6a7dc9bb6a07011ba173f902f6f9a4fac010f453f4d9dac3b83a0039a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648785, "uuid": "12cda71e-9208-45c3-b331-c52ece2c8339", "value": "T1D5D52303B7C545F2D5A20E320E945B63E77EB4600F098B8B53A04EADB571DD1AA327B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648785, "uuid": "6959fc8a-6c05-47f7-af06-f8c5b64fdc5f", "value": "30d1665d4c796f53fba13defcdef7cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648785, "uuid": "bb109db9-18a4-4b7c-9bfb-b7eb4eecf0e6", "value": "49152:2WhlHLBfJXAE9mjdl5xzir8/nGnH0HS1FjCkBqYl27H2C74JaDEqfnmOQZokyUbC:2WhlrBfKE2dlDirECHlTjCkFl2T2C7Tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648785, "uuid": "f88e403f-6758-4404-875a-203fcfef4899", "value": 2862624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648785, "uuid": "c934a851-1fd9-4982-9367-c42cfd370cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648785, "uuid": "0858e2c5-32f9-4bf7-88bd-9206f39aa164", "value": "a449aa3971e54d072641e91c37037308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7a505f-3779-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691670460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670460, "uuid": "e19d0834-ca80-4725-b940-dcc6c5efc488", "comment": "Malware payload (AgentTesla)", "value": "985c7c8f5dff6916d2bcfdd2bb6541ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670460, "uuid": "eccd8777-12e9-47f7-8c1f-5330d8280a12", "comment": "Malware payload (AgentTesla)", "value": "b676171dc6dc8e2fd1737a88c2dd52370c1a800cc6ee18e947341395fc76bb17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670460, "uuid": "439dd45b-3b95-40f7-b71a-5baf28f9139c", "comment": "Malware payload (AgentTesla)", "value": "1535bbbe5fdbc30e5bdc0daf4242cd43b1728ca8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670460, "uuid": "b769fe5a-b5f5-4f13-ab48-df945fae7426", "comment": "Malware payload (AgentTesla)", "value": "3849b314a47e4b038a1c8fad05d4a42354b377cec82bb93943c740d573f1b684b67d8c4b3234cd30e7e2fbcfd9bd2574", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670460, "uuid": "175677e3-b0b1-4211-8046-eead7c60360f", "value": "T1A5D423515710246AC8B4DBBD684B3A9363F4720F82F1E9AF75C420E94D3DBB91B02F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670460, "uuid": "25fcb4bc-50ce-420a-bc84-312a398edc1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670460, "uuid": "47df9e08-0427-4be8-8d35-d2c3d35b58e1", "value": "12288:KtL87+2pdcFJ7WJ72+9bRgJXVpIrKj4GMl9+yEWD2FKt44mYx1PKL8Llj+6L8:Og7+2pdcFJiJ72+BRQXsyqEo2FKt44mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691670460, "uuid": "9c45b5b9-34f8-473a-aa2a-10c8ca4e9ed6", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691670460, "uuid": "83490c6a-c52c-4d95-b0d9-e349c2b9ce5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670460, "uuid": "6f6806a4-4e70-4cf9-a9f2-69ee464d4edb", "value": "LPO 00864.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a73da0-3715-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691627791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691627791, "uuid": "250c14d3-d782-43b1-9271-ffb8a3952b1e", "comment": "Malware payload (Amadey)", "value": "05a89998f7b67913c8396f297ee24538", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691627791, "uuid": "7d879b94-af5f-47bd-a099-d34f55bff724", "comment": "Malware payload (Amadey)", "value": "b7188f1f5a89984a3a4a8bb91853d1b5c05c91b957f8fc1d58a75df8931fd309", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691627791, "uuid": "18fafa42-99f4-4765-bc64-9d1904e46dd3", "comment": "Malware payload (Amadey)", "value": "73da01f0c6b18992bca1ce397154922c056f858d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691627791, "uuid": "d8e004d8-61d2-48d7-bb45-cc0f775f0d23", "comment": "Malware payload (Amadey)", "value": "19274e5fc56ac0c6201568e7819cff5369c7755fc82c6a6679513bf64593b805f88370f38f7d7a7a910443fefad57e07", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691627791, "uuid": "fce3858a-1aa1-4ed5-ab44-4aa770bf9913", "value": "T152E41243ABE89426D8B527B018F703C31F3B7CA15974922B3785A8560DB3695E83673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691627791, "uuid": "ccd2fb0b-accd-426e-8b36-ee7e7419daf8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691627791, "uuid": "8cf97cc7-5fe1-47f9-8b7d-b98d4f75db60", "value": "12288:wMrEy90xhD+wzuxy6qmBCA8dqqm0xJmPBmdx5HLa3q6FVUXLs8otFt:kyQD+USEdNmGUsPdP6FVUXQVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691627791, "uuid": "d0b14a3c-167a-431d-aff5-bfcab871fc78", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691627791, "uuid": "f6299dde-16f2-4aa4-988d-e86fdd4308b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691627791, "uuid": "11bac03a-89ea-468f-bc9f-b999483472a0", "value": "05a89998f7b67913c8396f297ee24538.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134a7d94-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691685826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685826, "uuid": "c58e7cd8-ea6b-4166-8418-d389424a86d3", "comment": "Malware payload (AgentTesla)", "value": "e7f0fe284b0c76cf8aac8468281805a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685826, "uuid": "3a7a4b33-8ae9-4c21-bba4-883f86ad01b2", "comment": "Malware payload (AgentTesla)", "value": "b723d813af59659cb9a6164a6b1e9e2ec42353ca05272cd3b773282e76fc2385", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685826, "uuid": "21d231ce-84ec-45c0-b54a-a04ec8f1427f", "comment": "Malware payload (AgentTesla)", "value": "ca4cb949c73080de4d106204014de41b2f4fc478", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685826, "uuid": "6e2aa119-2647-478d-a85d-b5a5f90be1e7", "comment": "Malware payload (AgentTesla)", "value": "b27d72abb6803bfeb2a096becd96d41687ff356f62ab7cdca517942fd04d60b6cad16fa0a40fbb3b819ece16af066c72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685826, "uuid": "d046ef25-eb9d-45f7-8e91-3407ac4ab515", "value": "T155D4230A2275E74BD1F5CEB468A31BB50221A70E11B6FDDBB44636B18D39E980F43F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685826, "uuid": "a2017184-d0e1-4aef-b991-42c26b3d2541", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685826, "uuid": "3db09940-e99b-4887-8247-f323c2e01706", "value": "12288:T8L87+2P9j3JPlcBrw6MbIpTPeAKQxRL5Q77jsBKucz7IBErm3L8dEnL8:og7+2llPlcBrQ2TPexW07wKucz7M3L8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685826, "uuid": "a85b4dc8-6b09-4230-8ee8-3a03fe378018", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685826, "uuid": "70f53a0c-ede0-4f68-b383-5e2428f8e580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685826, "uuid": "b82633ad-290b-4779-8a7d-26f11995b262", "value": "40023540MES_S Quote.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423a4fde-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691685905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685905, "uuid": "188751c9-4211-4d96-9874-128bb491bee4", "comment": "Malware payload (Formbook)", "value": "d00f31dd951ec9b9e11a779af47d1b6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685905, "uuid": "8433447e-9fbc-452b-913e-a04bd916d566", "comment": "Malware payload (Formbook)", "value": "b842e2fd60338a5a60a60ca5e4ec84be149b7a15c7840e93c2e22ac03843701a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685905, "uuid": "a71e7fc7-9c9f-4e32-b00f-bf1abed067ef", "comment": "Malware payload (Formbook)", "value": "b2427c436e18a866f662ef1fcbea6cf21c6f679a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685905, "uuid": "5a82ef2c-9b77-4d4d-aace-c36a52b133d7", "comment": "Malware payload (Formbook)", "value": "957e88067ab345c4b5a8d23656c114afa2274508f4b2fbdd3ef207d1ebef539e4b360efa0185ebaa489ae6332e0b171b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685905, "uuid": "7d416232-7dba-4373-8476-c4d2075c5975", "value": "T1F094AD2375BCC4E6F89C3DF10A284725AAB56E920274E147D64FBEC9F877613C6086D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685905, "uuid": "d660c25a-62ee-4690-bfe6-e4585e733f84", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685905, "uuid": "a72494c6-6858-4afc-8f9d-c165af2d12a7", "value": "6144:cYa6baqHj6+QceNGmSaKpycKkm9wvsR4cAJ94lZqS68khNB:cYZ32VNG9aKpqwsRMJ947qekhNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685905, "uuid": "4a2da48a-971d-4145-b493-364303750967", "value": 436284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685905, "uuid": "82281213-7fb4-41cf-a990-be5a8806c7e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685905, "uuid": "fdb7a96c-2297-414f-b314-9815aa5a2a38", "value": "\u65b0\u7248\u7535\u653e\u7533\u8bf7\u4e66\u2014\u2014\u9002\u7528\u4e8e\u672a\u7b7e\u53d1\u63d0\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae0ce7b-37ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691693060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691693060, "uuid": "b3447de0-fe1c-4715-95ad-23a23e3885e1", "comment": "Malware payload (AgentTesla)", "value": "ec8dee0c18ddbd51ba9b3f3da9b3ee5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691693060, "uuid": "e82c61bf-6f66-4907-8bc3-e720f97b155c", "comment": "Malware payload (AgentTesla)", "value": "b9a72ccaad2c22150062d59d79744e1ab3aa5a106aa0837bdde9e05ccb39c91e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691693060, "uuid": "63f11716-a42a-4767-ba08-b93aa9b32b0b", "comment": "Malware payload (AgentTesla)", "value": "d55b5acf3a63fbc1e6154303c6c43cee9817a074", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691693060, "uuid": "0d7dd4ef-aa68-4518-b2ad-b9b1f92639de", "comment": "Malware payload (AgentTesla)", "value": "e86adbfc885e09d07552874e8140ba6e8909ee1752437921a4651e4832603cba660f01e3d71a322cc9ccfd89309862d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691693060, "uuid": "f822c347-5c1f-4efc-9cca-98252ec7d293", "value": "T129E3A911A5CFA48CF2723F43179E75E98F1BFBE61626606D3144130ACBAAE94CE58731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691693060, "uuid": "ccee7e84-e99e-4bd6-8467-9a947a125219", "value": "3072:nzJdTomfZjKy+Wi+WP+Wv+WT+WO+W2+WI+Wi+Wo+WV+WF+WA+Wz+WS+Wp+Wj+W8e:zJdTomfZj2CnPTW2QaQ91AbqxDsVgwZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691693060, "uuid": "b78c9ca4-2c29-413e-8ae0-c2e9cbbcbf2b", "value": 144970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691693060, "uuid": "c7f1aa15-ec8e-4399-9f9b-4e00e701e05b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691693060, "uuid": "8ad17a9f-31db-4b3b-8488-000bd1e3d8e5", "value": "IFB.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1f1ead-3750-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691653011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691653011, "uuid": "d112dacc-3688-4e4e-8b44-d430bb665b42", "comment": "Malware payload (AgentTesla)", "value": "bd60996e0b6b1a3a04b1499342d85c9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691653011, "uuid": "fab3cfdf-d584-47c5-8bce-9a0b4d126216", "comment": "Malware payload (AgentTesla)", "value": "ba348bc63949f756f58851994c72de4edb43656461f0784ba666e25c5268802f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691653011, "uuid": "a76e86c7-476b-45ff-b372-00e848989dcb", "comment": "Malware payload (AgentTesla)", "value": "59634cc4350974fe84ae296b35572fbb360a5437", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691653011, "uuid": "b6160a0a-dd52-422e-bd1f-8e3501c4ce0e", "comment": "Malware payload (AgentTesla)", "value": "50d809af3ab394e177209d0721b35f4c3ef133fad952392769f58d27046e569487195b3e8ee8e079a453d5c3b1738329", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691653011, "uuid": "c88f80dc-f5e7-4003-839b-6deed174519a", "value": "T1A855DF06767562A1DE44D739C5F7580083A7EE8877E3DA4D2489B2ED0A337BE5F03286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691653011, "uuid": "343fec7a-00e1-47da-b4a4-6513e7413fe6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691653011, "uuid": "7d5f6553-67f1-42eb-a5ed-b814179349a1", "value": "24576:M1McN7KVKylA27w9HR83VAfBrnzgqGXAFGdX9sPFhgN2:9cN7VsIR8lAf9nMNwFaX9s9hgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691653011, "uuid": "a96349f5-2983-4c62-85b5-47461cd057f7", "value": 1288464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691653011, "uuid": "f38fbaec-a467-4b33-89d4-45a422a189a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691653011, "uuid": "c43dac2b-c658-4ba4-92e0-abcfb2b1af6d", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3597d57e-3742-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1691646800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691646800, "uuid": "41f07417-bd84-4112-8efd-4b9e6f8466f1", "comment": "Malware payload (QuasarRAT)", "value": "f905123f4a3c9c95cd51dc0ee433ba8f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691646800, "uuid": "6eafef63-629f-4500-8199-c8a911206779", "comment": "Malware payload (QuasarRAT)", "value": "ba426d437309667874833f60de7397597e17a6daa59fac280cbe6bed820195dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691646800, "uuid": "4c00d105-1d69-41c9-8bcf-10d8d6248d42", "comment": "Malware payload (QuasarRAT)", "value": "6cecccd93571c3a2994597813061f39ecc8890bc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691646800, "uuid": "9e518f9b-ad97-4266-9e46-373e4f0ddd2b", "comment": "Malware payload (QuasarRAT)", "value": "144adf0e01adc352550c4684afdb87c5508b4c15446f4ac8a76b9664cb1ca10e2d93c648b16650ed80cfccd9b49adbaf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691646800, "uuid": "47e712bc-536a-4167-bd9c-bb8ab3dd376c", "value": "T1EB44771025DFA48CB2723E5317ED36AA4F57FBB65B3AA16E2004034B5B97D40CE95B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691646800, "uuid": "482e8493-607c-4dd9-9291-5d6e17fd6cfe", "value": "1536:fNrVFO5tNy6NpepemGOnNM3N9NHAAAAAA/PNtiNWtNa4Ntq2ENGkNgx2Nyp1wN2c:lGepemnUOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691646800, "uuid": "cf2d1626-9423-4dc3-9bbc-f36f15164d3e", "value": 260728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691646800, "uuid": "fc15c5c8-8a20-4722-88c4-2fb3d8cde9fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691646800, "uuid": "b25674ad-c4f9-44bc-b88e-f0bc5bfbc48d", "value": "massive_soi_dog.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe68aed-379e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691686250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686250, "uuid": "6e222f08-d549-46e0-b813-0da27c4ec9ae", "comment": "Malware payload (Formbook)", "value": "b56ce6c54428054e755a2e56f6cf009c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686250, "uuid": "1f3d8ff5-9baa-4fb8-af4b-c2d5484bb9fc", "comment": "Malware payload (Formbook)", "value": "bbd52311d6f6fcc5e1c1296fb53932cac1445ed4d3fe3872a2a8de1f83bd1bf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686250, "uuid": "9158f235-91ae-44ce-bd82-f3bad322942f", "comment": "Malware payload (Formbook)", "value": "66c5f3b48f03cfd38b3faaa2e3c5c7a3487eea66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686250, "uuid": "16f06e97-3b8d-478a-9f3e-08cd811fa86c", "comment": "Malware payload (Formbook)", "value": "1fc780bbb2b1191b7c27f0e11af52846166d0a0db5a6384e3c9c504f049093e58aa136ff3282b4428602c40900f60c8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686250, "uuid": "818df2b1-36a1-4671-a3df-7f1ae2f6b0da", "value": "T12DD423C8073D652AE5F8627C54A3171383B6234F2571EF9BB8C67CC86C2AB944A56F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686250, "uuid": "79deae7f-af2f-4216-8d89-6fce0f1d7997", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686250, "uuid": "9b02143c-aa10-4b15-91f6-cdd1d86d187e", "value": "12288:PLL87+28GA85T3a1k3s68Bn8P76Q/VveRxrqGeCUF0McCfg8L8:jg7+28GA8t3u58eQ/QRoGw2McYXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686250, "uuid": "787b3801-21ee-4bd6-9a3b-f7a681a939fa", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686250, "uuid": "ec5e000a-3a23-4937-9032-65c0a5c1c3ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686250, "uuid": "b508ad7d-5521-40b4-a443-46a92f67f5dd", "value": "b56ce6c54428054e755a2e56f6cf009c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45aad22-3768-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691663306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663306, "uuid": "52cfe0fe-36bb-48b1-8cba-d15e53542ee1", "comment": "Malware payload (Mirai)", "value": "4227a36a152ffa3f97ef5ab909d223b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663306, "uuid": "912b42d1-573a-4b4d-80ba-0832b7874c37", "comment": "Malware payload (Mirai)", "value": "bccbe29fa22b01d9c807d9aabe8eefd3ced2eb0495b460011bd42ac286a019ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663306, "uuid": "e3f14329-5756-4fb0-9b1c-0327060d5588", "comment": "Malware payload (Mirai)", "value": "7f23cbb555e42864963d0c37981af6f9538359f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663306, "uuid": "be7d1703-5e36-42a0-8d36-9669e4c16979", "comment": "Malware payload (Mirai)", "value": "b3334add4d73367740d01ea7378479dde571a9e40669676aabcdc57a4b7e60786cc8775d3c103fa54ab2ab7817e5792c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663306, "uuid": "8cd381ca-f01a-4b4f-a7dc-b15a0619ead7", "value": "T1E6C2D075011A9BE993B0D53FC16CCB84ABB7D435A27E71FD51B0D12C3C6A00A6DB8683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663306, "uuid": "503d7ce7-16d8-4089-8435-0cad269c547d", "value": "768:7J4yxVZId+Uje2D479EwyKvpmxEqY6Fs3Uoz1:9bx/R0e2k7awpqMz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691663306, "uuid": "354b8e7d-20cf-4821-b636-fbfe1eb71854", "value": 26192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691663306, "uuid": "deee630a-eac1-481a-a51f-b2d2ad4cc230", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663306, "uuid": "2207b741-28ea-4508-b106-f365baf86961", "value": "SecuriteInfo.com.Linux.Siggen.9999.27863.17370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a626af88-3768-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691663309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663309, "uuid": "c76f4089-f679-4d1d-9866-3c37680886b4", "comment": "Malware payload (Mirai)", "value": "ff09b0d16dccac81c6d0ae18a2545931", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663309, "uuid": "b5f0642f-0c6b-45f7-ab99-a98399e4ba1a", "comment": "Malware payload (Mirai)", "value": "bd82309ebc9da654c5ac1a37a1c81aaa36d228e9bf5c526f36fb5655468d4dc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663309, "uuid": "db3f8348-d04d-4a1d-a4d8-e8af832675da", "comment": "Malware payload (Mirai)", "value": "d7457349a14c9660851218953ca36d6a76eba00f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691663309, "uuid": "a5ddb867-5e7c-4e9b-b911-942323e41c78", "comment": "Malware payload (Mirai)", "value": "84f7c6936fb93db66cd9c00e8c5ec3442dd3810cf66ebb84f8d1f9c3559ed465977ac4d1e9f47095a072cb0a83038a16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663309, "uuid": "9de61672-f5cf-418d-b623-a9ca904ab6c9", "value": "T167E2E17346567093C7A92D3F7C1D42DA3D574FBC904F7892522CA1AC2F9AC423AF9182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663309, "uuid": "dad856b5-c773-48cd-a90b-a31259ab2377", "value": "768:3EbYnktpeynXsPJCuyaYeyossG7W/n9q3UELhG:0bYkFncPJCcDWsCW/2Lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691663309, "uuid": "6f90b4ec-ffcb-4991-be73-438092f9f529", "value": 31240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691663309, "uuid": "b15ce0a8-2a51-4511-9c8b-09507c09b1e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691663309, "uuid": "ce6bc6c8-ed4d-43ab-9464-599f22fd015b", "value": "SecuriteInfo.com.Linux.Siggen.9999.31342.20445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20464199-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691685848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685848, "uuid": "5adf8441-e081-4358-864d-53733a72146a", "comment": "Malware payload", "value": "82a3a2e03ce908ecd36d17707d85ec47", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685848, "uuid": "89ddf2b2-b529-4aa7-bad9-e2ce9f5cb0ab", "comment": "Malware payload", "value": "bd894837ffe28e3d7075aca49c2c79e3464d890fe22ccea28e1bd56676123481", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685848, "uuid": "f2fb4b5a-a90d-4ef4-a577-d3ecd85eb6ed", "comment": "Malware payload", "value": "6519362968b70e4a30fd4cf99956018ccf726bf4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685848, "uuid": "ac75cfde-48ad-4e4c-b6ba-d581eb4fbc79", "comment": "Malware payload", "value": "4e3669be6d63fdf66b575b804f0a46fb385f5d101ba7905ea103c2842609f11a1ccef0e58e07b77265253190110d70f4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685848, "uuid": "29ab62e5-0211-4969-a761-961cac13e92a", "value": "T168D42337476BE1E8DA0A977AB2B2A02F06737DDBB70746816072905F89785D908EC47C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685848, "uuid": "3cb43b04-9b29-4b11-8a86-74706543389f", "value": "12288:iKfOFyA8CbzMnGbK5X8oE3TViUdqljq/o+zkWinrcZL+oN4IGs8jTgzM:iGA8a4nwusoE3TViUdOS1uo0ouls8Tg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685848, "uuid": "ea40d95e-335b-46fc-ba00-c5d6c819302a", "value": 652610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685848, "uuid": "238217ce-0d9e-49f1-819e-86415e1f20da", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685848, "uuid": "c0578924-5068-41c4-a980-c040d465f55d", "value": "Cotizaci\u00f3n_90650218.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ddb28d-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691685824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685824, "uuid": "324e1e8f-9690-4605-8846-7bbcac105459", "comment": "Malware payload (AgentTesla)", "value": "98bfd8e917fd983b9e3515bdaa4d7fa7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685824, "uuid": "89f4120e-57bd-4dab-8f0a-8677b2091293", "comment": "Malware payload (AgentTesla)", "value": "beb9b68668fe7eb7130c8c7337d8ca5b0358e98d175393fce2dc01a6b3539901", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685824, "uuid": "d126686f-b4e3-466e-b89f-2a4381c1b7ac", "comment": "Malware payload (AgentTesla)", "value": "2f4926b5ecc00114ffa3e38d2a240213205732e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685824, "uuid": "a9a05bef-2a72-4eed-85ea-d0879e10bab8", "comment": "Malware payload (AgentTesla)", "value": "009481d582190aac3f9b266f4c5d22965cc8cc8c25a8bd7d05942754a1f3f4908a5c7d1537c6213a4d2f4ab1a9eb2b52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685824, "uuid": "8df80c63-5fd1-4677-834d-6c1913691525", "value": "T126140713B90B8BB1C3895736C5D701040779EA81B2A3D65A7BCE13EA79E33B6ED05217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685824, "uuid": "f91ef30c-1797-48f3-b3de-958ddea810fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685824, "uuid": "fc72125e-798f-4e07-88ba-fe5bb0bf8507", "value": "3072:AdljmiyRxIL64bPtPv+LN73LwdxQFLBvqBGoEX7j9vfxv/dXk:A+PIL64bPt3+LpM+bqBREX7jnZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685824, "uuid": "f2e7ce5b-a0d2-4410-93b5-1936158b01dd", "value": 198728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685824, "uuid": "4462a11d-54ab-4b04-8435-eb04c7e882ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685824, "uuid": "407b801f-296a-4641-9aea-2d8a04dcce09", "value": "DOC08102023.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed04fd5c-3745-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691648396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648396, "uuid": "99b5485d-edd2-4f31-b372-73d235c4aad3", "comment": "Malware payload (AgentTesla)", "value": "7f21218d662d1e6e7633feeede7b9957", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648396, "uuid": "1bfa2b75-872c-4a62-8d16-3ef10bdd3065", "comment": "Malware payload (AgentTesla)", "value": "bec9d10adb4629b7438c1450a378f704130f925170978084564a89c2e5f8ccb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648396, "uuid": "5c9e50e8-9b30-42f5-a048-a12fd502185d", "comment": "Malware payload (AgentTesla)", "value": "e7f3d588853da4e366f5e22d4d0d2e16eb1b38c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648396, "uuid": "1ddc3e02-cc73-4f8d-868e-cc13ca505234", "comment": "Malware payload (AgentTesla)", "value": "4ac20b669b363979400d46b09239dc352f5eb2492b443ef1acf453da3ad049c496a54a898e5cf2738e50708fe938ed22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648396, "uuid": "a217ab44-9935-407f-a4bd-09af8cc21786", "value": "T121E412FE72FB8D35EBA85935D69218142374278FA473D70A150422DAC129BCA6319FCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648396, "uuid": "0c8666f7-b2bc-4cb6-bdc1-eaf6b81c2981", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648396, "uuid": "52157de5-7ec5-448f-bd4a-6f7a99bfee53", "value": "12288:k4sRBGGTIYlV2UwuikjqkXzoBf9BO7xkYGQskjYz/:PsDxIYlVNwuBXSBO7x/GQTG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648396, "uuid": "77f3530d-71ec-40ca-9317-1059208556d8", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648396, "uuid": "1568ba35-1b45-4e73-80e6-c78cbf7cdfc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648396, "uuid": "7e4fcab0-d8a7-4382-a350-51d0811e9f75", "value": "Cotizaci\u00f3n_0825119.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec58b97e-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1691648824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648824, "uuid": "d374445f-e7cc-44ea-9eb1-cc7504ff1a14", "comment": "Malware payload (CoinMiner)", "value": "20205a98a2ed1e6b7ebc2d5221de4269", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648824, "uuid": "7a171b7f-e41c-4958-9c81-8a19a1059075", "comment": "Malware payload (CoinMiner)", "value": "bf459e9f34afe365a3e55f45ffc3664e38c0f63e0a35189e521a7d513d576cb9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648824, "uuid": "2010fcdc-73fb-4c7b-9949-cb2cce6838e8", "comment": "Malware payload (CoinMiner)", "value": "e8d1ffeca0328a997a2c713315db338d08031669", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648824, "uuid": "44ffe724-ae35-4cb4-bf47-3bea0765067d", "comment": "Malware payload (CoinMiner)", "value": "41428da19e794cbbfd5cafa743b8ffb4c64c781fc39ab42a7d6471a0251e77d9d0cce7f6b24977006791e06173d9a152", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648824, "uuid": "502fe67c-f3dc-42ed-bf8d-3441e717b2ec", "value": "T16F36C655B9875A80EC4D06F3C5DBAF44DB21E81287024C357ADBA3AC8EA63E77C458C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648824, "uuid": "d3f12c8e-627e-422b-aede-8df5868ee8cb", "value": "49152:I7fRdRJDiOV6ARr2RxfVQGxzZ9otOHQgjz:ItdRJD+VZxzZ9oqQgjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648824, "uuid": "afb9d7d2-a565-4398-8f47-65a9e0f33522", "value": 5166080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648824, "uuid": "b0b8a513-8b8e-4f98-ab5c-c19d13d83780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648824, "uuid": "907cdfeb-3dac-4bb7-8d26-9d79f0d7f3ef", "value": "20205a98a2ed1e6b7ebc2d5221de4269.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65010ae-3745-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691648358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648358, "uuid": "7e2dae88-af77-4589-87c7-fd466be35257", "comment": "Malware payload (AgentTesla)", "value": "5e9352eeb17fd8e6d79bf7c6c57748dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648358, "uuid": "caecd574-0cee-4410-bd67-6750f5d6d685", "comment": "Malware payload (AgentTesla)", "value": "bfb21923fd9f54c98a65fe8c42a1f545dc6d4d853043bbbffde602bf500a2ace", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648358, "uuid": "bca6a3a5-7126-491d-8314-9a474d37729c", "comment": "Malware payload (AgentTesla)", "value": "2124381e98cab323983bc8b3ccd99b009752188e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648358, "uuid": "06dbd4a7-0da4-49b8-8618-7f8febf6a633", "comment": "Malware payload (AgentTesla)", "value": "850eaeb275b21923ee82f3e2f90b4bf6b7f66b4a4636564bac38e95be503466ad45e620b9966db1a55735631d7125b08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648358, "uuid": "68811eba-fbe4-4f00-8a0a-a5e59166a18b", "value": "T12EF412FD72DB8C34C7A89136D7A2700403F1AB8B25A7E70E154822D1DA6ABC55764FCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648358, "uuid": "d852428a-9adb-4eb0-8a64-5db3ff6ab6f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648358, "uuid": "1a856f46-7834-4a9b-92bb-51c6937f1245", "value": "12288:IdBnGGTIYlV2UwpOvgBqhuGz4EqD2vk06wJs2BxY1y9lTTOkrbp/Kn:IdBnxIYlVhwpOv6qTzoSvL7zuyXikrVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648358, "uuid": "2ffc315e-d68a-4b49-b474-9b6160389f9f", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648358, "uuid": "d952a2a1-5ae1-42b0-a994-5bda26dab593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648358, "uuid": "562e4ec0-4b4a-49fb-8f55-8680c88dfcaf", "value": "6Comprobantefiscal-7099874433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a722c9f4-3745-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691648279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648279, "uuid": "4b5c0ce7-568c-4737-af3a-4ec80220c015", "comment": "Malware payload (AgentTesla)", "value": "48e0af00cb77aa474abe78e59a16ad11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648279, "uuid": "a5082208-52cd-4771-ad1a-9b292576dc17", "comment": "Malware payload (AgentTesla)", "value": "bfee732d76f8bbce6036f9f2eb9c7c7f3c764edde3de3274f49e979fcc29d4e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648279, "uuid": "455a715d-6788-4711-9e85-c4f80304ed15", "comment": "Malware payload (AgentTesla)", "value": "8885edf33087e9a0662bd8a536b6079bc4c2df4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648279, "uuid": "f2f85f63-975c-4e53-801d-4c8fe19fdb9e", "comment": "Malware payload (AgentTesla)", "value": "8e5e4f47d37e340e84af652e3b96400aac56041e2e6ad5e03b4a3a7c4a441d74d1f41cdba16c69dfca3ba0339f268876", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648279, "uuid": "9b79d9c5-a6d4-4d8c-88dd-1a9ae3ccc49b", "value": "T16BE412D7B3E78D51C3A4AD77D0E241141332A78FA0B7E74F264412271A267A2754ABCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648279, "uuid": "9c775dae-5812-45ae-91c2-58abfa63efdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648279, "uuid": "dc804cd3-96fa-4b58-a0e3-764ae29b8de1", "value": "12288:B+GTIYlV2pfaOA4sAUzzgtVJuDt4/OPsHyWvxPLcAh9v:BZIYlVV4FUz0tSDt4/fHj5PLcAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648279, "uuid": "e19c4b0c-1e16-4bc8-9c15-c47d39f05342", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648279, "uuid": "75e6706e-b1ee-4c1a-941c-6872e6099b35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648279, "uuid": "f75b373c-0d39-405b-b453-32b98347fe4e", "value": "Current Price List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01eb8d2d-3747-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691648860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648860, "uuid": "33a8687f-d7c1-4fe3-bc47-50c81f732742", "comment": "Malware payload (RedLineStealer)", "value": "47b5d25889674d95905aab2d241e00d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648860, "uuid": "17e414ac-52a3-4bda-a2f4-e1b880c64b2b", "comment": "Malware payload (RedLineStealer)", "value": "c348c3775a0481aa6b252df6079219b5617ff8e21b2e13c7f230684a9b120001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648860, "uuid": "b87be092-b1ba-4965-9cdd-35a1f8887414", "comment": "Malware payload (RedLineStealer)", "value": "7f7d5a2bfe634ef30bdd4c1f84af7283234a52b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648860, "uuid": "c8252d37-d1ab-419b-9eb9-be85b50d5f23", "comment": "Malware payload (RedLineStealer)", "value": "4d55934eed3fe385204f4f2c9931b8a1b395aa7d6b2dc2b16d5b65d42e9e87ddf80d50bb4847f1ac1395d594ed37cfbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648860, "uuid": "249c0cd9-78d0-426e-8f4e-a46edd852324", "value": "T1BEC49B22B7A4CF26E39307BBD6535B8202281C497741EC319AE648FD8595EF9CDCE193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648860, "uuid": "16dfa14b-2738-4bf4-9acb-b99b84952d36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648860, "uuid": "d9703294-9576-4bb0-8865-bb44e13f9152", "value": "12288:a/kYWZCssXMypqpC734Dgv+5oq3tDiuS6vtG5ix:acYWm8ypqeOVLtWh6vtG5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648860, "uuid": "b2234cd2-4ff6-4964-a6ab-0d043be57807", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648860, "uuid": "37105574-6870-4a26-a929-514a35e2a40e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648860, "uuid": "aa929773-8285-4947-ac9b-24ff256c86d0", "value": "47b5d25889674d95905aab2d241e00d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65bb7cad-373b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691643874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643874, "uuid": "dac54206-3c98-486b-83cd-14fe08988066", "comment": "Malware payload (Mirai)", "value": "6df4eb753d51dae1f894655d4224da59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643874, "uuid": "43eb4135-6d27-4d09-a55a-27e970381399", "comment": "Malware payload (Mirai)", "value": "c51061c8c1101f61f12a0ae773c1bd093eec6a0eb1f52346435cbd94fd0ef45b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643874, "uuid": "9f30cbba-c256-48ee-a3c8-e8960276d48a", "comment": "Malware payload (Mirai)", "value": "e956acae16aa16b5c46ae97371993ba12d2f0103", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643874, "uuid": "de6b6b00-47e9-4f7c-9dc2-3e6446e24c80", "comment": "Malware payload (Mirai)", "value": "903d9c56d5fa4aae045c9fa6df492a3a8bc2cad1ad3cea358e507f3ce0c71b6ff4929ed60eddc61da58ab203f727518e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643874, "uuid": "4b138e16-b282-4030-bd41-2cc42d891d6a", "value": "T1EBC2D070F8C079F5DEFEAD38985089D03BF61E4937E2CDDA108DDE115222D26DAA8A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643874, "uuid": "9b736386-2326-4372-a1fe-bb53db2feb07", "value": "768:7KnqLiChP7gI5gBZw+LajRnA4uVcqgw09O:7KqL1h4Zwa65A4u+qgw09O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691643874, "uuid": "74a532ea-b2aa-40ff-89ed-84953f286ef8", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691643874, "uuid": "a78d4154-0e70-43ad-ad90-9ad5f8a6d794", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643874, "uuid": "e1570e39-e542-49dc-a391-b390299ee71d", "value": "6df4eb753d51dae1f894655d4224da59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1909ef2a-379e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691686265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686265, "uuid": "3523f9b2-3f5b-4175-8069-ac3decddd9a8", "comment": "Malware payload", "value": "6cf5ac58131db5d5221d4678801c798e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686265, "uuid": "2028331e-f28e-43b3-8e38-513b5b8075d9", "comment": "Malware payload", "value": "c51a66f98f171ccc5ebbe2f8e44fbd423e7d82a6cb2c82cce8f0e346a7fb2247", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686265, "uuid": "908dd215-1176-45de-86b3-5e4848222791", "comment": "Malware payload", "value": "3d9177ce945f9617ca029bea5f9a136dbef399f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686265, "uuid": "956651d0-61f0-4abc-b36c-ee915df2dc57", "comment": "Malware payload", "value": "3e55e3fcdf9e54e2b9781633bf960631e33bbd68cd1d3d20533ee9da9ba01ea3b77f180e1decf5190fb48e2f04690537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686265, "uuid": "0e5133dc-37d9-427b-bcd7-13a1507bf762", "value": "T171B36D1A729011FCD47AD0B9C98A5A07EBF374598321A6EF33F597661E23AF0183E750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686265, "uuid": "8d09ec11-f76a-4c36-87d9-ce871324e9fe", "value": "1536:u4BZuBvr7zldr+MVw+5el9GYog6h7QU9lo7UCsByoX:urBvr7z/3OhhM0s4qByk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686265, "uuid": "74723f97-6f63-43af-867d-058901de2790", "value": 110518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686265, "uuid": "0360e0e2-c77c-4626-83bc-b27b731c2ab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686265, "uuid": "ca9db638-5277-4298-a8fa-e18c81cf363a", "value": "6cf5ac58131db5d5221d4678801c798e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e988a0-37ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691691944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691944, "uuid": "63b35fb4-4a08-48cb-b2ca-528237b4aef8", "comment": "Malware payload", "value": "79c7a19cf1063330ab3bd09bc49ea09f", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691944, "uuid": "23d406bd-d6f6-4e99-b360-03badec7f2a0", "comment": "Malware payload", "value": "c5619b4b4d83359d27ae80e355248f9ed05a65b43d8866f71252e3b89e52cca9", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691944, "uuid": "20a0cd43-f9ed-4b3d-b7a7-ea009dab674b", "comment": "Malware payload", "value": "f12a7e1e0a6ed18ecd4b43ec94fd666647b08dff", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691944, "uuid": "b562afc8-ec15-43dd-bb47-1b19219f3f3e", "comment": "Malware payload", "value": "0b33936c423aac8a703527c4aeb1578c837f350f8318cadb8df8ee935c23ef5a0714858bba3ea4ab0bcd548522e14ca5", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691944, "uuid": "caf2db18-7df7-4eb8-ab04-5504fd7d715f", "value": "T18FD02314575FC055C573450E543CFC1DE44EB54115C7C96832D1DDCEEC41092CC1D955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691944, "uuid": "1a064784-7722-4beb-8ed3-a2171dd2f5fd", "value": "6:HRYFVmpdDSZPmQSoIJ56yYesbBS5s7A54vVG/4xHy:HRYFVmTOPUW9nSerVW4xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691691944, "uuid": "4fea1eaa-1bfa-45d7-8f85-f2868622dfd2", "value": 222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691691944, "uuid": "80e973dc-3b66-4ccd-a482-74d24a1850b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691944, "uuid": "2fb2180e-d391-4b51-b488-94a6eddd2103", "value": "download-update(silent).url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6cd205e-3797-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691683550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691683550, "uuid": "327644d7-0511-4ecf-9411-27d942842068", "comment": "Malware payload (AgentTesla)", "value": "b4bef95aed3a16a073f3f57810fb6287", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691683550, "uuid": "dceca48a-62b8-49f1-9184-4ab6adcbd6ea", "comment": "Malware payload (AgentTesla)", "value": "c5a1da9fa315b425546a7050902f09c08166462422329ef5bf84ec75ab2b15ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691683550, "uuid": "b75cb8d0-584a-4f83-916d-226d688a0ffb", "comment": "Malware payload (AgentTesla)", "value": "5a2a40ad0ee0096ede48b664514fa7d2407806b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691683550, "uuid": "9a809cbf-d775-4d72-9774-c72a5ecaf14b", "comment": "Malware payload (AgentTesla)", "value": "cc92ab83ec3af7d77451f9523780ae3dfe07bf37fb89a306226dd3482fc6c72cc2ffad3fc475b8ba595b07bcc1f66333", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691683550, "uuid": "5e281b53-6a0a-4817-abf9-f2547fb7954d", "value": "T195E3C703B69AA6F1D3D95B3EC5E710020F71E681B663DADE2B8E63E908837765C01717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691683550, "uuid": "3a6cacf9-4265-4175-9085-d9c202d32858", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691683550, "uuid": "4f1b8750-4d6b-4d65-90fa-1c6c68566f8e", "value": "1536:c1waERkfVs09LdXZChov8CsI9BDl/KnrhfoOwYWi/ERgYBf8hWf/CFG2YXuhro:vk9LHv8oBNarhfoNjhJd/CFGluhro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691683550, "uuid": "157df7fc-73a1-44ae-82bf-7ec78d9ed3e6", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691683550, "uuid": "9f71092d-b15d-4038-b1b4-e798d675f744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691683550, "uuid": "61050e8a-2a25-49e3-a7b6-8ae062adae98", "value": "\u00d6deme \u0130\u00e7in Proforma2 Fatura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d09cc19-373c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691644181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691644181, "uuid": "1c6f01da-012b-4350-b13f-4025f6710e64", "comment": "Malware payload (Mirai)", "value": "d5565abe01f8aa41a366c348ccd97a27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691644181, "uuid": "41595027-30d3-4cf5-901d-3ca28f8fcd64", "comment": "Malware payload (Mirai)", "value": "c68671fafd3ebf814737f6105f5da518ab7f765cb2593e138346919e1cde0190", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691644181, "uuid": "422e30f0-a0b1-4334-8e9e-842f2ed85f86", "comment": "Malware payload (Mirai)", "value": "25f78b5b1c00d9a4fe9b046abb185777d14adbc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691644181, "uuid": "01ed71ae-839a-4532-8cad-86c4ce5c82d0", "comment": "Malware payload (Mirai)", "value": "840c5b543dffbb5f70d56b8f71a865d00d786c9b843ca49bcf8b0c9093efc97812ce92f2d52a4d6086185e1a80c187d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691644181, "uuid": "f5744bc5-d577-4af6-a462-a173dec9f297", "value": "T12FB2E162F1853E61DB70313A797CC60057AB57F8A4FA72713624B7AC4BD2C4764B814E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691644181, "uuid": "e0397b6c-8c85-4102-a8a3-aeac115daa0c", "value": "384:5ZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdVhymdGUop5hKR:UX1De9kONQG5xD+jHMDzuVs3UozYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691644181, "uuid": "6ddc9dc1-44d1-4a90-8ff3-c86f3641a0b2", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691644181, "uuid": "cee539f5-9d48-4a23-a517-a609bb3e51cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691644181, "uuid": "ac9af5be-5e53-41ae-af50-a77de9c69f77", "value": "d5565abe01f8aa41a366c348ccd97a27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ad9871-37c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691702418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702418, "uuid": "5020fa7c-124a-48bc-a6bb-9ce08896119d", "comment": "Malware payload (njrat)", "value": "2d13f9099ff755932ed8a26dc0fbff3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702418, "uuid": "eb031e95-fe07-4452-bcef-0ddb664857aa", "comment": "Malware payload (njrat)", "value": "c761365d5b37acb7799abf13f2df39a8375733bdff1d37f89ceec2ef1d139b08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702418, "uuid": "1cb4680c-a6d2-4b03-aa25-14b61fd10223", "comment": "Malware payload (njrat)", "value": "ea3b4d39fb1d75ab3ad8667b1ff39353f79614cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702418, "uuid": "e12835ca-92e9-4c93-945d-04bd4aaa4721", "comment": "Malware payload (njrat)", "value": "3b9580dfbb2a5ac7672ed6dabb8d634c6c5b71bcfd0a0f52cef87259816095d248693379023501f40a3712e4f796cddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702418, "uuid": "7076c7b8-2645-41b4-a5f0-824f52195335", "value": "T16FE22C6DFBE64465D1BD0AB60571950013B8D103E523F7BE4ECA24E62B3B6D84B84DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702418, "uuid": "a2e381d2-d260-4594-9689-678b9403fc45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702418, "uuid": "d6c5e4c9-4b15-4305-ab18-c38d0ab3fee0", "value": "768:QQW23OVvZVYzxDCPOm1+/CqEpvYeHQmIDUu0tiDhj:/+6SHq6vQVkEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691702418, "uuid": "67e4364a-e31b-4105-8084-52aeda587387", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691702418, "uuid": "4699cc0c-f211-4a4e-bbb7-b89c15e7a8b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702418, "uuid": "76f1b1da-6832-4d71-9821-038e564aa9e6", "value": "2d13f9099ff755932ed8a26dc0fbff3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a114700-3783-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691674886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674886, "uuid": "db870059-404a-4f9e-841f-2961810510f7", "comment": "Malware payload", "value": "18c5ca01b0995fca0a2e254fc84de755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674886, "uuid": "ea1b773b-eb63-4753-9706-7f7219cd052a", "comment": "Malware payload", "value": "c7bff672cf5feed3f58ecd7e1fa2cf6b1e9d903d5654a4c4452db2fb56f3c00d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674886, "uuid": "263dd777-bdb2-4f27-9b3c-5877614d5e51", "comment": "Malware payload", "value": "0c5976f15cc8a037f8fa210143893a426f0f6345", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674886, "uuid": "4defd70b-3a54-45dc-86f3-bf3486e8bdb0", "comment": "Malware payload", "value": "36a8b343558c3ae8e9cbc522133868092ef8734a4cbaec80fdf604ca04e8afbab20603a7cda67907462bb4e99af2e717", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674886, "uuid": "e0ff516b-04fb-45e9-a370-367c87460321", "value": "T1AC978C0773E60195E8B7D1388AA75103D7B3B8639331DADF329D06151FABAD49A3E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674886, "uuid": "15a6e0b2-c596-4edf-bf9d-7bf14aa77e41", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674886, "uuid": "7f28be25-3540-4000-b064-c8df9b25c8d8", "value": "393216:tzJjLG+AqDOPrr5g3EKd7qr12pFd5glhzHwSQ9C1Bm/B7AAtvDlA2L1MoFspkEza:ta8aTaxXrLYn6ycrYRad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691674886, "uuid": "c9801b31-9812-4487-934a-018982077b8a", "value": 39799251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691674886, "uuid": "de122da2-6382-456b-acee-3d7d3c324189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674886, "uuid": "f2f331fb-6c66-48ef-a9bd-58c146ed5c78", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f548a3f9-3727-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691635525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691635525, "uuid": "8051ec54-73a6-4af9-aff3-cb9005ff1fe1", "comment": "Malware payload (Loki)", "value": "ed62aac77111e60045a749684573e7c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691635525, "uuid": "1db940c4-c3d7-445e-8311-6dc0e30325c3", "comment": "Malware payload (Loki)", "value": "c8699616f0921ca0cc62d60cf4961557415ac5d72a0f83e870829b168241492f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691635525, "uuid": "1ee0e4d8-b4fb-4a98-901d-0d8c30e6a768", "comment": "Malware payload (Loki)", "value": "b10fe128a9ed085eeba9411dfdb809dd08602bdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691635525, "uuid": "f77bc6bf-81e7-4d32-a3de-12816b775e44", "comment": "Malware payload (Loki)", "value": "7699c5f6be6117aa41df397d849e6184cacde8e706b2dea622d1338ff3250d9be04d42d1ecbca271e0c23b99ce6e9454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691635525, "uuid": "70865cf2-fd46-4e92-acef-4264ec49cedc", "value": "T14FF4E725E77B655AEF19A5E88E2F847238D6DCC0F0B5C588A7E72C0385C23214D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691635525, "uuid": "a43090ac-97c3-41b2-8758-f9da8baaf31d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691635525, "uuid": "47074861-1861-4ea8-93f9-09d989d23676", "value": "12288:uznLZ8Rs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUO1WXLFQwfNCQAFqKZs:qZ8Rs6CE3jLMpppdpppppUO9Rs6CE3jx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691635525, "uuid": "6e3d4ff1-d5d9-409d-a8bb-ea02d3d9a17f", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691635525, "uuid": "5c54afa4-956f-44ca-ac37-1f8b7ec7014b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691635525, "uuid": "8d790903-86a9-4683-b526-972d26c0b851", "value": "KVXuls18K90i6DY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672d1459-3779-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691670505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670505, "uuid": "282173d8-6307-4869-b964-e8c3ffe1b375", "comment": "Malware payload (Mirai)", "value": "411cf2cac855f3debe098b68d73eaf20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670505, "uuid": "383e2a68-a18f-4756-ac55-81cb2f785872", "comment": "Malware payload (Mirai)", "value": "c9c3f526d65b4898150d45ae4b94bfa5e60c2be69a920d3d2e62cbf04b30faca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670505, "uuid": "f970f449-870c-4e00-abf0-7ce8a076eea8", "comment": "Malware payload (Mirai)", "value": "81a0aa6996ba03c5717d47c2aa158ba344287eb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670505, "uuid": "a22ff356-cd1f-42c4-a5c1-50abe9ce7662", "comment": "Malware payload (Mirai)", "value": "e0a0b9b058a20e077c028606a8b2c169f3a42e7efe78b864814b1a9ad9dd06b451484140088b81bbfe6564de5a96ed7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670505, "uuid": "0ef3691c-a637-4656-a40a-6afcc16f529b", "value": "T11DD2E1640B1844BACE6AC4BE0BA94F526D660F67D213D0073B12D8C2FD9549D3C93BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670505, "uuid": "7f04e071-e916-40dd-a031-4b51bc5facd2", "value": "768:9mq0lAtrvbaGN4M0V4OItuEuDeKzC29so5iJgGlzDpbuR1JG:9X0WbXN4MF/uDeKVs4mVJu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691670505, "uuid": "c28a1fd2-a6f0-4a9f-a361-8c6b295736a0", "value": 28444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691670505, "uuid": "c7ab619b-f3af-443f-988b-4c0a557c774b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670505, "uuid": "abdd382c-a42c-4ed7-8e73-9317ab074937", "value": "SecuriteInfo.com.Linux.Siggen.9999.22839.17817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77d3b86-3757-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691656064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691656064, "uuid": "d0bd6d82-54fa-42c1-b841-9d316228a561", "comment": "Malware payload", "value": "6d5afbef146234c547aca1be51d4b450", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691656064, "uuid": "3236ec54-4fe2-48a0-a63e-4bf6dd425f95", "comment": "Malware payload", "value": "c9fa760049a826fde59ac7e0a7408591a5f3b23cf12e628c69e299b53e197e0e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691656064, "uuid": "ffa10a7d-b5e8-455f-9e93-3d4074204ae1", "comment": "Malware payload", "value": "9fe1d6106a7491b379be8264140620665b4ae8b3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691656064, "uuid": "0fb8581c-7c0c-4514-9a80-e1d563c3c81e", "comment": "Malware payload", "value": "2c993739fb004ca0559baffbea602059986d350294bfea4353824c044ca60cbb61b847aebd2655a1ba04c810f0626ec8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691656064, "uuid": "663a0d0d-5eef-4b5d-8b07-cfbf11eb4960", "value": "T1AC1377D1039D9EBAF20A75BC44C46D714DE978BC722FD1E9DBC68C9B8418F8512A0D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691656064, "uuid": "a3b0c28b-5ffb-4ddc-9d8b-3750992d8766", "value": "88d0c8baf81317c8274cc2cc88e50a41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691656064, "uuid": "1684ff88-d586-4346-827b-b97516a61ae3", "value": "768:xQTp18rt94Z1PkcDrC2S8jR/8Lyvoht5NtdWfDdPBC3dLYD9Vi:xI8srG8jR/8Lywht5NtYLdP6KZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691656064, "uuid": "703e1fde-9ce1-4752-9924-f4cf6262fbe2", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691656064, "uuid": "be441473-8d13-4539-b65d-4fd7f69a9355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691656064, "uuid": "f769631f-34a8-406b-bc80-aa2aac14ef5a", "value": "SecuriteInfo.com.Win32.PWSX-gen.29920.22912", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da956e7-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691685924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685924, "uuid": "ee769f4e-21ae-400a-8dd3-a419f13e5722", "comment": "Malware payload (RedLineStealer)", "value": "d5445b9782e7d87b288b620068b5e65a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685924, "uuid": "72048217-501f-4222-9507-081e2d187daf", "comment": "Malware payload (RedLineStealer)", "value": "ca26e44c17842303c3960abd21b966ede71d30a2f1100f72580a863f5993e28e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685924, "uuid": "98566972-3367-45a8-b5e0-7a9af1d01af3", "comment": "Malware payload (RedLineStealer)", "value": "a5217edc9016122f7b73b207fedf3f2dec6b764b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685924, "uuid": "9479f985-7c47-4897-82e3-909998b83909", "comment": "Malware payload (RedLineStealer)", "value": "b1b6de342e0c3452e1f65bb8f5a36a82687502bebb84612d64a8fc73ec634eecfa088848140b95fb3c6795d64e7f57fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685924, "uuid": "e8bf87e9-e78b-480f-b84a-59c6484201b1", "value": "T13B445CD26ED17C60F522CE328D3EC6E6363EFD518E59775A1228FA2F18B11E1C262711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685924, "uuid": "2da25826-f707-42ab-b802-ac5a93e6ecd8", "value": "652c7ff7afcc08a2e9c5186e380250b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685924, "uuid": "c44f88b2-2016-4090-b31e-a0cfbed4d228", "value": "3072:dkPrY4ZsO3c6QmAES1NEWxfwG8VrNHMSvUXBHtsRb8th/VI0B:qtN3xQmA71HRwTySMXBHpRVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685924, "uuid": "c1712e52-ca14-4290-b212-d56bdd0eff9d", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685924, "uuid": "eef63bdf-73aa-42c0-957d-105ca937d480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685924, "uuid": "cb9b95ba-a642-4265-bd2b-492185c3f199", "value": "d5445b9782e7d87b288b620068b5e65a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cffb9e0-379e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691686245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686245, "uuid": "26085dec-7683-48e3-b54b-240e80d72f6e", "comment": "Malware payload (Formbook)", "value": "13017dc676737635794710e2e8802884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686245, "uuid": "573ff7a1-67fa-40f1-95d3-49be27aa0c67", "comment": "Malware payload (Formbook)", "value": "ca290a08560360e9090ea83a3f3916fd3db3d0c058bc7aa0ce349e8783b3ab23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686245, "uuid": "9f1a5911-ad0d-4eeb-9f60-c55e9e8f2b14", "comment": "Malware payload (Formbook)", "value": "c631fdc5b2ae34f749c89be6b8b0ab902bbdf8a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686245, "uuid": "9e80ea81-8386-4077-9807-6a8fa9539934", "comment": "Malware payload (Formbook)", "value": "8f341796128df901c5251f7e1a72f1f95e9e6930d4d75d4211ba887b50cac2fe698207a518bcdf76b3dfbe3390530455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686245, "uuid": "cf4fa7a8-1cb4-4b72-8d27-3c23a77d01b6", "value": "T16ED4234923385759DCA572FE24432211F374621FE4F2EBCB3A8834AAA62975C9B51F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686245, "uuid": "28f3acd2-9439-48e8-8404-8864c1cb0c05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686245, "uuid": "515bf1dd-7712-4a5f-a657-ed0c21b3bb33", "value": "12288:K2fL87+2DdiDVzKheGcsXxMfDCA9g+8gAErlTQyygoymkZbTYRm6WsL8:vfg7+2DE+5csXxMfGAa+BVoV6bTAm6W/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686245, "uuid": "ed47618e-800c-4819-b150-d3d75c9775d8", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686245, "uuid": "48f3a67d-1bb3-4af7-986e-8d5bd701b56c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686245, "uuid": "98c6b58d-30f9-4f52-a385-ed491b05b664", "value": "13017dc676737635794710e2e8802884.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ae81ca-37c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691704780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704780, "uuid": "832b698a-f10d-4e5a-9104-e0e7c34d419f", "comment": "Malware payload", "value": "5b788feef374bbac8a572adaf1da3d38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704780, "uuid": "25c11d9f-b061-4513-b874-acdef71a1e2e", "comment": "Malware payload", "value": "cbe9107185c8e42140dbd1294d8c20849134dd122cc64348f1bfcc90401379ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704780, "uuid": "50d624a0-7196-4aa8-99c9-9c1a373a5cde", "comment": "Malware payload", "value": "76d6cb6b6e9b40b07944153b1f140e786e3ae381", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704780, "uuid": "3b66ce6c-688d-4615-872e-067d7ef9b677", "comment": "Malware payload", "value": "592615de4dad4d913f6f2b0852f2e1995a38b1e7bba297bf4a5ffe0afcb39ec9af84a5c723f5876740cd01f7d0847c65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704780, "uuid": "821ff56a-441a-4e92-92cb-dca602da800e", "value": "T1F5C4F1864F63D43AE4AF02733DF9453C9F4246D8DDAB290B0EE095B007E3FA16E56499", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704780, "uuid": "ad9f8518-52c0-4777-9f16-b625f0c6c241", "value": "12288:SiwDR2uLHaEKnQv+fO3HkuZUOHW1Kkh7BxMIyy8QHDNLsRn9tvC:VwD997+MH2DhdxMCJen9tvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691704780, "uuid": "a3a540a9-085f-4d4e-a48e-8ec9ee61c738", "value": 569740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691704780, "uuid": "0a83b35c-f60f-4190-a170-367497e1534e", "value": "application/x-object", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704780, "uuid": "c161938a-97b5-46d0-a1bc-0dd4ed6fcd22", "value": "cbe9107185c8e42140dbd1294d8c20849134dd122cc64348f1bfcc90401379ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e603d09e-37c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691704219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704219, "uuid": "7b71b137-1e95-4840-9ee5-fc7869c62952", "comment": "Malware payload (njrat)", "value": "2552ff4323d3b76ff573add0b228a91a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704219, "uuid": "103460c6-f3eb-4737-86b9-d7332d649771", "comment": "Malware payload (njrat)", "value": "cc7336198e20ac4118d39d03eb46d31d8ee71b07277bb9f492b94a9da4f64b16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704219, "uuid": "9a7234b2-304f-4885-a103-4c4bec422912", "comment": "Malware payload (njrat)", "value": "6149b2af6220e97d40eb1108f2b4609d4ed1f03e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704219, "uuid": "b8cd9676-9910-4c56-9098-59bf1441f501", "comment": "Malware payload (njrat)", "value": "d074cbdbee511514a22749dc75fa83babc3e0d61209f0a9b721fab3ea26fdedf9bd97f56659ad919f9065f9616dbcf9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704219, "uuid": "e152b0ca-e167-4471-8753-334dbd71f291", "value": "T1E6033A4D7FE1816CC5FD097B06B2D01207BBE04B6E23D91E8EE5649A37636C18B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704219, "uuid": "ad71875d-ec7e-4b00-a849-d77dd6439437", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704219, "uuid": "8585a3eb-9fc6-422c-a040-2a4042459986", "value": "384:McLnsiDjT95hL5YyUvZ7vLOw4qYddArAF+rMRTyN/0L+EcoinblneHQM3epzXxNE:DLvv5zUvZ7blYrArM+rMRa8Nufqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691704219, "uuid": "c2a0f3a5-70d8-4f5f-b480-ced7a6f210bd", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691704219, "uuid": "70ab2bf3-25d3-47af-be21-3402d816c1e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704219, "uuid": "b3f53086-2cdc-4846-bb22-c0f12320925d", "value": "2552ff4323d3b76ff573add0b228a91a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cf7d8f-37a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691689186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691689186, "uuid": "4639b8b6-e1fe-422e-83fd-6156975eda60", "comment": "Malware payload", "value": "70259d2cb147cb4d81f19788ce56798e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691689186, "uuid": "84fe8568-ac62-454f-bec9-70563eec4921", "comment": "Malware payload", "value": "cf13d674eb22408e5567545f63725f0a8f3455b394e31769f2dd3b651d491045", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691689186, "uuid": "eef2ce1d-413d-4a69-9ce5-ef24490b9115", "comment": "Malware payload", "value": "7639288b848e937ded808f0261faa8a17792036d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691689186, "uuid": "23e092df-fd7b-4bc2-aa69-b7fd0fc3b3fa", "comment": "Malware payload", "value": "feb8e2feab55730fed1efac9dacf3e93e23fe8b5b29b52dc90268fd50015792c5d63ad5d7f012fd7cda79b99a0df45a5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691689186, "uuid": "664efa58-f283-47e0-90a3-41e4873bd6f8", "value": "T17CC32A00339DCD74F066117902556A320DBA7C32B63F99DEAFCA4C8E46B8A817764F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691689186, "uuid": "a3331ff8-c219-4e50-990a-2a0b8ef3eadf", "value": "0b8af3550b5710c15669b5b350fa662d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691689186, "uuid": "a79a4c4c-933d-4109-b9f2-27d519f89c11", "value": "3072:z+OYo+QUv7YhIRu9Rtp+XIosUHqdtSYW:SI+QqYh6u9RtIVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691689186, "uuid": "f0cd7a04-0bb9-4c90-8499-19d3225a79a1", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691689186, "uuid": "f58d6346-4d56-4eb1-b0b3-48fbeb16f31e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691689186, "uuid": "369b1b6e-a72a-4f60-89a1-aa7d89f22e41", "value": "SecuriteInfo.com.Win32.PWSX-gen.15173.30796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19f1fed-372e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691638391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691638391, "uuid": "b1888d30-870b-4cd4-afbe-63ac14afd067", "comment": "Malware payload (AgentTesla)", "value": "192d51231b1bbfe246f1b14242a3cde6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691638391, "uuid": "94be66b5-f9d7-48dd-8660-96c4c2f58c5b", "comment": "Malware payload (AgentTesla)", "value": "cf58f75317f4bdf3150cf37739edc9e76952652f4104e16198f3462f0912859d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691638391, "uuid": "409298b7-83fa-4f44-80fa-4b1141880ccb", "comment": "Malware payload (AgentTesla)", "value": "cda9496564fccbd477c899d6c3c518198c7c47d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691638391, "uuid": "b0341130-56c2-473e-a723-d4f3edb83417", "comment": "Malware payload (AgentTesla)", "value": "157a5f3ef00bd928764bd10c9fffb62f66668dd749d88611e97cd7a33094c2ab6500d9051efebf22808698bd8419664a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691638391, "uuid": "0d1487d3-5d78-40a5-983c-4972894f0441", "value": "T1C70523D563F49DACDFB9987AE8101115C732A8CEE434D58F1A0C1036A77BBC16A607AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691638391, "uuid": "7470403e-4666-43e5-ad89-193d13fbc08b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691638391, "uuid": "4a93f371-c27b-49cd-a2c9-0efd0d21359e", "value": "12288:HGTIYlV2JibjVoxuyRHrOzPTMxdV3OnDqvcKfAUgnZkmNUb0WXDRxm/Xtn+Pb5yA:EIYlVwLOrTMwnccyFgnUb7VIZ+FX7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691638391, "uuid": "55d105ac-e942-4ee1-8a88-300bcc02aeb4", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691638391, "uuid": "ca841c5a-4669-44c9-aeb9-4a2ca7d94573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691638391, "uuid": "b8515d11-8a78-4834-842d-0e51c34b2a7c", "value": "SecuriteInfo.com.Win32.MalwareX-gen.11817.25295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3cd236-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691648477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648477, "uuid": "1c45e908-8f76-49db-a26b-1b13b71f15e2", "comment": "Malware payload (AgentTesla)", "value": "c4f3890ae15ee41ff8ca50cf53950e86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648477, "uuid": "5ad5a1f9-2a8a-4af6-a18e-0fd22446d298", "comment": "Malware payload (AgentTesla)", "value": "d09c68e797f9efda512a9e1e1ce891ab2c37613a74c0a6473b0415caacc84fe5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648477, "uuid": "f0b806ad-333c-47f4-b36d-35e115104af1", "comment": "Malware payload (AgentTesla)", "value": "8a89b96435d9a6e2a422969b7126630f93d67ea9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648477, "uuid": "5a60daeb-6b81-4567-8265-dcb0803ca0be", "comment": "Malware payload (AgentTesla)", "value": "22b94106ca90dd76545921171d9bdd6e43bc2591e622899bc6b8aa4ab228fee07a85554992977b07e540532519784708", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648477, "uuid": "75ff06c6-08fc-488e-a682-2d28510518cb", "value": "T15C45010936B86232DD04C63555F25E20C2EBEFAA27E0960A29C4B56D1F317FD8F135DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648477, "uuid": "3c5abe6f-5150-4bef-b0a1-162dbc41e373", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648477, "uuid": "7869fbb6-4e60-40ba-bc87-46abfd259927", "value": "24576:tY9eo1tpas/g6d5o8+iy31fvlBSVXG2PLtXPUrnIv/T:tLoFzY6zo83wlMgKPAIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648477, "uuid": "ca297faf-e9a4-42b0-a367-c4247d4b5513", "value": 1198504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648477, "uuid": "bea7014f-2ac7-449a-98f2-1935fa7ac871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648477, "uuid": "3adb5415-4bc1-4802-b660-aa83a5f46ac7", "value": "ORDER LIST_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69aa22ed-373b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691643881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643881, "uuid": "8473c067-67a8-4363-8b93-6cfcf7be6e0f", "comment": "Malware payload (Mirai)", "value": "f2f261065fab69c3703afe39151b4d8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643881, "uuid": "4f14785d-afc6-400c-8930-1ef6c1f04925", "comment": "Malware payload (Mirai)", "value": "d0a1e2f1e6ecfbab32befa4557b75fffd834c353ba15cbb96012ce935013a5d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643881, "uuid": "dbc09b0a-91bd-46ca-9566-1eaa3311716d", "comment": "Malware payload (Mirai)", "value": "291939f7f09a843680018358a30b5c1d8624c37d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643881, "uuid": "be742142-73c3-4ff1-927f-1a9d3e62021f", "comment": "Malware payload (Mirai)", "value": "80a4b7f8ce0913cef4d2a5429d456a14e347b4958e47f987ee3c79286ff1d1ac51c7530514c9da5d11f573fdc343d44c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643881, "uuid": "e099fa42-2954-4db2-b7bc-669851071940", "value": "T196538D75D11DAEA8C0414AB4A9198E704F13E4C046733EFBEA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643881, "uuid": "eeac8fde-f842-464b-bdaf-beb86b37cc4a", "value": "1536:ragXV1f1Fl/wtknCPQauiufs3Ii3O/qyD6EZeCc:r57f1b/0QHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691643881, "uuid": "052dffd3-dfe3-490c-9c90-129078f33a03", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691643881, "uuid": "e7e28c5d-fc3d-4ee0-a5a2-a71374f38ecd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643881, "uuid": "4dc3ce45-5908-46be-a289-9b941b8a62ae", "value": "f2f261065fab69c3703afe39151b4d8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd85c6c-37c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691704745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704745, "uuid": "a14d9489-d105-4358-b796-cbceac6a01f0", "comment": "Malware payload", "value": "d1abb8c012cc8864dcc109b5a15003ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704745, "uuid": "99b6e12c-e384-4d6c-a348-52dec69874bf", "comment": "Malware payload", "value": "d182239d408da23306ea6b0f5f129ef401565a4d7ab4fe33506f8ac0a08d37ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704745, "uuid": "9d35a999-b317-4fe7-a74a-5352f01fe027", "comment": "Malware payload", "value": "2ca4787d2cfffac722264a8bdae77abd7f4a2551", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691704745, "uuid": "179cb9f7-0c7a-44f7-9e7e-01b0bab99351", "comment": "Malware payload", "value": "3cc94979166670dece06c8183251789b37de5508551acf1f15fd011699d75af804b38401fa704acbfc374a85954b25b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Reptile", "colour": "#EA52C5", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704745, "uuid": "b2f4902f-86d1-42f3-b6f9-8f5e53381d42", "value": "T178D4F19ACE9DDC2EDB999C32DFFE66F95B40128C5D01AE43CEC4E1B419D3192BE60046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704745, "uuid": "bcf14257-2c4b-465c-97e9-ca5bfaaf18b8", "value": "12288:GCUh0wI6nS6A350qGt4vQNPlhTDhG5AZXzEQHCDy+rqF9pOa2ulTW:GHrI6S6g5nGt4v8fFZbINmFOb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691704745, "uuid": "057a8148-b4fe-4947-a140-d215a5fa97af", "value": 644496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691704745, "uuid": "876a0b54-31e6-46a6-8428-bd5c8b9adf05", "value": "application/x-object", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691704745, "uuid": "8a906771-d122-4323-adc8-966bb949823d", "value": "d182239d408da23306ea6b0f5f129ef401565a4d7ab4fe33506f8ac0a08d37ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcf9f12-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691685841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685841, "uuid": "88d3f566-914f-4604-a14f-da85409cf8c7", "comment": "Malware payload", "value": "8470c6294d27e627a4e5e80834fb4f12", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685841, "uuid": "9c258132-67e1-478f-a0be-1010ae6919f3", "comment": "Malware payload", "value": "d2a7c435e6a0189df3e4c710bd792a3dd357c0b85871ca4359ddf980216f8696", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685841, "uuid": "4c27f1c8-2520-4b9f-b76a-fddbe38fe4cf", "comment": "Malware payload", "value": "df6b90dea2166a6f7bdbe7c73ab6e699bc0d6141", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685841, "uuid": "ddedd7e2-6bbf-4965-a0c7-404a069cefb3", "comment": "Malware payload", "value": "e4426c7ecc21dce9e78acc9ed6da600eb42747db46dff5d00d3405d2a05e6fc9ec7b72be9baa2b31277d90afa206cee7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685841, "uuid": "52d39b53-e3b6-49f9-88a2-2e913ccbaf37", "value": "T149D533C9D5F32AF0D1066F2B940A6B59CD2E988D3CC7510EC5D4C10A6B11E88ABD9B3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685841, "uuid": "5b126da1-c05e-4068-88cf-26f5e0c6bbeb", "value": "49152:7OSMtsfnIoeRVC1fapxCnJJK4NycWxeQjndhOJLUyjHgffbNzaQpRK398Qczeeix:KSNnjsE1fapxCJJK4Nydx/bdhOy8Ah/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685841, "uuid": "ae8d85c7-c331-4409-afe4-8f642d08451b", "value": 2841450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685841, "uuid": "dbd5519c-f3d4-4556-9f94-6adba1b2a3ae", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685841, "uuid": "5d81c0bb-17e8-4e38-9864-b750b3be5a79", "value": "REF#117-100823.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a08b0a-3745-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691648412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648412, "uuid": "6684d0b8-c8ed-4420-b16e-297d4376e842", "comment": "Malware payload (Formbook)", "value": "0ae4399a1f11153e998b027e4638166a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648412, "uuid": "18f4c511-ad4e-47c9-95cd-86d744b3c291", "comment": "Malware payload (Formbook)", "value": "d38a6a6faeecb0d30b8d9a8d857e850f1f125dc1cfbe497899bd52695498bef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648412, "uuid": "8a815a8a-6c04-48b5-9cb9-e83ad2ba1b72", "comment": "Malware payload (Formbook)", "value": "db467afbbec5653ae0e4ace3715a7f5472443d9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648412, "uuid": "fe65f3d2-ca7f-4289-8fb3-1c631e07420f", "comment": "Malware payload (Formbook)", "value": "761b8d186ba8d025da12eb8163baf7a3b4e31ede1666d04c0a95314286145c2546840c901f0f21e15cd7ab44bbe159f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648412, "uuid": "a4a3521f-b0e7-4c5d-a573-ec520f61e1a3", "value": "T1FBE402F9A2EB9D34D3B85432D6A6242C1332E20B5477F31F111811D6962AFC973A67CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648412, "uuid": "ddbc2796-45e9-48ff-beef-e75fd4dd8fed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648412, "uuid": "0ac293ca-ac90-49b0-ac0b-089b7fcb83d8", "value": "12288:5wCNEGGTIYlV2UwpImgRLY7Nc2mwGn6gCaeDXUPUvAEH39U3W6:vqxIYlVNwUV12mxnDCaLoAIUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648412, "uuid": "3f0ea8b8-9207-42e1-a25a-e3c80409f27d", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648412, "uuid": "ac62a554-5c39-4248-962e-126008e8c520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648412, "uuid": "b4cb4894-0e95-4f9b-9bb4-3bf87e853436", "value": "0ae4399a1f11153e998b027e4638166a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0714722-3747-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691649234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649234, "uuid": "7d05d4ef-2c1e-405a-96c6-aa64df310fdc", "comment": "Malware payload (AgentTesla)", "value": "3af407a3b281c9387570ce9f81a50919", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649234, "uuid": "e3e74e38-4099-4191-9d55-5b12a6b05e6c", "comment": "Malware payload (AgentTesla)", "value": "d573dcc5c3777f6c1b89727f678198a840c7e299d9d48ab5989adff5dc24ba24", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649234, "uuid": "dc657dee-3cc2-4dde-8f94-4021703064a6", "comment": "Malware payload (AgentTesla)", "value": "953deba366883bd29554d92be8ede678f2680765", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649234, "uuid": "72d46e4a-4ba5-4013-9f1b-9685b7e98203", "comment": "Malware payload (AgentTesla)", "value": "ea6afff6c6a652c054b29bf0979ed3485a80bab87524bb20e1971a15f065a105956918e7103787e7f2cecf2f518d91f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649234, "uuid": "05d241ba-fc45-4440-b085-800a6ad18da4", "value": "T15414803BBA8A8BA1C1477F35C19E711C0B61DEA1A663C68AF54D337209F23B7494570B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649234, "uuid": "19c9d3ac-9052-4fc8-b620-99b85ba5822d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649234, "uuid": "c9627777-158a-4dbd-aa47-6cc1d3d31d2d", "value": "3072:fFLWp4+sx/UtNLqZE6F/ptrHj1SZSqUqEY:fse/UtNLqb19qvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691649234, "uuid": "693e5ecc-67e7-4fbc-bc7a-a931b97dd935", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691649234, "uuid": "ad6a4fd6-4654-4f1c-a5aa-c5f52e73a317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649234, "uuid": "0445db67-ddad-4e1d-86bb-de52edbdfbc1", "value": "OFERTA_646265747727400000000264.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b52dc52-37ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691698456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691698456, "uuid": "7733f4dc-2f83-40bd-9bf3-475fc3f3ed4e", "comment": "Malware payload", "value": "260af6b09eaa8e80b1765913196304c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691698456, "uuid": "784b4e41-3e80-4248-8dfa-02a66e4fdca5", "comment": "Malware payload", "value": "d5bde9401f3694dfef00d4c30adcd32a5b5af040e6b4c3ae5792e466738886a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691698456, "uuid": "73cad609-b691-4e66-8b96-08f7dd30fd5b", "comment": "Malware payload", "value": "cbe24470fd6273210260d9864122841e8f5e4ee4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691698456, "uuid": "06229e1f-8070-43a3-9fec-b63efab87e51", "comment": "Malware payload", "value": "54a4c35c4bc6091779dcdf718cbab816142b963e76fe84e84eca6dd87301111d8887c69bbcbbe3be488a5d1324cf9050", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691698456, "uuid": "89807684-9167-41be-8955-3f055f39b04e", "value": "T186C6E113F7C4603ED0661B3A487B9368993BBE642E2ACC5B6BF4094C4F357416D2E64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691698456, "uuid": "9c95dacd-a9a1-4a59-bc5f-ee00ec398717", "value": "565887e6f998785f70880efcdbabdc93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691698456, "uuid": "4a402936-36a9-4380-a96b-ebaa6e61dcf2", "value": "196608:elrioC5yn1MEKMfMsFyymZ6OtKxM3n5xodSJ9DR:AmoCkqE7HdzOtJpxooJtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691698456, "uuid": "ab823aff-28bc-4547-9ed4-9a1661cf8c10", "value": 12002312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691698456, "uuid": "b87096af-0665-4d16-af7d-2f0a74071979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691698456, "uuid": "a1f00077-2406-4f36-8c84-c7aae91158bf", "value": "ousa_fourth_stage_unpacked.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df50f722-3745-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691648373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648373, "uuid": "6edd36dc-5a1c-475e-a43a-f3bd387277a9", "comment": "Malware payload (Loki)", "value": "eb602c683028bec0c77dd980cffb190b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648373, "uuid": "89a2bc4b-634a-4b83-a3cf-4e21e8cf6f04", "comment": "Malware payload (Loki)", "value": "d6157b6de3c5fa996df4dec819507e7534787878bcace12405b1874d085bb602", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648373, "uuid": "a0515072-48ce-4ec9-98af-29e49328706e", "comment": "Malware payload (Loki)", "value": "04a3ed73234ae96a22b0cdff379b9d802018c467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648373, "uuid": "0f2f4585-229c-459f-aa46-a190ddc4f44e", "comment": "Malware payload (Loki)", "value": "a92b418d5c3037b0effcfa1d08e37024ef79f72c02900cc95449cbe8d061903a3014bc8979d09e12b971573bb330f660", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648373, "uuid": "f458b256-aede-49d6-bb5d-cc5dc2553284", "value": "T16DD412FCB2D75C30C3AA0A36C76111042375A7EFA5A3E70F150422E35A2ABDA5755BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648373, "uuid": "09380b68-c50e-4110-b985-0aa392f74426", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648373, "uuid": "c4cc7dad-7741-4d59-98fa-66beb5561e3e", "value": "12288:+NaGGGTIYlV2sw2yCR4qW+lhjCvsqwxvbr8KmvUSWL0plz+39fh:6aGxIYlVRwsFFxKcSOqJo9fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648373, "uuid": "4f91cabf-6c4b-4e6f-b2d3-5e86e503946b", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648373, "uuid": "4dff25a3-1d4f-47b4-a34e-584ea5909d4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648373, "uuid": "0cf6af0a-6645-4268-a794-1694b54c3818", "value": "eb602c683028bec0c77dd980cffb190b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ae8eb2-37b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691697081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691697081, "uuid": "9633d02d-7e5c-4a00-a561-6802319a2d20", "comment": "Malware payload", "value": "1d296865107f94d309610fb92c5035ac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691697081, "uuid": "27f30ee5-aae9-43b4-ad1a-7d5871d3f780", "comment": "Malware payload", "value": "d703ac3c8116503db1273f6c30c5aa35315697f9da065b107fa793b98a3f6d95", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691697081, "uuid": "49f4dadd-ddd4-4cb2-b836-07d52b2c94a1", "comment": "Malware payload", "value": "5fde937dbb83cf60b3004ed9aca74a63908555f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691697081, "uuid": "c15ff824-897f-46a8-a5c3-c675fc193ad8", "comment": "Malware payload", "value": "668f219f83a7619db9e26d464e21307673e5bfc3cd9141bfbb962f63979614f3d72017615577a133ee5552e30ed81ea9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691697081, "uuid": "8b40c830-a6aa-4dc4-a693-8a897bb4a24e", "value": "T1E2165D13B3C4213FE05E0A3A5C37B625993F7A21791ADDBA5BF4088C4F359426E3A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691697081, "uuid": "8f96d296-6d51-4f1f-b4c9-139f0720413d", "value": "2a517132f42c5df73facf36e77347f07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691697081, "uuid": "d6764812-7f5b-4983-8faf-c7a69e7b0e64", "value": "49152:XfN14TDCo9B4E3UymOJJSUTeRAg+yWG6jeLiJLHbRfOjI5FGHXyAKC5xCp9LI:vN14Px9JUpRApvjCiJHRfOjICHXbay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691697081, "uuid": "788eb48c-287a-48f9-a75e-cb055d30e197", "value": 4239368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691697081, "uuid": "812c85de-7597-41b5-9a05-e3258fe01042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691697081, "uuid": "7a1f45ee-b7dc-4652-8ff5-66944ab77a84", "value": "AGLoader.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65322f4-3716-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691628091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691628091, "uuid": "e5e4ce41-7b4d-4235-ad21-306e381a924f", "comment": "Malware payload (Amadey)", "value": "a9a838634f31957b2aff39214eb0c071", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691628091, "uuid": "794a02ee-4bef-4e1a-a680-13681d1811cd", "comment": "Malware payload (Amadey)", "value": "d94cec46d74e0a6090004a3b7990ba7247a6be375ff4076c2acaf6ef6bbe3596", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691628091, "uuid": "c034229b-75b0-4d60-8321-035f3bca057c", "comment": "Malware payload (Amadey)", "value": "209a22c53adca4c0f24541fe7a8e224ca9736aa9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691628091, "uuid": "8efaf2bc-b9e1-4deb-98d5-1eea21c81aca", "comment": "Malware payload (Amadey)", "value": "002363cdf269100f02e0f710f5e1483b6fc5a55ae6d02de68c92906fd9901086d84de27c905fcde06138a7c4d13ebc88", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691628091, "uuid": "7e2520b3-e496-41aa-a35f-8e68d2a90d62", "value": "T166C4125367E98236EEB617B014FB12D30B37BCA19CBA83573345594B1C72290A87277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691628091, "uuid": "aa7d8710-2364-49b3-97e8-84aef5a1e39d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691628091, "uuid": "e29c60e0-940a-4b3e-8284-867e7bf4686e", "value": "12288:eMrXy90vCMnR+YYYswC79h+7SHSd/BIEMt3dt:1yB2otYsb7SoSzMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691628091, "uuid": "695fe15f-a801-4b7e-a263-ea5e33e168a1", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691628091, "uuid": "2898d9cd-225e-4283-a68b-42e2d4549ea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691628091, "uuid": "9dea04af-b093-4bd9-a064-b1966949473f", "value": "d94cec46d74e0a6090004a3b7990ba7247a6be375ff40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d5c836-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691686022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686022, "uuid": "914190db-ee45-4972-8b73-e33a3c80c4eb", "comment": "Malware payload (GuLoader)", "value": "ab19881bca62b38bece83453255334a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686022, "uuid": "cd4cb561-0e54-41cf-8534-afcc9b827e35", "comment": "Malware payload (GuLoader)", "value": "da9594c3bd6a52391ae305eb7d8b7b493eae18fadbfa458a1741c3da476770f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686022, "uuid": "ae76fcc9-03fe-456f-9313-50c72a09d691", "comment": "Malware payload (GuLoader)", "value": "39adf64e9a3ae8c2a8e8e7b698945dbc6ec9321a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686022, "uuid": "9f25aa47-f40a-42ef-8478-9179b6edf66b", "comment": "Malware payload (GuLoader)", "value": "a0445335ac0fe53a5edc644010ecb5123fc01d057fd3f45554ee128ae378f02f8e946e41ae53fdf6f97d4ff5c66cc1ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686022, "uuid": "7710f59e-94b4-4ea4-bee5-55284fab0f0c", "value": "T1EE2501C7BA068613DFD8CBF91A529E26655D3F724728EB06D1283B278D7D86131DB230", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686022, "uuid": "17837b3d-e426-4e84-8066-82b4b712c48e", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686022, "uuid": "0cc1de59-5258-46bf-b80a-b7ebb492c8a8", "value": "12288:qxJHziSd6IG6lt3wOAWPq9kGDCe8ER8HxOrSqcj7fCj4H4C5bBXIrNE72WiPpKzF:KFiS4Cd0lb8xHxO0OdCHXIOCPpXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686022, "uuid": "75dfc760-ffee-414a-86c3-c81baa072350", "value": 1034648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686022, "uuid": "0982e5b6-01b5-4467-b991-28250c8b7999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686022, "uuid": "64534b17-9dbc-4f98-8767-2c0bd226d755", "value": "(\uc11c\uc6b8\ub300\ud559\uad50) 230809QUOT - 0329KR\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791c4a24-37c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691703607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691703607, "uuid": "be0babc0-5896-44cb-ae78-6a418c11c8a8", "comment": "Malware payload", "value": "d7997b7ec8ece8e5f8e08653e094df08", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MoustachedBouncer", "colour": "#46DBE2", "exportable": true, "hide_tag": false }, { "name": "NightClub", "colour": "#602B55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691703607, "uuid": "a85fb605-dfb7-46ca-9b82-e7ed5eaa8fa2", "comment": "Malware payload", "value": "daa02008b2b7c325d6169c7dc37658f9ac19f744569a685b3f8b78e6622bfa22", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MoustachedBouncer", "colour": "#46DBE2", "exportable": true, "hide_tag": false }, { "name": "NightClub", "colour": "#602B55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691703607, "uuid": "dccebd78-9f31-4ea7-aa31-27c79ff11b75", "comment": "Malware payload", "value": "ed3838fd75ddb4db3aa16dc11c69680bd1438145", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MoustachedBouncer", "colour": "#46DBE2", "exportable": true, "hide_tag": false }, { "name": "NightClub", "colour": "#602B55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691703607, "uuid": "018571e1-bab9-494b-873f-b7f6046aef50", "comment": "Malware payload", "value": "bf0c6881c34ac5794a04de4685b7301a3e5de064d9cebcf08f74f6f64a55963578480fd50cc9d9d2a71fdf2378962b56", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MoustachedBouncer", "colour": "#46DBE2", "exportable": true, "hide_tag": false }, { "name": "NightClub", "colour": "#602B55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691703607, "uuid": "7bb3028c-63be-4303-8317-1481bf8abe8e", "value": "T13CB32822364D8279E6CA217C143C2B6BD73FA471EF6831D3B394BA5A1DA91E32D31117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691703607, "uuid": "a12d5971-a8ec-457b-9e6e-c821ec8cfa0e", "value": "72093c181ac0f7a289e462b70f8c131f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691703607, "uuid": "1e7b047f-14f2-4004-9366-7d2242d70eff", "value": "1536:J5r5v2qQwmHAmHV0KlbADVFWHKKK93rMSpSfTLq:zrZ2Xwmgm1dlMhMKKK939SfTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691703607, "uuid": "b154f5a1-261c-4b4a-ae35-7752c46de0fc", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691703607, "uuid": "07a11061-cff8-4533-a50f-2043ddf2d1a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691703607, "uuid": "9d216189-c68c-44ec-ab99-67e4d096b7f6", "value": "daa02008b2b7c325d6169c7dc37658f9ac19f744569a685b3f8b78e6622bfa22.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f90737-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691686024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686024, "uuid": "2af5c328-c65a-455a-8863-a41fe8a65784", "comment": "Malware payload (GuLoader)", "value": "472b58c98849e1c0864e9b207b359fa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686024, "uuid": "28e103b8-a7c9-44ea-84bb-7e6fe3c6568a", "comment": "Malware payload (GuLoader)", "value": "dafc9076b2647e720be94ee22ef4ed3df4d90fce8eb9e64b870d5ee9700dee40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686024, "uuid": "8d58be9f-8e1c-486a-be4d-d6b7bdd6824a", "comment": "Malware payload (GuLoader)", "value": "f63ff660c171aa7b7f28ae8ecc5c71cf42dd99f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686024, "uuid": "a0131525-90dd-4294-bfa9-9a0645aa5bd3", "comment": "Malware payload (GuLoader)", "value": "56df6579db8502d67d776dc5776fb61670cff7f060e6b6fe0754045b2d51e745bcac2c588bb116b2fbb5ae0c40fb9f41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686024, "uuid": "30d676d3-786c-4b20-b3c3-a1ffb61e8862", "value": "T16525F0C3B9429153DFC8DAFD2B428E65191E3F325719E706D2293B2B8C3D4A135D623A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686024, "uuid": "b2630604-1603-4814-bc73-eb3e92df5ed6", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686024, "uuid": "320bf258-bae3-4609-b4c9-0635002e22aa", "value": "24576:oFiS46RvPLv+8fyG57u3g57U2/cf0QvH:fS7d+8fyG57OUUOO0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686024, "uuid": "a2ee17f2-8932-46f6-88f2-033726e923de", "value": 990120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686024, "uuid": "407e0460-192d-432f-91f4-c1c6d9f5ebed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686024, "uuid": "7cce5fa8-f7d8-41a6-8f91-cddc8450087c", "value": "Request for Price Offer (VNU 2308-10VN)\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60534053-3747-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691649019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649019, "uuid": "7f8d0ebc-1f12-40bd-b82e-e85d2953fccf", "comment": "Malware payload (GuLoader)", "value": "bc8ebf9f39014db71b02f152ca9f5f51", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649019, "uuid": "453a8a93-629f-4621-a658-ef9fc9032201", "comment": "Malware payload (GuLoader)", "value": "db61dcd3f5c9c54b8e9cd4193bf855925452409083d0a937287f351e2ecc9546", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649019, "uuid": "41d51964-701a-4667-8364-117857678cce", "comment": "Malware payload (GuLoader)", "value": "1c3706ab990ca755f5d34c459ab8e01853b02d94", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649019, "uuid": "00d19644-a0f3-4131-8b26-7a625dfe2615", "comment": "Malware payload (GuLoader)", "value": "3e41d780455405637a104da2445855e9051d971911a33f2569394e1bf475760dea95ed562eae7b29375cd1d2363d47ef", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649019, "uuid": "2d3e37d9-fbaa-4cce-b9d0-057332776b9e", "value": "T1A0A4233C64A8797B62A7C55B9F60679F13B9E192C928DF92D71795832134C8A3B23303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649019, "uuid": "2edcd9da-7633-44fc-b3d2-e4f91714e0ba", "value": "12288:qMcgRK2WvazUVnwH788Byanmw+YoG2+kg3z+0P5q:DfYHaz+G88JmcE6j7Pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691649019, "uuid": "eab853da-decb-46cf-a709-1f611e410612", "value": 464746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691649019, "uuid": "323f3f83-6b09-4a11-b9a4-3fba1a371313", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649019, "uuid": "31f54863-79d6-4a3a-a4db-df61ee266e44", "value": "AFHS_QTN_2023_00229-ORIANA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29632751-3782-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691674267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674267, "uuid": "70528310-af18-4d5e-9e56-582859dd96f6", "comment": "Malware payload (AgentTesla)", "value": "954f8a5432fcf4567a25a5cdff191572", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674267, "uuid": "5f30a049-a977-47b3-be11-f7959dc37a17", "comment": "Malware payload (AgentTesla)", "value": "db77d447402dda806b6817fba4b619789e8af03233d9a08414d400538b2bedbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674267, "uuid": "fe12f129-1b96-4ac2-b939-acaffa662ec6", "comment": "Malware payload (AgentTesla)", "value": "740955871726e28fb9b110989f4ee98ee00be26a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674267, "uuid": "d1e50ae1-30b5-4adb-902c-ab9536db692c", "comment": "Malware payload (AgentTesla)", "value": "eb13bef8330ea3a53b7212f0161ad2690d07a63634db40557b71ee6cdbd809c278980877942dbc7bdb423795237ac5b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674267, "uuid": "2e00d7a8-d091-4018-acc7-e3b7ce6aed67", "value": "T11B050726E77B645AEF19A5E88E2F847238D6DCC0F1B1C588A7E72C0385C23514D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674267, "uuid": "75bb2816-3783-49b8-a1a9-e74ab6de07ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674267, "uuid": "133bcafd-54b8-4610-a9b4-ca0a1495efd7", "value": "24576:TfRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOMUF4T1oMeryzf1tjQT5:TfRs6CE3jLbO9Rs6CE3jLbOMNqLWT1pQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691674267, "uuid": "4d457358-1e0d-4b9d-9b55-287abb36c82e", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691674267, "uuid": "db1d17da-c417-4603-b788-50b9feffb357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674267, "uuid": "b09c4551-376c-40f3-b956-bc75a743f5fe", "value": "gucc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a56c209-3734-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691640848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640848, "uuid": "3bfe3d54-c984-4969-a1dd-348d6af834b3", "comment": "Malware payload (Mirai)", "value": "9f7a849da558d3862949746fd666e6ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640848, "uuid": "6d72c24d-e9eb-41ec-bf9a-e852b62f8d61", "comment": "Malware payload (Mirai)", "value": "de43b6339efec312834606b8c94b775438242a457acb57af21672760a586c961", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640848, "uuid": "2d23eca4-8ddc-4ae4-9c17-f4b716576203", "comment": "Malware payload (Mirai)", "value": "ca23b9dae41349819b0c66416b1501474e1cbf51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640848, "uuid": "8169162d-6dac-42bf-a22f-acb9349a16f5", "comment": "Malware payload (Mirai)", "value": "d784ef2825f88e107b7b415363df6f82dbd5fa02689a50856fbfcd9517777d5398f421f65c69c5ab592e3bae3b0eaa91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640848, "uuid": "52240df5-ad71-4b5b-baa7-e07b36b7df6b", "value": "T1DC233C48B640E0BFD187017214BA5BA74232E3797050E96BD7542E3AFA77210E7277EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640848, "uuid": "9950ace2-5afa-4638-bc58-ecea601ed9a5", "value": "768:vhZsUCuud/qzIZS5XFDxvMKu04A5lsT5kSe11ou5KLcRBv8PJVNSFufIJ:vhg5SzIZOvu03/Q611ou8oRBO1Skf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691640848, "uuid": "0e24382a-51da-4c81-a12e-d90913e1e1b0", "value": 46356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691640848, "uuid": "d4404a0e-afd5-4c23-82df-af52abf3d3fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640848, "uuid": "66d091b3-2d4e-4e54-bcc8-73d655ad6d4f", "value": "9f7a849da558d3862949746fd666e6ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5986cb1-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691648813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648813, "uuid": "d2344b96-6857-4508-a33e-c056c18cf40f", "comment": "Malware payload (Formbook)", "value": "e145956aba7e0cb197eab4e63c1fe2f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648813, "uuid": "92f42f6a-524f-4963-b9d6-22797b2469b0", "comment": "Malware payload (Formbook)", "value": "de626ef467f34c5443918399208e46e271a40e010e23622eb53ef37d147e746f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648813, "uuid": "48c44736-40af-4137-9fad-4f79c44f3ec7", "comment": "Malware payload (Formbook)", "value": "e65efb474d53a3ed6649d52b2641c3b5d96be612", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648813, "uuid": "ce0a77a2-437d-442e-a6fa-9144d5fabe9e", "comment": "Malware payload (Formbook)", "value": "9ab0e39fec6fb75f4490e521a4002656692a3970393733bc34787f1e5dc49e18e33435acea4b34371a4696477064ed4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648813, "uuid": "70c1d05b-dcd9-4d50-9cd8-af8c84a1643a", "value": "T1DA54120473B19867DF2B8A32557D2A305E76EC120568A28F6710374DBA73B87F90E743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648813, "uuid": "b0007452-654c-4e72-b28d-c5763668961a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648813, "uuid": "6bfa55bd-3a70-42e4-98f2-3adca0ac845e", "value": "6144:jYa6+mNVq0EE/MwcywUSGUeQGsm9laNE4jCCYUy8Xg3N:jYImNM2/M5ywff/3NE4tZy8Xgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648813, "uuid": "617137cf-aa71-43b2-b6b3-41d1eb4b3c7e", "value": 281009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648813, "uuid": "63ce3e58-dc1b-408f-b324-304372750100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648813, "uuid": "d8b4a308-9935-4778-b00d-757912952565", "value": "RFQ# 25-4275.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9ed95b-37bd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691699717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691699717, "uuid": "493bac19-a45d-4b41-aba4-12624decacc3", "comment": "Malware payload", "value": "ed9150c61fd66757f5dc1357c1384617", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691699717, "uuid": "51961596-0194-4c1a-9e2c-9ed7ddd7db35", "comment": "Malware payload", "value": "e05323d9ca6df47d9add5b2f757ea2490ebd11dfe1b56b82a9e93ba9d814e162", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691699717, "uuid": "98d12917-24c7-4b5e-9121-ac2d333316cf", "comment": "Malware payload", "value": "220466f711e96f202c107d4ed05ffe837c1099a3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691699717, "uuid": "9fa3a812-7f4c-49ed-a1b2-e68be0a70edd", "comment": "Malware payload", "value": "8b87e6c2d8366f23fbafe5118da087aa2838b903bd07054b51fb447f11e2ba708e07e3348fd511a7ed1a5ca89d0ca85d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691699717, "uuid": "e4a9f255-0b1c-47e7-91f3-595e3812b3bf", "value": "T1B6148D11BA80E232E9F6153563FA57B25D39BA303724A0F767D40999CF702E1AE39347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691699717, "uuid": "63203d40-d829-4a85-a3f2-e9dac86f8e1f", "value": "f2446e70194057c6d86e5807958fb117", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691699717, "uuid": "2230d6ee-d365-47f4-b536-7eaea5c16269", "value": "3072:Jquj3THroBGHnTKslI0rjxHTgLcbE/6i6e1eXC/T9CJg29LV4q9/:B3THkBGHTKLMtHTd4/UbXUT9X2rP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691699717, "uuid": "7ab51a1c-c5a3-420b-86b9-3606dbb5289b", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691699717, "uuid": "5f14ac0f-9535-476d-9dbf-12bbe955d915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691699717, "uuid": "48f19654-20b7-455d-bbd3-70bc273c3fd3", "value": "2023-08-09_ed9150c61fd66757f5dc1357c1384617_torrentlocker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1005400-3747-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691649154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649154, "uuid": "2da29937-f84c-4d6d-a585-f526a0b19296", "comment": "Malware payload (AgentTesla)", "value": "0987fee1421f0512c2721f67112ce5b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649154, "uuid": "4769a765-8a7a-43c2-912e-7bfc54efdcc6", "comment": "Malware payload (AgentTesla)", "value": "e0740d03bf77ab18c8ae69d123797ce413ff597216cdaf3fe1f77c1cb21d81c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649154, "uuid": "60706c60-0208-4377-8286-6fdfd21a9555", "comment": "Malware payload (AgentTesla)", "value": "6f455bb8b29433bdfeb356dedf87bcbae1e10188", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649154, "uuid": "4f3173fa-6265-449b-89d5-9cf13bf7bc3d", "comment": "Malware payload (AgentTesla)", "value": "07bdcce48767f2817fdd3182eda488bc2006d507aa589a0c2d89a80593278dcdc2c957a63afc920662ddbadbfc066ef8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649154, "uuid": "ba20f4f4-a95d-4bde-aad9-e8457ed17113", "value": "T1D8150822E77B6589EF25A6E84E2F847179C6DC80F1B1C58CB7E7680385C23114E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649154, "uuid": "93bb2f35-3826-4c8d-a069-be8a3248b8cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649154, "uuid": "bb9f0f67-3ab8-4f26-a580-c129b0da2ac6", "value": "24576:sUYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOiOgucC2nbd1C:stRs6CE3jLbO9Rs6CE3jLbO6u+bTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691649154, "uuid": "34eaccda-e9b8-43bc-8b94-f8eb0b1964c6", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691649154, "uuid": "0b94c7b5-6440-4b03-9e4e-218433b631ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649154, "uuid": "3f61137c-2b5c-4917-9d6c-49aeb486f45f", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ce347d-3797-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691683554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691683554, "uuid": "d6727b2b-57ce-448d-80a9-99e1012768ca", "comment": "Malware payload (AgentTesla)", "value": "91ad07f88056eabdb4852e46ab5d7d80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691683554, "uuid": "1ee96071-c464-48da-b4dd-a9785479a073", "comment": "Malware payload (AgentTesla)", "value": "e16d7cbd1f122a3679f5bd5950a5be2a6fb296cd9456f5a2d46605fba1a218b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691683554, "uuid": "281d316f-0c75-4a60-b908-0ff49aa22020", "comment": "Malware payload (AgentTesla)", "value": "d9a250ae935faa1b6b814a8071384d319223f33f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691683554, "uuid": "51f02f34-6362-43be-9bf5-049e474eb6b1", "comment": "Malware payload (AgentTesla)", "value": "73bd52ed258d0688bc74b2b78940b38934573c72bcfbd3116387e1e93ee6017ec245a9369b1808ffcefcf51fa8829089", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691683554, "uuid": "505b4197-2eeb-401c-b130-e68959249699", "value": "T194E423A5B5469E4707F1FCD0F6198E7CEE81C0679DA87802AF95B40CB466C82B47E2CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691683554, "uuid": "7c05e8c6-78dd-4b38-8071-2e486e825ebc", "value": "12288:+JZWn/8pUGSkCEc7a4fXWvKywHVKdW5HPFA288njzKukvjg:+JZWsSrE0DfX6K1VK45HPFA288nCzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691683554, "uuid": "052a3521-0111-438c-98ba-0d397bf0181b", "value": 670379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691683554, "uuid": "36708dd9-916a-4097-bab3-2da20a2e42af", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691683554, "uuid": "9234ff8c-e14a-448c-91ea-658a37620b5f", "value": "Transaction for USD137.000.jpg (2).r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5597627b-373b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691643847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643847, "uuid": "e3f10ec6-3cc1-4b65-8a7e-41f07ec1153e", "comment": "Malware payload (Mirai)", "value": "55a355c6ed448a9c8a84cd8b2ab28d89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643847, "uuid": "6e8c1c97-42c2-44b4-9545-1e2593182a0e", "comment": "Malware payload (Mirai)", "value": "e1a26543c3bdb0b1c8e262a1da398601e504d29c0af9abbf7eaed6e40decf69f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643847, "uuid": "c3639852-1c0b-4598-8ac8-5a9f2a0e693c", "comment": "Malware payload (Mirai)", "value": "a387f051e8471042b1c35e4eedab891ae1a66a55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643847, "uuid": "79c0333e-386a-4445-815c-80ce4c68d88b", "comment": "Malware payload (Mirai)", "value": "16a982cd920a179a64bdf6f50f0a15810ad449b145790caecf1f191a98dca9aafdef0975e063c8ebf89e78c4cc4a5fa1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643847, "uuid": "271cfe91-0b5c-4bba-9a71-37bebf974b36", "value": "T1CCE2F1D555B698B8CEA21D7AFC634B0E252EC6FC89FB112297F4373423B09D64AB0443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643847, "uuid": "7d883ca0-ff57-4830-bc33-4c5d30794984", "value": "768:q8Lm6COq1fewdHy62pud4yNOYSOyB8LrL9q3UELd9:zLJCmjpkcMKU2LT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691643847, "uuid": "cdb55a05-d97d-4be2-9eb5-1b393c4c0a3d", "value": 31864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691643847, "uuid": "e9afb709-9699-4421-833a-fc1080bd0e9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643847, "uuid": "26d80bf9-79ad-40cd-b663-f1b98343e4f1", "value": "55a355c6ed448a9c8a84cd8b2ab28d89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05596f55-3790-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691680219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691680219, "uuid": "d07af19f-a576-4e03-b505-d6bc96fdb7dd", "comment": "Malware payload (RedLineStealer)", "value": "f3dc3f1ee9a4b04dfcc491830bb66aed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691680219, "uuid": "b177a18a-428b-44cb-807b-ccf556942953", "comment": "Malware payload (RedLineStealer)", "value": "e2bf48830541d0130ac798ce9036e84b3427d45de59b8acd3f44a9d0581b1309", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691680219, "uuid": "16fecf09-3958-4f02-a5c9-3213f47b33f5", "comment": "Malware payload (RedLineStealer)", "value": "5eba67b89f6279b022e775b51df4be886851f2bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691680219, "uuid": "98a6cbb9-d660-4079-8f62-8d9c60093a1e", "comment": "Malware payload (RedLineStealer)", "value": "79a293f9f3f53ed945c7f634eb95fb503d30b5339f88251827b93917facc9bdcadc391d15944624c4f1cd98b32395e23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691680219, "uuid": "6b5f6d70-5f68-4192-820c-6cfb86f9ee01", "value": "T1C875BF3FF268A13EC56A1B3245B38310997BBA61B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691680219, "uuid": "87bf93ca-3858-4919-848d-59a4112f617d", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691680219, "uuid": "2e1e40e2-3443-47fc-8d40-24c69112aac4", "value": "24576:s7FUDowAyrTVE3U5F/etVBKic6QL3E2vVsjECUAQT45deRV9RG:sBuZrEUunKIy029s4C1eH94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691680219, "uuid": "84d5db42-1ba4-4b68-886b-7d1d0bfacf23", "value": 1673183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691680219, "uuid": "ec351c95-3116-4aeb-a595-fad8bd3e1e11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691680219, "uuid": "ba6bcb59-9137-47a4-aaf7-d08476a5e0a1", "value": "F3DC3F1EE9A4B04DFCC491830BB66AED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ebe978-3747-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691649003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649003, "uuid": "e4201a88-6691-4555-8a3b-bd9075627416", "comment": "Malware payload (GuLoader)", "value": "7e2aba390a87f2072a8825f25045550b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649003, "uuid": "f5f36b7b-c081-433f-a58e-b542d1c84a13", "comment": "Malware payload (GuLoader)", "value": "e2c44f040b867623bf5bc9c9551265f134dc735562955b153b7cbe0b5165c600", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649003, "uuid": "40d90fcc-d82a-4e60-841c-b1f88dc15867", "comment": "Malware payload (GuLoader)", "value": "ba295f399408d70cfa41c9c14c82c900ba3bb842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649003, "uuid": "d3fb63a7-9408-4c4e-8b2c-7c6572a0863c", "comment": "Malware payload (GuLoader)", "value": "7181bead2786fa00a82c7a341ba612ed1f4deb9c13bee40b5859b3a4cce8da970dc9c6a6d9ba8dbd54d8066ebbceb820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649003, "uuid": "2a906fe7-2885-4bd8-9098-af760fa6eaf9", "value": "T1CCB423947B54CA73FA2E96B040B78BB67BF54C1248D9DA0703D47C26ACB33508F5E94A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649003, "uuid": "9469d798-84b3-4349-b20b-539ff1804227", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649003, "uuid": "72967bd8-2e29-45ed-8bb6-94ae2e00e6ef", "value": "12288:rFJthQat+DpEdZP8DGE6TcpkjpAO7imdxAu:/QaYDpEdLLwejpl7iju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691649003, "uuid": "c718cec3-3ded-4081-b631-c9d1c0ffa6eb", "value": 495360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691649003, "uuid": "b95a7783-0aac-4573-82a2-fed0c305cd0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649003, "uuid": "54cfcf26-f01a-4316-8fce-98d49c373f12", "value": "Folkeregistrene(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129f831a-377b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (WSHRAT)", "timestamp": 1691671222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671222, "uuid": "c2a3ea29-bb5e-4cd8-90d1-e486089cccde", "comment": "Malware payload (WSHRAT)", "value": "1cc985fc54d86c85a9fedc783ece93bf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671222, "uuid": "a6fb4e02-77f8-4d06-a2c3-1383e1f037b4", "comment": "Malware payload (WSHRAT)", "value": "e3c938b4f4fe140677bb420c68b052b4473cfc1135b223871ade67706a3d16b3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671222, "uuid": "6be7fb9f-d980-4995-8cf2-57fc5ba7c4ee", "comment": "Malware payload (WSHRAT)", "value": "25ec6c257f51023f42094cf74e748514369190cc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691671222, "uuid": "a24d688d-a686-4eb8-8084-8c16b8d9ca1c", "comment": "Malware payload (WSHRAT)", "value": "b22e1dddcc93ae4eb1035e656a2b9c8fb76b73054f444552739531c39cfe73179011acba252bc7e94d75efe7c5cb69a7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671222, "uuid": "cc6e46bf-b35f-4754-b719-c527e71d3607", "value": "T1ABE1C9985E0C95443DA4A6B5E9DAC1C8C7DA371EB5A9FFF9887BE42D24710353E2B0C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671222, "uuid": "e45cc813-4f49-4047-9bf1-1ae3d314cd7e", "value": "192:rrCbeo9//0bGiExYWySgU3Ub+k0OAaBvRMYRfuYbcZwulYp2h:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691671222, "uuid": "aba59af0-70bd-4680-95a7-e9b66fa1e386", "value": 7359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691671222, "uuid": "c9c81715-cb44-470a-b9e3-446c089bc817", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691671222, "uuid": "0f050e35-ddbb-4da6-9071-704d32f20b02", "value": "PurchaseOrder.XLS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfb9700-3774-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691668503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691668503, "uuid": "9512ec36-35ed-458f-bee2-190f2887252e", "comment": "Malware payload (AgentTesla)", "value": "fe68a059f692696d3e29b7a63d6e3b23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691668503, "uuid": "37336033-a16d-46da-8247-1e9b1c423c79", "comment": "Malware payload (AgentTesla)", "value": "e3ef1490f0d59378d4bf439027c89b4bc7df3168e9f521ab38465dab076557da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691668503, "uuid": "411f4e4d-0603-4249-8a1e-9a1dae3ad06c", "comment": "Malware payload (AgentTesla)", "value": "42909415954e6190764a99c5f498ad3b3fe79572", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691668503, "uuid": "d3d5fd4b-3665-496a-9951-a9b166200f7d", "comment": "Malware payload (AgentTesla)", "value": "1b3186035d1ef9a840587e16e33ac5a4f73c19c49df2e6e44b13dd5e73266039b51e7231c07765a99a053fcfd77ffadf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691668503, "uuid": "63bd8765-d609-4818-8373-9ac84e72657a", "value": "T11F05F822E77B645AEF19A5E88E2F847238D6DCC0F1B5C588A7E76C0385C23114D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691668503, "uuid": "27c200f5-5a4a-4ff7-ae38-5710e090da85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691668503, "uuid": "1d9dd722-e2b1-4c18-92b5-10725cdffba7", "value": "24576:Me1Rs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOqUFdSV5rkbwTIvcy:b1Rs6CE3jLbO9Rs6CE3jLbOqMorMkIvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691668503, "uuid": "54d18330-833a-4e86-b143-f0dc764c298b", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691668503, "uuid": "d9b48da1-adee-49e7-9407-887b5f7e3920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691668503, "uuid": "73a08755-568b-40af-8eac-9b96808efda1", "value": "SALE_ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6edfed-3747-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691648984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648984, "uuid": "25c29b61-912a-4eb1-beea-c3f9c8f1ac16", "comment": "Malware payload", "value": "d5749487dc08ea7db89baab9b11fa808", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648984, "uuid": "2df30e8f-17ed-4ed2-836b-fb17e78db4dc", "comment": "Malware payload", "value": "e48a8c6b451e361a4dd19510caecda0c8c082eee3022e9a32ea515d5da46f7c5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648984, "uuid": "6366d81d-a24c-4f42-9c92-19252d89e4ed", "comment": "Malware payload", "value": "71fd780a5b973368a5970ce1eb8c309d10b757c6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648984, "uuid": "f8e33d9a-799a-4ca6-a0ee-0e18ca982313", "comment": "Malware payload", "value": "cca6dda041eb68bc7312777bea364692e0af1f76dd8c60ba9bf193d998efaf795560c89e41ed8c4293a5a21acb0edc86", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648984, "uuid": "2dea4264-492a-49b3-a586-c7887963c0ca", "value": "T101137791079D9FAAF61A35BC41C47C315DF469F8732FD0A9DBC68C9B8409EC522A0D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648984, "uuid": "d7dd6536-62a4-4210-96c4-93099842e94e", "value": "88d0c8baf81317c8274cc2cc88e50a41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648984, "uuid": "2376bc0c-6914-4ef6-bc71-b612fd116124", "value": "768:8ln0er1X5H0tMLe5NMKt0yfCO8r6agSkl9FnduOjycD4:850e5OF5NMKt3fErngSGRduOjyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648984, "uuid": "56e5f42d-ea0f-4e8f-aa46-7d9a8e91ebca", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648984, "uuid": "c44f5756-fabb-4ecc-a1cd-b3cfbeefec35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648984, "uuid": "a05f1d59-2ae8-4c84-95b0-f32248295e9b", "value": "SecuriteInfo.com.Win32.PWSX-gen.28345.7162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1169801-377f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691673287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673287, "uuid": "e87b2fd9-a565-4b52-a220-5d817f822e2f", "comment": "Malware payload (AgentTesla)", "value": "b40e864bda71e516ba8b939f39a3f827", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673287, "uuid": "73b975d5-935f-4bdb-a970-20fed1701401", "comment": "Malware payload (AgentTesla)", "value": "e4cc4462ef5c6d6f79f23b55f1b61f0bb5d02b158702b6e03596ba48edf1c696", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673287, "uuid": "74659270-8988-4e39-ac8d-0ddbe51a3564", "comment": "Malware payload (AgentTesla)", "value": "79cb2c1a60e4aaaf01b959fff5e8d85b31f84d05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673287, "uuid": "a089a79b-8a3b-4282-82ed-8b6380a52522", "comment": "Malware payload (AgentTesla)", "value": "caa15ed7240dca020e17787418e3d8177aa65815038d9d55045b9c084d7325c0cbc912eac0f437eaeaf4fbd6eddc4b36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673287, "uuid": "d82e71ff-a3b4-42ed-8627-7e71fef13efd", "value": "T1F2050826E77B645AEF19A5E84E2F847238D6DDC0F0B1C588A7E72C0385C23114E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673287, "uuid": "3e8e27f7-1cb7-46af-8d06-c1745c28784d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673287, "uuid": "ddd96490-8814-4017-a8f8-ffbd8f7a214b", "value": "24576:z6hRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUO5UFhBWKfQ8T8Hg4HTBnn:ehRs6CE3jLbO9Rs6CE3jLbO5+BjfQDAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691673287, "uuid": "f65c4778-7822-48fe-b8d4-79301ecedce2", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691673287, "uuid": "db22837a-ef75-46f6-b21e-50bf3f6a85aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673287, "uuid": "9131ed07-ee13-4194-8521-676299978326", "value": "nunu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52fe5378-3734-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691640836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640836, "uuid": "d8e523c2-b52b-448a-9e5e-cc948fe6a75f", "comment": "Malware payload (Mirai)", "value": "e3f6f0d01155b7acce4b26fb9fac00da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640836, "uuid": "6b591072-a088-42fe-86c5-1e6fc103427c", "comment": "Malware payload (Mirai)", "value": "e54701ab9348ca47fa84049f49d51b104ee59fd038c7e4d2c9f15f4a68df17e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640836, "uuid": "85e95a3d-5135-4f9c-8e78-c13ddd8168d3", "comment": "Malware payload (Mirai)", "value": "d78f8d458c1a68eafaa4ab06af4f72785647d4fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640836, "uuid": "f8ef4f06-183c-4700-be71-70cc58ab96db", "comment": "Malware payload (Mirai)", "value": "62d605e8878d2baf40f70c190eaddd6e112b5f2eff7dded8a0b60cfde33930bb62111797e69ee9d6acce5ae7b67e274d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640836, "uuid": "c3e26449-2e8b-458b-8dd5-7eaa7b40d280", "value": "T18D63E808F9945B26C2D166BFFE0D128F33270BACF3DF71265A34566433C5A7A0A3A425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640836, "uuid": "fb1e15be-528c-4fb2-bfaf-cec823fd8520", "value": "1536:rdn7tW8km/XUodmcMlW1umwSanmI9uM4iVQ8NzkBKs58YUHL:R/82wSaNQ8NzkBKsqnHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691640836, "uuid": "357f6c9b-13b0-4b23-abb8-ecb93362587d", "value": 71076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691640836, "uuid": "5441a2e5-470d-4a10-9a1b-c5bf6eab00b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640836, "uuid": "e215be7c-807a-4e4a-a5aa-082c33391a07", "value": "e3f6f0d01155b7acce4b26fb9fac00da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ff347f-37ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691691946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691946, "uuid": "ceba7aee-5bce-4258-b5ff-7ab2c6782f4a", "comment": "Malware payload", "value": "573110c89d774ae3e0b0c2341c81b8d7", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691946, "uuid": "a477152d-4f6b-4c20-aa03-dcf231a6fdd2", "comment": "Malware payload", "value": "e696016e7521f82f561de25c4947bcb3f1015a64230e1393e8eedcab56f573f9", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691946, "uuid": "a7ae3479-982f-4634-84cd-1eb932c3ad18", "comment": "Malware payload", "value": "d1954ae6d9a9132f97c1ad56f94cfdc62d01a411", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691946, "uuid": "f1512e35-51c7-43b3-b783-85f18ec7fc0a", "comment": "Malware payload", "value": "de311f2a3c6422a5107f99cce91c7d62b5c1b092f0274c5f5766ad4774ab0ebe69b6086b8d11803ad9f2a50eb4e83ce6", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691946, "uuid": "b796b8d7-b3da-422c-a777-a322a423a830", "value": "T17C316B3723B9070CC2759A3768B1BA13973AB40DDA0F4F8A32415E78285919CA925F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691946, "uuid": "6f14fca1-6244-4c7f-8aa3-4c39ff78cc3e", "value": "24:8NkZsxzpq4tN7oKkaghW89A+Wkp+/CWWypMTl7pEQeyTppTpZab/2XT:8xX5jF1i7iQ9ab2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691691946, "uuid": "56234565-6ba9-48ca-b17f-394257583c80", "value": 1520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691691946, "uuid": "0445e590-3d9e-452b-ac44-ec945584b5d7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691946, "uuid": "ac37e1ca-ccc9-4314-9ecd-5b556b8eef84", "value": "drop-updater.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab92f95-3726-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691634890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634890, "uuid": "110e0dd8-001d-4d2f-aafa-5ef5aebc0115", "comment": "Malware payload (AgentTesla)", "value": "69a6658099c0aa485bf75c183866931d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634890, "uuid": "d078060c-13ca-4be6-a867-087ba85d6d58", "comment": "Malware payload (AgentTesla)", "value": "e900e880ce3272ce750db05a3428dad9c354116d22cd125c374708cfd9aa0fa2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634890, "uuid": "c73bad89-b661-4aa8-8953-11a45cf426f0", "comment": "Malware payload (AgentTesla)", "value": "29dfe2bd2b582b7673cefba736908d3819c09192", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634890, "uuid": "3db51563-c6d5-4e68-b20b-44cf7797731c", "comment": "Malware payload (AgentTesla)", "value": "a06631098829e421114409116bbee33501755f684cd1b4ddf8a6c45b6ecf6ce1a97849385b8bbd270fa88f8d7ba4ef3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634890, "uuid": "c0112857-e666-4d65-9ef9-f2a6f2b5ba77", "value": "T1A6E402FDB2EB9D31D3BC1432DBB360045334A24B5567F30A106422E68A2AFC56795BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634890, "uuid": "443f260b-2b01-4cfd-ac8f-ce8ebfcc2adf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634890, "uuid": "877e03ff-e3df-4d4f-8feb-11a202d72696", "value": "12288:1Qf1kaGGTIYlV2UwlbDvpcTGkGp14tQLCoMtwPKI+kmGaJuMFjmXvhOjJ:wkaxIYlVNwFhL14uWXtwPKIvaJLjmXvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691634890, "uuid": "cae35ec4-481d-4152-9f37-aaade131a220", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691634890, "uuid": "d4caaa76-156a-413f-b28d-2c8ff48f15ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634890, "uuid": "5ea47e38-4434-49a8-b014-dd32092361b8", "value": "SecuriteInfo.com.Win32.PWSX-gen.15126.8055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb357627-3745-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691648393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648393, "uuid": "a759e102-e0cc-4874-be1c-a86d99e07d5e", "comment": "Malware payload (Formbook)", "value": "e9c535fbe747dcf61e2806eecf4bd636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648393, "uuid": "3a0e313f-96a0-4c97-9c60-a870485e9dd4", "comment": "Malware payload (Formbook)", "value": "e993ad6ce52f0658ee9c8df04a56361bfa2a8c21d1e31673f798e470caba554e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648393, "uuid": "7cfa345b-8582-4f03-9098-8199156a3550", "comment": "Malware payload (Formbook)", "value": "64ae7645b41b7d5f68cee32a73e13db42a86d9ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648393, "uuid": "f483b4a1-7bc4-4187-bede-8554f674a9fb", "comment": "Malware payload (Formbook)", "value": "db06623d5cc8223f72ad4ef8bedfe2d7d82dba0d00e09fa14b08f0e2c7737d2b732e819397f6fa8cae0ca3f7fda978b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648393, "uuid": "b32427a0-a5d1-4f1b-bf9c-408cff8a15bd", "value": "T183E412FEF2EB8E20CA701573D6A615181336674B7062F31E250822D1992EFC9539B7DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648393, "uuid": "3b5415f8-37de-4803-a9df-cfe628c826ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648393, "uuid": "87981477-f09e-4b4f-a31b-fde6d75122c5", "value": "12288:c3BKUGGTIYlV2UwP3jBQSPJTqj+q15NG9pl+lKM+ntfwB4pAtMp:c3BKUxIYlVNwP3jTlhqjNepMlKLlwB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648393, "uuid": "424e13d6-7707-4de2-baf5-94306b2950e9", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648393, "uuid": "d0d97b66-7976-4785-8687-af0bd45ffb83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648393, "uuid": "e4400179-9106-4d3d-9b89-a08c353fd408", "value": "Solicitud de oferta (UNIVERSIDAD NACIONAL DE SAN MARCOS) UNMSM5694PE576.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d06fe6a-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691648584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648584, "uuid": "cb11b2f6-135e-40f9-9525-611bfc1741b9", "comment": "Malware payload (AgentTesla)", "value": "f5d0d80021a2eb9424ff9a561c317864", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648584, "uuid": "b53e5ea8-33e6-4ba7-a224-02d9d8286961", "comment": "Malware payload (AgentTesla)", "value": "eac176276ac9472b58ad204d92036f532ce91bc1aa72c5e20bce31743fe612d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648584, "uuid": "351dbcb1-0c6c-46a0-86ce-461cb9af39c6", "comment": "Malware payload (AgentTesla)", "value": "5545be81c8a6c6993534acb67581b2049cfe31bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648584, "uuid": "99484c81-53e5-436b-8887-9091de864697", "comment": "Malware payload (AgentTesla)", "value": "c7029f0cd81f0bd7b1f9674892dce7b3e6e01db53185ede7cffcbc8d345c6cfc84369aa7d694e4c4aa21dfc8b0d1168e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648584, "uuid": "8ee8f6dd-dcfb-4b10-9fb5-8bf96afb2f6a", "value": "T1EBC423A117F48E68CDBAD67EC43419006332B95F44FCC64F16082D7A9A36FA25E45FCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648584, "uuid": "45f08d82-5d66-4cff-aa32-3dc466d3e10a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648584, "uuid": "68abd326-da40-48c2-b9b9-04112acadd1c", "value": "12288:vGTIYlV2xv4k2LWMPr5MUt1EXZH1xkgeYqjRXhD:8IYlVqAkeWEr5ja3kgajRxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648584, "uuid": "5faf2e3a-60d3-4366-a50b-9419aee67622", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648584, "uuid": "032b7089-f37f-4b0d-9eef-f6ae5f817723", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648584, "uuid": "6298db50-0548-4432-b162-c22b9f41f9cf", "value": "20891.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d34582-379e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691686255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686255, "uuid": "5f0f623c-ec49-4b65-9df4-3f170be4a5b8", "comment": "Malware payload (Formbook)", "value": "32b66f4634f5c466bc1b4fa61331fbc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686255, "uuid": "1dde051e-4c69-4558-af8d-4883bbcf9865", "comment": "Malware payload (Formbook)", "value": "eb3bdf2cff8b5de8c911726f07eed2aa77a39ae01b21c0dd33aeab333a2be512", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686255, "uuid": "67d2c6d1-86bd-461f-ad6a-0f05c36acbd0", "comment": "Malware payload (Formbook)", "value": "bf9ba1cb3b0c922a8e6c7e85dccb2cab9dabc7b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686255, "uuid": "862f3d10-24d7-4730-840e-7f9b1503412d", "comment": "Malware payload (Formbook)", "value": "5b8e1a8cc23d17aebc932e37f2d7bae04ea85c70ba5dc3aa880dbab88175fdaf4c09b78fc02e89fa8e4082ad767779fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686255, "uuid": "3d86bc7c-fca2-46e9-9139-877c70cfdd78", "value": "T1D6E402FD62FB9D34CBA95532E2B1640013716A4FA0B3D35E150803D9D82A7DF6726ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686255, "uuid": "c66d4116-b1bc-44a8-9068-06dde78af49e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686255, "uuid": "2cc790f1-50a1-4d47-a1ab-ef23db7c8732", "value": "12288:UWuU2KsGGTIYlV2UwDfwDfDuSQsU/G6bLly1eYAepvGBh9vVG:UWuU2KsxIYlVNwzYHheG6bUT6h9vM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686255, "uuid": "3c1e2a63-bd85-4922-910c-11e5c3a5b217", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686255, "uuid": "bbe6897b-c40a-454a-b464-ae9c5cf23576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686255, "uuid": "6e2a5f05-a10e-4af3-926b-e8d682c08938", "value": "32b66f4634f5c466bc1b4fa61331fbc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f80002-3779-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691670503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670503, "uuid": "bcbeda1b-bf18-4b28-a84f-6329bcf3c48e", "comment": "Malware payload (Mirai)", "value": "427cd78ac51e6ebb40103184a96c6b2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670503, "uuid": "82e7930d-c7eb-4d4e-bc5d-85c418340538", "comment": "Malware payload (Mirai)", "value": "ebb95964fdb3b705afedd6b4cea2d087a06402be7d13f062fd60238c3eb7ff92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670503, "uuid": "4f09f837-1a8f-4b3a-a42c-66e499874b7a", "comment": "Malware payload (Mirai)", "value": "ccf42cb52ba4d2011109b0c0e0cdc323005a98c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691670503, "uuid": "91b68933-4291-4f73-ad01-c0294ca5fd12", "comment": "Malware payload (Mirai)", "value": "f29e03b462d38f52ed185fc774852a931cac7897112357a0039e57beae8573e69915caadecc4492ae9334971f912d513", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670503, "uuid": "8fa637f4-d7fa-49c9-9197-28a8f56759e6", "value": "T135D2E1CC71A2F8ABCA9D5CF541AE135519A09ED032CA43FC4B514CD8B679B8BB20D4BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670503, "uuid": "eaf0dc19-ae1d-4930-80a5-0cb3d2a43c00", "value": "384:InNMYvOlmmDlHtaYNor0CwBxN8ZJWc4t/N8+lNxW6x0jnUObIZU0SZCLBXIzRWGz:I6YWsmDlIJcBxNPc45TxajUxytEy9W+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691670503, "uuid": "86607dec-588b-460b-8ee7-91b121b21e4c", "value": 29284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691670503, "uuid": "506942e1-c2fd-4d2a-9627-80f30361d487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691670503, "uuid": "0fdb5285-2dbc-47db-bd8d-a408108fcb40", "value": "SecuriteInfo.com.Linux.Siggen.9999.17009.28826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb093f3-37be-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691700203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691700203, "uuid": "ff055f9e-9705-4125-8d05-0d2a4ed94135", "comment": "Malware payload", "value": "af5595472e4afc355f9f7977a580e0ae", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MoustachedBouncer", "colour": "#46DBE2", "exportable": true, "hide_tag": false }, { "name": "NightClub", "colour": "#602B55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691700203, "uuid": "a91e6e56-08d8-42d7-98ef-4c6a97f8425b", "comment": "Malware payload", "value": "ee2c61216ed691f8bf1f080fb9c7d7cfc6f370e6f5c0d493db523b48e699a2ec", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MoustachedBouncer", "colour": "#46DBE2", "exportable": true, "hide_tag": false }, { "name": "NightClub", "colour": "#602B55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691700203, "uuid": "efe4b09f-2f9a-49c1-924d-f76fc2fdc5e1", "comment": "Malware payload", "value": "0401ee7f3bc384734bf7e352c4c4bc372840c30d", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MoustachedBouncer", "colour": "#46DBE2", "exportable": true, "hide_tag": false }, { "name": "NightClub", "colour": "#602B55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691700203, "uuid": "64625dc5-7733-49d1-963e-6e8249d3dc46", "comment": "Malware payload", "value": "e619f880d581f9b3e2484317bfc0ba5eb270d2d1c20653aeaeffc51b010309e8b4f0848725945272c927586efda3f932", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MoustachedBouncer", "colour": "#46DBE2", "exportable": true, "hide_tag": false }, { "name": "NightClub", "colour": "#602B55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691700203, "uuid": "e623df18-6979-41d1-8faf-dfe934fa05fd", "value": "T13AC33822764C817AE6CA207C143C2B6BD73FA471EF5831D3B394BA5A1EA91E36D31117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691700203, "uuid": "218f4d54-8373-40a5-9290-c41d3b36cc8a", "value": "58edb5f4eabbb52e430646a5ed1a1cd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691700203, "uuid": "b5c74561-851b-4fe1-9bf0-954422cf27d1", "value": "1536:NmsOnJ3Jrpv2iQgOHQ+viM6dngDBl+fCKaI2WRbZGT0zf0Lo2Yj:qZrJ2vgOw+aVdgdcCKaIPRs0zf0LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691700203, "uuid": "a555b3f9-db6c-4fed-a4df-578553bd15de", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691700203, "uuid": "7f75326e-1755-4812-ac9e-8478057f10fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691700203, "uuid": "cf8e5c70-2f77-4c4c-a8f3-938b7a563d32", "value": "ee2c61216ed691f8bf1f080fb9c7d7cfc6f370e6f5c0d493db523b48e699a2ec.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d25b72-3726-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691634992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634992, "uuid": "5df19362-bc5d-43be-a2d1-9d0220337f77", "comment": "Malware payload (Mirai)", "value": "7a34349009bbb3cb69115db3e3e3d877", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634992, "uuid": "74ad9011-a99b-4ac8-8563-c80696b36c0f", "comment": "Malware payload (Mirai)", "value": "ee883a333618210ff6052aaf012af6c079d56a1621e7d032fd27657dceec79bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634992, "uuid": "24db327b-6b6c-4437-9a1b-63734bd9d45a", "comment": "Malware payload (Mirai)", "value": "9433b755fcbe50d0dacf45e5994aea7bc4589e74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691634992, "uuid": "3e18b1d4-33da-4073-bb48-fc7b8d86c65e", "comment": "Malware payload (Mirai)", "value": "1eb9d2efe172599223db4a06216d1424be376a0cc2bf653cffe3f875952e0d5b08a13506a704259ac5cebfa7c4941fa6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634992, "uuid": "424a6f45-b234-4f08-9e80-fc4668f02d43", "value": "T1AF6302C1C538A165A9201A3ABD3BAB02DBD3CEFCE1417513105E0AA1B6CF947E2F1DD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634992, "uuid": "b19b1629-e6c4-426b-afcc-278a1284cd72", "value": "1536:hzmS2sC28ehNbAcs4NJ1BvoNvmdLdaT+QMCGjlYj//Jaor4nd:hz2ZcG4v1BwNvmdLdaT+edj/Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691634992, "uuid": "d1974c19-6bcb-4cd2-a777-c9dcd6ca73b3", "value": 72356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691634992, "uuid": "4c86eeb2-cfa3-4728-bee7-545d0a7194cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691634992, "uuid": "5664a443-e689-48fd-ab2b-76cb41abb079", "value": "7a34349009bbb3cb69115db3e3e3d877", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4524df78-37c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691702660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702660, "uuid": "f7a510b4-5f41-4ca3-be60-4313e7507b32", "comment": "Malware payload (AgentTesla)", "value": "3b406b3978fc20ea2c51d0f713d9e50e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702660, "uuid": "141eecbe-e333-4ee6-944f-e31f545cc549", "comment": "Malware payload (AgentTesla)", "value": "f03f1ae3d3d6bde555d9bc841f8b11ee27459cb9937ae50298b24acb3190552e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702660, "uuid": "541835dd-5b47-4fb7-abb7-ef67403436d7", "comment": "Malware payload (AgentTesla)", "value": "dfb25c5b88a1478bd5430b6c31558836e2b8f5f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691702660, "uuid": "f23a55c4-6488-4a14-9329-3b6ff3576ed9", "comment": "Malware payload (AgentTesla)", "value": "6ecdce7d3ab3a160b655b117742716542a12cb4cf597f21417da4bd9660b21c605a6d4c319cd3ae391548f1d099292ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702660, "uuid": "b31ac120-d19b-4a37-a786-7e82a474acde", "value": "T1F4F412FDB3EB4D32C3B96573D732141403B2A34BA462E71B155822C5856EBCA13D2ADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702660, "uuid": "ae512c61-b929-495b-a603-180faee159e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702660, "uuid": "74b6ca10-cc36-427f-934a-fcf97ffe72ea", "value": "12288:Xo38NGGTIYlV2Uwx4PNb20r7NZS1nP1z4/Reh2vu4n9HePijbn0w:g8NxIYlVNwKPNf7NCnNUZeh2LewLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691702660, "uuid": "0767b8da-adf0-470e-9293-9c5f902aec43", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691702660, "uuid": "9acaf37e-6b09-437b-b051-73c3ed2e3cfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691702660, "uuid": "774293ae-27c6-4e8e-9db2-0e0d08ab0a5e", "value": "Transaction for USD197.000.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15b8550-375d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691658657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691658657, "uuid": "6b4ef978-1e1e-49a3-ad5a-026b43cdb58b", "comment": "Malware payload (SnakeKeylogger)", "value": "2df720814213f552806266092491aef3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691658657, "uuid": "9f8b7fb3-216d-46be-99e1-32f5f4dfc7c1", "comment": "Malware payload (SnakeKeylogger)", "value": "f361e170045155b17f3482dde57abd3917d67182b46aa9cc8364e9042f3a6b2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691658657, "uuid": "cf410739-83d5-4c28-b052-861504ab440f", "comment": "Malware payload (SnakeKeylogger)", "value": "c8460a87efcceecccc6e401468928433a25feaec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691658657, "uuid": "d0463b73-6865-4914-a8d8-8c10bc7fca70", "comment": "Malware payload (SnakeKeylogger)", "value": "5b9f710c0b217f139ebac426a10d58b45ce29d1c3430d91d166193e45fe1c1793cebf9d2fed8672fd6b0d345de2bee7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691658657, "uuid": "ddb027b7-d603-44ca-9d5d-c9210fb64dc3", "value": "T135E3C603BADB86A3C2945B36C5E750080775E583B663EA4E358E2BD908477F79E0B317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691658657, "uuid": "10c51401-d859-47c0-aa42-af55ffe0ff8c", "value": "3072:IYJ++yBIU6pNbIccfcxgw8PKtw2o2SYcug:L+XBILpNpBxg3St5o2So", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691658657, "uuid": "cb94fbed-190b-4f69-b85e-9f24e5d656de", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691658657, "uuid": "ab918e93-937e-4d29-a06f-24e09975be02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691658657, "uuid": "c3b5a5a6-18b1-4718-988f-532819a8215b", "value": "Ffrhpjc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a67568-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691685918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685918, "uuid": "7f8836bf-719c-4bf0-95e7-87bf720417aa", "comment": "Malware payload (GuLoader)", "value": "e91b672ef9b2cd75672e7e1393560245", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685918, "uuid": "815158a3-9aef-44d6-be10-a1738a560d62", "comment": "Malware payload (GuLoader)", "value": "f4643ae205171f14662089498c31653ea89d802f7e6a806a7aa55e78a26d5fa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685918, "uuid": "26b7ffeb-ec0b-4190-a043-feb70ca4185e", "comment": "Malware payload (GuLoader)", "value": "32c00ed7e282a3fc1760264513b4a60947ac21d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691685918, "uuid": "be994ebf-2a59-4d45-b127-c93411afc626", "comment": "Malware payload (GuLoader)", "value": "3042e79a428c2dda716e0d95936ee8096f5191a7b3a1611d634a60881358fde5ca26510b25c2d88ef599987ea246de9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685918, "uuid": "5a577771-ae7f-4f7a-a84e-b2cb931cd0e9", "value": "T110A48C9278CA31AFDC2F4674035FEAB62A795CE17391096E5F40360D4C36A4A90EEDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685918, "uuid": "d8fd459d-115e-437e-bd47-dcc9b6b567c9", "value": "dd68e663380c71f66b512f005f1be7ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685918, "uuid": "ec4f45e2-f80d-4063-a24b-80e5bf66411e", "value": "6144:QcqNGUt5PZVheNA+ff0Dc/OWFUNX8LOIt3kX7CmI6uJatDAEtbIJ2JuX7aVT:d0nhe2eMc/lEwv9kX7CaY0DAEdIJ2YC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691685918, "uuid": "2f2b1f7a-5c4e-4d96-8f5f-2673b1d954cb", "value": 484144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691685918, "uuid": "45cc8844-0ac4-4d9f-8bb2-e1b2c4d49a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691685918, "uuid": "66b95ba0-a672-458e-a1b6-6d928e2e0ee8", "value": "Fizet\u00e9si eml\u00e9keztet\u0151 0060008879PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b505313-379e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1691686269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686269, "uuid": "17ae53b9-637e-40a6-b04b-a0a10d298165", "comment": "Malware payload (CoinMiner)", "value": "263a6280bd3fefdae517181e163b349b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686269, "uuid": "5ae7667c-86e0-4b97-80eb-6b121c01ec12", "comment": "Malware payload (CoinMiner)", "value": "f4c16e317a14aacdbc3784f0eb47ea8019d715fe29e551c8801cffbe146d6a95", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686269, "uuid": "3838f48b-d73c-4af9-ab17-80c5b661b15b", "comment": "Malware payload (CoinMiner)", "value": "c0076d214d0f4f2a0f48e3e62a32d3b50fed8b47", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686269, "uuid": "ef5ccdf6-a49b-4b7d-824b-9a2c88a64739", "comment": "Malware payload (CoinMiner)", "value": "822f90f0e4b481510b70debf8b70a6632021fa2c54d20a7f6e4f19419a4e705b1f069bab781725cc186699b1008fb429", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686269, "uuid": "5bc05033-0c61-481d-ba59-0bde60059859", "value": "T162060909FA474EA0E84D01B7C69B6F08EB74D811C743A8367A9FB39C8A573D62C495C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686269, "uuid": "ed3a2e9d-5211-49c2-b227-de32f8219fe6", "value": "49152:ZfuwUQOWHFqJPEK++n50oTilZfcm9NNKz:kcJHFqCK+wBilZXKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686269, "uuid": "52ca34d3-9982-4509-bb03-45a457900ce5", "value": 3817472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686269, "uuid": "28a8cc02-2db4-4e30-a969-a3af2296dc8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686269, "uuid": "c54c61f5-7193-4635-9a7e-98e9f0127711", "value": "263a6280bd3fefdae517181e163b349b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d99db9-3748-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691649404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649404, "uuid": "cc9737c6-5966-44a4-9397-37cbbaa302bb", "comment": "Malware payload", "value": "26f6d09d7e4a64cf78c0f46360483d1c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649404, "uuid": "ee752366-e6fe-4bd2-9b01-7c140e94ed56", "comment": "Malware payload", "value": "f5667deeb3c9300818d4bc6094b1755a1e35b2840b17d0b2936f73148a991980", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649404, "uuid": "dbbacf2b-c114-4578-a408-eeb134e7b45b", "comment": "Malware payload", "value": "36d179718a7b1c509e6e0bbe2408bf6bad47038f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691649404, "uuid": "97f9f065-b8f7-4410-95b8-ff39ddfedbc9", "comment": "Malware payload", "value": "b07b8b2cf99dc8193c7492d235af903904aab116d64cb9122667a65207cece602960ccd255a17c8111ecd807619318f5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649404, "uuid": "1667a8a0-1104-4c84-945f-590b7b6b247b", "value": "T139A2BF57DE50083CF379813291CA2285DA1E26A7D26B3C08AA36E39D4D7C5DE4D3E4E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649404, "uuid": "a733d7a2-b03f-4fd8-bc51-be5142db39df", "value": "384:JHDOaSFG6f59UORfqNy4Y0Fivd7ZMM4EUS9rDhCl0mppOuFdO9WMhku:JH4lomfsRYKiAMx9Xg0mpvjMW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691649404, "uuid": "749bf9fa-4800-4c90-b314-1735f06ff1c0", "value": 23257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691649404, "uuid": "800547b7-b07d-47b1-97ce-c6d1cf2b5010", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691649404, "uuid": "c86f9801-5a5b-43ce-a73a-1b1530102122", "value": "PO.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754d6e7a-3719-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691629297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691629297, "uuid": "dd0b58d9-871f-4bc5-ace0-2eeabd68c54e", "comment": "Malware payload (Amadey)", "value": "a8fd90d5ebeb2ad3193d02706b24b7c4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691629297, "uuid": "a1e40eb0-51a4-4981-869b-9466eb4556a7", "comment": "Malware payload (Amadey)", "value": "f7748d83cdf2f80371b56d85b4c8b78e2df64e30189eaef6dfed5f6ce739fe54", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691629297, "uuid": "dd0b7428-2ed6-408f-8af7-4c043a308f79", "comment": "Malware payload (Amadey)", "value": "b460fda07ef76dc5b6cc3e56ea257d97aa8b9698", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691629297, "uuid": "058542f1-d300-4569-83d2-768451f6e902", "comment": "Malware payload (Amadey)", "value": "41beec34b355f59528850dd8f019a2e9a9a627c6de09c11a51c9fede0e6f973ee629bf4ecdb89d7bcbc0468e5c59ae9e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691629297, "uuid": "f7929c40-1f9b-4830-9696-6c1798e486a2", "value": "T12413F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691629297, "uuid": "7647d8e4-c93a-49b2-8f22-2995556e0260", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691629297, "uuid": "86bba2d9-edf7-49a7-aaee-8e96b034a22a", "value": 41717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691629297, "uuid": "f2a74a41-523a-4cb1-8d06-7acf4fdcc59f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691629297, "uuid": "aa613ea1-8ff3-4b27-8609-d9a46913f708", "value": "a8fd90d5ebeb2ad3193d02706b24b7c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6252ed-3727-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691635218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691635218, "uuid": "4bb814e0-f018-4038-9828-149debd79a1d", "comment": "Malware payload (DCRat)", "value": "121803c75457639b8f375c751a75e9df", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691635218, "uuid": "b2dd177d-371d-47ac-bf3e-ba5ad5fd826b", "comment": "Malware payload (DCRat)", "value": "f7f1a21b2b510309b2fc79c9017c454ce5208b4824da1fb3ab92f6be5213fe4a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691635218, "uuid": "f8040931-1c2c-4912-98d4-bc6d82771796", "comment": "Malware payload (DCRat)", "value": "a56349ecfcc9f9333155da10575019646f6ce0cf", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691635218, "uuid": "d32ec4e0-ca11-4b88-93b2-89cd429f36a1", "comment": "Malware payload (DCRat)", "value": "fd94e95659f5474199f23148568b98891b540d173f2b4bb1d9714a4b35e277f833702ca74e88addb07eaf38a2cf72ad1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691635218, "uuid": "4dde5704-7303-4d03-bcee-2bc8e10befe6", "value": "T14B658D027E54CE11F0082633E2EF494847B0A9556AE6E72B7DBA33AD55123A77C0D9CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691635218, "uuid": "fec4a371-3621-4571-b24d-bcdce8ef97b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691635218, "uuid": "7aefa4af-e8ec-4863-bba0-2c7188beb9aa", "value": "24576:t6/16VpovBLQonrdrcseFsaiM+hOMBrFfzNJR:Y/wVpqjoiMKZp77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691635218, "uuid": "e0b1c457-52b5-4ac6-84e8-c3a7d73d886a", "value": 1518592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691635218, "uuid": "87f596e0-0777-460b-90db-c55b84b5d25e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691635218, "uuid": "17c98bce-5545-4370-a84c-9e20599b18b1", "value": "121803c75457639b8f375c751a75e9df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a7dc6f-379e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691686236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686236, "uuid": "bfd54573-efb3-4fc3-8804-a593a7383098", "comment": "Malware payload", "value": "3bc76916332f735c819bf1deb570e92c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686236, "uuid": "b4fd5970-7eae-419a-ac83-517f9926ad15", "comment": "Malware payload", "value": "f801a1048b1e1bfdba8de6c22afa35016bdf6faa4408a3dfb74fb3ccae16bdc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686236, "uuid": "f2e106ac-30c1-4e4a-b96a-47dddcf2c139", "comment": "Malware payload", "value": "e43dded6d805e37fb0af5bedc7b56fc47ab96b87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686236, "uuid": "f16a3856-13de-422d-bb38-eef1ac49dbcb", "comment": "Malware payload", "value": "8742bb5a4b90e08d071e7f71742468ae2d121d3ce86d380e8bd244df925405cacfa8f39c14b29e8196084eb935f174ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686236, "uuid": "c722d788-341f-4c5d-b6d0-277959db985c", "value": "T166845C117AC18037D2F330728A6AA67577ED9D315B796ACB9BC40C349F789D2663820F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686236, "uuid": "83d58fb7-29d0-4879-8d75-038beefae23c", "value": "6144:hYEVWTg7KU/8dIWC4PgejQxyM0G7fXJeXBKUOJPk7NXh+dma2+c3/Rh6iLcZDk8d:6FmtWC4LPM0G7fs/OJPk7NX8dm2c3/2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686236, "uuid": "4c30f771-171b-455e-a655-95641f58191b", "value": 386900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686236, "uuid": "b5789c1a-ecfb-4d6c-b9b8-f65884948c71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686236, "uuid": "0309b629-838b-4b0c-b308-ec37a0b4964f", "value": "3bc76916332f735c819bf1deb570e92c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd590c7-3783-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691674868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674868, "uuid": "7b98f643-82cb-4f95-a3d8-a326a48e6cf6", "comment": "Malware payload (AgentTesla)", "value": "d525784068f44c8c06b97756f67bca48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674868, "uuid": "b88c89e0-2987-4376-8c6c-f43509818d6e", "comment": "Malware payload (AgentTesla)", "value": "f8125e4ec3ac9a91641133259d6096405cbb989fa716b533874bd248519be3b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674868, "uuid": "3a0f3fe3-7be6-4dc3-9404-52c0ad5fb720", "comment": "Malware payload (AgentTesla)", "value": "94b2559e71b72a6c7029b9eda95b1a480eb25ea1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674868, "uuid": "e0c0c5e6-dd1f-4e0d-a8aa-dcfabdb0056f", "comment": "Malware payload (AgentTesla)", "value": "50314b5b52d07f70b10050f4e2be22fc359fa2cee4cccbae8e8450520da61c0957c529359a6dc94332cc56e1e352c27b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674868, "uuid": "96d439b4-1358-46b2-bed1-c4a23085d4ee", "value": "T11645AD3138C68FB2EFD220B506DCBCE296EDB2F0072545D767854BEEA2605D06B3D856", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674868, "uuid": "71e6447c-4e70-427d-a93b-443e28da50c2", "value": "c8cb7a778b504c2b41383b432dbd8883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674868, "uuid": "897e6bde-a4b3-4d28-b888-c2967dc44044", "value": "24576:ydBXwq3wYbKJxMZGmjBB/n0dSmsmIfKNzeAE/Nh/P0tqSQ:+XJbKJxM8MY0msmIfKtenn/PKqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691674868, "uuid": "b9dcbfb1-9727-4d33-9425-ffc051a5e46c", "value": 1256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691674868, "uuid": "23ac7355-349f-44c2-afd8-10880229a424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674868, "uuid": "c38b33a9-4ee5-4a2f-b4d9-67442a6c7a81", "value": "38h4tp20bm85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24331fa-3782-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Moobot)", "timestamp": 1691674470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674470, "uuid": "dde8f67d-467d-49d7-9922-aa290a58ea0e", "comment": "Malware payload (Moobot)", "value": "118f0375db4dcd331ecea40d8f1fd189", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674470, "uuid": "090a4b14-fac9-4d98-85f7-eb57773bd91a", "comment": "Malware payload (Moobot)", "value": "f8187719fc0cbf8382bb96bf97460191e826cfb929402d0a4bf29c79e47e7f11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674470, "uuid": "d877bc07-ac8a-4ed7-b552-3c439d441e14", "comment": "Malware payload (Moobot)", "value": "fcf2f1468adc0f8b33141f1659a4a3af31b9796f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674470, "uuid": "c2dfb165-ecb4-4934-aece-3264469583dc", "comment": "Malware payload (Moobot)", "value": "3f668483e71924ac6e327338fb4c77f8d7f71df51ed7ef534b0bb1706860090f6b723bef40353ab4c74208d1731d4d97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674470, "uuid": "8edee906-88b3-4b52-9e96-0d4fedd4b687", "value": "T14113F888FE58531EC6D172FBF71C038E7B3B0768F3DA32265E355A6133C6A654A2A510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674470, "uuid": "5d0e6119-1bb0-4b41-b94a-0bab35c78b8f", "value": "768:CFHMyZDn3q5q+UIf1GLbQK8Ga1faOdNFXMpIGpW5G0PJMp1vkqI:9GzD+UekXn811fgpiG0Opqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691674470, "uuid": "e9e0b1c9-2a7d-480e-8aad-615f108ba737", "value": 43428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691674470, "uuid": "201ac4e3-6bb0-4c0d-b482-5184a742a195", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674470, "uuid": "7c1bf884-b9de-4fdd-b1ee-b29ea96d8bbf", "value": "SecuriteInfo.com.Linux.Siggen.9999.13307.11180", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a422fbdd-3782-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1691674473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674473, "uuid": "4fe1e86b-e503-4431-8d9a-463dab45a978", "comment": "Malware payload (Gafgyt)", "value": "1f10c35f50ddda39be9bf0b287d843ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674473, "uuid": "69fd0856-2e4e-4f3e-a7e8-c689e26c9236", "comment": "Malware payload (Gafgyt)", "value": "f8c474100ee334bd688369a6ce7286293ed653a084e0cc552088470970491b80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674473, "uuid": "874f6ef4-3e7f-4c0e-ab31-5647b2f99446", "comment": "Malware payload (Gafgyt)", "value": "96063461e3b8717dcf3e8bd1cd340bef69f5b435", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674473, "uuid": "3d556a90-6fb0-4659-af46-237e21161d11", "comment": "Malware payload (Gafgyt)", "value": "17c2d5a4516497e1637b11cb0b93de799c4276941f1c3f003e5001afc31b807cad1ac49765c318eb42fa0e5039897a7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674473, "uuid": "29d494b7-db49-4bc4-b56c-597b84d470ac", "value": "T14A6356697E21ABEEF66C82314BF75E70939522D236E19294E2ACC70C4F7024D588F7D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674473, "uuid": "102c39e1-3155-4b42-b239-13647ee2ad26", "value": "1536:grWLlonAmDZRa6KdKW/CPDXCMYiti3vzwS0mcHAgvWyu6e9d06p5:HonAkKh7gvWyuh0W5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691674473, "uuid": "1d2f5c8c-7669-4754-8489-48b947d8c929", "value": 66768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691674473, "uuid": "ea0c3815-1239-4903-b94c-065e0487300c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674473, "uuid": "bec73530-b792-4cf7-a71e-989149f43c4f", "value": "SecuriteInfo.com.Linux.Siggen.9999.2156.2359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f918ba9-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691648695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648695, "uuid": "81d0053e-fe68-4e6d-abd4-34461cdcb461", "comment": "Malware payload (Formbook)", "value": "4ea2c3f880352ef506a9580ca65e6c9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648695, "uuid": "b9ff7933-c1a0-44ef-b067-27776a60b64d", "comment": "Malware payload (Formbook)", "value": "fa278261af3ab337d468f32853cbf7dc6f13bb529684f45d92a2069ee21318b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648695, "uuid": "a1aa70e7-de0f-465e-8272-a98885c420dd", "comment": "Malware payload (Formbook)", "value": "cfa5d6edb6d40c1776e964b1669b8c212614dce0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648695, "uuid": "e7d8d3ca-154f-40ca-8755-8a89592e2945", "comment": "Malware payload (Formbook)", "value": "4169406890ecfc17b0b387c13b783635dd71d30a7cf6583f35aa3a51ee1774bba89159a542a5708ae285a1dbdd4cefc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648695, "uuid": "9725200f-bd58-4292-8956-67ed3089408a", "value": "T19F05373C11296A4DF7A586FCB6708CFF17A4692F80BBF9F3885CE4D306A97D05502266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648695, "uuid": "8d49fc5d-470e-4fba-a88d-57b77f511d9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648695, "uuid": "32e5c94e-33ea-464c-ba9f-6279d6d744ca", "value": "12288:0Euc2pEOSLYTE7mv8pYM2IeAtbyFRcLe0nvii807ZdgdU:0jc2pEO6YTEqvqeANyFp0ny01d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648695, "uuid": "a2719d66-787b-4e2c-9e9d-1b9ec4404d0f", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648695, "uuid": "f1f68b6b-c8c4-465c-bd09-5b3622184b78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648695, "uuid": "5824042c-908a-4a8f-accc-e7fb3fe93b5f", "value": "4ea2c3f880352ef506a9580ca65e6c9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6157cd75-3739-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691643008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643008, "uuid": "b913881d-df5c-49b7-9616-09fe07f66ba4", "comment": "Malware payload (Mirai)", "value": "3b14a61af0e8e981d04ca27380a5bf17", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643008, "uuid": "8c3db352-a976-4a5d-9a6a-4559e0dc14cf", "comment": "Malware payload (Mirai)", "value": "fa8fb2bd2fb1bf788dad36da14e2251177fc2a55925a43e00e4ff4691263c8db", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643008, "uuid": "3d1007a8-305e-44dd-9c80-e31af34434a6", "comment": "Malware payload (Mirai)", "value": "9f9e226ba51a443d4b67a9f98b5eada34efbdd35", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691643008, "uuid": "04d77c91-0b10-4fea-a8c4-3ffafc1dbddb", "comment": "Malware payload (Mirai)", "value": "f403fddd2421b7617a1d44c2ceea9049d56b924f0d691ffaee74275151e875161ed2c7c65d7b1d57d7405dde0260747d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643008, "uuid": "03bded69-2fa3-4ce4-82a9-9a35d1a36436", "value": "T145C2D1221AEF39B0C1A464BAFD6C8ACB625F0FB965F15521764017A1CEE100352B58F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643008, "uuid": "e5752ada-2838-4b7c-964b-30f42e45df69", "value": "384:5XNSIfjdxuZ1DUofVOyPqMvt6GqAAdq1K0jzNH7EUz6z6RNo9ch88SmMhymdGUof:LjKX9vt6GqA3Q0jzV7EUyUq9E2s3Uozj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691643008, "uuid": "e3866b33-3a81-4909-a11b-b369fd451c8e", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691643008, "uuid": "379c20f4-de3c-40e0-a36e-339c118b7120", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691643008, "uuid": "ad06edee-a6ba-4452-8dad-da2acc1285b0", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb0ba76-3726-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691635000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691635000, "uuid": "b00f3b5a-19ec-41a6-a88a-8eee492356c6", "comment": "Malware payload (Mirai)", "value": "5088ee8f715fbd7b4d6f85c10577bbec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691635000, "uuid": "4b7d24f8-ed8a-49c5-b140-db1deecffcf9", "comment": "Malware payload (Mirai)", "value": "fb2962dc8d7fee27f6d418f2642ae3714e096fb21d16a7e6b4d3b125f8fabeed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691635000, "uuid": "7ef797d8-dc47-4150-bf3d-2cdadcadb363", "comment": "Malware payload (Mirai)", "value": "ffb3d6f711b65f58cc7873b632db27380b3e1eda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691635000, "uuid": "8a3d7c74-13a1-4133-be42-7f88be61a6b9", "comment": "Malware payload (Mirai)", "value": "c75ad7ffa1b4b5713c4bf1bdb1130419634e0c504d7b6dac7ca89e4aea1202240e0938301d1a1d29f9bce9f675edfb79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691635000, "uuid": "7f567929-7f1a-4d20-9f75-12b980936b5c", "value": "T119D36D82F4018F3CF89AD67A41274E09B4A1929467A3071BF397FCA7BC721955E0FD85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691635000, "uuid": "49bfbdfc-c6c9-41e8-aaa2-7bc82ca1d3fc", "value": "3072:xliZS69hDspVcFdOqAL/uHOKdRC50p822KZV2S:aZS69hDyqj5ha50p92IV2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691635000, "uuid": "fd5fd2ad-bd92-4a3d-be79-4210ddc271ee", "value": 137176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691635000, "uuid": "33a96593-ab33-4f56-8f0a-7828a5b93b59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691635000, "uuid": "62d2aa47-a765-42cd-b335-9fc816250f34", "value": "5088ee8f715fbd7b4d6f85c10577bbec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425bce60-3715-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691627494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691627494, "uuid": "79ea8fca-1cd5-4323-92cc-b19bf3d2e898", "comment": "Malware payload (RedLineStealer)", "value": "b7cd5e009c2b821868f73eb237b5d42a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691627494, "uuid": "91948f34-2739-4ae5-a8bd-3e28139c82bd", "comment": "Malware payload (RedLineStealer)", "value": "fb424ee403e7590fb91192e93f699fb47133442454ed69158733cb495e938580", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691627494, "uuid": "e2cb5fdd-5e9d-474f-8cd4-066b5614c2c3", "comment": "Malware payload (RedLineStealer)", "value": "93355f5789853c492048c40f5cfa728630935e49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691627494, "uuid": "d47fe288-0dd5-48a4-9414-5a51acc3482e", "comment": "Malware payload (RedLineStealer)", "value": "3c787677eefe85ca2b491564b89e8cd7689a9af5a4dd3730d4dbaabe8d479e9c2ec08ab2a5d25833fd9d73d93dfd09dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691627494, "uuid": "c668eee6-13eb-421f-b8d8-b5201bac9075", "value": "T10203F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691627494, "uuid": "1d408209-0e73-4c19-85b8-9ce6cd5825a0", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691627494, "uuid": "6bc71dfe-7432-41c2-9afc-5beeb1d09471", "value": 40709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691627494, "uuid": "e3df1c4a-8861-4102-9192-581c7d48021e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691627494, "uuid": "8ae30064-77e0-48fc-a408-77f0db4355ba", "value": "b7cd5e009c2b821868f73eb237b5d42a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fbcb2c8-3782-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691674466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674466, "uuid": "1980208f-face-4295-a55a-3449601de96b", "comment": "Malware payload (Mirai)", "value": "fa165e66c736498b2eece687b2eee7f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674466, "uuid": "65e6a635-12a9-443a-b07f-26a4ec8d1c33", "comment": "Malware payload (Mirai)", "value": "fcd08b2b48d80a3fa59612a9fe608c1c24bc6e7b03b07191300354f78706ba67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674466, "uuid": "54284eed-6357-4100-aea1-427cf0b67b41", "comment": "Malware payload (Mirai)", "value": "9e35112910ecde1a82f86ec99bebc9d120e5111e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691674466, "uuid": "4115e18c-d495-4cfa-afa3-5a4b5caa6c08", "comment": "Malware payload (Mirai)", "value": "4478e827d6a7231c70fc24c30c0e735d5263e2123f24aac683efc7b673e37d1ec1b749249df7b13b20e01f96e0afe706", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674466, "uuid": "c6de343e-8027-4397-8f42-1c8d774648f6", "value": "T138E2D133466664A3C7E82D3E7C1D41CA3D6B4F7CA44B39A2562CA1BC2F99C463EF5181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674466, "uuid": "6ec0a79c-9b3b-4aa8-b8c4-a503aa49d817", "value": "768:vEbYnktpeynXsPJCuyaYeyossG7W/+yG19q3UELh5:MbYkFncPJCcDWsCW/+pILb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691674466, "uuid": "4a0bbc92-9688-4997-9395-a9a8d7370a78", "value": 31248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691674466, "uuid": "fce79a78-2453-4138-94cb-cb5b04b55daf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691674466, "uuid": "d012e7f5-918f-405d-af96-e0b5b38528e3", "value": "SecuriteInfo.com.Linux.Siggen.9999.11038.30776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e0c29d-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691648434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648434, "uuid": "f1fff101-959b-4ab3-ab3f-0e1585dafdee", "comment": "Malware payload (AgentTesla)", "value": "b72055755e70c82e88d271c4d4afb705", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648434, "uuid": "aca9cbf6-bd77-4f7d-97db-cf95959d6170", "comment": "Malware payload (AgentTesla)", "value": "fced20585743f35e8506f51f075980f4eeb73a1c3bbf2e7e39588ab4a10beb37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648434, "uuid": "d8565e0a-3609-4ae8-bc01-b4351a16d2d7", "comment": "Malware payload (AgentTesla)", "value": "9e84ca256aa5e6c4efc605fc4960107f3bba1a19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648434, "uuid": "8fd3a51b-d27c-46ec-94db-9676a757655d", "comment": "Malware payload (AgentTesla)", "value": "0b68d81370374c3cb944283b0fcae78c597aa658d270ea886a73e7a1a86aeb01990efb51fb9f691aa514e78405db8501", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648434, "uuid": "0e2a45fd-74b5-44e2-a330-29f028267a37", "value": "T1CDF412BD77E79C30D3686832E78121052371A79FA5A2E70F110822D2C96A7C5B765BCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648434, "uuid": "ceabd7ad-8c61-4973-b376-c19ca347c231", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648434, "uuid": "56fd9678-1300-43bf-b109-f2126f38b5f8", "value": "12288:cOUGGTIYlV2UwP0U2FNPTdJjs78jST1BUsX56q7nuVkehXTOmUXXN:axIYlVNwPp2PPTdJjsw7iQXVkeOXXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648434, "uuid": "86b901a2-83b4-4478-87e0-c30d5c998171", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648434, "uuid": "d2c2e4a1-57b4-4a79-aecf-c6a9838ad652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648434, "uuid": "86988b18-2c98-4548-a18f-4792c3fd08ee", "value": "Cartas de recomendacin y hoja de delincuencia._1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0feeb2a-377f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691673179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673179, "uuid": "4cb1a7ce-c552-4102-90f8-328e48ee2ace", "comment": "Malware payload (AgentTesla)", "value": "8211b75c84d501f11e0e82cee2b01a11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673179, "uuid": "94dd2de9-9eff-41a8-ad78-01b0e1d95c44", "comment": "Malware payload (AgentTesla)", "value": "fd40c324ec61efe9fda8eea1716c2af91074fa0a2bb64368f4d698280e325a11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673179, "uuid": "e4344106-f4a3-4f82-a8b4-36982dc2505c", "comment": "Malware payload (AgentTesla)", "value": "330c720bd8aa9533e164cd49af4d5304618e92d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691673179, "uuid": "7c35ecd0-b6e2-4cb4-825b-d6cb31dc4d72", "comment": "Malware payload (AgentTesla)", "value": "b725d0c01c592376d9630c1918173897a7a02d3b9e36b1295ee846f57521cb7885c764359df2483fc9edd2adedd80e3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673179, "uuid": "fbaa1805-ec18-458f-b675-abdbc5807c49", "value": "T1BE05F726E77B645AEF19A5E88E2F847239D6DDC0F0B1C588A7E72C0385C23114D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673179, "uuid": "8f14dd1d-dba1-4757-a1cc-4c003ca837f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673179, "uuid": "b49b6e01-2320-42c0-ba39-080ebb85585d", "value": "24576:NPuRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOFUFNLFyhFNbvB9ELEPdu:RuRs6CE3jLbO9Rs6CE3jLbOFOYhZW4Pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691673179, "uuid": "9f7a0501-810c-4a8c-a63d-c8850cd80109", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691673179, "uuid": "c96439ab-6256-45ae-8aa2-d5aa428345b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691673179, "uuid": "c31e72d5-2c55-4ba4-b5ad-d81cf25c9d33", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004037ab-37ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691691807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691807, "uuid": "748dcfda-f976-4154-a759-0c30bdbd8814", "comment": "Malware payload", "value": "113c295681410c02517b52bd6aba932e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691807, "uuid": "81e34dcd-bf0d-4a19-8016-3d9c6734bc93", "comment": "Malware payload", "value": "fd64ca492cd7181e02bebe0d9b3b1c5616af08c7c1e1a7cc4e22ab41246c3995", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691807, "uuid": "07274308-0ab7-4278-bd1b-92ab3297e579", "comment": "Malware payload", "value": "fce1b1b3e8453d533f1e1a3e09c9be07e4aecea9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691691807, "uuid": "f84506fc-7904-4ab3-a771-da88b6b18ed7", "comment": "Malware payload", "value": "3d3b7564a5e037a8dcbdbdb016c4093abb9b6b9dc0533b1fdca30077154634dcb8d298c0cb9c0f843c0f8ce6113e0f99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691807, "uuid": "3c0bd75c-c1a3-4322-8691-ed35bafe1892", "value": "T1B374AFC27E917C50F426CE329E3AD2E6363DFD518E59679A2218FE2F04B11E1D563B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691807, "uuid": "a4a668b8-60b2-4447-91f4-ca63138a7ea2", "value": "652c7ff7afcc08a2e9c5186e380250b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691807, "uuid": "118f527c-8f14-4c48-8ce2-23d731be3325", "value": "6144:fKXk0q1dKqu9A3Sw5udy+H37xW82V598wzS78wXO:SUz1dKqu9A3J5udVH3FWz9sA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691691807, "uuid": "873d15bc-6611-4407-af44-ff17af5edc4e", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691691807, "uuid": "9c1bb148-a7cd-489a-a99f-fe22c8869048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691691807, "uuid": "aeb6e316-b87b-4366-8cff-adc188992d31", "value": "113c295681410c02517b52bd6aba932e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bb9379-3711-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691625988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625988, "uuid": "bec9382c-c008-43d7-9dc9-aabc6b66c041", "comment": "Malware payload (RedLineStealer)", "value": "ac48d07acbe9d248ac80d4b5b8bbe645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625988, "uuid": "448b1a2f-1b6f-4bb9-b0b1-fcafc60cafdf", "comment": "Malware payload (RedLineStealer)", "value": "fd7eb5f5c0502dfd7b434e268b33ab08cc58c26575cc420781d4f5f4e2be8188", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625988, "uuid": "76b9b072-0abd-49a4-bc49-81c899c2cb85", "comment": "Malware payload (RedLineStealer)", "value": "9b0367f366ad73cda72d7ad239411171223a306c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625988, "uuid": "f5bbe0cb-a88c-4d15-bc7e-e494abaef8bf", "comment": "Malware payload (RedLineStealer)", "value": "20f4eeca5d1745bc6cf766b516f88129ecc2edde801010e6db57898d9ffd528d875216fbeba317dec24619f0d9cf5d00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625988, "uuid": "711ed5d9-d724-4a4e-b045-859f38f3dd48", "value": "T16E13F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625988, "uuid": "863e16e6-6a4f-41b2-a5c1-8b3059b8e3f2", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691625988, "uuid": "2f1a8c9a-3f20-4521-b55b-f7631b6ae1b5", "value": 42039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691625988, "uuid": "2d4a21bb-a71c-497f-a490-05c6346ae586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625988, "uuid": "9cbdcbb9-2e53-4f2e-91fa-b8eff9b01559", "value": "ac48d07acbe9d248ac80d4b5b8bbe645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b761ac4-379d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691686028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686028, "uuid": "a7417ad8-0a91-4c59-bc12-5d57eb4e73a7", "comment": "Malware payload (GuLoader)", "value": "2601a9c634a7a1fb19c8378dddc85621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686028, "uuid": "e46df18f-15b7-4a5f-a272-71858adbfd99", "comment": "Malware payload (GuLoader)", "value": "fdac0492a14ee260da657d0d8c075fa9d01d2b3f6bf1fcd66abe73080240b88c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686028, "uuid": "eb704e9a-cae9-4be4-8221-de09e4dfe935", "comment": "Malware payload (GuLoader)", "value": "eac15716aee83d714d60cf893157c686464fbb20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691686028, "uuid": "d9cdea37-3684-4313-8fbb-73b9fe820bb4", "comment": "Malware payload (GuLoader)", "value": "fb91fb6b5e72a28e1193531fe6c4293aae161fc537ea2534b5ff1dca08842196c83f961a407b1962c3dc723c538e7261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686028, "uuid": "182c5909-dc9f-42b0-b4ba-c42ea344add3", "value": "T15A2501C3BA426103CFD9DBFD1A928E66191D3F724719DB02D2643B2B8C7C5A136DA235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686028, "uuid": "80ab5ee9-26f2-44d3-b70e-2f975926e2d2", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686028, "uuid": "7bcbad21-7002-47b3-9efe-7bfe19a83903", "value": "24576:xFiS4t7rrMhNFwprMQp7a6lHHKkQWyRNhv:ySYXApw26lVwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691686028, "uuid": "2103bcad-53c7-4d12-a66b-a6d58d4c24c5", "value": 1009080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691686028, "uuid": "fa8304db-6a02-42b4-87d6-008f117f9019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691686028, "uuid": "4ba6e92f-5806-45de-8d21-ded683e24ae7", "value": "Solicitud de Oferta de Precio (UMSA 2308-09BO)\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56bb7b86-3734-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691640842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640842, "uuid": "89fc9b41-c6cd-4ef7-96c6-460656ba6d06", "comment": "Malware payload (Mirai)", "value": "ff91e5ffc78fe58f84c2c12023795d0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640842, "uuid": "eacbbc0a-0d15-49ab-be0e-78fb4b99d4ea", "comment": "Malware payload (Mirai)", "value": "ffb80ce369f747d71516160b3ab0eb473a69aa2b3d5550a4f78cc22fb7fc6764", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640842, "uuid": "e5e589a1-c046-4dfb-a829-3107e2381b52", "comment": "Malware payload (Mirai)", "value": "bd31dd8785261f5b4e284e909d97e32d65e1eb53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691640842, "uuid": "ece73609-a775-40a3-9921-5f7721fd44e5", "comment": "Malware payload (Mirai)", "value": "271ec1cf0ff06364b759ebfe36c1f90702f70a440d3f8ddf46a9bff557313dc3ed3c6a7d8f3e417bf0b16b13d9741ed1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640842, "uuid": "9116d5c4-89c9-4e89-aa72-c7a15f7b3233", "value": "T10B43E848FA98631AC7D166FBFB0C03CE773E07A8F3DB72165A351A5133C5A65563A028", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640842, "uuid": "5042824e-ed67-43e7-8b6a-7013e2cf6348", "value": "1536:tPB6vQgwhKhTgr230sJ1FA+1vJ2Lw4oHHm:tZ6iGTgqZ1FA+JMwTHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691640842, "uuid": "66e3658a-e1a1-45e9-805b-c02770e81ee4", "value": 55812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691640842, "uuid": "150c029f-ef25-4626-a306-0e7bbd349891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691640842, "uuid": "37306105-a7b2-44f8-80d5-960c43c3d5ca", "value": "ff91e5ffc78fe58f84c2c12023795d0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f4bbe3-3746-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691648834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648834, "uuid": "8fb5aa2d-8865-4e2b-a3f3-1bc5134c7506", "comment": "Malware payload (RedLineStealer)", "value": "87467eface309ac95e0df4afd0bea2a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648834, "uuid": "975ebb89-599d-457c-8d59-0896c6acec26", "comment": "Malware payload (RedLineStealer)", "value": "ffd6751de1db3dbd68d7e10f164d5bf464bad385ab1debf5c5efc156bc0f3db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648834, "uuid": "ed94e6dc-86a5-45d1-bea3-ff0f00d11f26", "comment": "Malware payload (RedLineStealer)", "value": "0689ed36f00a6ae85fd827cc55b15ce59829091c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691648834, "uuid": "69e00119-97dd-4400-8537-856f9a2e30a2", "comment": "Malware payload (RedLineStealer)", "value": "a54396a53c9191a22d3fc42ce181fa7eafc7f14646c3c20bdd6261fed80ad04f3aa53eadd0a71907463269b074e69da3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648834, "uuid": "61991994-27ad-4538-be6e-4ceddf661ddf", "value": "T18EC412136BD44073E8F4677428FA03430B397DA14E75C66B27889D5E0DB3A99A83637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648834, "uuid": "976b6128-aec5-4806-84e0-ace7192c3ea7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648834, "uuid": "844e1801-207f-4cbf-9a9f-76e93b14b693", "value": "12288:EMr2y90j48288+FmnyOz/d0XLWG0sbPZMZ0iOAkl1U:6yw13BFcV0XLW3sSZEAkly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691648834, "uuid": "4b6b5996-e600-4069-8ef4-94e590b8c2c0", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691648834, "uuid": "33a584e5-5d1d-4b06-8d4d-94326719d21c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691648834, "uuid": "2444d719-ed9c-4490-a28f-2f203da6ca6b", "value": "87467eface309ac95e0df4afd0bea2a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }