{ "Event": { "published": true, "date": "2023-11-24", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-11-24", "timestamp": 1700870581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3dac178b-db72-4f8e-9136-f8a8d0d522b4", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58317bb0-8aac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700818331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818331, "uuid": "b4a42ffb-49cf-4418-936c-085f63afb543", "comment": "Malware payload (Mirai)", "value": "d6a9170094dbbfcda035a87add5f6a13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818331, "uuid": "f5a1c937-930e-4992-aa55-9e1723a3f859", "comment": "Malware payload (Mirai)", "value": "00a65e65b2a3a1c6a51ab38eaec284e47a94542b19f57dbf9f01480625606950", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818331, "uuid": "3fa6c5ff-4022-4eed-b3c3-96b9353a34a1", "comment": "Malware payload (Mirai)", "value": "30ed8d7e486f2451df3b057d22c3059d2a55f663", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818331, "uuid": "3aca3437-618d-4f96-8a68-5651dacd1741", "comment": "Malware payload (Mirai)", "value": "2d1ef7424fb3bba2978781d8824b61241b86903badeb00d5e715872693c2a3b0c8c77643c097302e65423119da8ecc84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818331, "uuid": "83f7d817-9aab-47a0-bbd0-813f4121b46e", "value": "T112932855BE825A22C5C513BBFA2E418D372153E8E2EF7207CD216F2176CB81B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818331, "uuid": "e0f71d35-5ab1-4dcc-8092-84d7cb0bbf58", "value": "1536:mjWzEQyz/eo1+YDhWFjWPIrn7J7LPWqfuP5PFT007T1v1/wbZnB:mjWo7z/endBD7JmqfuP5rVFwbZnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818331, "uuid": "60110eb2-ca8e-45a1-be61-04312c2d5d12", "value": 91460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818331, "uuid": "22fbbe37-baf5-4c59-9776-09bee2f10e4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818331, "uuid": "ebb017a7-fdc0-4bc0-a8ca-2d26b48ef5aa", "value": "d6a9170094dbbfcda035a87add5f6a13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb6b5e1-8a7e-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1700798714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700798714, "uuid": "a91dd83e-9eda-4029-a6bd-eb2666b7aafc", "comment": "Malware payload (AveMariaRAT)", "value": "977d0baab98c82cc29fdc48f1556bca9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700798714, "uuid": "dbdaf65c-da08-4f97-b77f-2b2c044827c1", "comment": "Malware payload (AveMariaRAT)", "value": "0105bafb9a326de3ee23e8d01a0b0bd3216a3de3906e28c10c3cfa4825939161", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700798714, "uuid": "ea63a759-d003-4540-aacc-9431ecab627f", "comment": "Malware payload (AveMariaRAT)", "value": "0d42f564f3971a2f341a2a417741d63bbd909578", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700798714, "uuid": "1fe55a86-cae8-4ccd-bf14-f0494ffb926a", "comment": "Malware payload (AveMariaRAT)", "value": "7532dec93ed94b9b01fc01510db8f75c33c78178fcf05a07fda7bbf92e123dcc491b49ce72e50e5bab685e7f688e14b4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700798714, "uuid": "3a8c1f4e-4fe6-41f1-acdf-99e8ff56ef26", "value": "T181D4EF2362BDC9E6F81C7EF5068807248BB15D961276F60BCA9FBCC5E873623C6101D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700798714, "uuid": "51083e33-b5c8-420b-b0b5-e2ca28622146", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700798714, "uuid": "95d2a3cf-6a23-4809-8562-6a391d6ef759", "value": "12288:qUR61SoavUPXUAcKbmQ0PtuqwOuUFgJGTlrLrACN:qUR61fXzbmNunZUF1CCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700798714, "uuid": "75a176bc-29be-4f9a-8702-d8e47deb7c2a", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700798714, "uuid": "1accdb1a-8ebc-4d99-a8b8-e5991f3060c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700798714, "uuid": "b54a4ee0-3942-4a9b-af1b-c5015529c60e", "value": "977D0BAAB98C82CC29FDC48F1556BCA9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ac555a-8a9b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700810990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700810990, "uuid": "ed2147ec-538e-4898-9c98-fd5c930023b6", "comment": "Malware payload (AgentTesla)", "value": "a777f0be9a625b0c7131998117ea69d5", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700810990, "uuid": "4e5e3fe0-919a-43a0-b52c-f98267d634c8", "comment": "Malware payload (AgentTesla)", "value": "01badcf3ed8e344bad48f962f07f08beccbfc53eabf16e172d37b40663b5a50f", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700810990, "uuid": "c7af59e6-6240-40f5-9245-0752273cd069", "comment": "Malware payload (AgentTesla)", "value": "8be4c8897d4e0907db97d871197245f2cbc24453", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700810990, "uuid": "e8aa41fa-bd9f-4fe7-bede-6bff333774c4", "comment": "Malware payload (AgentTesla)", "value": "4e167cc6483b3e4be1d54b6fc34dac57c441a4fb715d66b81ecfde2b0f23a01e89f9f091a63405fe3bcd9baa86b58730", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700810990, "uuid": "edb2b801-588f-40c6-a8f4-c0f2b17ac5f4", "value": "T14FF4330158DBEEC7C7EF94B456ABB6AEB37049D91345521B733AE801FFD104902DA8B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700810990, "uuid": "b465d4bf-7b79-49b2-8217-85808f0f3f01", "value": "12288:x9/Vb3RikWgC0yyzBtFe0fShL66Vv47ur6HZfbJc9PT0qkNNFkxsv0pITl4mt:xVVb30kWJDyzB3e0fWLLVv9reZtsPT0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700810990, "uuid": "70b1f88d-a0fa-4d37-bbd2-f6987d0fa331", "value": 734836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700810990, "uuid": "324e0f90-2b94-4d2b-9ccc-9bb1fb2a3c04", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700810990, "uuid": "3330d2e0-d822-4fd1-a012-ece756bbc8d1", "value": "Swift payment copy.pdf.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776f8797-8ae5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700842865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700842865, "uuid": "e03d077a-81e3-4847-a96c-a2b97d3dd5a0", "comment": "Malware payload", "value": "c130145c2fccbb9bd335b123bad50a91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700842865, "uuid": "cd1c7ede-acbd-413a-b391-27d70ffc3e81", "comment": "Malware payload", "value": "052e63367e14824f06834174b31fdbc4762a133046979fb1d588452bdf301d7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700842865, "uuid": "8ccd4aa9-e866-4cb0-b51a-afe35637fde0", "comment": "Malware payload", "value": "34278ca42f1ece8cb02a4eb9e1db0f31b7f2f261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700842865, "uuid": "5ef0c25d-1204-41a3-a5fe-c6e650f36455", "comment": "Malware payload", "value": "d6ee202247c45b4204f6a103962bc68421841d9f459375d354f518b4bcaab537153108fc2fd129b194a1f363a2bea773", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700842865, "uuid": "20f76665-e05d-4d07-80cc-e7215e99d3f2", "value": "T18E243807B1C06D38C78081B4ACA7E1AED7D4A1D2531506BEA23BA85DAE31DFFA537075", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700842865, "uuid": "876b3ce6-41ed-462b-a698-712212758ee3", "value": "386d544de80c264d87bf4fdc12ee0d7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700842865, "uuid": "b504a665-d214-4f38-92b7-0e19ec46848b", "value": "3072:THCae+du/k9T2yVhdxwVdZ5NqGefxzQx0Vt0VlNu3Y94o:HlZjmVdDgGeKCVtP30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700842865, "uuid": "136b611d-2824-48d8-bc57-1093b601ad0b", "value": 219130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700842865, "uuid": "87337331-316b-44a8-8800-4e6968835e7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700842865, "uuid": "c48ef65d-bf36-43ae-af9c-6ba3246cbdc4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b306e1-8ac2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700827994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827994, "uuid": "3da97103-9e06-45b6-aec1-ccd8397b9d57", "comment": "Malware payload", "value": "de3c65022caa3577aebd4ff38a346b7b", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827994, "uuid": "4d955199-a1b5-4e8d-8dd4-e043fe12792b", "comment": "Malware payload", "value": "0653c245ba72293be885fa932465989e0eb3cb36c3e0b5a83e7bc2b8905cf08a", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827994, "uuid": "884125c3-fb6d-4622-b5b8-22b46095758e", "comment": "Malware payload", "value": "d3c3ff9ddba4198a878ed6962a55c0e20aa62611", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827994, "uuid": "a73d4e56-e09d-4689-9f2d-77c317803191", "comment": "Malware payload", "value": "538a40444b3400c5d348e21eb270cd7f185249a159c6fd4341a3c9123faa83690c55bdc0957e97b367e49f2f10315893", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827994, "uuid": "f9e423e0-e000-4b16-bde4-d4565943eddb", "value": "T18FA1524413D0706027CB0FE62D2FF5E0F495C8FA39518C6B2110BEE8ADAC9A5D695E77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827994, "uuid": "87700f90-1f97-4d22-a910-efd06831bf43", "value": "96:6Wi782P1smGV2tNmAAYCHfMXVlwzVL4sIMX8QNmcZ7feg44GD:6bFsmGVE/pC/jVL4sIzgbZCg4/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700827994, "uuid": "31186c20-9bf1-4ec9-8fb6-79c4cd2e3355", "value": 4827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700827994, "uuid": "e0d24fe9-6329-4af9-a7ed-2776fef35097", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827994, "uuid": "0f87148f-65cb-41a2-9232-fffb6896252f", "value": "Agenzia_Entrate (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3812aac-8ab3-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700821598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700821598, "uuid": "cbbf1c05-9e5e-4b41-a64b-fa8f15490697", "comment": "Malware payload (Mirai)", "value": "78f926e5a126c60fdfcc8f1ad8408f23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700821598, "uuid": "e39e42ff-e09b-4ceb-a897-3600c79a49a4", "comment": "Malware payload (Mirai)", "value": "0730e802398d5c9587f52806f5f35b749dec4b2a275d4cdc84aa27e60f4cd42e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700821598, "uuid": "2569e3c7-09c7-4b7c-96fb-73fe5a0cc5e2", "comment": "Malware payload (Mirai)", "value": "0d7406252edad6a3917633019d18ae9725cb6c16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700821598, "uuid": "da8dc84a-2952-4f9d-9377-2e8766797a46", "comment": "Malware payload (Mirai)", "value": "aa41382c0dbbc98faf236310b5abdc4a98986c4eb99c258c95d1145e1184981fa609c2f02c33be9d39854254b008c9e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700821598, "uuid": "ebaf2d83-293d-4827-b3d1-f7fc857a9145", "value": "T168D2D02D8B4200E7D506C8BD25A057B03DF08B27AD928D6BA786ABD38F541F03977DE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700821598, "uuid": "48fa1e64-bdcf-490b-a72f-2eea7d4a9baf", "value": "768:nGjet9cdlFBDvBG2CwbGuBH4f0qJ/hC81D9jfRG6A+NIQBJgGlzDpbuR1JG:GjVrB7E2CKt/S1fR2qTVJuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700821598, "uuid": "792382f8-2d84-40ac-9dcd-25b5b82acdb0", "value": 28968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700821598, "uuid": "b549b4cd-e5fb-43d2-83f8-042fa679f385", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700821598, "uuid": "d0546770-06f3-4a7d-992d-f87f7758b0aa", "value": "SecuriteInfo.com.Linux.Siggen.9999.23998.17519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982b858e-8aab-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700818009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818009, "uuid": "f39c927e-3fba-427d-91ed-f5b9c19f697b", "comment": "Malware payload", "value": "0e2c37cc209fd52cce861928d859ab2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818009, "uuid": "4e7884b6-99f8-4bcc-ad1a-eec3cfe9679c", "comment": "Malware payload", "value": "081d8540af456e8725aa2de3bf1d18dcfad5aceb0a86c7fc5b8c847b1a78f051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818009, "uuid": "d0244662-2dac-4c0d-ae20-a61f72130d27", "comment": "Malware payload", "value": "773ce4304e33a6cd74432572472244d8bf8e2d14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818009, "uuid": "f2f3fa63-fa62-41e4-82fd-5035970edf5b", "comment": "Malware payload", "value": "378f5219e6b82568bec5ccef2ec3c8b8b8c2efe7c50cbf3ebc3e96a821a635fdd162be0bc79e8abb63285631cebf86d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818009, "uuid": "0f1e37bc-6b7a-46c4-9365-6139d86c11e7", "value": "T1A0C1ED415EEF00DAE26707701BE6B3B71166F9B1552E62F874848A689F30AC0CC62EB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818009, "uuid": "769275d2-b3fa-4d3a-b2f8-89a7975b6e9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818009, "uuid": "551b6cad-afc6-434e-ab67-151ce1b07934", "value": "96:JynTv7Y79VQCFyRrUmN2qUcrt6NtUqU2TW/VRXkd3ojCVfrl:Jyj7O9VTFmLN2q3rMNtUqU6W/TkdDVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818009, "uuid": "614ddd49-7ff5-4f20-a10e-404826c7a7cf", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818009, "uuid": "f614a63a-79b3-4561-bd25-99ac67db7944", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818009, "uuid": "2b4dd2b3-762a-4a49-8c26-846084e1d67c", "value": "SecuriteInfo.com.Trojan.DownLoader45.55850.21479.28750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9415ffd1-8ab8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700823585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823585, "uuid": "665d0237-9c63-457b-bab3-2a0fc45f9999", "comment": "Malware payload", "value": "3ff2fcedfdd5f2380277adc34f17507e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823585, "uuid": "91e44819-c4a2-4421-8c4d-1e2b82e12e62", "comment": "Malware payload", "value": "089a1d6ed708219b604ab7fdd2a9bd7cb28725799f9530089ea7d941a94c6bf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823585, "uuid": "b284c06d-beef-4b6d-9362-113cfee1a18c", "comment": "Malware payload", "value": "f627f7d08bddc7b941a8c985383c04cb0514af30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823585, "uuid": "03317633-5131-4832-8f6b-d547bd70457b", "comment": "Malware payload", "value": "4ffa1c04d8e3d0b2343b93a69e9deebb783353cc09576c79d310fd1d2e335467f2a6a9bf4c8658c07b8ba6404f425d27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823585, "uuid": "d1f1e493-4151-4c36-8700-ad71e4068860", "value": "T18A465A217246C43BDA6A01B1692CDE9E5138BE720BB154DBB7DC3E6E4BB44C21336E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823585, "uuid": "105ed803-5ab1-4464-9b64-c54160aeae6f", "value": "d79dd35f147f0bd91cc18a6615fcfa5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823585, "uuid": "a7f57f4d-8d23-4f40-a356-0250022813ec", "value": "98304:wAs++BUHecpbpx+sborjZGS/m6FKxjSwdd:wAKBx4px+sNPxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700823585, "uuid": "6bdc9165-8242-4499-bb59-e185dc1a470c", "value": 5843696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700823585, "uuid": "b73acd3f-6eb5-4159-b4f1-a0636e50e5d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823585, "uuid": "fdbf0959-9e6c-40ce-8ac0-93bf94131d7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e606632e-8ac2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700828018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828018, "uuid": "062773c1-14e4-4924-876c-292add06c3e6", "comment": "Malware payload", "value": "c628f7dccfc1ee11ea2c417dc8b93797", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828018, "uuid": "bcf28e6e-568b-4d46-9011-5b98a939aa19", "comment": "Malware payload", "value": "096f1efe5d48906704852cbf6952abde0b798d38885b657c175a4b5c9ea5abd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828018, "uuid": "8c7f3129-0f8e-4eac-83ff-568ac54dd04f", "comment": "Malware payload", "value": "d3c494c768b03f3be1adbcb1aa1721cc83138b30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828018, "uuid": "80d378f6-f032-4fd8-b942-7ad6baaaef9e", "comment": "Malware payload", "value": "fe52f9fbeb780faff95b4c90e4e63a84baafedd309903b6c93bf07fee296e1f84d9f3addfb233129c476c4e57a94aeb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828018, "uuid": "f0f503d8-9898-44cb-85b8-87b212905985", "value": "T1BE44691375D0FF21C45643358F3CD6EC7B6EB8619E259B8B22382E2A69312B3D667311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828018, "uuid": "217d11eb-e15a-4706-aeba-1ed06403eee7", "value": "7c1db49ad6667947e0650b5a549f4e65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828018, "uuid": "8e493cf2-4fe7-4df5-a8b7-3e801d463641", "value": "3072:0MnB5uYJy/+uDvv4o7TJ7FLASc4qy29fPBjT8xr5ROoE5A4:3LuEymTeIfyMf9T8VXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700828018, "uuid": "63da80a3-6165-4463-93fe-588767379312", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700828018, "uuid": "5826a2ab-78df-4039-8075-bdfc732edb86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828018, "uuid": "c9dc0263-204b-401f-8cee-d9127d177756", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c126f1e7-8aa5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700815500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700815500, "uuid": "31469103-4fa2-4dae-9114-d731885d345b", "comment": "Malware payload", "value": "c5f0766a1bb40f95938a08c0462d122e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700815500, "uuid": "b3fb6e50-3748-416b-be95-5e705579b724", "comment": "Malware payload", "value": "09b94cfcedeb57c7c368b53ff3969bd11d5e1111d1b4274b5d7518cc6cedfde3", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700815500, "uuid": "1c29de5c-09f1-4a60-bf05-e18f7bd04495", "comment": "Malware payload", "value": "47c285c1ebbc58b9e082593213d63ab1328810cb", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700815500, "uuid": "ddeb443a-cd39-4d9a-8efe-b45760eb498d", "comment": "Malware payload", "value": "aa4af7e296fa6a4d5a77129f149679793bed1e0e103a9a0a96fd9b73d303934bfc597ad493e4fe7fa29a52a9b5e6836e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700815500, "uuid": "fb7d7755-ddd3-4958-b524-c68d769181d8", "value": "T104112B14DAC51921FAB1CD7758F9A2C3871F3817BA526E1D029052B62830511FA26DAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700815500, "uuid": "4910318f-4d83-41d3-a5fe-a6687c69ad9a", "value": "12:8Yj0C3pQVe/4VdiKpi3vmHgIDHgIMasFlDmo0nDmNz4t2YqlEYH9ul:8YjFpQQCivJb75F4o0uB/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700815500, "uuid": "1a1a9bea-101b-4128-8180-0315ec0193ae", "value": 894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700815500, "uuid": "152a465f-df8a-47de-b2d4-e976228dbb8d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700815500, "uuid": "84f98068-56b0-45c1-be48-b7f6da0508dd", "value": "KINGSTON (16GB).lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b76a7c7-8aa9-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700816967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816967, "uuid": "bcf19bb5-d0f8-432b-be5b-959917bc4248", "comment": "Malware payload (Mirai)", "value": "5f60654ecf56731e9b304d4e6b3aa392", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816967, "uuid": "8353310f-fc8e-415c-889d-ea6d5b1bffab", "comment": "Malware payload (Mirai)", "value": "0a74b08899a5aec2889325b7ab36410b916775cc4f99e27aaf357c313c5042bf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816967, "uuid": "b6676e1b-e393-4ca6-b282-8c1152091a6d", "comment": "Malware payload (Mirai)", "value": "a92be1fe16153f416b1d167b40a70afb33be788e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816967, "uuid": "87bcd968-3ca7-41c6-a57c-de7fec5ec76d", "comment": "Malware payload (Mirai)", "value": "596c70ed33349dc06ab74a3b71603684a2b097bab2b48fc9944953cac61f70e42b8eb77405c37759f6dee4a3e9103533", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816967, "uuid": "d2fa3067-4540-47c1-b923-5c96b2a5ded7", "value": "T1A8F3C80AAF610FBBDCAFDD3746E9070139CCA41722A53B753674D528F54A90B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816967, "uuid": "a9531244-10f0-4dfb-9d7d-dfd041a4dc62", "value": "1536:lR9D9hu8Zz1HeVlmrEv8m/ChaT8zwdLXsx/5OBIVb8FaPRBfifAibs1pg:lR9DdZ58mrgxzgokb8Fa5BaDs1pg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700816967, "uuid": "ffa13707-1f74-475b-907a-d9af8160c58b", "value": 166708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700816967, "uuid": "252a272d-7cad-4d06-a972-1b4065c6496f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816967, "uuid": "d699e65d-cfb9-4c45-9219-a6bd49c611fd", "value": "most-mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210677a8-8aa9-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700816950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816950, "uuid": "f41a0cb8-265b-4e7e-9a18-0aaffb7f9c8d", "comment": "Malware payload (Mirai)", "value": "b77557949abf0d667f8a6c5eb96d2e8e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816950, "uuid": "e96962c5-239b-4611-b09e-cdd63ecd72e8", "comment": "Malware payload (Mirai)", "value": "0bfa5988cb9ca9fdc35c3df9a7885b6e4635a666e947a4b6d48aaa4519a8ab6f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816950, "uuid": "134dca43-f216-4e70-a98d-07cf42286b92", "comment": "Malware payload (Mirai)", "value": "589f79e4f113efc0a0ecbaa23060cc7731a2a3fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816950, "uuid": "0f69b372-aec2-40d1-9234-63f6995d94b3", "comment": "Malware payload (Mirai)", "value": "3237647310faca363744a8c9fb0720250a3e01826435ba9f1103cc95eb01b5523debafca4b48072949e5c27e8c9c36df", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816950, "uuid": "9f2a9a99-34ee-47a8-859f-a7001c7e32ee", "value": "T1DA835BC5E683D4F1FC5305B2A177AB364733E43A502AEA02C7699D36DC52950E72B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816950, "uuid": "acc9bf40-bb81-4a94-b4d3-1ba47be862ac", "value": "1536:lhYHjbkFjrWEYeeqrbayCgW7yL1PfmuSSW1/:lhYDIjrWJevnhCf+pW3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700816950, "uuid": "07ba1982-7eb9-478f-8928-a6b08fec3d5c", "value": 84100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700816950, "uuid": "b4f0d2db-5dd5-481e-b116-00750fc9c98f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816950, "uuid": "a3e50779-e84c-430d-83cf-56f9e15f6233", "value": "most-x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f716c4-8ab8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700823696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823696, "uuid": "2abcbcc9-032e-445b-a181-f240fd5e5790", "comment": "Malware payload", "value": "e674f9c82a8c13e8542e4fa88c306161", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823696, "uuid": "669d0dc0-3ae2-4acf-a718-05824215e02e", "comment": "Malware payload", "value": "0dbb4b2aa0a5f807e079f89b341dd2e1dba6f6e8b1b0ebbc75fa71dd850b2df6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823696, "uuid": "09408f7e-787c-4974-a32c-864b5b02211a", "comment": "Malware payload", "value": "70cc1422cebbcf2fee37f4d25566f7c415bb6508", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823696, "uuid": "e1c8a893-856c-4aa1-9246-f5002201de72", "comment": "Malware payload", "value": "8ee9eb2c3d6c181380bfed348bbe54329fc5adea4d597542dedfbe01ecc05afb1967ef586e0c27d76154456effabf161", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823696, "uuid": "ac02347e-be4f-47e1-b323-5b52cc208490", "value": "T139446A9365D0FC23C49607358F2CD6FC776EB8239EE5978B36582E2A69302B1D627311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823696, "uuid": "7c6dea78-e732-49bf-b0c2-bcb8a24b47b9", "value": "7c1db49ad6667947e0650b5a549f4e65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823696, "uuid": "1fde63a1-f62e-4111-9d56-c18028b6423a", "value": "3072:Lyh8Wq5uliV7tFux+Ro4ZBqkCMHOG80v4D8+Zr5ROKA4:X55uO70kqZXRfD82Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700823696, "uuid": "44627580-d5ae-4e55-be27-4e3d9c1d7fb5", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700823696, "uuid": "fd71b1d1-d2f0-40c8-b3d2-204c9fc25c56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823696, "uuid": "b6922a0c-1d59-44a4-9f23-4c3c9cf29fee", "value": "e674f9c82a8c13e8542e4fa88c306161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd9e1a8-8a83-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700800815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700800815, "uuid": "cecdf506-98cd-42b6-98f1-09dc3f6f64ac", "comment": "Malware payload (RedLineStealer)", "value": "0527527439420186c6b4be310f297539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700800815, "uuid": "625d9bec-a12c-41f0-aee6-c550ea515f7d", "comment": "Malware payload (RedLineStealer)", "value": "0e6cc92ddd335649de96aad8cbe226084143eb732be0cdb205477f0cc4cfcbab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700800815, "uuid": "e7271555-a8ef-4561-a41c-6accd1a10f12", "comment": "Malware payload (RedLineStealer)", "value": "479653a6df9bc2675830fb246c7ac5438956820e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700800815, "uuid": "e8f5e044-7bf1-49da-ba55-b13d695ff3f1", "comment": "Malware payload (RedLineStealer)", "value": "67088c8578d9c27ac944636eef4308ab76c2dfa4a642ddfc9161904f77728e5580db29868e042dc81550eebdb1e2e097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700800815, "uuid": "ab755edd-1966-4316-9f88-8ec16fe74c29", "value": "T1AD94CF11B141C433FAD36A72A8D4C4745DB9F4304F6902D737C4A53DAB6ABF3A6382A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700800815, "uuid": "541677b4-8be8-46a1-901e-46369fa63714", "value": "f5b092552ec597635b0eec0dd811df92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700800815, "uuid": "f05193d0-8166-4bdc-b3c9-ed0b3895db46", "value": "3072:aMcIDm0sCq3jmDIbnlOyv+GDEa22wjAhsAQuej924tNLx:pcIDm133jmenhDEMhcxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700800815, "uuid": "12895384-b768-4b73-999c-95da14b029b4", "value": 446412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700800815, "uuid": "5b119a91-1abc-42df-9ccc-109a87e37115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700800815, "uuid": "61fd4646-bd5e-487f-bbf4-8ac1f2ea5108", "value": "0527527439420186C6B4BE310F297539.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83bd1a2-8a83-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700800883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700800883, "uuid": "e03f3b06-ec03-4e01-931a-faf024756ff8", "comment": "Malware payload (Formbook)", "value": "37e853f3f2cdaea613d1fcc317fa5795", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700800883, "uuid": "ae941d2a-4ac5-4335-82a3-dccfe4749911", "comment": "Malware payload (Formbook)", "value": "0eab8b2bd23f7d06734b61ba357c9fab1d97758eeb5afe2bd89fc293b88a8674", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700800883, "uuid": "e4df4df0-cda0-437f-9568-5d79bf4dcae0", "comment": "Malware payload (Formbook)", "value": "51bfdbb26dc7c497288165e5154be9d5ca0a8e20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700800883, "uuid": "d2eeab50-1b54-4b23-af94-e01db1175e5f", "comment": "Malware payload (Formbook)", "value": "2d8b957530277b3bc421aa940358c2b7b42d8d0997075333a03a65cdef34dd1341ae7657bd15630b7f665d520f7380bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700800883, "uuid": "5dcf2143-373d-4e1f-a77b-600e24829906", "value": "T16AC4228333282779CABE57F422A44A0447B368022953FB6BCDCA66D71263F055EF1767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700800883, "uuid": "724dc9ae-55db-4ace-8f08-f2ee220c6304", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700800883, "uuid": "d7d987f0-edb4-4c83-8631-45174d8ae81f", "value": "12288:LEX0COq13ivCe7V+lTX9y/d0XoKRJ66+Scj5xqAjxUPy:i13iqe7VQpYK/oScT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700800883, "uuid": "78a8ab41-50cd-4ca0-a575-80f29bcdeec7", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700800883, "uuid": "97504b9c-f9e6-4125-9831-e4db070ffa9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700800883, "uuid": "c167fc65-0b77-4e34-9c8c-4ae8b94a5275", "value": "37e853f3f2cdaea613d1fcc317fa5795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5a5cf1-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864242, "uuid": "10484908-a48f-4617-b028-412fcdfbfb10", "comment": "Malware payload", "value": "ebf176b4462a7745671f4a500c20edcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864242, "uuid": "6f0ae86c-e306-4180-9d74-a89b954b2471", "comment": "Malware payload", "value": "109226f36197e9a4ad07c15d6d78fd92df7cfec15a426fd5d2cd5f1d1b62cfda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864242, "uuid": "ffb28808-9e88-42b6-a5ea-741046cf8a4a", "comment": "Malware payload", "value": "88e21f0e419896088d513e1d02645a6e41ee9ce4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864242, "uuid": "546c4497-21e6-4e8c-8130-7b6de753467d", "comment": "Malware payload", "value": "f4f08c8a8d00cd5e1c7be9da024e9fa761c608bcdd43adf67e2ae388c6704711ee25a085ecdbf958da1aaf2207ec063f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864242, "uuid": "e674c1de-373a-4230-97ab-a0d82e612a46", "value": "T155736C147760D432C00608344D5DC6F25B7E7C322BAADA83B7865B7F9F752C2AE3A259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864242, "uuid": "bdc67a80-7741-402d-be14-b6e81aa4a81b", "value": "6357bf600b0a4c663d1cbb6a45d03641", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864242, "uuid": "3daabb78-8a5c-40bb-aafe-cb30ff5f4aec", "value": "1536:iTpUoEFf2kqOlTqp5/+fpPMQOyepJYX5+ESCsN:iWRf8pZ+BaJO5+EWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864242, "uuid": "6d8700f8-f990-49da-83f9-5b403f127e1e", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864242, "uuid": "eba13f10-68d0-4de4-bc3f-4519126069d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864242, "uuid": "b27ad64a-bb45-4cf5-b52a-6e4b943cd257", "value": "SecuriteInfo.com.Variant.Johnnie.213266.7053.1188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26b14ca-8af3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700849084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700849084, "uuid": "fd637ecd-1f70-4ef3-ba8c-6ce298a0aed1", "comment": "Malware payload", "value": "fea57a9771d85e0ffc04fda35b846623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700849084, "uuid": "19ffd6d2-ccdc-47b9-852d-40e1f6b6b484", "comment": "Malware payload", "value": "10ff8934864fde526995fff37bc18da095c550bf64a185388d030cdb0d780aa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700849084, "uuid": "f637a070-7f94-422a-84d0-c6dc8dd779c1", "comment": "Malware payload", "value": "97e12098f8b95de368277b4e7a2fb7fcdc32c9bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700849084, "uuid": "6ac2e461-70e7-4b3b-beaf-bf3b19954fea", "comment": "Malware payload", "value": "5bdd61edad7f2b6ef269aa1cedd124dde3d80aa9d0ceff0fba61218b78202470618cb167183c6d9a3e0564603958f614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700849084, "uuid": "4b171289-3986-4ddf-85d1-91144479ed60", "value": "T189E4127312AE6F8BD0BF53BB8E20D2444BB0EE255594E714ACC334D645BAF60A871D93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700849084, "uuid": "df2620dc-5088-4923-ac40-c934c7d1428b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700849084, "uuid": "9081b5ab-8803-4fac-8202-95b10ec7da9f", "value": "12288:jE6jD/3nDiqaCbteEMMByldkMXJZq+/fRqQ1MOMscDxLENzpc:jtD/3DiqaCFCeoZqsf1MdsAENp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700849084, "uuid": "cf8ccb4c-26c3-4907-88b6-474d259a979a", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700849084, "uuid": "9fe5186f-4996-45f3-a440-3f28f4b92758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700849084, "uuid": "da91ba40-d1ff-4ec4-bf10-639046c003d5", "value": "LAM CHUAN #710036288.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a396da6-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864237, "uuid": "259fb9a0-af1c-411f-b854-789eca9fe92f", "comment": "Malware payload", "value": "383409497acdc62dc9e6c80800726384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864237, "uuid": "319bd7a1-37a0-4e29-8659-3f3eac6d6e0a", "comment": "Malware payload", "value": "110b0e2d3e7fa90249f99f79833125a5659ec89b2ad066b565d561761f7c957d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864237, "uuid": "20cd627d-7d24-4452-9b26-6e12ecf6ca22", "comment": "Malware payload", "value": "108204434729ee79939eeb71198a069c4fe6ca15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864237, "uuid": "ac8c825e-f8b5-4985-97bc-0d75c9b0ea65", "comment": "Malware payload", "value": "b565fb2a068866649519b8e74f962dbf56706ebe2280972c5918c38dec2961bd4dcd8969e980e0330427ae5d98a97718", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864237, "uuid": "c018a317-3924-40b1-8492-acf588a067ba", "value": "T1C5551251B680D473C479063085E3CA112335FD258BA69BD733DC773A5E632D2AA7A2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864237, "uuid": "bd10c61b-900d-4aa9-abb7-ac4e7b0c20e8", "value": "19da68fe597690d6c53cb89a5d2336fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864237, "uuid": "d62829c6-77e1-4c9f-9c29-083c14fd8dfb", "value": "24576:EaMvdxT0zNAspS/am337JHwtI81lLsI74jeLsvSS9CGE2c9EGPwsWa:kvjToNJpSHRwnmnjgslCGLcnos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864237, "uuid": "fe05b72d-27b8-4b87-890a-39432f935407", "value": 1404928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864237, "uuid": "267b64bc-2311-4494-86b1-43c4d7f3a9cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864237, "uuid": "6f35af2c-2f88-484b-bb2a-f339b9557b98", "value": "SecuriteInfo.com.Trojan.MulDrop7.35401.31961.4859", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e92f5a8-8ac9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700830851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700830851, "uuid": "c5df9883-0aa4-4339-bd9b-c098419ddebb", "comment": "Malware payload", "value": "11874b5a52ccae16235a8e27216c1ae5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700830851, "uuid": "bf1b1659-611f-40c9-bffc-f0e1d88cdb5f", "comment": "Malware payload", "value": "11baa23e47b7cf8b7f75cf19753154840744f0f4d01399598f34ec3fdae2fb77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700830851, "uuid": "1a12b7ca-5189-4ae3-8833-24113ddeaee6", "comment": "Malware payload", "value": "89b47396be6c21106b9f27538f032d1591fad95f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700830851, "uuid": "3abefdea-ac31-4aaf-a1eb-2b2dc4d32232", "comment": "Malware payload", "value": "ecb251017a56e3cca07247073deabad83edddfa47bd72a839c76503e9bc58c375f56d1b4346c814f829a3247bbdb87f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700830851, "uuid": "b0796b44-168c-45a0-96f6-6ec589b20273", "value": "T1DFE533A36AD45ADDD72782F020FD4A2C9570A19358E00C853D9E649EF637F0ECF9258B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700830851, "uuid": "7cad88bb-0454-43dd-8bb1-e5a89866d6b1", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700830851, "uuid": "f8277b4a-b27a-4da9-bd71-da4e4ecb02c8", "value": "49152:xsnF7LOcyDLSU+H2wD3uT8NdYT6bZ+LoKrrBa4LXIm8RWjgU0zvYfgC6jKCRkRhl:69acyMtiyZQrBa4LX78bOF6jvUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700830851, "uuid": "e7f3ff30-2c3a-4c48-b352-3d21f01b0a20", "value": 3213320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700830851, "uuid": "343c6477-054c-4917-8342-e26ee55b4e51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700830851, "uuid": "d078f700-cb4a-46b4-9daa-3f305dac3bde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aeaedfa-8adb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700838441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700838441, "uuid": "37a585d7-facb-406b-b2d6-05fbc00fd890", "comment": "Malware payload", "value": "569064e533483d8f5bc2cb2324bee693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700838441, "uuid": "bab4b619-eb4c-4ef4-92b9-8fdfc407ae4d", "comment": "Malware payload", "value": "12bc81aebbf5c475690bb9680c07a43bd58aa67e08c091a1b2195487a3da1862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700838441, "uuid": "c0d01da7-22fb-4a33-98ba-90becabf6f26", "comment": "Malware payload", "value": "928005c91b7038c167d4eea523d3f205f28defa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700838441, "uuid": "9d09de0c-2ce0-42c3-88b6-a7211391ccf2", "comment": "Malware payload", "value": "5ee1cd29415c7e13b3aa0dafa264cc861e2c1ffef9e414845681e498dbf6dd2bc4f22e88f4f749746a66eac2b52dc629", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700838441, "uuid": "abb783a8-cec0-489e-899e-8a8597c66679", "value": "T19EE24B483BE58327D6FE2FF229B2A1010275D507D923EF5F5CD885AB6F67A8142013E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700838441, "uuid": "88a4b80b-d791-45c2-ad01-616f5279db54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700838441, "uuid": "69952b6a-c441-4ecc-8a40-892ddcbdc12c", "value": "384:M8wTA+5OfPgEBQqWvfcQLZe3sr0hYACSqRN9PD42uRugtFuBLTIOZw/WVnvn9Ikm:3rgECfLHrMYAoRN9M2uBFE9RXOqhebz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700838441, "uuid": "b367df74-9332-47fa-942f-639789d420fe", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700838441, "uuid": "9f080b60-6dd8-4bd3-a2d9-b9634faf8bf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700838441, "uuid": "680f64f1-a837-42ae-92d0-0d9de5629fe5", "value": "bRQa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c1c608-8aab-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700818005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818005, "uuid": "1809b49f-983e-4317-9e07-88fc353d5710", "comment": "Malware payload", "value": "887c8ab2ee3e223da282a35dec64a61f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818005, "uuid": "fc4c1ea7-beb7-4732-9e83-b647c00d5a7a", "comment": "Malware payload", "value": "1391f4b5a1319940dec3f724e9dd6ce01cb596cd691c71b271e448e496b6e3c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818005, "uuid": "0ed00a6a-31f4-4c22-a553-6683303db8c9", "comment": "Malware payload", "value": "ec43ea5d449853c514c527ba55a26e677795b8a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818005, "uuid": "d3ca91eb-9739-47de-a791-756cc562bdac", "comment": "Malware payload", "value": "ed747b6828f772b58865cd2660f50312888a77d98e9f65ee66b47d740119c59f6d25e9743382fefa369ed471b00c2a08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818005, "uuid": "10801d20-8fbb-45f3-b627-254fe32461f6", "value": "T1FFD1BC816EDF40DEE267473017DAB7BB01A6F9B1552E62F874848A595B70AC0CC61FF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818005, "uuid": "81f5840a-8d31-4a44-b906-bf2bf1fb35a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818005, "uuid": "8a1772e7-8ef4-4748-857a-f16655a58a39", "value": "96:Oxwzc79R8CFyRrYccLWDTBCNlJLXAYCsnvk+Dv7MXzXd3ojJirl:OxwG9RnFmYccywNlJMYZvk4MzXdoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818005, "uuid": "9ec568b4-a231-46ea-b98f-2e9dfee55017", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818005, "uuid": "bd4fa809-1342-47b3-9e4a-3c6b8ecf10d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818005, "uuid": "ca98f613-f2f0-4f28-85b9-377b2da4e772", "value": "SecuriteInfo.com.Trojan.DownLoader45.55850.31523.3941", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44429e8d-8adc-11ee-8907-42010a9c0042", "comment": "Malware payload (Zyklon)", "timestamp": 1700838913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700838913, "uuid": "91e5d583-a0e3-41de-bad4-46e22b8a3ea0", "comment": "Malware payload (Zyklon)", "value": "b7625ee5aed7a234f98a5d3d2ce65e30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700838913, "uuid": "71ecdaf6-dd07-46cf-953d-bd3c40b6b067", "comment": "Malware payload (Zyklon)", "value": "13caf72860e00c295fda55bb96e743fbb46819ccebf86cd3f32ccb5752a208d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700838913, "uuid": "17bc3dd8-b8f9-45e5-8a5c-03315729947a", "comment": "Malware payload (Zyklon)", "value": "27c85276c8a8b5644fe6c44408d063cc3cf30db9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700838913, "uuid": "daba1a5f-1180-42f9-87af-85052ec7c07c", "comment": "Malware payload (Zyklon)", "value": "e70259eaa08d1bb0ba66f9e03d928116b50f6fe01c56f64702003b02da7c62748aa1850c5c543c18d7b9ce46b3caad41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700838913, "uuid": "c36ca328-4c0e-4470-ac37-7dcb0bb1c3bf", "value": "T1270612C27DA08CB0E42117F16DA5DEB1A23B7F58592181E769E07E4BBE325D25C321E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700838913, "uuid": "f41320e7-3654-43ef-87e1-ff86c4a64cdc", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700838913, "uuid": "0ae9d582-bcd7-4993-ab4f-76efe7822c43", "value": "98304:n05Q6mWW2X8ibAOIkGE2JmN49Iy+3fobumosX8SuhC21hNkHv:ZTibAOIkr2Jmm9IH9m9nuhC6NkHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700838913, "uuid": "62753aa1-7fb6-42d1-8b6b-736dcc8be241", "value": 3922867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700838913, "uuid": "b71cee79-b672-4da6-b0b9-7d78b95b990f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700838913, "uuid": "3ae19133-88b5-489d-9279-9f30f185de4a", "value": "b7625ee5aed7a234f98a5d3d2ce65e30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd03ae1-8a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700792138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700792138, "uuid": "c39c6fb6-be7e-4bfc-b32f-ada981388667", "comment": "Malware payload (RedLineStealer)", "value": "892f09ee6d46c68ab20c0aa4849a79cc", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700792138, "uuid": "33bd7591-4a53-4d07-8df5-244f67cd3404", "comment": "Malware payload (RedLineStealer)", "value": "141e1080063391b7da029f94989bfce5b81f85cbd89ab751c9755d23ee0cf80e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700792138, "uuid": "80ee7f12-e03f-47e6-952c-13a61060c817", "comment": "Malware payload (RedLineStealer)", "value": "fa24502e983c0b698d1d065ebe90b312009f6072", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700792138, "uuid": "8db2dc78-201b-40d2-8533-aa576ab4fba9", "comment": "Malware payload (RedLineStealer)", "value": "9117b2209fecf03a1d7bb64ba24c40ef360c4349f276e2f20953b2de0a97758857e45e0b62f1f03e87b461f90b31e39f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700792138, "uuid": "d5ce3edd-dbae-483f-9c76-c271135d6cb5", "value": "T1E0E618C7F85551E8C099D37486369263BA713C985B3027E76B10FEA42F36BD0AEB9314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700792138, "uuid": "b8d372e7-a2b2-4143-91a6-7042f01e897d", "value": "b2e121c8fb86c781c89c83ffff7fe337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700792138, "uuid": "5d67ce0b-9509-419c-bafc-39eb285d4d26", "value": "98304:SHpPSsUWPd3rZmTXaPsrCoVevlyClzWE2A/l+01bKNrzpjau:SkWPBrrRMYErzpja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700792138, "uuid": "18a88d0a-8ec4-44ed-a9cc-e33ab76aecea", "value": 14707712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700792138, "uuid": "83142e7d-3b7a-48ed-97dc-8b0a1c806057", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700792138, "uuid": "01c16d68-3d47-4190-b5d0-9c4800d50b0e", "value": "892f09ee6d46c68ab20c0aa4849a79cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860364b5-8ab2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700820985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700820985, "uuid": "06642141-b662-425a-a6ca-66732b202275", "comment": "Malware payload", "value": "36f2bf0573bedc2ba4c8902c3095a867", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700820985, "uuid": "2efcb13b-1ffb-426f-b6c8-171d1a316875", "comment": "Malware payload", "value": "172c25ce4a5916f38026250b5799b318751216eb858a6b1230b039527115af52", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700820985, "uuid": "aa4efc55-1dca-4d36-93d4-2cf514600bb9", "comment": "Malware payload", "value": "0fbf309148ef7fc9b3a9e7958fe87192a91b531b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700820985, "uuid": "f8a8c318-5c37-4bf5-84b6-b1ce89626d38", "comment": "Malware payload", "value": "3ec4be186bf0348fb70280ff9f442e3563a36c2f714f227f5095c6d52c92f7dbb09d1a693080c4eee995392868f410ee", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700820985, "uuid": "4de67ee3-1e39-401c-b751-77ef6f9bbf7f", "value": "T1FBA623E65BCDB6B9C082563451038397B483A44F84BE599A3FC67D019A28FFB054FFA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700820985, "uuid": "834784dd-7449-433d-ab9f-240467647200", "value": "5a5081b1176ce07a5e6ebc3dbd7a5ce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700820985, "uuid": "bdce3dbe-611f-4a76-afc9-858820ecf1cb", "value": "196608:xMKc4viXqtzu6KRcQXIQMEMMT6pnBR/r7cTTuXdAO5AjZqdx:vc4KozubR9XxMQ6pnX/rAC014", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700820985, "uuid": "5c84bdc1-4dab-45bb-8025-a00201156624", "value": 9596416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700820985, "uuid": "e0de8ccf-b948-4bf5-82b3-6c57dfb570b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700820985, "uuid": "faa8a06e-23d5-4cc3-b38e-737e1450d8aa", "value": "36f2bf0573bedc2ba4c8902c3095a867", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99324bf-8acd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700832721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700832721, "uuid": "83de99a5-b49c-4e77-a5fb-66b9e5efb9ef", "comment": "Malware payload", "value": "083e7af32530f9f24cef34f07ba288dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700832721, "uuid": "826e3235-e769-4838-ac25-d9a73a4f1253", "comment": "Malware payload", "value": "17bd90ec1ab9fdfc235404d2a8705d20713b7c44f330097806e312dcbedbb2c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700832721, "uuid": "0421e808-5173-48f4-89dc-070b9a18e89a", "comment": "Malware payload", "value": "e4fbeae8928a79c2df6cec4eb0889f06cc49088d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700832721, "uuid": "67784548-ab17-4b49-8883-63963cd1687f", "comment": "Malware payload", "value": "9e259e29a2287a7abe4260572f5df02da0bce90831fb598d9ea068fbec9fbd48add22812ce381aa1deab29e7fe5f796b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700832721, "uuid": "518b5455-f04c-4b19-ad24-92d6fa44a36a", "value": "T1BD44591369E0FC61C55603319E2CB6ECFB6EF8615E27C74A22583E2E69322B1D667311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700832721, "uuid": "257b1a6a-8638-445d-af39-5f60e2d57c42", "value": "c577c58a31abefae7ed25bcc269ae1b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700832721, "uuid": "a26f676f-d896-4565-8628-14dc4ce576f2", "value": "3072:pVZVUDXS+epH3R1+iGmlu+2Zs3Uxu+TvhULKl9os8hr5ROCkk83:d+DCNxHs+2ZAUzhDfos8lWk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700832721, "uuid": "ea129ca1-100e-46c4-a1e8-33bf5d9c1494", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700832721, "uuid": "ef8e53d4-f25e-44ff-b7e3-c72ca55b177d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700832721, "uuid": "17a5ef3d-a7b6-4bd3-bd8f-c35564bce111", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d4134f-8aab-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700818010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818010, "uuid": "2f9d2ccb-cf21-495d-8cbf-4c9dd47bc0a4", "comment": "Malware payload", "value": "a25afcfcab5014e3b1c1d00be2ed1c98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818010, "uuid": "773e195a-ac3b-4781-9687-0c021933bd04", "comment": "Malware payload", "value": "18c04e1e7011010cc0cf983dda84804c03bb1de35adff177614f6a4d537f5e6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818010, "uuid": "69813952-0476-4fd7-8208-ba2a94b821ca", "comment": "Malware payload", "value": "33b01c0c85791e70deab178c307b976856a53f17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818010, "uuid": "31afb372-ea25-486a-9c30-42969730a331", "comment": "Malware payload", "value": "10b0273c877978ebd5f5c4bbaeeefea8bf5148caccd38ed818f2477bb1298e97ee8622bddbcef45b4ab5a18371258105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818010, "uuid": "2aa64650-5620-475a-a038-565ea8312999", "value": "T11DC1FC415EEE50DBF26307301BE6B3771666F9B1552EA2F874848A599F31AC0C822EB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818010, "uuid": "69d94e11-3902-4b7a-a008-9fb98f5aa399", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818010, "uuid": "84ac32e5-03e9-4693-827f-12559cfd0ae6", "value": "96:679SSCFyRr8n5NzVTq48w/rt4x1d3oj8rl:c9SZFm85NzVTT8w/rU1dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818010, "uuid": "f1117454-eec0-47c4-b7c1-c30f24e9a3ff", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818010, "uuid": "ac54c3fc-57ff-42ba-87ea-9148146c1cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818010, "uuid": "caddc547-792b-42ac-90ab-740cfad0382f", "value": "SecuriteInfo.com.Trojan.DownLoader45.55850.280.31061", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5635c52b-8abe-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700826058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826058, "uuid": "2af433bd-1c35-4e47-9ffe-9542679b20d5", "comment": "Malware payload", "value": "14df404b858d170ccff1bca3a15d5a21", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826058, "uuid": "e5cc477e-a6e7-42c5-9f5e-5332caf3fa0c", "comment": "Malware payload", "value": "19937e405b6aee62a32a488162174604e0a53e688bdccb3f7aeb0f780ba7d1f1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826058, "uuid": "5c039f16-67e7-42dd-9ba5-70a3dfc27591", "comment": "Malware payload", "value": "185f19635fac2eb0edafd69f4dc881494081f474", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826058, "uuid": "0f4c1b35-a33a-4591-9a67-56a86fdcb23f", "comment": "Malware payload", "value": "3feda3b7201d05b8bd8c0d7239d28a8b5db85ee17a7bd2e59b4372df847cc4dcecec951f2a7a152ccfc18cbbf5c265b0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700826058, "uuid": "5b9f681f-ca10-428b-9dca-18e75a9dac46", "value": "T1C795AD1175D6C53AC47F45303AADDB2B10BE7AA10BB588DB63D40A2F4EB94D20272F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700826058, "uuid": "767057b6-5335-4a6f-86f6-9545b4f18daf", "value": "49152:vjyCvosTi0sOAZnWk7fNQGqAO5WynKsQTVWEdVxyJpMRIv/BoaTzuVJHsgsFJY:fcODA6AOY2Kxq/BonEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700826058, "uuid": "3e9653a1-31c5-4900-a7d6-a8c4ecd28420", "value": 2009088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700826058, "uuid": "a85d3270-790c-4929-9bf1-908843c06d27", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700826058, "uuid": "f7dcf762-3052-4876-95a8-e8f8768aaa5a", "value": "nf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9beca01e-8aab-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700818015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818015, "uuid": "f822a2cd-a534-4633-b58a-83f3cd6d9a3d", "comment": "Malware payload (Mirai)", "value": "f108faab980ad825c9e1dd55f3fe6fb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818015, "uuid": "be520c2b-7ef8-4702-8e2f-19311442eac5", "comment": "Malware payload (Mirai)", "value": "1a6d5a55453155f517783061069f1606c3266f418e867c5c2c41ec8f779a557d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818015, "uuid": "77480a55-6668-43a5-88ab-5040b5fc8eee", "comment": "Malware payload (Mirai)", "value": "401d9e59794f7101a5466ab845c92164511e36a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818015, "uuid": "06da32cd-15a1-4d8c-a885-1f904ba08149", "comment": "Malware payload (Mirai)", "value": "9bec9ad17440b9e6708bb886805deab30948fa0bb7d2e8ef5f82fcd97483b3f6560c2a4000fee31c2fc09637a47c8219", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818015, "uuid": "a9e3f290-7f78-4b63-b268-78c100dd9b6a", "value": "T186A31956F9814F11C5C512BAFA2E018E331217ECE2DFB2139D206F24B78B96B0E77956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818015, "uuid": "cb3781e3-2cc5-489a-959f-e843d10e317f", "value": "3072:J8blhcxyHqub7PaZiDH4utdy2vErjwbZnc:Gbkps7PaZoH4sIjwRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818015, "uuid": "8c6ac88f-f07b-42c4-b017-13865accf155", "value": 99648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818015, "uuid": "6644fead-a62b-4a42-be74-b91c23750516", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818015, "uuid": "f38bcbd6-d26d-4cfc-a960-286a981bbecd", "value": "f108faab980ad825c9e1dd55f3fe6fb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe87b5a-8a98-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700809673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809673, "uuid": "a258cbfd-e887-46c4-b5da-be7ad007430a", "comment": "Malware payload (Mirai)", "value": "12af361220f421d4682a429d28e54f95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809673, "uuid": "4275428f-c09f-4cdb-9dde-c66d1f54044e", "comment": "Malware payload (Mirai)", "value": "1c296fc1cf48c53d898f32dbb6edfa8d44a1fc35dbef0ef7ed0971cebac25894", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809673, "uuid": "f21c8227-7114-425b-8603-21d825d469ac", "comment": "Malware payload (Mirai)", "value": "1d68ea92dfab6af4cac230751f84deba046341cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809673, "uuid": "cc4ffcba-2994-4928-991d-1f3d9cae830d", "comment": "Malware payload (Mirai)", "value": "7f24a6653cd800d73dd5fcb1cd3e44b7d071e97b13cf504c6dc1d777aacefd933b653bbc909e9ca8749172ac6e348704", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809673, "uuid": "8c6cc26e-a4b8-46b4-a13f-d6f14ea6dd99", "value": "T12373C81E7E228FADF759863147B78E21AB5823C627D1D681D26CD6002E7074E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809673, "uuid": "433b7df2-089b-4285-95b5-8fa5c9453f2e", "value": "768:eDsas4Eb/1hJX5RJagwZD1fE80Bzfmk81DXiGjyInlxejUeUwEIm:M03JXfJSEZfwR//eYeVE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700809673, "uuid": "6d129ee9-0dce-4523-a3bc-d1c6829cbf49", "value": 76660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700809673, "uuid": "1deceaaf-58f7-465f-9a94-7b4484884c05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809673, "uuid": "0e679530-fbfd-4451-b256-0cf93ed6854f", "value": "12af361220f421d4682a429d28e54f95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d0deeb-8a9f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700812604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700812604, "uuid": "74cc5aec-6503-43f7-b5d5-de1a1d887663", "comment": "Malware payload", "value": "52e47f5a70cad4a24a69540a25be2f7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700812604, "uuid": "c1664bdc-b45f-47e2-ad21-85a5d073e216", "comment": "Malware payload", "value": "1c922d5d98f3333762eeea86319db57bef6ccf320f48b05b59166bc1451eb86c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700812604, "uuid": "8ca6434d-812a-4488-ae8d-9549e40d6750", "comment": "Malware payload", "value": "f226145a25a96b4e5232184e8dee0e6822211247", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700812604, "uuid": "9dc8c998-88de-4a63-8481-2707201e27c8", "comment": "Malware payload", "value": "bedc434ef64ad98916781c9f0992ea49c3a75a6bc5f55a0aaf1d544bd3b07074122ac0b62cf9634715fa6ee947b88e8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700812604, "uuid": "0228bb9a-209f-4ba8-9a7b-cc8f0f7da316", "value": "T19B446A1365D0FC21CD5607358E2C96EC7F6EB8A1DE6C978722582E2AE9302B1F667311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700812604, "uuid": "a8b3644e-17db-4ccd-9c39-d74b2b805ba5", "value": "26174cd618191e0f458fd2f9d0ece6c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700812604, "uuid": "eae936d4-1abf-41b6-bab6-689bfe1bdf56", "value": "3072:HgSzZ0aSx9VwONzC+eBhTCciw7uuq9/MpCOsjX/8C5Ru5sFsAk:5VXeVFerCY6R0gpysFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700812604, "uuid": "de231e14-03ef-4a67-a5ee-1aaa60a49be7", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700812604, "uuid": "42b1bc06-9c3f-42d8-865f-a42ae1a2538a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700812604, "uuid": "45f8d1dd-5413-4ec2-9e17-dc0bcc2c37c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c3bf0f-8ac1-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700827204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827204, "uuid": "61cbb67c-bf07-406d-8481-b092fafa5ec1", "comment": "Malware payload (Mirai)", "value": "966c0c55df770b2b78b4f0291770de72", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827204, "uuid": "3dce76c8-3758-42e2-bdda-d3e617e6de08", "comment": "Malware payload (Mirai)", "value": "1c9730d359631686ddfecd4479f26bf6ff96daa1e956558906f69bcf81eb40ca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827204, "uuid": "4526b026-2c56-42ba-9b0b-f755bfd70aeb", "comment": "Malware payload (Mirai)", "value": "9c65b21358e18be8308a77a75db610e9340cfa07", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827204, "uuid": "fff13504-a0bc-46ce-80be-cd79374ad023", "comment": "Malware payload (Mirai)", "value": "8af3d849be57b57d48fe9130af0ce7d88f97ffe5acae02bab95cbfaf2b5b553f9cbce18b09e84155e1637591bf5acb36", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827204, "uuid": "ce8af3fb-406a-4f5f-8738-e441ed99e8cb", "value": "T199436BC4E643DCB2D8171630147BAF37BA76E2E91224E746D3A8A736EC51702E016EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827204, "uuid": "e71e586c-b953-48ee-9cf8-89c1515fd507", "value": "1536:BF14yTUx6AhcHIO3OPlHc0Z6SblcMUiBVFrVCwbZnm:B/4yTUxdaIOePl80ZN5cMlrHCwbZnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700827204, "uuid": "cd1e5dda-d507-491e-bb8a-0e99a3cc5bd0", "value": 59088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700827204, "uuid": "9a211efb-9bfd-4135-bf41-b9fc6979295a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827204, "uuid": "1c36c3e2-8db1-4e22-acbb-69423632b08a", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8d84d0-8b23-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700869366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700869366, "uuid": "567982ed-a47d-447c-8167-378e3c6aacbb", "comment": "Malware payload (Mirai)", "value": "2e03de9f75322f79922b7ebe0259078d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700869366, "uuid": "ed194172-cc85-4d40-b368-0f4eb9c44f7e", "comment": "Malware payload (Mirai)", "value": "1cc732318f1348d4623e8cf7f12c5e718e214f380065124e8bb9466f8b0d2eca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700869366, "uuid": "0212cde3-d0c4-4af6-b600-5127e33e79f9", "comment": "Malware payload (Mirai)", "value": "de52b43daa53b92e9ca7eec11dad92d2dc12480d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700869366, "uuid": "eaf76151-c9b7-45df-bd9c-6db6ac97009f", "comment": "Malware payload (Mirai)", "value": "4a5841943e5607ab49c23542d49db632c8ccd9082a6cef1570d0df752daa8afbf8bb75153a3bc94301b82bbd0953db02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700869366, "uuid": "e06cc409-7383-4a11-88d7-b03b23b95faa", "value": "T12CD34B46FA418B17C0D517BABA9F428933239764D3DB33078918AFB43F86A6F0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700869366, "uuid": "4eb02f3b-52f6-4c9b-9bb0-59c5e14941f8", "value": "3072:WVt/nWOve0kNxvsWnFMf/k1vD3u5CMqKl07/IFM/9A/tM:ot/nhve0ExUWn6f/k1vDe5J07/8M/9AW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700869366, "uuid": "7a2a3ac8-fbac-417a-aeb3-8ac36d84dbc4", "value": 136914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700869366, "uuid": "f70316cc-6a40-4abf-b1f0-57aa01c424d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700869366, "uuid": "da730701-652c-4f78-af94-781688e9bd4f", "value": "2e03de9f75322f79922b7ebe0259078d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47be0df7-8b15-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700863400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863400, "uuid": "867f816a-f62d-4bef-8979-21f112284f5b", "comment": "Malware payload", "value": "41c5fe99006eef29d7008f8927663cac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863400, "uuid": "0e93c6f2-b06f-4329-b10b-d7b9a113123a", "comment": "Malware payload", "value": "1ecf32c1650e2c9b0a47cdf39b0c22e8f92e95a115bdbc89988da52ab755139d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863400, "uuid": "2e32a4fb-5bc5-4ff6-b141-e1ae69f6efe3", "comment": "Malware payload", "value": "e40269a25b1b078c9be8c48b69fb20177cf7b0fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863400, "uuid": "7cf1ca1c-c4d0-4013-93ca-25eb813c59d5", "comment": "Malware payload", "value": "a9ea1d025d24bf32ad4fc152309e560e8ff89e1dedd6deadfb7687c8ba83f9ac1a508672f3c541b2654b42b174ee0da8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863400, "uuid": "9a6b678d-e450-4892-a9c8-ffa8a655a800", "value": "T191348D9365E0FC2EC65747304F2CB6EC3B6E78229E62474727581E2A69302B1D6EF351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863400, "uuid": "537abdee-3bec-4a1a-92c1-15e97fa70162", "value": "e9ad50bc63efe5521ad556ec46de70bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863400, "uuid": "b188cd6d-e98e-4af2-a352-14345526bd96", "value": "3072:178edpVt4HHvZxD1sBoFkw/R8DAfIlFXZGFDFP8Jujyw54NjV:am4HPZxDqBmmDGGXEFDFPUNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700863400, "uuid": "d9795f16-94b9-4786-af90-d2c7a32c6bc7", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700863400, "uuid": "50851975-03c5-49d9-a341-73b16a716f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863400, "uuid": "1873c7f2-0a57-4c9b-8a0b-bd278dd28488", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4434d9-8acd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700832379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700832379, "uuid": "22ae7872-48df-4e35-8f51-0d36ab444f75", "comment": "Malware payload", "value": "1d081762c9418e17364d27b984ba2ae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700832379, "uuid": "8b5fc7ad-5709-46de-af07-52ff48124876", "comment": "Malware payload", "value": "1f3b7a5b5dcad705398697e8cf460beab8a73d05d299a6dbbebe96f10b8a00b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700832379, "uuid": "a1e55e3d-4f08-446b-898b-82ac8f4c9131", "comment": "Malware payload", "value": "ecb33d08a5b5a7db8875229ebbfb4a1cb3adb57d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700832379, "uuid": "f72b67bd-b3b7-4f91-80b9-e2f3c8b74eb4", "comment": "Malware payload", "value": "be450cc66507b21566418b369e462b2e233bcd93c8b90938e1f58d09e5e801a064df898878885cdf85a85d592d45b5ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700832379, "uuid": "046e1bef-a311-4e08-a1d8-b6ea7a5dac27", "value": "T169E5B619FA515C96FC6D03F1AA7588442EC18C46966CA85D35E373CE8B3D3C2D09BA8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700832379, "uuid": "22b940ed-637d-4020-82f2-4cd24faa9173", "value": "24576:3+tTJ+TVsjlL8WQUFm9lg2Kra76oY4XWr:udJxh1nFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700832379, "uuid": "ba057a4b-ef84-41ae-927e-f04beb358a07", "value": 3158528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700832379, "uuid": "567dcbfd-f55e-4e26-b034-6469c7279b7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700832379, "uuid": "e167050c-91d8-4c72-ab94-7e8bae919f5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ef03d6-8a98-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700809683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809683, "uuid": "2c49c07a-7e6d-47c8-ab61-c987d96f080f", "comment": "Malware payload (Mirai)", "value": "e6e19abff27e1001252b0783ca6138ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809683, "uuid": "630d19c1-7e00-4623-a196-88c960ed2bee", "comment": "Malware payload (Mirai)", "value": "207434b4299ad66344a89a6de2c64b430276fa56061069a49c5438ce465252c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809683, "uuid": "78080873-01cb-4e37-a1de-50f0098aee97", "comment": "Malware payload (Mirai)", "value": "9b413c855bb0fe8cc30e847bdceece9d05e066b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809683, "uuid": "fc456f41-9ae5-48aa-8f17-04175604d864", "comment": "Malware payload (Mirai)", "value": "93bc1e5fb72325868ab6cfd25e5925f9aeb25d1eee8b9717c2c7ea9318311c6617d72030920c2a18c2f82b832f7f4395", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809683, "uuid": "a5cbb95d-2f1f-4ecb-8a6f-b07edac8ea5e", "value": "T1D4338D77E8265E18D08A4170B8248F741B23E5C1934B6FBB26E9C2B95483DADF905FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809683, "uuid": "1d6a8293-239e-4917-b28a-357bf223f8fb", "value": "1536:LGtlY8LsvUpoKBgajReCJ7axC+MnUSmaa:qtlY8LsqPBtewCCUSmaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700809683, "uuid": "f6ba1ae1-ad8f-4fc4-8498-71789415c323", "value": 52076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700809683, "uuid": "6fb94a84-7b53-406c-9f5b-da65047178b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809683, "uuid": "bdfebc71-06db-4584-a659-6b3cfed64e3a", "value": "e6e19abff27e1001252b0783ca6138ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae34f35c-8a93-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700807738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700807738, "uuid": "2d3cc717-181b-4d85-b578-9944f6f2a87d", "comment": "Malware payload", "value": "6d8d01ba0a7ffb604b4726ea90d82935", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700807738, "uuid": "fd66d2e7-0dc9-4158-a6de-c8d92799aeeb", "comment": "Malware payload", "value": "218f108322b3fbecc63c9c63a3fd34ff8ff17bc60156ee7e76e929f49e0732e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700807738, "uuid": "479215be-f08a-4b57-b1ef-1b3124a88eb9", "comment": "Malware payload", "value": "9c1a9a1ad67d30b8bdfd31ec0a249ba52e3bd2e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700807738, "uuid": "8e8c9acd-131f-4860-bb9c-1f301c9edbe6", "comment": "Malware payload", "value": "3b5ca7070a3768b648af919043d52d8b3ed0899c4415478a5e034bd2b6a706d57c6df2564fe5443cc826118490469a4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700807738, "uuid": "c938ff9a-0774-4651-b53c-cef0127b8ab9", "value": "T15344691365E0FC71C45707354F2D86ECBB2EB8619F659B8B27182E2E6A302F1E667311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700807738, "uuid": "c5a30b53-f613-4251-99ac-8890e46de5a3", "value": "26174cd618191e0f458fd2f9d0ece6c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700807738, "uuid": "fccf04b1-1cfa-48c9-8507-cc65c0505e63", "value": "3072:lAaalYSEfw921bQ2XPUnWbaB46k8VZzKGC5RumAo:ua87MwsTXPGp4RUzKHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700807738, "uuid": "edb04150-a1b0-449f-bb57-03be17255c0b", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700807738, "uuid": "49cd5b40-ab9a-4f12-b0c5-fe69aa2b9b53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700807738, "uuid": "67ca2bc8-7600-4aa4-a8fe-97600c29530d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425937f2-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864250, "uuid": "134eb2cc-4ec6-4a7d-9fae-0775266be166", "comment": "Malware payload", "value": "a17cf254a36eee1875106be5992865e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864250, "uuid": "2eebf067-b075-496b-b3a2-9dcd31f63cf9", "comment": "Malware payload", "value": "22671d1536382fdbb9c1fc0c8dc3172c5174f27a7f48191867082697ca7b25fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864250, "uuid": "1f14678b-a25b-473f-9fa0-3f3362b7ceb5", "comment": "Malware payload", "value": "703df870a51217cc725b4b6ab8ebb1a90aacd624", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864250, "uuid": "39032c36-b910-49db-9857-31f5f04c6567", "comment": "Malware payload", "value": "5f891ee03e18c6d1e139f2d7def97b17286333d05e586602f3f824aff7f1cdfd0ec96bf522c4a63f1e8541c29d0b75d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864250, "uuid": "51b957cf-c032-4341-bd6b-ef30f2b552fe", "value": "T177B46C22F690C476C1632638DA4B5BF8D926BE10F92C6A475BE93C4C7F393827815397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864250, "uuid": "553a28eb-c0e3-498c-b293-c696b44d4408", "value": "af13d7ea109eef680c68518cd54d90ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864250, "uuid": "1bd8203a-13b4-4fae-84f3-5c80c21981c8", "value": "12288:dtAOwpAKzmDK59HQ0hzDXAOCI54PdAzJv8W0UZ58oB:drw6K66QMwDImdAzJv8qZ58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864250, "uuid": "07b66346-751e-4f85-ab0b-29b82c2c9e57", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864250, "uuid": "d4d5396d-55ec-462d-9f0e-6c1824087a2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864250, "uuid": "33ef65d3-c3eb-435c-b006-ce1a4fc7ab92", "value": "SecuriteInfo.com.Win32.Kryptik-CPZ.25982.2708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1123996-8a87-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1700802615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700802615, "uuid": "104e441c-b2d1-4f96-af5f-d8524e219f6f", "comment": "Malware payload (DCRat)", "value": "bf031bd09dab5037a32e95290bef27d0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700802615, "uuid": "655377a2-d072-449b-881c-65ece3b5eb97", "comment": "Malware payload (DCRat)", "value": "23350615b3fc362fc7c8adcda2e78507a0bd912e0b48f0988058972e95eba22e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700802615, "uuid": "6c465fe5-1678-46c7-8fa3-5a01ce216239", "comment": "Malware payload (DCRat)", "value": "2608e6d61087f9fbeb1149c57428eb00963cb37c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700802615, "uuid": "ac9d4b9b-b921-4429-a7c8-e464efe3f22d", "comment": "Malware payload (DCRat)", "value": "70fb45ecc9ebbdac59a2ab64e1014180512ac43e762fb6a1d7962b7511bbabfc6317d2f2a0559e7471bfd3b3cfa0585a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700802615, "uuid": "01b10a5e-16a8-4124-86b2-2fb091b9c00d", "value": "T1A4452A183AEE1436F0B3AFB14BD4798695AEF973771E998D14C003CA8612740DE9673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700802615, "uuid": "0738d5c8-bbd5-4f40-a2bb-e05dcf2f8dea", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700802615, "uuid": "42fc5069-9090-4ace-a938-c126176f55aa", "value": "24576:2TbBv5rUyXV/vTn+4EkEZxTJMA+o3iE0n7162:IBJnTn+4EkgmA+o3K73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700802615, "uuid": "5c20158d-9d2a-4ff9-8591-de03ba381454", "value": 1186178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700802615, "uuid": "fc6855b3-0e2b-4d64-bb15-4752d430cd16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700802615, "uuid": "3c9bb640-60c9-4787-9bc2-22b063558e48", "value": "bf031bd09dab5037a32e95290bef27d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684ca9fb-8a94-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700808050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700808050, "uuid": "3e58b910-d9a6-4221-a637-b0cbe6786fd6", "comment": "Malware payload (RiseProStealer)", "value": "60dadd87272c7e2f1a94f5bbdce89d05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700808050, "uuid": "282edc31-20ff-4b14-8845-ca7236c21a91", "comment": "Malware payload (RiseProStealer)", "value": "24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700808050, "uuid": "321b2d73-a01d-48e8-a38a-269f524aec43", "comment": "Malware payload (RiseProStealer)", "value": "0dbabc0a372913c9d59ab0d32292104bf3f0710d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700808050, "uuid": "4a33be59-80ad-46e6-9113-12934f5da821", "comment": "Malware payload (RiseProStealer)", "value": "8cf43d2fac7880514734495486e4cdd400e5e8995b3a0ecbd003182f77409f244ef85d809b00257c74e601c93621c192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700808050, "uuid": "b18266f0-698d-4e08-bb8f-96eeb23314d0", "value": "T10B659D21FA08C0B7D09211B0916D6A7B95997A322BAF4CD3F7C05E6D01B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700808050, "uuid": "ab6e2370-5078-4152-83b3-8a65da645906", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700808050, "uuid": "ed62f137-f6f1-4c75-8f57-e3e7c1624507", "value": "24576:8N+bPGUvbX8AdjI9Bahe/wz78RaiyhrbnC3OlKekN4srzEhbaLUCKWmRlsSmYTzC:8wyYjI9EheW7WaiUy3V6baLUCmRlnmYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700808050, "uuid": "42eb5198-733c-4436-a351-eed86d67a355", "value": 1542280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700808050, "uuid": "f2cdbcb5-5b60-43f2-aae3-97761c25405d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700808050, "uuid": "6af8edaa-22a8-4ace-9b82-b54f590bc02e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f51bbb-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864251, "uuid": "4a67bf8b-9ea4-40b0-995b-06defae1324a", "comment": "Malware payload", "value": "e7e398b14a116970259e1414f244e30d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864251, "uuid": "ebb53368-2035-47bd-a202-0abae4c97d25", "comment": "Malware payload", "value": "24a8cedb2f93f3cbe964c20dc686229a501686f2e528ea21969e13e082464146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864251, "uuid": "2907a6ca-1c22-4dcc-9968-e24f90989e5e", "comment": "Malware payload", "value": "88db0e8724324b579858f1f402b298b75b6135b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864251, "uuid": "0a0d87d7-af2e-44bc-a5c5-c7f3c94cd96e", "comment": "Malware payload", "value": "e473a239648c9363e918e7dda1f2917793e0b1a62173c144a5d04f3cd6b25dedf57136d7f92545d67ecfde7d88a6592c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864251, "uuid": "5ce81fdb-23e2-433a-b357-0fb6fab759c8", "value": "T1D051C81B3C7A4CB4D3884BF2386BA911FDAF92723794B3811B6945D89530329EA21358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864251, "uuid": "f62d4ce5-a099-4854-8a08-733c364fe563", "value": "899ff83b1b6666463e8a5f5aefb7729e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864251, "uuid": "5cab1279-e254-43cb-8a4f-4a596971e7a8", "value": "48:6eT/DkgAMAAKgSYcGaRdoBzoxjRujp2P:nkFgS7GaqujRujp2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864251, "uuid": "735daf46-a3ce-47a9-9b33-85d8b3c43a5c", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864251, "uuid": "d6860f10-6cf2-45ba-8b4e-6ec3e8f30521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864251, "uuid": "47959443-aafe-40bd-9072-5dae361438aa", "value": "SecuriteInfo.com.Win32.Napolar-AQ.15043.28665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa9a6ad-8aa9-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700816948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816948, "uuid": "aa9bce51-8d2b-46f6-8095-af4d5e687473", "comment": "Malware payload (Mirai)", "value": "89086a26c8d68ad3f36e78810575fd42", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816948, "uuid": "d777d588-2cb6-4f78-82d2-665e41f0fe84", "comment": "Malware payload (Mirai)", "value": "28162bbecf2b3ec8b721cd45910b9d7b594dcbcbddd59c80021c6199201fd55e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816948, "uuid": "12ea8d7f-068a-4513-8d99-915c87209b25", "comment": "Malware payload (Mirai)", "value": "f0eba103391545791e112a86ae1821a1c3297d0f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816948, "uuid": "6588cc05-b044-44bf-a1d6-aef03a565ee5", "comment": "Malware payload (Mirai)", "value": "211e76a2529e1057fc90b0102552bef03c030f4a0caf29ca50de6f8622adf52ada04f493da30343f3ef33dfa823396f7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816948, "uuid": "30c9383b-a306-4d00-aa88-5eb691991d33", "value": "T1DCD3F846F8819B16D5D111BAFE1E024E37231B78E2DE73029D246F747B8A8BB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816948, "uuid": "dc36bfbc-59a9-4633-bed2-aaa168109af1", "value": "1536:YDn1gmfcMCd9zQi4uHNUlTaZnsfdcXyutDe33WvbWab4sqbidizENkZVH5f+2srd:gfPi1UAZsVcXHenWvbWabMENkLR+2UD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700816948, "uuid": "7fbe1714-b6e0-488e-a291-7117bbb4b515", "value": 137680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700816948, "uuid": "307a2876-6d91-4819-867c-9650968e1508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816948, "uuid": "f09b1978-7080-456e-9a4e-e488e5fd8da0", "value": "most-arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e6fe8a-8a5d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700784350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700784350, "uuid": "fc9bf1ed-7572-449d-b725-b2b5f4924878", "comment": "Malware payload", "value": "9c902370a45ca5ca820b48ea61f02577", "object_relation": "md5", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700784350, "uuid": "7c6b37c9-f224-411b-ab53-a7859428b737", "comment": "Malware payload", "value": "2a7f4adcf351e75c03b1a62df7d7528d19056bd963720f953f73f05a625ef068", "object_relation": "sha256", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700784350, "uuid": "f55d3fcc-b2ff-4580-888c-66e94c6f48c8", "comment": "Malware payload", "value": "1896a6c2e1b8c74605f6a6dec66ccac3a9556cac", "object_relation": "sha1", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700784350, "uuid": "67a5da08-3789-4355-b54a-f794adc64bb7", "comment": "Malware payload", "value": "184587367b62db7063f73adb3e2307b677e7ab1568b136f0ad2b63c06cd8bd6f1c7c90639564cc41da2069682acab993", "object_relation": "sha3-384", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700784350, "uuid": "0c5e43e9-8b57-4a2b-b6db-0c0687703ed3", "value": "T1990110B6364A3404CE93E0B2EA0B1DEBD0104A090A3D3DDF38328D9A502409E9E63492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700784350, "uuid": "b686edaf-0ce6-431c-9687-01c5b14dc61c", "value": "12:MNMrseGLqv19k5AGbzGvVk11PRnlwfFUObq4cnpIT49BBZUjap:MWGWv16Xzh5npIT0BBZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700784350, "uuid": "a0ef7324-33df-4e17-a476-c70f4792a4e3", "value": 714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700784350, "uuid": "885b5abe-639c-423e-bff7-f095d617e7a2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700784350, "uuid": "45cd4ed4-9bdd-4b35-8b79-7b8f7ee5d37b", "value": "FACTURAgzneih0__Ikb_(295).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92be06d6-8ad2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700834750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700834750, "uuid": "1bb54043-61c4-4648-a73f-0061f64b368b", "comment": "Malware payload", "value": "ecd9a9359d5d63d85ff58a6b56af864d", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700834750, "uuid": "0d7088a6-fa16-4e34-bd88-7d6cd08d170c", "comment": "Malware payload", "value": "2c19de830dd5b6bb726e3532706947823356667d4f55a8e069991d1b249ec093", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700834750, "uuid": "32cff0f9-3220-40a8-94cd-b0cdadef7211", "comment": "Malware payload", "value": "a6ee63900595a22206b7a75306c60a4431161b02", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700834750, "uuid": "40cc9936-f8b5-4987-b584-37d031eff13d", "comment": "Malware payload", "value": "3301f2df748ead84a8df47b2fee4e90f8fe6d04de1649d4c533e1d9205487962af2a4a2ff65ac62251a5b85626c23832", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700834750, "uuid": "0bc87086-dc1b-4f2d-b85d-de07ddbe0fe9", "value": "T1F91723C795EE4298C0D30E50698543DA39C174AFCAEDC92D3ACE5C027522D6AC9CDBB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700834750, "uuid": "2744fb52-2b35-4bc8-9d92-51b5591de5c5", "value": "471bac843c91a9a3ab7ad3e9a3e34c8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700834750, "uuid": "2daa2c45-0eee-4e30-8c12-6ab64cc3007c", "value": "393216:jHyHW126XTRvgXZ/19Tz2Yd/KYgT3oopCrDI6F:jHyHz6jRgJ/DTz2Yd/03L6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700834750, "uuid": "bf315f99-a599-4ccb-a479-710b5e2114f7", "value": 18622768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700834750, "uuid": "0f92b7e0-54a2-4b82-9e98-837add74b06a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700834750, "uuid": "7e7e4f40-141e-4198-9e2b-59f718a38c7f", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5313517b-8aac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700818322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818322, "uuid": "ccaa78de-3952-49b1-8190-0cb003175c9b", "comment": "Malware payload (Mirai)", "value": "eed041599c599d674b6b289426ba9787", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818322, "uuid": "88aadfba-73d0-45f5-89d7-9c7f595ac986", "comment": "Malware payload (Mirai)", "value": "2c1aa87e47ff245f78b1fbc58ab6bcecc677e036bf82b036f7377c0a17784f9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818322, "uuid": "5c163546-b6e5-4e37-8489-db86a7bd7fd3", "comment": "Malware payload (Mirai)", "value": "953c9412f61e22389a994de8a7cc048ba08a8cda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818322, "uuid": "e24590de-ce7a-4907-8820-fe23beb480b2", "comment": "Malware payload (Mirai)", "value": "cb078cd9f73704245e03144f44cd8be1620f22ac21d5235ff798683e59da84d20fc815816204271c791d127de7b41154", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818322, "uuid": "5be68ccc-a5b6-4b09-ad6e-5d34cea1b50b", "value": "T121C33B06731C0947D2632EF43B3F27E193EFAA8121E4F644355FAA8991B1E324586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818322, "uuid": "787a21dc-9963-4160-9a08-1b586c13ef62", "value": "1536:slr0RHg8xCH2OV257+Gxd+vLsQPBi2M/GZpJXjqkvAJ9NPF46cwqAqUx3+AdggS:OiAa+GxkjnU2rpFjWJsAdggS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818322, "uuid": "01b379c2-b26d-4a45-9e64-a875aa4a5bcc", "value": 125444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818322, "uuid": "cbcdf933-3181-4cd2-8fd5-ee48b4eaec07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818322, "uuid": "2e6c392d-e940-440c-b8f2-1c4f3fb551b6", "value": "eed041599c599d674b6b289426ba9787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd389f8-8a80-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700799338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700799338, "uuid": "2a4abcce-b0d4-457a-823d-a686ce15800c", "comment": "Malware payload", "value": "e06b51fc094ab322ce2245be8349216c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700799338, "uuid": "c8736d1b-81cd-460d-8d84-bed81ce85962", "comment": "Malware payload", "value": "2d22f9065326574ffb475b1cbe2c4a15e9347a3dcb255e0bf1652d9fd9a63374", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700799338, "uuid": "44d01413-9767-4ebd-8df4-3b88b261201a", "comment": "Malware payload", "value": "2c08c5a87615383289d8a83203dc2ecfdae3e0ab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700799338, "uuid": "5c7a204a-ad82-4163-9f89-ee1f302a8fbb", "comment": "Malware payload", "value": "73053d194406c246a8ac9c9927ef30aea168af65bff2c2b1822f18f83fe83fd84041fb27ef4980347f9709d100702c09", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700799338, "uuid": "f0fea209-754a-4c9c-9df6-1f9bcc30ac87", "value": "T10CD6F926F2508E36C0DD4B3A449F47615335411B8BA3A78702E4D9BCBDCA3A15FB678B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700799338, "uuid": "db8d6821-a1f2-4c84-9091-2f2ab83eb47c", "value": "362078582da621306e05e27e85b03470", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700799338, "uuid": "fa6134e8-3217-42ca-b6fd-088fd47b6ba5", "value": "98304:rgk8iCoDu+GfOls2B4nCwB+j8FBfJmRHu55pnpDYMkfipcwalZLCwpokCFCxJD9K:kk8IKmkDM6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700799338, "uuid": "d1aa15ac-830b-469a-ab3a-98f7272fb2c3", "value": 13007044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700799338, "uuid": "ce96b78d-9e7c-4ad4-8022-e092f24fc791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700799338, "uuid": "41293a5a-437a-440b-a34e-150ad391fb07", "value": "SecuriteInfo.com.Win32.Casbaneiro-D.10568.21098", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabcfdb2-8aa7-11ee-8907-42010a9c0042", "comment": "Malware payload (Vjw0rm)", "timestamp": 1700816429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816429, "uuid": "a71a7d5c-edb1-479b-8cab-98a93873f4af", "comment": "Malware payload (Vjw0rm)", "value": "7d1e985be05e1038b33ae1c4e980a663", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816429, "uuid": "dd1efbce-6aee-444f-a7a2-7c4710dfb9f0", "comment": "Malware payload (Vjw0rm)", "value": "2f2b1b66553a447bb3384f5d22407a00bedefc43f5d4fb63b8b4970ed6c1702f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816429, "uuid": "8f4baa43-8d47-4029-9b3c-38325fe34288", "comment": "Malware payload (Vjw0rm)", "value": "364d4a8f587b94716daaec3ce4ed80d00b356c0c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816429, "uuid": "c6d0b749-d21e-4d9c-b7a7-a7cd39494a44", "comment": "Malware payload (Vjw0rm)", "value": "5560615e542ccade30216e475462ee6637b470651a0ec97a93aa26872053388edfb7d8e0b5f1a98bfdc0c0143287bfbd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816429, "uuid": "a64ac3e0-356e-4f7c-866e-01db46526a26", "value": "T17316FFA179D0A8D71AD45FF3DE0A69E0E2873D2E6011102BD4123A9362DE471CAD7BF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816429, "uuid": "30c35ef2-bc80-482b-a21a-722ddd456cec", "value": "24576:1ZGBVFPB36kJuadeEKwN8o5red0epniTcZkgbMegyMDoIWqkaln8wDs/Pm+x7Dt5:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700816429, "uuid": "7aa945d7-ebb0-4e28-af64-484dcc0b89b0", "value": 4030804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700816429, "uuid": "d182d90f-e347-4231-8bca-c1c282872462", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816429, "uuid": "6460992b-bea1-41d5-947b-964fe4afb76f", "value": "neworder.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44467fd4-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864254, "uuid": "3ccdbdd3-6920-4920-9659-8099014542df", "comment": "Malware payload", "value": "9d8f7c961e03d631bee96046fdced088", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864254, "uuid": "21ca6db7-183d-44ea-8ebf-8d1d2841cce0", "comment": "Malware payload", "value": "2ff9c620e4c5dc4ce49558d28a0577b586337c2dd759d2ac79e745d03acdaf34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864254, "uuid": "e6377d34-d090-4dcd-ba90-5856945810f9", "comment": "Malware payload", "value": "5dca80d4a76378ed42b9d96a9307744b7ddd04b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864254, "uuid": "b2526957-8451-44e9-bfc1-bc2380cb7cde", "comment": "Malware payload", "value": "4f739ce94d970ec105fc2eaf0fcc2ea941d371920fd18bf6fbfc9cd359c9699fc701c4474d1b227b6fb34207348e04e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864254, "uuid": "9eeabe92-3f37-4af6-9819-bf20731ed989", "value": "T18704019221A4DBB7D67843F8091286A053796F225111D37E3EE296C6F7B3B024DC37A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864254, "uuid": "55a938ce-f656-42a6-ad70-0193ecb4db9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864254, "uuid": "768eba8f-c2fe-4e10-866a-0c8f35149031", "value": "3072:uTNKZsU0ExrqPdY/WpSgG47X+Pk834QjXwZQ750WJUDBtF3a26lvQZtM:8KZZeOoXEr3bHXJEka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864254, "uuid": "d256b0ed-818c-4860-9d33-e595831715a4", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864254, "uuid": "8b29efe7-b28a-48fe-8b05-76ab90caee92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864254, "uuid": "97b952b6-bb1c-4835-a380-666ee36998ec", "value": "SecuriteInfo.com.Trojan.Siggen8.29758.3392.19190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4022ea5-8a87-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700802647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700802647, "uuid": "a2f14da6-135c-4236-af0f-0ffd01342d1d", "comment": "Malware payload", "value": "45e5b7841b777240f4cf11a61c828654", "object_relation": "md5", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700802647, "uuid": "34cb7765-647a-4b6c-9c08-4eaf05820900", "comment": "Malware payload", "value": "302b327d6fde9c79d195e2a0936b9eea56f5c052102daec19c7f0a9c018ec3e4", "object_relation": "sha256", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700802647, "uuid": "13533ea6-0e1f-4aa0-9098-ba8645e69f38", "comment": "Malware payload", "value": "1d4ee1175822a04f9c81a8a75ee5dc6df9d503d5", "object_relation": "sha1", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700802647, "uuid": "7b80d460-2d0a-4d96-ab43-879de0cad341", "comment": "Malware payload", "value": "fd1c8166bd2e5314e5da346cb85b6b354aff4d98b806e488feec08e7b9d02cc0a8781330832844f61ebfdfea3d13d18f", "object_relation": "sha3-384", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700802647, "uuid": "87459537-8d0d-44c2-9ed6-3e3ed17ba5c8", "value": "T130E5EFAC78B5B99AF1D0837BC7C52CB6DB2CA440D7993D9B8E2042567D8310E4F7AC61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700802647, "uuid": "20ef886e-d58c-4e3d-b1cf-d7406668cfcf", "value": "49152:SE8EKeiv6F/t0rfgHggdLTRG+pgJiIuWmftZSmKO2:SE87efWUAgdLVG+p4iIjaGmKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700802647, "uuid": "b2334fc9-b6fa-4700-bd09-7b8a26e4a292", "value": 3170368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700802647, "uuid": "143c8f3e-e261-407e-ad36-1f8ac1af4a92", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700802647, "uuid": "44ddaed0-d9b8-4b9b-b5a0-2dd8e8e03f70", "value": "Photo_19.10.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec9cc56-8a70-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1700792706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700792706, "uuid": "18d611a0-8419-4e64-b1db-9bf443239e6d", "comment": "Malware payload (DCRat)", "value": "1ba5d94672b14a759ae0d0ffa4e0687d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700792706, "uuid": "c6d4e9bd-289c-4e99-87c5-23005425a1d9", "comment": "Malware payload (DCRat)", "value": "31dc3451ba0ff218ff031cf6d52542f7d67613b31751743384b7336d4e1a15f7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700792706, "uuid": "d86f2ccf-77fd-4c67-892b-8ea4bf3d3902", "comment": "Malware payload (DCRat)", "value": "e85329dae230856fd973c5cf641cfce77dba3fa7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700792706, "uuid": "f568ee3a-8b41-474e-90f4-3d08636aa5f9", "comment": "Malware payload (DCRat)", "value": "e03cc91b1aa2e4dfb11c87f8ebce698c8b5462d115f7cd7bfbd12ca5adf7d1d06ad5141cf83504082ccf1e5cc33d3853", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700792706, "uuid": "ad40a7e4-d2e8-4800-af82-913c3f056225", "value": "T1DFE5D72029EB1136F1B7AFB195D1758E87AAF5F3B7168F8E305082C68712784CD9173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700792706, "uuid": "1919ad11-d157-4932-8385-d5cbb0381bc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700792706, "uuid": "a4fc7cf7-45df-4ded-b2f5-b917f493641b", "value": "12288:uTc16qpr+cd0XTLG8XhMGiXPrQfkXmm1RhdLB9XGbHJW/6D+:uwXB0jLTXhhEqM/6D+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700792706, "uuid": "4f0403a5-ae45-4d6b-915b-513fe12456e2", "value": 3294208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700792706, "uuid": "2dfc5233-30ab-4cd4-b2cd-0a3ccda9d5ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700792706, "uuid": "09a3cdd1-1731-445f-a7da-e8c680e0cfcf", "value": "1BA5D94672B14A759AE0D0FFA4E0687D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95a6f6d-8a9b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700811166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700811166, "uuid": "922eb28f-7700-406b-9c9d-7199400b1894", "comment": "Malware payload", "value": "b4480ccc1718e42c8be3b61f926e7f19", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700811166, "uuid": "7f20d39e-30cb-4222-abd6-bdd1c3bc8183", "comment": "Malware payload", "value": "32279db20e7b5f108afdc431a61a1c04510c81a1da72928ff427d5dfd5ec6768", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700811166, "uuid": "b782ac74-4cd2-4b19-9869-bbed12d0a569", "comment": "Malware payload", "value": "867b19dfa5e1d56bee8928bbee0e9f02619692fe", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700811166, "uuid": "362dabc8-e37d-4948-86a1-d60955199a66", "comment": "Malware payload", "value": "77333475c0563059fc06d227f0ae8b4c38ccd675ff994b95cd29845b8b0fbb5f2530c0db0f8f7c143d7a4707aeeadd22", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700811166, "uuid": "22f9b6f2-306a-43a7-a020-01cf5ea70fc7", "value": "T1FBE4338C3EA71D589DD97F19B177228D1CB366653C990B4FCFE1AE241227724E28847C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700811166, "uuid": "227ff10e-b1df-4899-917b-384295fa0eab", "value": "12288:LLTq7346JLzYnXieaW2A/PPD3CdUkQj1YBKn5YRomwLP:/e734QxPWlP/kQCBu5YRoHLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700811166, "uuid": "be743d1e-706e-454d-bfe1-f913ded06198", "value": 691079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700811166, "uuid": "27ee082f-c327-4286-9d2d-f2639612f41e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700811166, "uuid": "d2956d3e-f6ae-447c-8eb1-92902b427c20", "value": "QUOTATION NEW.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bafffd-8af3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700848707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700848707, "uuid": "a41e32a7-ee73-45d7-be2a-15e10a46af68", "comment": "Malware payload", "value": "4eb0ec33656f498988679e2450d470e4", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700848707, "uuid": "7bfcd8f9-bcea-4c13-a30c-ac9e0ec8a5f0", "comment": "Malware payload", "value": "322889437765125628ee9bbe4ed2ab96d09199207fec53badf2b16c17e8b7a0e", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700848707, "uuid": "f323ef19-52b8-42d9-aff6-7ea960d4ca23", "comment": "Malware payload", "value": "4baede0d3111fb021c25e689684a9ffee69882d4", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700848707, "uuid": "1a34d970-21c1-4caa-8c4d-af62ff09f55e", "comment": "Malware payload", "value": "6d822ab1b59065817d02f1884c16aaa8b018edcf20b84e5708fcce6a0368edf7ce8b7adf550e0dde6867e0f48f1cc1ff", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700848707, "uuid": "1a3581e8-6266-4172-8ebc-a17a15a0eade", "value": "T1F9163398526ADDA7C91E7A7E002A1F4D2BB1407345A1BDDA5B60FC4E5FEF8401E3B4B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700848707, "uuid": "10539cf6-da26-42c6-b0e5-a1e4fa7ae929", "value": "98304:ahVQAfMPfCLrFes8u9LLgdZsjECIezNvQyURUNiAgM:vAUPaBYu93IsrdzNvDgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700848707, "uuid": "16816b3a-4e7e-476d-87a3-9cdfbf8f79d5", "value": 4320098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700848707, "uuid": "86544837-3ff7-4444-8b15-e4c209096f8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700848707, "uuid": "6fa32007-742b-4963-9806-1c7ffb941666", "value": "Iv\u00e1nsiqbVHBDYDZOqcucZFIOzlkf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26eebabb-8a98-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700809658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809658, "uuid": "cbac083e-01fa-4a83-bd4a-4e0cd22075be", "comment": "Malware payload (Mirai)", "value": "b4f2e69cd9f9d6c626624262c4586cdc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809658, "uuid": "73461e88-8c81-4c56-99a0-08f1be5b34e2", "comment": "Malware payload (Mirai)", "value": "323acf6fe365882f1a78c49c6ac90f84374a30b2d595b1abf40573f1c35bea4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809658, "uuid": "694c312a-206b-474f-b029-42b33f4f2e70", "comment": "Malware payload (Mirai)", "value": "19bbfdf69ba168457b36fad2dfcda989801fd178", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809658, "uuid": "daea3aae-0adb-4a6a-86c1-7b766b344ce4", "comment": "Malware payload (Mirai)", "value": "7bb6e226163e0a9648cefe5de3bb66855e50c195aad244f2ccfa36a1375762a753bdee1472992a3fc78fdab41a102c54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809658, "uuid": "b36ddb5c-0497-4a00-975a-d1d1de511b1f", "value": "T18D533A54F8815A13C6C1127BFAAE428C3B2657E8E2DB7207DE225F2137C692B0D77E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809658, "uuid": "82735e76-038a-415b-9185-7fe656c02022", "value": "1536:wU0hPht5HPU6RuRA2Sy1EgjofBt5yv/S:wU0LwWQE66Bw/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700809658, "uuid": "83de425f-5841-41d1-a9d2-17486b4c853c", "value": 62880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700809658, "uuid": "e15243ef-e63b-4660-b383-bf2461b5b304", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809658, "uuid": "5e598b1c-6d64-4e74-aaba-99729c68efbf", "value": "b4f2e69cd9f9d6c626624262c4586cdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d437da5b-8b14-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700863207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863207, "uuid": "4d944cca-3c1d-42e4-939f-b4ff6dd1ad0b", "comment": "Malware payload (Mirai)", "value": "7d05a954f1602dc68058a865182252d0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863207, "uuid": "867180e2-cd6a-4171-b550-0a8a06634c01", "comment": "Malware payload (Mirai)", "value": "3387aa4642e6d7ebfa15d86b2656917ea9fa14b59bc58bd3328b814c5de8e954", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863207, "uuid": "4b1dfdb0-be62-4b18-8ba1-be75bdc76667", "comment": "Malware payload (Mirai)", "value": "edb462f2bd8d0d32aff2fcb200c3febedb90baae", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863207, "uuid": "5f62d2a0-03bb-4424-ae85-046011d0c101", "comment": "Malware payload (Mirai)", "value": "a5c038e6e9a1123c1ed56bca985e148a8ff61277ced111645827c775559d586640a3faf3f8f1b0a1f645075f7dc9b8bd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863207, "uuid": "3fc77e17-d387-4d3e-b6ce-9197fee8669c", "value": "T1A36319817C80AA26C7D0177BFA9F108E3314ABD8E1DB73478C141F95769A81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863207, "uuid": "6a7d7d14-87ce-48ef-9892-39bb7fca8c7c", "value": "1536:GbtexU5L9XouIRhb96pUQzXtwavaJ3V8OHxouJeZWDFI8dM:GbtexU0r8QCKw2Fba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700863207, "uuid": "151e743f-4816-4313-b601-8c43310a217d", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700863207, "uuid": "7ba4bff3-177e-42e0-8b93-dcc222dda4dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863207, "uuid": "553fbcdf-3291-4e19-a0cb-9be63544f277", "value": "loligang.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe872d9-8aee-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700846899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846899, "uuid": "35887b96-e813-453c-a7c6-68e94e1fbe98", "comment": "Malware payload", "value": "c9c89a47c7d937ec0f26092dd8427b70", "object_relation": "md5", "Tag": [ { "name": "base64-encoded", "colour": "#994AF4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846899, "uuid": "cf4eb9a4-fd64-4363-bcd6-5350528ed677", "comment": "Malware payload", "value": "338dcbd0f75abd063e351bf27c13255ec0f776964ccb7c148ec46806c158ec2e", "object_relation": "sha256", "Tag": [ { "name": "base64-encoded", "colour": "#994AF4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846899, "uuid": "34095265-0bae-4763-a476-e1f1c73bf4d5", "comment": "Malware payload", "value": "69b578f01b7386be72d7cafcb45bda823fe29a97", "object_relation": "sha1", "Tag": [ { "name": "base64-encoded", "colour": "#994AF4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846899, "uuid": "9e9446e9-2c1a-4e78-b45b-cb7de267ec55", "comment": "Malware payload", "value": "45fd9e915c81d908cd584e1972b8a73b1a12282ba73292192aa9e73b6c2279473d825c6f70c666c09bd8853a1a7aedb6", "object_relation": "sha3-384", "Tag": [ { "name": "base64-encoded", "colour": "#994AF4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846899, "uuid": "b1ae8e43-534d-4db0-8cc2-078384382bb5", "value": "T18BF44BF476D47BD70F75194DB3CF40B23D54B857F0EEED86228D0D1E928429889AAEA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846899, "uuid": "fed7d0b7-bd5c-4e36-a888-c7ffcd86035d", "value": "12288:Y7oh5QoNGWGZyTPnjAmM9aZKTz1RpxFg+cO6lKc9NTu7i8AO7QXM3us4PXK:Y7oh5QKGWG0rboasThRpxr56si854PK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700846899, "uuid": "e5894de6-bb20-4d07-afe1-6cf685f291af", "value": 723778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700846899, "uuid": "0b4d4f2d-d1c4-4e4e-9bb3-187cf7e5959d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846899, "uuid": "e2aeac74-93d7-4901-ad85-8942219c850b", "value": "hellish", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7223807c-8af5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700849728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700849728, "uuid": "70420ce6-7d3b-4328-a424-9845e11d18d2", "comment": "Malware payload", "value": "689c6a0016dc1e7724a2a2314685d89a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700849728, "uuid": "a8627cb6-65af-4ee8-a6dd-c9f9379b935c", "comment": "Malware payload", "value": "3515f85d0649c8d24f9de22e0194198e1a5e24d3c67ae70d1a2d1896e54067d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700849728, "uuid": "f1030855-87a8-405b-8665-97bba0cf75db", "comment": "Malware payload", "value": "d5ebb8e6e7559508f9250111c22846b8d2607980", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700849728, "uuid": "6055914c-6b85-4bc6-9f3e-565753e87565", "comment": "Malware payload", "value": "b8c02d52648e3cdfeb3218b1b152ff1bea0231b6397a99f0b294c23478e35dd8fba9b9a55898b87e76940852706fa010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700849728, "uuid": "f548920d-a33d-4fa0-8fef-628678f41dd6", "value": "T16BF5338602C0CF24D1BDD97567F6D9BED3B1AC107234959BA8B931D2BFA10253E136E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700849728, "uuid": "812ee9e2-f2be-4d5f-9f72-6bb73898d86b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700849728, "uuid": "5c0550cd-412d-43eb-960d-5269d8713829", "value": "98304:eMnAFPky6ruM7GpoVCgslY5A8DkY2Az0Tyq:QapiSVCgpV9z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700849728, "uuid": "3243b44c-449c-465f-9a88-5430b9912764", "value": 3492024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700849728, "uuid": "80013143-7ebd-40fe-a000-67a6951b339e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700849728, "uuid": "a9743dac-811b-4a9a-879c-3e83b2fee25d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07575489-8ac3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700828074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828074, "uuid": "58194ff7-1c60-4254-b8f2-91b9d35d1d8a", "comment": "Malware payload", "value": "89f5b77932dedddecc6565e52cb6684f", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828074, "uuid": "0f98b6d8-b0f7-4774-9b33-e914020173d2", "comment": "Malware payload", "value": "35eaa20dfa5a5c422ee9002d2467c49eb145e29698fc27ec8ac60e2b19846815", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828074, "uuid": "86da48b9-a505-4013-a793-752fa71aa50b", "comment": "Malware payload", "value": "467d648e35ea6d6c12b1c3fe907cb96cb4ff4d2b", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828074, "uuid": "bdb8ea20-e3c7-4430-bcd3-eeedfcfdd04d", "comment": "Malware payload", "value": "e861a53b1c484e65d39750a97ec7d6571b8c1806a71f7d58765503c0e57a731a240006ce8bbab80a5bafc36c66f69c7d", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828074, "uuid": "8d4d9090-e31d-4e1e-9b5a-11b520f82838", "value": "T1EB91940036E09048034B2BB63F1660FDFE58ADAE7ED3D8AE7C40A6784DA9815DDD2D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828074, "uuid": "27f28711-b39f-497c-92d4-7cfc8b45836f", "value": "96:jZNSImAkZZGPBjIfDkzzDsAuXakDBY0IM2La/BSRxQjs90dJ/rG7bGQ:jzfkRCzDsAg9BY82iQ90/zG7b1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700828074, "uuid": "2bb35044-4ac5-4028-be83-002c14bc5158", "value": 4318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700828074, "uuid": "48fe48c4-9a9c-45c5-83c4-362d44bef799", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828074, "uuid": "9d1d08b9-24f2-46ac-a1b8-701fbc741754", "value": "Agenzia_Entrate (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45082883-8a89-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700803266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700803266, "uuid": "b6cf076f-b3d9-4be5-9b9b-e08abe5ce7ac", "comment": "Malware payload", "value": "000a852284beae5109a5da319a84ab21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700803266, "uuid": "b2fa2449-9ee4-4b47-b8f4-847840b64e3c", "comment": "Malware payload", "value": "369888d461380a61d73d7c8dc5e12c134cd8964950f36df98751b30e1863371e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700803266, "uuid": "1f9f5e84-e2b0-4add-b9d6-94c250f3d469", "comment": "Malware payload", "value": "c4482e31c8196a18f76ef4506d1d96898e00de77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700803266, "uuid": "c1ae555b-161f-4733-8575-b810080a4b54", "comment": "Malware payload", "value": "4da36e830e5af1221f2512f72606bcbc6914d320e5c80235192855bde105d23c5af7728f3a6ecae3efab40f00482d1ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700803266, "uuid": "3eedfbc9-3064-40e5-9e6c-ac1e04a68a5b", "value": "T1DCD533567AE38D36D23CC8744FE5A80BD7733D4BA831925015981785EBF21A0631DFAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700803266, "uuid": "5cff03b9-573e-457a-b1e9-3a9012790e62", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700803266, "uuid": "edf3d34a-5b8b-469e-a081-6d045b55fdd8", "value": "49152:l2dKgqFC/iTqHv7bb9NfQSvzZxPQUlsMuiRPzGjNBi+tsvDcRY0E:AARFpTIXhJ51xlax/7TtsvIlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700803266, "uuid": "992f5231-afd1-4a1a-82a6-224682b5c35c", "value": 3007652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700803266, "uuid": "49383051-bdf4-4dd0-be4b-4d2e9f031120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700803266, "uuid": "4b0f3567-c866-464f-b24d-3266133f9353", "value": "SecuriteInfo.com.Trojan.Siggen22.14345.14195.15363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca090565-8aa1-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700813797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813797, "uuid": "849a6647-fa6c-47f0-b87d-8214fd9c8c74", "comment": "Malware payload (Smoke Loader)", "value": "8cf3cf1b823a85378b6368407e12c181", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813797, "uuid": "3d85dd87-b0ea-4d46-a41c-14aeb9535c1a", "comment": "Malware payload (Smoke Loader)", "value": "36c2741465b9cf44c246ab5139421edce8b94483e63d5fe8e6eb18dade8ac263", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813797, "uuid": "6470e34f-096a-4803-89ce-24ede03dd312", "comment": "Malware payload (Smoke Loader)", "value": "76d38a1d1afe7f22c5d28bc774f73f328b23e761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813797, "uuid": "ba9232bd-346e-4ab5-9a05-f50640a457af", "comment": "Malware payload (Smoke Loader)", "value": "ffd6479e5715d52a05f077017b93b61e5714d8ed3514691009ac6b53568ce100937c7befd60695ef23ac041999224c0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813797, "uuid": "3fcb7c70-38e4-456e-87b7-6ea5117a0a02", "value": "T14C445A1365F0FC21C47247308E2C96EC7B6EB8215F65D7872258EE2A69312F9D677322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813797, "uuid": "7562c32f-a6c2-4eb3-9939-a2fc6bb836c9", "value": "26174cd618191e0f458fd2f9d0ece6c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813797, "uuid": "36094199-5f41-49e5-92b9-344587b12b5d", "value": "3072:8BeRONNnoWPxzx/sXq2MbgVC5RuCUOAk:oeYPoaxF/iM8Ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700813797, "uuid": "a5d70a49-1c5f-40d1-a286-2a16282dfa49", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700813797, "uuid": "18d7e167-42c4-4efe-a7a8-5e5b408229b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813797, "uuid": "2b59e858-c00e-403a-80f0-205188c2cf56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c8d23a-8a5d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700784373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700784373, "uuid": "9b9cdfd9-f634-4118-8541-c31ba3f62545", "comment": "Malware payload", "value": "498f2220d6962b5b49fc6c2750610a90", "object_relation": "md5", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700784373, "uuid": "fb483f83-3a0e-4cac-9627-f068bf3c7152", "comment": "Malware payload", "value": "36c56e3a9202c35e76a3ed10d00650c821b6ee9e1b3834fbab5fa5047d1ee99c", "object_relation": "sha256", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700784373, "uuid": "7629024f-9d3e-4211-98c2-2e98af2ebacb", "comment": "Malware payload", "value": "06485ce9a6ba48a240c712497900a4240385ea02", "object_relation": "sha1", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700784373, "uuid": "634d28f5-b037-4c04-b7c7-6b890f759fd5", "comment": "Malware payload", "value": "35b0cc731b1714b20d9a4d0d7f9074d78da88f5bdfa39fb4d8b8f3ea342e16423136f26ee5312b71b080126cf8ed06a6", "object_relation": "sha3-384", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700784373, "uuid": "7ce9d059-95ec-4d96-a5d8-45aaaf32fd99", "value": "T1B90125910117C8C6DE4B4D61D4860E4B761FCCE69F2EF9EE5832694446F0BA41D4DD37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700784373, "uuid": "1f150628-f42a-43d9-bdfc-0e7685d2e86b", "value": "12:3wK1s60pqPV9BnZp1wmzj9laD/WoHtPexAUKCSvTWAUKLk5m4rp+lGhF:3XlZV9BnZpGmzplqWDxAbCUWAbYmq+4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700784373, "uuid": "e6dc82f4-69df-4f98-a374-c084f8b99a49", "value": 781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700784373, "uuid": "931bef1b-832e-4e9c-9648-57fda7a15761", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700784373, "uuid": "3ad09d3c-f10c-45a4-a6d0-21a7f5a18d8c", "value": "FACTURAgzneih0__Ikb_(295).PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e34ad49-8b06-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700857049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700857049, "uuid": "42c1f294-57ee-4e0d-b817-11cda9c5700a", "comment": "Malware payload", "value": "a194ad7a3fe74fb6a1749a0d72bdaa79", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700857049, "uuid": "308a19b3-5315-4dcc-9d13-64a42dae7853", "comment": "Malware payload", "value": "37d8436aa414c5df4340f06fdeac9bb1ba1ec2a8a48918d6d96948e9ba1d862d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700857049, "uuid": "a32f0418-f811-4e1e-a64a-f5ff4cbe6d95", "comment": "Malware payload", "value": "6718940dff7d9c85fa050d675e5fe7f3de78d29e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700857049, "uuid": "5fe7172a-b733-47a4-a647-4b3baac90900", "comment": "Malware payload", "value": "b034f6ecd22cbefc54c229b2a70d5e78d64a84a731f5b68a67692122c62a12f92c229ac18948f63b4fbe159ae5ab7be3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700857049, "uuid": "0f28ba59-3d99-42e9-9b57-269b367a32e6", "value": "T1C8A25AEADF85D5FAD78A71F6C4AE14BD29E95A302F2500EB45A911291F20AF3D1B0313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700857049, "uuid": "ca99c55a-56f3-4a3d-bb45-a869f231fb02", "value": "2dc5e55f04275b1ccf1b46d5155429b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700857049, "uuid": "11e7f7c2-820c-476a-a7ac-886474f166df", "value": "384:DnMulcYTEIkzLuFdb0S3pSI+NrwjXMr3OT/X:DMu+YwIkzLuFd4khyU4eT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700857049, "uuid": "85e74331-070f-4055-9d2f-5357867642b7", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700857049, "uuid": "7c31cf77-c97f-445e-894b-77724e72b597", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700857049, "uuid": "2068509c-222d-4bf8-96e8-ce87f83bd1c7", "value": "SecuriteInfo.com.Trojan.Packed2.43489.24938.28393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f706936b-8ad9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700837925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700837925, "uuid": "bedf10da-9e21-4f12-abf1-bfd14546df62", "comment": "Malware payload", "value": "bf6f221b0588d21e73f2095cc4eedaf2", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700837925, "uuid": "7224c8d6-1802-4e2b-ad5f-30bee19e3ad4", "comment": "Malware payload", "value": "397584eda8f01bf29d148fcc38c1481e81c44a9e6fa45c95c041a7662c037157", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700837925, "uuid": "f28b3f89-c1ad-458a-9843-c22d23ce5245", "comment": "Malware payload", "value": "171694b0fe53de3d2a799cb8822560b58309f20c", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700837925, "uuid": "e2c52477-419f-4f6c-8c07-55dd8acb05f7", "comment": "Malware payload", "value": "c71e93805deb3ccc4d97938b1a2ecf53f808c69a4a0585d1fabdc40daa31c3996e2e85d9d8f5e48dc7d644e598a62eaa", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700837925, "uuid": "50f821a8-9c41-4051-a7ff-d40f99ef64af", "value": "T1F7354B22A3D14437D5732F758D6B86986C257E302EB4D95A7EF89E0C0E38B817D353A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700837925, "uuid": "16d16447-463d-407b-8a30-c91e75180454", "value": "24cdc56b5fda73aeb4bb75aa4a21ffc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700837925, "uuid": "b58082b8-fb95-4e8e-8a2b-c268fb61bdbc", "value": "24576:k5Pc2oOjSiX6F9204jN76eOJd9eZEdRapWhmAMJ8vDjr5xyH:t9Q/O7wWhBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700837925, "uuid": "4682e713-5a6e-4919-b86a-947c36d70e85", "value": 1158144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700837925, "uuid": "401e8947-24c6-4109-ba01-7a7ff33b7bad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700837925, "uuid": "7a4b1713-cfae-4e47-aacd-5ec2fb17cb1b", "value": "17008379227449124c02f07946c3fa3d94fbf21f81224eb350604040b9bf0cc4f8f690db90211.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9474e194-8af1-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700848067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700848067, "uuid": "14598bda-cd17-45ef-9d21-c078aa10de37", "comment": "Malware payload (Formbook)", "value": "09a70eae110ee8330255f6ca379c4e28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700848067, "uuid": "974a881e-1875-42ab-81fe-7951cc9447d0", "comment": "Malware payload (Formbook)", "value": "3981ee1705c19ad29ac3d94a6a95a6b55d10c5ed686b5fa3cee9d69995268da4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700848067, "uuid": "3d6e1630-3dc8-49c0-8b59-51a15365609a", "comment": "Malware payload (Formbook)", "value": "e40fb6c666d638b1068d7480c79dc32ef469cfe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700848067, "uuid": "4979ce95-d40c-4095-bdd7-2e7c48d5b7af", "comment": "Malware payload (Formbook)", "value": "7a75b523a23e2c0b0bc1975e362af85abd214d91ae93d10946bbfe6e978ae54d9d4f9e9f7afdc362b04c77170ce70383", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700848067, "uuid": "46c7ef63-ebcf-40dd-9cc7-b918bd3e49cd", "value": "T197D42316129F2FDBE8A943F74A34D20043F06E3458B4F3656ED632CB41BD765E652A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700848067, "uuid": "8776d4ea-fca1-490e-a677-69f2081ca346", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700848067, "uuid": "dd5a744e-6760-434d-af1b-bd6898a27d97", "value": "12288:pHE6jD/berN8VGWZeDYKf7ZmWwYGTFhBu68dAksXtx+5sLENz:9tD/bex8gWQcmoW0TszdAXXtU5sLEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700848067, "uuid": "a29469b6-953f-4b14-8acb-f30138b80b38", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700848067, "uuid": "5066a0aa-85b2-4c9a-8d57-0e88519eb7c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700848067, "uuid": "89412387-f00b-46be-bd26-495a0ba8e6ac", "value": "\u043d\u043e\u0432\u0430 \u043f\u043e\u0440\u044a\u0447\u043a\u0430 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e1c70f-8a90-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700806378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700806378, "uuid": "78cc3b8b-ba39-42e2-98e6-0e93a7fd5749", "comment": "Malware payload", "value": "51367ff68633e00c8a084cb52534182f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700806378, "uuid": "5da378c1-7bd4-4a37-994f-ea178ec8a4ae", "comment": "Malware payload", "value": "3c16def99c05de25b1b8dfb73757f3356bad519c9c39292752aa07fab0653936", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700806378, "uuid": "a2625952-8410-4ad9-b922-748aaf45748b", "comment": "Malware payload", "value": "52a06ba919a3ff357e456022493f66289acee4b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700806378, "uuid": "ee86a804-6424-474a-8f87-89a2850bc427", "comment": "Malware payload", "value": "11ab53d32600efa88e85ab697949545fd73757d5ba131d21067c3e7ff15fa736749a7102cb2192ce6d4fdec8d42a946e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700806378, "uuid": "632dbebb-7ecb-43a6-81f0-1fdc8e6082f1", "value": "T1F48412ACE65CBB12C6E94B7F94E6B95553B1C2B2B30BF707B8C9822508117D76112BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700806378, "uuid": "a34de1c4-2dac-4343-9f15-41a94ea35d11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700806378, "uuid": "f8e919bf-f347-4688-ad56-b7f830e02aee", "value": "6144:mbrmxtDV8OaZZDew02Ypus4G+ftUhNOw9Jiv/5IvjA21ROSF043sZi:CgtD+OKIt2YpL4G+fHUJ7L51ROSFn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700806378, "uuid": "45b94c02-de65-4edd-b655-e023d1a52aa8", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700806378, "uuid": "ab7b89b3-bfdc-415f-934e-223b3f754a73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700806378, "uuid": "58febcd2-104b-47ff-8dd4-bcbe45c0e823", "value": "51367ff68633e00c8a084cb52534182f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f64e7f-8b08-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700857941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700857941, "uuid": "c5bc925d-df1d-41cc-be8e-8e319e7eafe1", "comment": "Malware payload", "value": "8a2907164515e339bbe40eaae6871168", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700857941, "uuid": "7b4d6cf3-91ac-4a6b-85ac-1affa86fd4e1", "comment": "Malware payload", "value": "3d664fa0cec81f33f5d79de5e3a3cb060f54c442a90ba84c712fea2d9861410a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700857941, "uuid": "729c0d91-c8ba-45a6-a565-17ea88486ecb", "comment": "Malware payload", "value": "28228d762b807f0224b020f66b4095dbd08cfc1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700857941, "uuid": "97bafb53-b31b-4236-8ee0-8c0fd5105658", "comment": "Malware payload", "value": "88d1569c1704684c3e1ecf72e10c6f7ae5b30e015d4c96752774adb22120408c2faeb76ab7229240cd3fe4171fe350ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700857941, "uuid": "3f68e8bb-e2fa-497f-a41f-77539da10ea8", "value": "T1EA347B1379E0FC33C25707754F2D96DCBB2E78725E66874A37189E2A5A302B1DA27312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700857941, "uuid": "c7c6f5c1-c925-4298-9c53-cd504e35438c", "value": "bd153cb170efdbdb1b1268a5a173f793", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700857941, "uuid": "8826e870-37a3-488d-9e33-8ca6ece47937", "value": "3072:/m4A5y2qi3mDFDauAvP0o6x8kbxphvNIxU5w+qVV:9JXEmtAvP/3CLvNqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700857941, "uuid": "a2d0df12-656a-4bf9-aa3b-d4d01d37a910", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700857941, "uuid": "378cd33f-57b2-46c3-9a42-e3fc41d73e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700857941, "uuid": "8a75f5cd-4741-4893-8063-acf5b5256418", "value": "8a2907164515e339bbe40eaae6871168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a14e986-8a86-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700801933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700801933, "uuid": "3e3a5b64-9689-4cf9-a34f-eff52c4ff27a", "comment": "Malware payload (Smoke Loader)", "value": "d689713e2c880daf649ec894a0761274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700801933, "uuid": "84bb876f-5a9d-4092-8d24-6bca6d8eed83", "comment": "Malware payload (Smoke Loader)", "value": "3d827e587c7f6e0fd92a866370618bd014d45c725dea96379ce641c6f75cb862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700801933, "uuid": "e3fb3de4-ad6c-43d4-9992-df3a87955c5c", "comment": "Malware payload (Smoke Loader)", "value": "52c82f76cf79f616dabb9ec0aa91d14c95f19fa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700801933, "uuid": "8f7e96f0-5f22-4954-90bc-5a1189862bcb", "comment": "Malware payload (Smoke Loader)", "value": "3b64709df829762e8eb049b0bbd21f7a669de1b62fde7eb46b47b12358947c0bd4d098481798e8cc1df82fe5c5d38459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700801933, "uuid": "c220696e-287a-48ef-a909-5cda92d8f4a9", "value": "T1816622ED2648735CC05F8075D023E8D3A2B75E0FA9D9A59A72D6FEC033BA7309605B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700801933, "uuid": "e508df53-4e2e-4b85-a591-d1cfc3ecd7b9", "value": "ee26deb5354c4489ff0dc7547168b2dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700801933, "uuid": "eb2bea86-b940-42b9-a86f-11f77965b9d1", "value": "196608:zy6KNPftIQbD/RB9R+27xwOP7O1Cle4ppODra:z/+fmQbDJ/B7xwO61Cle4ner", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700801933, "uuid": "62604cbb-910a-4f49-87b1-7d94d81a77db", "value": 6502912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700801933, "uuid": "e54e22f8-4e28-4e98-b9da-efe86570a66b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700801933, "uuid": "f1c3fd14-36c8-405d-b133-55163093954c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fad08bd-8af0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700847576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700847576, "uuid": "0432b00c-e2f0-4eb7-b901-03d592be22e7", "comment": "Malware payload", "value": "4fabd56f994ee77c3b6c5801af8c1ad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700847576, "uuid": "b64c0f7b-88ac-4bf0-8b5b-c4540ba63c4d", "comment": "Malware payload", "value": "3d9a35553412df33fdb411308a79fd2858d9c51ec73a1ce46751a35839fb58d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700847576, "uuid": "e581000b-ba6a-4cf8-8a7b-a76aa5591901", "comment": "Malware payload", "value": "034f29159d5bb146ec5acad4fa1e2a0524ea7c3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700847576, "uuid": "8348c1b3-40d2-427d-b1b1-72d589245ae7", "comment": "Malware payload", "value": "d14e29efcd33fc6a3a149d885d5687fefb4b8bb18cdbfe709068ffd068a0526c802e36e7d37c9be6ae81d9efc7dd1910", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700847576, "uuid": "f0272e6f-bff1-4460-bac2-6a13ce20142d", "value": "T18315E12822B40F99E8BB53F5896842051BF6BEAD503BE39D5DC170DB0E71B815A07B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700847576, "uuid": "2689e01d-3307-4569-86fb-108fb945992e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700847576, "uuid": "17109791-a13f-47cf-83be-5fde83e3fe0e", "value": "24576:pAtD/61rgywSbU5T3NUQ7yTSSiSW0FTyjP+ENasJ:K611enVSNDp0FJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700847576, "uuid": "e721e198-8cee-4653-b4af-64d40154a746", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700847576, "uuid": "3602f8d6-c2c7-4f8b-a776-5d699a9e0e8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700847576, "uuid": "135c7c3a-ff30-44c3-8997-31f76cf37801", "value": "SHIPPING ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcca06d2-8a87-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700802608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700802608, "uuid": "59e00056-4bfb-402a-a359-612df32789b3", "comment": "Malware payload", "value": "b23e772bec21d16a46ef8a398797aef9", "object_relation": "md5", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-12345", "colour": "#244051", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700802608, "uuid": "1c822e37-c9b8-4226-ab7e-5044e32578cd", "comment": "Malware payload", "value": "3fc46463c2e8fef258dbfdf8637e075cebee2fbec69c1a80ba2cd2e123abea42", "object_relation": "sha256", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-12345", "colour": "#244051", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700802608, "uuid": "9ebc0236-121b-4866-bfdc-a83762ea600e", "comment": "Malware payload", "value": "2f1853aad33bf0e947349d3f83f5ac311a15d40e", "object_relation": "sha1", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-12345", "colour": "#244051", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700802608, "uuid": "82ee64c4-aaf3-435b-b789-0b2f3e73dc4d", "comment": "Malware payload", "value": "4220881a35645afcddde6a985e59c75659d6a9dacc751851be47136a93506a984f4b455296810fe5b39c6e19453f4469", "object_relation": "sha3-384", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-12345", "colour": "#244051", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700802608, "uuid": "d77dc695-7598-44b0-91c3-ee979e7bb452", "value": "T10BE53346E50F99F720D7D8030B5F6551A6CBE430C3AE2EEA714259CAEE1D50FF31A228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700802608, "uuid": "e3776d47-3535-43e3-99c6-4ef9e67e3344", "value": "49152:eeZauxOALd19CaXZ2wzgJC7XBBxnCqViGP2Zmh9yKXtZmCnJf+SkFcjY6eWkiP0I:eeZ7xvLdLCRwz57cqVtPmmhFbmCnJfDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700802608, "uuid": "be39cfab-d8c0-4f4b-b807-33c0e9b0ed6b", "value": 3062135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700802608, "uuid": "f82c7e89-cdeb-4f72-b9bb-2c99c10eb87a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700802608, "uuid": "f89bf325-85b9-4af4-8ead-6c25610b521b", "value": "Photo_19.10.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a97220-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864249, "uuid": "74813e55-55ee-4643-b14f-0a1cec2a22e0", "comment": "Malware payload", "value": "d5e491ac4e82a0e6f27c831f2c9c1693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864249, "uuid": "7d63b3a7-bc66-499e-8f7d-424168fc5944", "comment": "Malware payload", "value": "4087a9b62568bc1b5b28f3e797a98d0e7adbe1ad699a85020b7a1bf89564a961", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864249, "uuid": "190d7d45-df9b-4c5f-803f-7d0c4b8b405a", "comment": "Malware payload", "value": "a3314d65014b41e60c30385feaa8f8d289450e34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864249, "uuid": "2d2542dd-5cbd-4ea7-bd60-eda73016df43", "comment": "Malware payload", "value": "bbfc9eea954659c93ba44c65a5cf37584570759e85285ab37a059ecb95db80a1212ec07562c0531bb553b15f9f1cee16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864249, "uuid": "2e275373-e47c-4921-a9c2-e0f984a9a551", "value": "T10B05125A2739289FD2914B3B8156A27CA2B4C9B5BCD79BC347616E3FBF2E3840DC0415", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864249, "uuid": "79888fe1-bef6-49fb-81fc-0b25ad482ce7", "value": "37366700dd7a367e4c9fd0ceaeed80f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864249, "uuid": "a5b140d3-3d65-4e3d-a35a-c7f1cefe9407", "value": "12288:Uz6c7ohITybPJLF2j6wjyttsYsL79eGw6S08QcHNtXpnG5Pre5iDsJtR:X2E2ypxttB27YSS3QcHNtI5sigR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864249, "uuid": "2aedf84d-bc35-49c5-adcc-a4b3b9b3df99", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864249, "uuid": "78d15193-2930-41eb-b512-4cad08c6a1b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864249, "uuid": "4d49d340-4c0c-4d2d-982d-496a88c096b8", "value": "SecuriteInfo.com.FileRepMalware.13355.4308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6f3baf-8a66-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700788243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700788243, "uuid": "5f3e054c-8510-4014-af86-eecafccab172", "comment": "Malware payload", "value": "306f93131b9fbe1f0d98d3e421ef08d1", "object_relation": "md5", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700788243, "uuid": "464deec2-267f-4a92-bb3a-f88ea1788934", "comment": "Malware payload", "value": "4389f6fbbb6ecd15f872e419ef8e92bcde8c99e1d6ae98609c4cefb88aba4253", "object_relation": "sha256", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700788243, "uuid": "e0922ea3-1d8a-4b70-9c7a-ddd63bc7cdb5", "comment": "Malware payload", "value": "5e9493fa6dacc92969d869ffcd57b40ecbedab90", "object_relation": "sha1", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700788243, "uuid": "1e7fdde5-9bca-45e4-9af3-64dcfcca6d32", "comment": "Malware payload", "value": "ee0f894f39b9dacb9813772a59ad22867d907017802f4e9ccc3e35cc2734b492a064577d5aada6c6442ffc5ada8c97ba", "object_relation": "sha3-384", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700788243, "uuid": "bedd8185-b719-43a0-bcf7-5d791c1d7ec5", "value": "T1B32733B448E4BF0E8656A1937BB02128BEC9715E18D67D4447B7EBC48DB29E413CD88F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700788243, "uuid": "4451a2a0-0f42-4750-8adc-a73ee14476d6", "value": "393216:LZieBw/8RXjVixKWACmJsXVCL2CN7jf9ueoRNQNEy0Faki:LZi67RMKWAFsFCL2CNneqV01i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700788243, "uuid": "f5ac0aa3-8814-43b1-a4db-fb51352c3c46", "value": 20418748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700788243, "uuid": "c42f995a-8c1a-426f-b989-377af9dabee7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700788243, "uuid": "654dcf06-e9ff-4210-b977-aa94c1ad0825", "value": "m.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882bb269-8ac3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700828290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828290, "uuid": "4d44015e-4e3d-44d6-9468-7bcb415d860a", "comment": "Malware payload", "value": "5614500771a42b393212dfe60d28ee08", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828290, "uuid": "6c808304-12ef-4a80-bbef-2a2402f3f606", "comment": "Malware payload", "value": "44db8442c2c89ec84cb4b6d3712f79399cba4b1530ad2afa95ae38aa9d6165d6", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828290, "uuid": "584ecbbd-ee0e-44a2-8c1a-05cf85875b78", "comment": "Malware payload", "value": "e38af6dc85ae1c42c398ef2d29f5ea05a45b9836", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828290, "uuid": "068d044b-513d-414c-8ef0-cdf1e1804ed2", "comment": "Malware payload", "value": "e122465a749b3a41b5349b3d1a17e6a574aa52407bdd8e1f614d3d4c11dceb7a7e4663d3689d9a0b97eb1aa18a60770d", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828290, "uuid": "c5848ea9-f05c-4dc7-885e-dc8bf916a112", "value": "T1FA161712AA968225D47E0475CDAA52ED53307C285F104EDB73C87A3939F32E17E327AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828290, "uuid": "89fb63c2-431f-4dc9-9588-5c07f93f5848", "value": "6805b9d9f17bc82a9e79068d20b7f163", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828290, "uuid": "6f968dad-2d8b-4e12-89fa-ce57f74cd949", "value": "49152:nctar2G5D6OZgeihsiPBZGugXX37tv/iaSeGDEDnfs5haXIMg2hyg/mWc2LbG/kJ:Sa6yD6etih5PBZGrf+qIsorru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700828290, "uuid": "d2d3ff0e-ba36-454d-8e1e-ad5d0efcaa5d", "value": 4196352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700828290, "uuid": "4f9ff6f1-c50a-4979-af4f-ad7a65b985b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828290, "uuid": "819e0a91-e50b-4f1a-9ba7-17cb8854b095", "value": "1700828287b5490a64426f12e65121aafe8fdd0b56ac5c95942a699c213e307e3786eccb7b558.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed4729c-8a91-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700806665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700806665, "uuid": "3df87dc7-049a-4d57-b729-c8bc8e6109fe", "comment": "Malware payload (AgentTesla)", "value": "83726ea819b5cf98ef92932f2eb3a6cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700806665, "uuid": "a074792f-0769-416e-8b45-6ff72cc5acf8", "comment": "Malware payload (AgentTesla)", "value": "471cc066a5f5828095b8a36548de488db6b0c06443f2d295cc7268910436eda2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700806665, "uuid": "c60fc0a6-c088-49cc-8003-b78a4a8c12e4", "comment": "Malware payload (AgentTesla)", "value": "b20c4f47b742194d1e18dfe75155a017ac131a75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700806665, "uuid": "cd45bb49-9bdf-4897-849c-8da4dd6ef0e5", "comment": "Malware payload (AgentTesla)", "value": "6002800b39f99c31c142e68706d74a9ff1c7770a1abe1bc1f86c7996af1af015d3849f2b72792baef4aac40ad2afaa45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700806665, "uuid": "bf3c9173-afae-4143-98c5-38e18d5708bd", "value": "T1ECF4F43D1B9E0667FCB9D6A7EFD0812BF061AAE7F2099D24D4D703559302A02B4D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700806665, "uuid": "df4d6ee7-986f-437f-b05c-ae03c4a59355", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700806665, "uuid": "02fcaa19-63e0-4371-b54a-beee4bef57cd", "value": "12288:Y7Ba/mFiTEJ0+0OR8FCkoMOPHl4Hjo+xOBwf7mbO9H675vKjVCtqDXMtX9gbNgHh:BOP6HMP67YO9Hy5vKjVCtqDXMJqbyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700806665, "uuid": "4a944005-b996-4f5c-bd3c-074adc5b7d34", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700806665, "uuid": "43b6d853-bc94-4350-ade6-b9d987ceb8c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700806665, "uuid": "c35adf10-32d5-4002-ab7b-6c95472eaa7c", "value": "83726ea819b5cf98ef92932f2eb3a6cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fdfc37c-8aa7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700816277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816277, "uuid": "e3e9a847-3e68-47a7-ba55-941328c6cec4", "comment": "Malware payload", "value": "3cea7e107e29e87a03fa5be3702703f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816277, "uuid": "0d0b5d19-a294-4c86-9f61-2d7aac536fd5", "comment": "Malware payload", "value": "47a04664a365c39d370aca429a736ec4e9cb971a3ebee07de1034889e26fb900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816277, "uuid": "a2ae3d16-b462-49f2-b9aa-6ebf6a6769e3", "comment": "Malware payload", "value": "860cb2dd0d360108ab36d3c365ad0b2cbd28f449", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816277, "uuid": "99b5830e-9ab8-4a56-bfa7-9da509515630", "comment": "Malware payload", "value": "a28cd61727a167136d9f06bd4b2a107d1378492e226a952b94141588e79007dd9863598d4e21dd00b7b1fad920d79513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816277, "uuid": "ccc7c417-1af6-4739-ae75-616b8f33c1f8", "value": "T12626DF52D3E4410CF1FA2B3599B146D81A327C51E97DCA2E0618790E6933FCF9EA1B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816277, "uuid": "5956aeb2-be91-4022-9944-10ce9d27a60c", "value": "83a16448cb90e20899e2697682f235ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816277, "uuid": "963d736c-62aa-4a90-acad-179c3291ade3", "value": "98304:v23aQ4a5Y7RCarz0ijCwuCIk/AXoM50I4sAzbfLiJ9T4hX1:v2Fp5AQVwuCb/K50Jwxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700816277, "uuid": "4443742d-dac4-428a-9096-3a4413b026cb", "value": 4634632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700816277, "uuid": "d8b23501-97ef-4669-8af4-39e4ad07c781", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816277, "uuid": "70b27207-82b9-4896-a422-6098c22eb28a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d85e31-8aa0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700813421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813421, "uuid": "0011ac88-d8ee-48ed-8253-c3de7c889343", "comment": "Malware payload", "value": "873b7876689b7d2662a16285b58bbe09", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813421, "uuid": "d677407f-1d79-4495-9654-10be6d35eeac", "comment": "Malware payload", "value": "4974467c6d1c3495bbdcb83ceb0cb61770814588f6ea22868483a25d1e0a6764", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813421, "uuid": "c1a9ac4a-4d42-4fde-a812-9a85da05437f", "comment": "Malware payload", "value": "dba314979ece21e27d9a68ecf17afcf32a7252c9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813421, "uuid": "78c1b063-6996-44f8-9477-0dec5cc63619", "comment": "Malware payload", "value": "9e98ffadbb87550f79f8349d4dd93a47dcd915834124c87a7031d239576c1f56f94ad801be89f45c6ff38cdb4338269e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813421, "uuid": "e81ba738-7fe3-4951-b267-6e83e21be5fa", "value": "T1B704562CC74F02A98F52833A9B275E4546BCBA2EF34011B5306C437533EAD3DA1666BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813421, "uuid": "d49d1cf3-3a96-4c0c-aa49-43d314e140ad", "value": "768:HwAbZSibMX9gRWjKq7u7Fs3vjurq6jSTyTA40mGIGACwF:HwAlRIukvirq6jSTqH0mGIJCwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700813421, "uuid": "9f341446-6d5a-4852-aeb7-5c25dad98c6a", "value": 180278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700813421, "uuid": "74fb7106-887b-4c39-9f24-31f1a591b501", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813421, "uuid": "1aab719d-0a4b-4f55-b15d-a1f134c2ac4c", "value": "FILE 372.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc1589b-8abe-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700826101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826101, "uuid": "ec73bf48-d10c-476c-9ede-a384d7e4d5e5", "comment": "Malware payload", "value": "b0aa7f8520765aa377aaf6ba1c7f1615", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826101, "uuid": "b9335a45-b589-4817-8c50-fa7db91e642e", "comment": "Malware payload", "value": "4aec5afac727d5a7f1ac4be75fbf4326ceaae46b611db61d3cc76050b86f570a", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826101, "uuid": "654b6c30-9612-4d45-9a10-4a6bed16cc66", "comment": "Malware payload", "value": "2baa396f54202bfdbcc3e9d435229d5bd6cc7f23", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826101, "uuid": "bea2a28f-1537-4ed8-a320-0cac96e27628", "comment": "Malware payload", "value": "616ed86e4413fca46db1143217e9235df792c7cdedc028e4bbc39f2aad3d6e496f46f48f92a26b203ff402d04b892219", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700826101, "uuid": "98fd6d3d-3981-4dd7-8e39-617691c67027", "value": "T171A1942A03416C4A43971BB79F7B2AF2EE5F56E3394144877000EEB83D94A19F2C7630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700826101, "uuid": "a2df482b-4a45-4230-9567-3667a5af97e8", "value": "96:MShlK9mAnwgs5zTR6EG8YhM5G8khMLLFy6lWw+6IwBrjeCaScwYk29ccTB069VZc:M8leBsVR6n8YhM08khMvFyGBrjeccwYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700826101, "uuid": "3743e54c-c5cc-4874-a062-d8357a6e944a", "value": 4645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700826101, "uuid": "55fc5578-a10c-457a-b4e5-c5580e2fd02e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700826101, "uuid": "745ec230-36c5-4064-afe2-12103e5ca0cf", "value": "Agenzia_Entrate (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e295d393-8aee-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700846910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846910, "uuid": "6bc3f2b3-4053-4032-936d-52906f224d94", "comment": "Malware payload", "value": "b419d8724f97769becff1367e8b53966", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846910, "uuid": "c39eb27e-1f37-4f5a-af8f-36a1ec9a2571", "comment": "Malware payload", "value": "4c98e73ad9fc8d3a97d2bf372165d819c2c9db0fcf1e0fafb742749dc0392a72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846910, "uuid": "6c10588f-126d-4148-bac9-9e249cde599e", "comment": "Malware payload", "value": "58765b51bf6ebee89b085dda047f06ab106b3cbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846910, "uuid": "50d2cf78-da0a-4d22-8808-dfbb2b5ce265", "comment": "Malware payload", "value": "5c315a992777dc62683fc2961136c7467c1264838396da0bf18cee9cb43bbee969a8debce1f44def63b452f9232b0add", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846910, "uuid": "6beaa9d4-ba51-4f08-8ce9-944189d7a88f", "value": "T162E4123A326D9FD7E63B53FA0D30800813F4AF2E4A55D6583ED535CB41AAB509F21963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846910, "uuid": "e7334f4b-6bd8-4d98-bdef-8671d25ff737", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846910, "uuid": "0a4477e7-f462-45dd-8523-cdd4986abc71", "value": "12288:AE6jD/9P5z5gF31Y7BBnuwVl2aUBR9aD/TZTXVKCTENz:AtD/9PhSF3Utz2F9aDdLUcEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700846910, "uuid": "e4116eaf-d96b-4aab-a43d-c80b98a3f3ce", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700846910, "uuid": "83e7a824-e634-4f22-b16a-d5997b348a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846910, "uuid": "f274df1f-e152-4739-a437-b39f66c292dc", "value": "chima.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6351ea-8a90-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700806450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700806450, "uuid": "7ba1b865-e5f5-4ed6-ba2a-fb7fe0b10063", "comment": "Malware payload", "value": "71139d96f11c279007c6d9684d9bb2b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700806450, "uuid": "67e56ee4-ba4c-422f-83b9-51a0fde78f25", "comment": "Malware payload", "value": "4e8bebd67621eff21975545d88aae86314779073170ffdc770cbed4bf04f2650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700806450, "uuid": "c308c3e7-1588-4403-bf6a-061c6f306580", "comment": "Malware payload", "value": "e3116fe2de0d526c0e576c76545c4d6dcc7dea55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700806450, "uuid": "c8e070c7-0f27-4a8d-822a-0e73c7d41f41", "comment": "Malware payload", "value": "bb1149523674b5c75cfe4992cb738ba33d6db765841c1e0bb762a39fca8dacc1cadf23ac9a8d6e911ee3a2e2955dfd32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700806450, "uuid": "0c9e8e33-3fce-494a-956f-e9402f3a5aaf", "value": "T1A14633AE97D0E53CD350CCB4C82F52902532B7BB36394984118D49ACB7663E8B47E7DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700806450, "uuid": "a6b668d4-85a7-4210-b7d2-6f808263956e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700806450, "uuid": "9954ad47-3813-4115-984a-f90b1c31cc76", "value": "98304:LchHMKyDyc70SwAvO01JgBixtqMhlE4f+Ue/czLiRZvcFqhblsXlwagEblE:Ay3l80DBl5f+2QvQus1zgCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700806450, "uuid": "163a4710-be20-4dc7-8458-6748477621ce", "value": 5418473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700806450, "uuid": "f4f7bfd9-206c-47b8-b923-59aa58d7edaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700806450, "uuid": "848fddaa-f57f-4d34-b65d-0affb66300e2", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.7314.13212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3415ba3-8b14-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700863205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863205, "uuid": "f8841430-8201-4f0e-a532-8c4297f34645", "comment": "Malware payload (Mirai)", "value": "bd373debe53d2d20c7ba6570a5c74a8e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863205, "uuid": "7bf4047d-4265-4545-80e5-9dc34f0afeeb", "comment": "Malware payload (Mirai)", "value": "5066a33690a2ce58815611d82e1def66efa61960527d37506e50f7a6c057c543", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863205, "uuid": "07beb0e9-5e27-4a8d-937a-8080f55ec6a0", "comment": "Malware payload (Mirai)", "value": "80cbd2ba75f7f200a096a674fbc78573deaf1fcb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863205, "uuid": "c26c979c-973e-4a30-a398-e4ef488dd8a7", "comment": "Malware payload (Mirai)", "value": "f67b45dc915f2ab69b6244379fc68b3606aba6f144d21ae915f84808efaf2cda1735bc6ee6b5b3b74cb308fc3b253759", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863205, "uuid": "d5b490f6-ac5d-4492-874f-ccb2d2930745", "value": "T137E34A42EA408E13C4D51B76FAEF41493322D765E3DB73078D185FB43F86A9E0E62A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863205, "uuid": "4676cb4d-65fd-4b27-9663-e8a24bc79c1b", "value": "3072:walgM69pe0QmlTvIUdt9mrsplDKZUQQBKXAVanXX+F8JyvSPhLZ85iBMR6yoC1Qu:walgM69pe0QmlTvI8t9mrsplDKZUQQBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700863205, "uuid": "dfe58661-bbd3-4666-9c0d-95c7e6efebe8", "value": 145189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700863205, "uuid": "a0e8ee51-f6a0-45cd-b582-43f8cb717171", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863205, "uuid": "8c7f8db1-ec7a-4df1-b048-ce07a6251f02", "value": "loligang.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11090a44-8aa1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700813487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813487, "uuid": "b16b199e-4434-46d9-8ec0-cbbd21c80959", "comment": "Malware payload", "value": "e8901e5315b8abe21295bdd2bd827d80", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813487, "uuid": "31bbade3-42e0-441c-af0e-64f4fed646d8", "comment": "Malware payload", "value": "51a34883ed7ea9979adb267dce0ca79e5bb3ff2f8ca8d6dfee1642257df78c1b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813487, "uuid": "a3ba9dfa-61ac-4151-a112-44581c807086", "comment": "Malware payload", "value": "c6d3b997aeacf3561f61e019561e6a7d952ce07d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813487, "uuid": "ddd91232-f0f1-4b30-afc6-8e04b905593a", "comment": "Malware payload", "value": "656af8355299e32ae57f9eec544a94eee334606f674eb38bf4f232d526faa4beaaf80b9057108f9e89271759649341f5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813487, "uuid": "e048fd11-e86d-4cfa-8388-683a4995bec7", "value": "T1F6252382AE31EEB8C16493BD087B4F1403F10E845598ADDA0775B9EF666F761031FDA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813487, "uuid": "02b97c7a-a05f-4d3a-b833-6852f3545fd4", "value": "24576:U0tOI6lSwNN1oQR/NYT2P08vlzZPFv6S5If8dBCEA99XQ:UiM/1UOdaF8dBCD99XQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700813487, "uuid": "73dd8938-5e8d-4c36-9cca-88450a3714d3", "value": 1034776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700813487, "uuid": "46c2ab38-36e2-4576-9e69-326af3b0007d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813487, "uuid": "80134f3e-30f5-4f03-a5da-3049f05ef2d0", "value": "Order 080523.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650b0825-8abe-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700826083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826083, "uuid": "65b47d9d-109d-4de8-ad49-a12720eeff30", "comment": "Malware payload", "value": "96c5d824632bd849f9222c611ef02666", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826083, "uuid": "f3a72e7a-7973-4953-9068-6cec9b9c1b61", "comment": "Malware payload", "value": "521d295317915cd4cdd9d54a6dc5d502ad07b1f32558228da9959a40fa4edea3", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826083, "uuid": "6c771f24-d882-4fa7-94a4-d1c4667ecece", "comment": "Malware payload", "value": "2ce6e684a6222a597fc73d8d7dc05683ce0f0510", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826083, "uuid": "8f87c34b-1da1-47da-a53d-1d068a9ad2b7", "comment": "Malware payload", "value": "7bbf5e00af05fb4cd34d290f3efd01d5fb2695dd40318fe642f4a97de116bcb3d038512722496b07ddefd7954b27b678", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700826083, "uuid": "81eae990-9606-48f2-b85c-fe0ef052ae84", "value": "T19091669872D8E48403AB13A3BB77B0C0FC5E65A338506447E0405865BE61716DEE4B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700826083, "uuid": "40812f04-8439-494c-b7b6-1e29096e2120", "value": "96:YbWktmACJiCKeIW0YDbID0YDGsPbX8DIv2Hns98/ap7+oNi8edasq9BwlRO8+XmU:YbW4AiHeIW0YDbID0YDPPbX8Ev2Hs98i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700826083, "uuid": "a2466e73-b164-479f-903d-3f4d7d0b076a", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700826083, "uuid": "4698323c-4d14-4e0b-b274-f80fe6078e8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700826083, "uuid": "5c0a64b4-bcdb-476f-9329-b7857e8b1a68", "value": "Agenzia_Entrate (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822fcf62-8af7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700850614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700850614, "uuid": "0605667e-7e6f-40ca-ae0e-89388d30418f", "comment": "Malware payload", "value": "16c3480080df33e4c0c15fec767751cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700850614, "uuid": "d59a83da-e9b2-49a8-830a-6a3907c129e6", "comment": "Malware payload", "value": "5296d5c3990b7662dcf037851ca21b153fa667553f83976b21d1ba6867fb1d26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700850614, "uuid": "e9e7161a-8810-4769-90f8-c013c2bb7c06", "comment": "Malware payload", "value": "5c0e3c892ea09ffc6c49752049b8fab96732d49f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700850614, "uuid": "8c73b6a0-0660-4a9a-be12-fb6a4ea97adf", "comment": "Malware payload", "value": "6e2a6a8f9c2847146bc0a0d2fa00c60827bdbc58cd79e12a726b2a7724b543cd045afb27dca6bed0907019f485911e97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700850614, "uuid": "48f10e65-0406-4a2b-b0b3-7768ef6c434f", "value": "T178757D01BBD9D95BD45F67B3A4B703244BB4ECCA6232E74F0A59639A1C523252C063BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700850614, "uuid": "719d4048-5499-46a8-b7c4-87118233a8ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700850614, "uuid": "e4eb8b13-e907-4663-91a8-861189bccc89", "value": "24576:8QCsQ2u2UOGOgfa4POSvVQthqg/ipIGElgvlT16PTrchacMv2JXkoydp:8QCsQ2u2UOGOgfagvVIhqiiAlQTeoyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700850614, "uuid": "33b2cf64-1793-4534-89ab-6ac53b6ac11a", "value": 1602096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700850614, "uuid": "2c507fc8-fbe6-4696-8c73-9dd23510592c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700850614, "uuid": "20c63e23-20ed-4bb3-aecc-1209da0cdef4", "value": "PO 1290-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21c47fa-8ab3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700821596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700821596, "uuid": "a5f8d844-50f5-4e94-99d0-44100b670a69", "comment": "Malware payload", "value": "c1ddea7e06d9aa3b7c02583825ea56e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700821596, "uuid": "29b3aa13-3b12-4ac1-8611-395ae3f5b341", "comment": "Malware payload", "value": "54eba70ea6f9d1ad08f90dbf65f5701ed0838782a66ebe2a68730d129822e905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700821596, "uuid": "c365ee5c-687c-419a-985b-3b79c5281a2a", "comment": "Malware payload", "value": "b953e47554d91f1115d9ea59e9c2f96e225998bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700821596, "uuid": "8fe946cf-c18b-4aa7-8bdd-af43269ac4fa", "comment": "Malware payload", "value": "fe9e601de12d85b280c4e4ec07aed262e02c4855b989e289fe465daf784ef5860b553d1537290830422570cd4c1c2428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700821596, "uuid": "8ec8ea2b-f2be-45d0-b862-43c9d8e22047", "value": "T1F24633AE97D0E53CD350CCB4C82F52902532B7BB36394984118D49ACB7663E8B47E7DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700821596, "uuid": "cb073b5e-065d-4c2c-b55c-202b6e29e898", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700821596, "uuid": "0b99d798-2663-4b55-94b4-da3f831c7ec6", "value": "98304:SchHMKyDyc70SwAvO01JgBixtqMhlE4f+Ue/czLiRZvcFqhblsXlwagEblE:dy3l80DBl5f+2QvQus1zgCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700821596, "uuid": "581fe03d-c0e0-4c4d-b73c-a07e1eec0e5b", "value": 5418473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700821596, "uuid": "0a861689-3b3e-4482-9070-443cdc6abf9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700821596, "uuid": "87f821b6-ba2a-481a-98f5-bb7ee4f7afa7", "value": "SecuriteInfo.com.Trojan.Siggen22.14944.10582.22721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492ed833-8a98-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700809716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809716, "uuid": "7d13d1c2-5b5a-44a1-a396-fb9f534f2a56", "comment": "Malware payload", "value": "bedac42746c2b83bf0b4238c72271346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809716, "uuid": "bf1a74e8-9fb1-456e-a376-ed350ac65237", "comment": "Malware payload", "value": "5628951705135b7582a7913c52cc3c547b50a6a9badc656351b8b7945b1d8d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809716, "uuid": "bf7dd4d5-dd27-4ac2-b4ad-a16068249949", "comment": "Malware payload", "value": "cc2ed883609ffafcaa77eb4738d1b7fbdf0a0ffa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809716, "uuid": "d49e38bf-7b81-407f-a6b3-c9fae23fd134", "comment": "Malware payload", "value": "6c4c0f27163b33e972d33af0dc1119d70e3e1f9fceb360ee79cf38587c723fa29ff5e883abff0e6efcf26c03c3a41f25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809716, "uuid": "fc69991e-2dbf-46d3-bc3a-4a594725d3bd", "value": "T138445A3375E0FC21C45287315F2C96EC7B6EB8619E649B8F26582E2B69302F2D677311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809716, "uuid": "a8f5e19a-b9a9-4758-aa68-ff7ea946120f", "value": "26174cd618191e0f458fd2f9d0ece6c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809716, "uuid": "0afd1642-d1fd-4406-b4f2-1e8225c02311", "value": "3072:HKtk4b3BOGMPMbKRzsraTsFg6KdmxaNDllCVlINC5Ru557qAo:qOKROGMPMbKurPomWhMrLChV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700809716, "uuid": "721d2dfe-b8a6-4140-bc5f-ba8173298372", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700809716, "uuid": "c8aa7c1e-3316-436a-8fae-bd13404640a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809716, "uuid": "0abbe06f-cef7-4cea-84ad-a05f5ee78564", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9ee192-8add-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700839407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700839407, "uuid": "704e7184-9e3a-4b16-9677-d919bef9310d", "comment": "Malware payload", "value": "9b658afeff1fd350f65ea0d1175216ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700839407, "uuid": "10a1acbc-da33-4606-8090-232e5cd4af65", "comment": "Malware payload", "value": "563eda16d6151e21417ac5cecaff3c533acdce1304ca1f042c52d86ea60d24b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700839407, "uuid": "2c87427a-8b4e-42a5-bb49-73dc5d4ad0f7", "comment": "Malware payload", "value": "6f67d3bddf8dd41da28f471c8b9b83175f96220c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700839407, "uuid": "cbbe7e38-1007-40e0-aaeb-3fcc228b8976", "comment": "Malware payload", "value": "9433c0472a66baff55d4b2a575dd908fa697d26bbc9e70b7c27ba9a597e85cbee3671aa36a7b5d0f7e33cc099266a0a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700839407, "uuid": "f36eb6db-c88a-4c7e-aebe-e36949f048fa", "value": "T16136339330516139C4B1683284F643339636FA3AA1BFE1B5698D09DDEF93EF46108B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700839407, "uuid": "d83d4ca2-d411-4f08-8118-4391aee9b240", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700839407, "uuid": "02c82e90-e2f7-4d27-9e43-f2a918212034", "value": "98304:Ad3L0TpNwgdnac+LdvXVajAqlxgc92ca6Qc3zQxHI7Fya0pYrAKlE:M3Lq6gdna/raEqwzca6QcjDopKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700839407, "uuid": "e2a4b040-a7e3-4d7f-9b16-af4d7191f3aa", "value": 5179704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700839407, "uuid": "a507ca42-0462-401d-9642-35b33263fe70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700839407, "uuid": "1696ec23-f172-42e4-a8cd-f6bde2fead8f", "value": "SecuriteInfo.com.Other.Malware-gen.16437.17908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60455282-8ad2-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700834665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700834665, "uuid": "e6244080-efe3-4d95-ad34-61cecf5888bd", "comment": "Malware payload (RemcosRAT)", "value": "2fb8c581cf0bb31a95221b308d654e06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700834665, "uuid": "145faa99-557a-45b8-ab75-9e268f015b35", "comment": "Malware payload (RemcosRAT)", "value": "5883f823c20dba07b8340163a93128f2b056805c441ad7a7162d139e82c503b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700834665, "uuid": "2986b505-6ff4-44c6-b713-252fa9d707ea", "comment": "Malware payload (RemcosRAT)", "value": "7415c98c6355db123a7960bc0435a01228df5766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700834665, "uuid": "3285216b-8381-46c4-94e4-f87418989bbd", "comment": "Malware payload (RemcosRAT)", "value": "5f67c3c5b327c5a5e668b446bc56da3e8738df676d693fd41a5895e7ba9210ab7d26ae344af66e94954a3a35e73020ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700834665, "uuid": "f9d630a1-a2dd-457c-a5b5-e4adc5d8dff2", "value": "T10CB49E01BAD2C072D57514300D3AF776EABCBD202826497BB3D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700834665, "uuid": "d2b535bb-ec98-47c7-88a2-91cecee050de", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700834665, "uuid": "af7eff64-9ec3-4e33-a9d4-48cd51cdaa9e", "value": "6144:+/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9gsAOZZuAXec7z7ov:+/uPq3AfK496Gw0lwGXN3pvs/ZuW8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700834665, "uuid": "1ae0ff6a-29e0-4be7-aade-d9b927573c54", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700834665, "uuid": "12c4385d-4e0e-40ea-898a-a906c84d5ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700834665, "uuid": "3ffef170-7751-4eeb-9a76-f638f405817b", "value": "xpKemuNsr6Zc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439df54b-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864252, "uuid": "c8bcc4b4-015e-4f44-8f62-0229574c3d87", "comment": "Malware payload", "value": "1010f2576e4eb5d2af36fd8ce9e5adf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864252, "uuid": "32a32ada-184f-41b2-b500-ae1e777ef789", "comment": "Malware payload", "value": "596c0b0f7b5a610f19de379f56720e33cc832ff48e5498c72e0608a7b2cd95cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864252, "uuid": "533175c8-6eaf-4f21-97a9-c22d10fced2e", "comment": "Malware payload", "value": "bd7fd278e427b75b0fd7ebe0000ae3506c711e4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864252, "uuid": "976e66da-5501-455e-b7fa-066e69211720", "comment": "Malware payload", "value": "ef443f6fc74116037ca27790512927a4449d06d787113eeb6d7505905e6722baded2bd061665da78d6558d307404db7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864252, "uuid": "c5c30c3a-0ee5-42d5-8a8d-b1f895e0ef14", "value": "T1E5843911BA90C563D8A64B708E2FC6E9781BFA44BC647447B7F61F6C1E386016E32787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864252, "uuid": "d5667fea-6bcb-490f-acac-c0d8b7d9c10d", "value": "6144:Z1VizB/7gy4JXwuj5V8MYdgu2jZYgHHORDB/1j10bEVDx:Z1VizB/0yyh5V8M0gVZYEHORl/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864252, "uuid": "db10545f-cec8-4df2-b233-c362a4345461", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864252, "uuid": "188ca6ca-f647-4713-ad9b-7e180b63ca7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864252, "uuid": "f91f6eaf-45a5-4d9b-9b1f-5657b04ab999", "value": "SecuriteInfo.com.FileRepMalware.4561.17938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e2eb50-8b0f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700860718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700860718, "uuid": "ed689c67-8e63-4c46-92e1-6602be8b51bd", "comment": "Malware payload", "value": "0558c5e33b58002d17d3c69d32d96c4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700860718, "uuid": "32b9e5c5-861f-4e5d-bd9e-cf73e1f6a5c3", "comment": "Malware payload", "value": "5a08016b7110cf63c4e5fca8976b9afc9d6da94650ffb9e14129b30364e939a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700860718, "uuid": "05d94ffe-86be-46bc-8bec-7ff9ea5e4bab", "comment": "Malware payload", "value": "7fbe435995fa117c374da2ee0eea9bdc271aeb49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700860718, "uuid": "4fa62897-07ce-4864-bff1-a1de65a3f74c", "comment": "Malware payload", "value": "efcd8af3a45021c3c1f958eae4d52ee91900236e75d64b631bec222d1b8d254cba4375c80d213fcccdbaa9e6d28ad089", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700860718, "uuid": "d1f1d5af-0cab-4112-b21b-1288c93f55b2", "value": "T1B9349D1379E0FC61C66747358F2CD6EC7BEEB8215E62834723181E2E5A306B1DA27356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700860718, "uuid": "36ced924-d012-4b9b-bd46-9bde352d212f", "value": "e9ad50bc63efe5521ad556ec46de70bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700860718, "uuid": "740103da-a1bd-4222-8371-666bc30a0849", "value": "3072:LoGF942exhI4DRtIqgBjO28FsH5j1lphTE0qVAyDkdXw54UnV:0O42eT/TgBjHH5j1pTE0US7Un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700860718, "uuid": "eda34506-6e95-4fa1-830a-bee5f7c126c8", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700860718, "uuid": "34838883-b62e-4105-89ca-3240659c64f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700860718, "uuid": "db3b6717-0ddf-415e-ad32-04ea519aab00", "value": "0558c5e33b58002d17d3c69d32d96c4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3919779e-8af8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700850920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700850920, "uuid": "44f16f43-3564-420a-a11b-0397fb062b23", "comment": "Malware payload", "value": "9eaac944695d3b696f6e0451f6c580b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700850920, "uuid": "2c8b94df-96e2-4d21-9cd2-1ad844bab519", "comment": "Malware payload", "value": "5aef45398566aece608ab79365c4c968438ee3c4de238865a266663be2ed849f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700850920, "uuid": "8febd25e-c687-4993-ab0e-a07341cb6baf", "comment": "Malware payload", "value": "9d8776176a12e7b10a80999d2036488478b95790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700850920, "uuid": "bb13ff0d-c916-4ea1-b988-35742562430f", "comment": "Malware payload", "value": "dda94cc39fbdd8bad4c30574bafebf51e66a8fd04ee5772092ded18e95697e22ade1d609785b5da73506cc780b6a2b9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700850920, "uuid": "c49831f5-6508-4c55-a498-69274cbba20b", "value": "T150347B13A5E0FC61C19707344F2C96EC7B6E78617E61877B27162E2ECA326B1DA27311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700850920, "uuid": "7e997c60-cc09-4e2a-8ead-9cfd1fccda28", "value": "bd153cb170efdbdb1b1268a5a173f793", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700850920, "uuid": "67626dc8-ee16-4606-8b1d-c3b2aff81ee7", "value": "3072:hHiegayetvTmbyCBhRD6QVRHrwIB8INDU5w+r/Kb:hoAvKbyqD6QVRH8+tO/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700850920, "uuid": "d1a03c31-4f45-41fd-abd6-8e4e09c85b3c", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700850920, "uuid": "51991915-4c75-4cdd-956f-8eda74c328c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700850920, "uuid": "c3948e88-cab8-4e40-a5b0-494db67b9ab6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9179a3-8b06-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700857048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700857048, "uuid": "a878ad7f-7235-4a4e-bf92-727731e833ee", "comment": "Malware payload", "value": "f82308d0af556753cabd8e43f9be5564", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700857048, "uuid": "a0f18a98-26ef-4412-a0d4-95d4566d800d", "comment": "Malware payload", "value": "5bc25ece9e42d7950942974641c36a70028e1824327b3f162a466251310f8586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700857048, "uuid": "8fa61255-aae3-40a2-a19b-76fa40639f39", "comment": "Malware payload", "value": "be94a0b3256d802677b0ba3786b91c582d1642e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700857048, "uuid": "245ae459-d148-473a-b0e4-8b8fb18a39ab", "comment": "Malware payload", "value": "740b864bf0969e329a46502deb7d43292f1ebabfc90662a730a6148566846a223ec1cc977d793667973b6fcbc73b26b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700857048, "uuid": "61a0b2f6-15e8-43b1-bbd4-3c2c98231fa5", "value": "T119442A003A70A134ED9422B12CB751B50ABB7F4B89698AC67B497FFF4CA15870E173B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700857048, "uuid": "0ca6c8c1-3adc-44fa-8c0b-d2aa150fe529", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700857048, "uuid": "f14ba9c3-fd67-455f-bc30-58d8bd23c127", "value": "3072:b5peTpaEOOOOOkOOOOOOFOOOOOOOOORo3xZYM3RkGKG5OC6ezktCTl9KfBtUje6E:b5+SEx2FGKqOC/zkil45tkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700857048, "uuid": "cce0d99e-ad33-4b99-bd5a-c79e6d7efe95", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700857048, "uuid": "15fb8147-f369-4b82-9c0f-58af43d7b948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700857048, "uuid": "6dab4db6-fd72-423f-be76-dd99102e2a26", "value": "SecuriteInfo.com.Trojan.DownloaderNET.226.26457.22145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d2dae5-8a6f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700792067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700792067, "uuid": "c70648b0-fbc3-47d4-91de-47415af7372b", "comment": "Malware payload", "value": "9984593ddfeaaaf28b70204c90c49155", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700792067, "uuid": "fe0e50c0-376a-48f4-ac33-cbd7602a445e", "comment": "Malware payload", "value": "5c24be203f93789ea77c6a5a7c588e52dce29c25f9f355cdcb3f30c4114e583a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700792067, "uuid": "a94db614-bf70-45b4-9b31-c147b4dd3f93", "comment": "Malware payload", "value": "2d2d486cf2b25a0548c4f1f9d2bf0f7c9ffe2ff8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700792067, "uuid": "560788d0-ce03-4242-bb6c-f31470d3ad96", "comment": "Malware payload", "value": "172778087dcf277a1fb4bd5f7cb08b4cf7fa395fd6231d988681e249af299de7d2543589b49b106d0149bccccd5b1fd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700792067, "uuid": "cef597a9-6450-4855-a0c6-d63d63f10d73", "value": "T155D533567AE38D36D23CC8744FE5A80BD7733D4BA831925015981785EBF21A0631DFAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700792067, "uuid": "aae03562-0919-4146-9aee-5cd8d53df297", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700792067, "uuid": "fc77171f-682e-4132-ade8-927073e7e37c", "value": "49152:U2dKgqFC/iTqHv7bb9NfQSvzZxPQUlsMuiRPzGjNBi+tsvDcRY0E:5ARFpTIXhJ51xlax/7TtsvIlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700792067, "uuid": "c7db727b-2f65-4bdd-819f-d31e7544a0e7", "value": 3007652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700792067, "uuid": "b2db638d-fb7c-40fb-821e-b9c25aab2450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700792067, "uuid": "c128a435-f232-4382-a392-00d493bee2ce", "value": "SecuriteInfo.com.Trojan.Siggen22.14345.25700.26185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ff6604-8a9b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700811267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700811267, "uuid": "7d760560-aecc-4056-a49e-9d8f305a1a61", "comment": "Malware payload", "value": "28826531e8dacd56928090ae7063cb83", "object_relation": "md5", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700811267, "uuid": "2c6a116b-5ab4-4ad6-96da-31527d1e80b3", "comment": "Malware payload", "value": "5cf604ed1b9d5d18625e82b4e727e1fa12b1a3eaf9dde01e3d36103e1d532bbd", "object_relation": "sha256", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700811267, "uuid": "990cb70a-8c0e-4618-be99-d2b4fe8f5e3b", "comment": "Malware payload", "value": "2ed25aa96acfa069ec90efa271ab835edbad9f57", "object_relation": "sha1", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700811267, "uuid": "a9bdd9aa-2bc8-4975-b919-6fb5b87a3f58", "comment": "Malware payload", "value": "7930c63f64449e7a4903abfd7295df39223c138a31f0eefdf0c33212415513eefb10344e7a84b9d788544be9fb7d274f", "object_relation": "sha3-384", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700811267, "uuid": "1eaf3592-e2d1-4f1d-980c-30994cb9a8ca", "value": "T1F9E4338C3EA71D589DD97F19B177228D1CB366653C990B4FCFE2AE241227724E28847C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700811267, "uuid": "c8133570-1e0c-4817-a1ba-75348c3e2607", "value": "12288:ZLTq7346JLzYnXieaW2A/PPD3CdUkQj1YBKn5YRomwL3:9e734QxPWlP/kQCBu5YRoHL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700811267, "uuid": "f3e818f5-45d3-4a1f-8f44-e74ae5245835", "value": 691085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700811267, "uuid": "ea2c7eac-91e7-4176-939f-72080df0da92", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700811267, "uuid": "b0008736-739a-4894-9dcb-d3c77a1505d9", "value": "PRE ALERT NOTICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0de431f-8ae6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700843390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700843390, "uuid": "3f30f843-d5c5-4bc6-9ef1-8e3714e0b8f1", "comment": "Malware payload", "value": "647037f99336a619be632c91194db31f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyMax", "colour": "#69A5BC", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700843390, "uuid": "fc147a2e-88b3-4bfa-8117-6ee42163f78d", "comment": "Malware payload", "value": "5e0eb996bb8b15c4de184678e4cc0b022529d0aaa95e6b42ccf652ff2bd30a83", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyMax", "colour": "#69A5BC", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700843390, "uuid": "44eed6a3-e736-4045-8c34-839607f42011", "comment": "Malware payload", "value": "337adca3062ba7b972248aa51b45118779bd1855", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyMax", "colour": "#69A5BC", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700843390, "uuid": "8aade941-d1e3-48c6-93c9-aa3d13ce2015", "comment": "Malware payload", "value": "e562312cf290891c1cf38c48fb6943a5dce686236dbfaf00998a7416bcee4aa6432759727169dac854fb18975fde12ca", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyMax", "colour": "#69A5BC", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700843390, "uuid": "975f002c-79f2-4fe3-83e0-3ae94af1b377", "value": "T17A06E013EB85CA97D8BA83F16F370DA92A1B0F48C6429AD76420777D2D775C10DC6A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700843390, "uuid": "661475c6-908a-4307-a382-150294df2ad1", "value": "49152:RmzpP0cgwBwBhjxhf0bhY0SbTkiprIVaAWYPvQMX2RpQTOKYq3YqYikLAKzdGGDd:Rmzl0tRTVB75bTkSI5PBKmTnYHdzBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700843390, "uuid": "681c25bd-9510-4ba1-97cc-517a0e43006c", "value": 3952999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700843390, "uuid": "4c4eaab8-f6e0-4b5a-9886-399cc9cdfb8e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700843390, "uuid": "6e1d34a4-7418-4488-bf9a-01bfb7a9f839", "value": "\u0130natbox.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b279258-8af3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700848911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700848911, "uuid": "ba3a5605-b5eb-4b08-971a-7dbc11a8b707", "comment": "Malware payload", "value": "eaf8a00642ed7990b11017e7ef1a3bdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700848911, "uuid": "54e3b291-7022-4ed6-af3a-322b3ea381dc", "comment": "Malware payload", "value": "5e2c00103e36e20eb89234c1220e8235fc9cec5993612ddff5c6da7eb481d832", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700848911, "uuid": "b44ff075-fc93-4f23-873b-29d8d98d2195", "comment": "Malware payload", "value": "cc22f825e1a3e9a308508710f0a1ee4dce189f2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700848911, "uuid": "0cf95fdf-b8da-42b2-9878-23d0beaee31a", "comment": "Malware payload", "value": "76c4abe6d5b65a01f8df8f02fbc67769cda95e988db48a1a8af37abf0bf4b1dfd6d295cfd382ed287372a6ddedbab366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700848911, "uuid": "fadb2d82-8061-4c70-b83b-900c47e82f7e", "value": "T1514633059ED5505EE95D95BBC3C7FE2E36B61E6E4920850BA8943B8BFF37508003263E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700848911, "uuid": "a2384a26-e066-4520-8ca1-1b0925bf1d9f", "value": "1d7b3ec6e021fdb8eb5d7101ac8398e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700848911, "uuid": "a798c9db-fb02-495a-a99d-3d1753a380b2", "value": "98304:CbaHP6tnJEAXLFHnMsf+b31ZPTk0blBdrbCGDjYEpdNj2Or8DwC1dB6M:2aHP6tnnbFHnMZ1e+DdKaj1dNSOr6z1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700848911, "uuid": "9aabdc5c-c81b-45cf-b54f-73bccd0fb76f", "value": 5432072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700848911, "uuid": "486fda1c-4aae-4fe4-b0a3-face62185567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700848911, "uuid": "164a552b-cf28-4baa-bc4e-984e47b59e02", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3f3d01-8aac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700818316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818316, "uuid": "f30ba255-dea8-4a48-9336-1232ca8290a8", "comment": "Malware payload (Mirai)", "value": "4b17bc44c01ed8d7b28450a853ee4ae1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818316, "uuid": "1a67e8b0-73c1-472c-a6c6-18f297dc1f6a", "comment": "Malware payload (Mirai)", "value": "5fb9b18515b586222462a003554f258fc038412510599ce484bf70a49b74d4f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818316, "uuid": "ee8584b8-0c87-46ad-b9b9-d67ea60c0546", "comment": "Malware payload (Mirai)", "value": "6306386aecc0695c85b7c361bf18af86dd9edc9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818316, "uuid": "2877a0be-8e58-481c-81ae-ea42814c70b4", "comment": "Malware payload (Mirai)", "value": "7a7fa3be4bbaf84eb1952e5c28a51cf31914b80c615f36abe49b2d768103102f08dd4d26c53cc99002df6eae7f6a6e38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818316, "uuid": "8d6fcb36-2918-4d9f-8917-8a4c6fd4aeac", "value": "T17DD319C7F900DEF9F80AE73748530806B130BBA645925B37625B397BED3A1D90467E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818316, "uuid": "c8ec3a06-bcd8-430f-b26d-87f3412545d6", "value": "3072:WaiSwkNdmR19Pd/e+CsYaBHysVPjbihLhtIR+ayeN4hDP:t+V/eHsjHydLhtIbyeab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818316, "uuid": "8f52785b-f6e3-49c2-80c4-ccc027d576a0", "value": 142732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818316, "uuid": "eea415a3-ad8b-4489-84e8-cdb859927d20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818316, "uuid": "58fa2188-2ac7-4ed5-b657-ff54fc9ea736", "value": "4b17bc44c01ed8d7b28450a853ee4ae1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f874440-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864246, "uuid": "e875930f-6e0c-42b8-af6d-60a551315c28", "comment": "Malware payload", "value": "972eeb34c6cf3825116d2c77fb20e995", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864246, "uuid": "01390a64-edad-4eb6-bb36-44f3037804f9", "comment": "Malware payload", "value": "61aab209e7a13b2bad82a7fa49ed3c6edce683eb073a5caa935178e331992539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864246, "uuid": "657db634-ece2-430f-ba50-0f4f916e6c6a", "comment": "Malware payload", "value": "2f67d42ee9b6ad8f114fd05f0cf7c3264d6c3bbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864246, "uuid": "1061e715-7f74-42b8-a8a9-e2d0a5d526ba", "comment": "Malware payload", "value": "f0204d97743d8638b0b5058ce5f162a15ed547a7dd44c77612687ca054d83d5345773e60093b72a880535106c2f08e55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864246, "uuid": "f6f5b1a0-d320-4bd7-bf86-a10d0d278949", "value": "T103D55C237A61C0F6C65322305998FA36B5AEF578273D41975FD0AE1C2A31DC2492CE6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864246, "uuid": "7fa50262-d4cf-4c75-9d89-8ed9bb676485", "value": "89ea2e7b677d29da268c376c3029b143", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864246, "uuid": "351e9986-d24d-44c8-99ed-8a15a170a3a1", "value": "49152:WgChmt3dy/bzaE9VKz1lVe82NdmSKxsBd6rhPWIFdtOm+9:WgCot3dyj2E9VKz1lVe8CdmSesBd6BWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864246, "uuid": "c262f57c-c3c3-42c5-967e-f4e2a36fb388", "value": 2747904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864246, "uuid": "b651f1d9-c9e6-418e-a7db-25776ee820c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864246, "uuid": "e76d2b8b-1304-4db2-b5e6-e5e37d79fc1d", "value": "SecuriteInfo.com.SuspectFile.30394.20413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d43d38-8ad9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700837684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700837684, "uuid": "3554a524-ea4c-4c0e-8875-b38a20cae7d3", "comment": "Malware payload", "value": "ee4dd662a858e72220702e7437128e5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700837684, "uuid": "629aa327-1623-492d-b03c-d87f656d6b9c", "comment": "Malware payload", "value": "61fb5f6fc20352e348f5546cee051a153310470b220df048b1b101bfb60454d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700837684, "uuid": "9458e897-ed79-4f25-8658-3ff6ce223b13", "comment": "Malware payload", "value": "e39abedf599afe81c6a1a9c62180f6335d0067a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700837684, "uuid": "284a1165-f6bb-4dd1-a593-9b2c8437045f", "comment": "Malware payload", "value": "1a43735a60ed748de1f4e4ca575aa4c67ecd8ff352cb64031fc263f3130202cd8b0553e3b1ac4e40aec8db31ab0d785f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700837684, "uuid": "2b777eb4-76c4-4270-9dfa-010431d3a8e7", "value": "T1FAB4126572F0D8A7E15287714C6AC13D9AB67E10CC2B4447B3F03F6F7172A82C65BA29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700837684, "uuid": "6a64ea0e-7bbf-4970-a8d3-c9a57a6eed5e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700837684, "uuid": "2949646f-8763-496d-a787-222e68e2ba65", "value": "12288:HMbMhqc1rFINZifjzdN2r6EIzlR6uCyjI:sJ6rFIzifjH2W95RnjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700837684, "uuid": "70141136-9e6a-41bd-8de9-475a1d2e3dd8", "value": 510716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700837684, "uuid": "a7c3fa7f-c26e-4c7f-849f-4f5a62b085a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700837684, "uuid": "05ef4d13-36e3-4467-b1d9-07aabdae0b3a", "value": "QUOTATIO.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c74672-8abc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700825071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700825071, "uuid": "fd8f9965-2d4f-4b21-ac75-87d865e22774", "comment": "Malware payload", "value": "acc4d792bdf4f01ab8abf5909ca17913", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700825071, "uuid": "1dd9c1cf-ea79-4d6c-8ec7-09ff5a79cd10", "comment": "Malware payload", "value": "66642393b2e6f58433e14c240f6f19c43c74fc5ed5603e3431151c92877bfd33", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700825071, "uuid": "b64a5c71-526c-497b-b3b2-276229eeda62", "comment": "Malware payload", "value": "37d7557449cc5dfab7f58cc701e8b169db67ca5c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700825071, "uuid": "61810598-064d-46ca-93ef-9fef1ff6e97a", "comment": "Malware payload", "value": "d9c901883b36aab9db2ffaee0c5963df9ba9be45f2c074892d39aa0f48ea352c3b3d8649dc2ba6bfdede71719d6b478c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700825071, "uuid": "1f1201dd-08ad-4625-bc36-8ab79fbb7a96", "value": "T10BE7334B28DE1CA5712244145EA1E20527E3CEF6B6467ABFB3026F54A0FC9FBF954231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700825071, "uuid": "e20474fb-e4b3-4c72-9133-042bbfe11225", "value": "1572864:XzZRLQtq6GXxM0apcFLiaU3AuH3E3AcJd3A7e3A5HZE3APSz:XzZi5GXxjapcliaUpXEzJd4eMZEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700825071, "uuid": "24f73801-81f1-4cd9-98a7-c874152618cd", "value": 69342943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700825071, "uuid": "c2c05fdf-b6db-4cbe-b8fb-a38d3ff60a35", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700825071, "uuid": "459a309a-201f-4276-b1d9-b47fb99738a0", "value": "E-Rechnung_DocuSign_Signiert.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b40828-8a89-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1700803264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700803264, "uuid": "3c84a4a4-80d1-4f00-aeee-508ca5ae2b0c", "comment": "Malware payload (NanoCore)", "value": "991132ddc79bd645dc6264f86358f724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700803264, "uuid": "a434f6a8-c454-4b81-a5e3-c8403435bbb8", "comment": "Malware payload (NanoCore)", "value": "674427173a5e079caa90209387e6131f19ebafea2f2a0b7c580fa8ea7d4eaa45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700803264, "uuid": "6c2aeae8-649a-4daa-aafb-5bd830a2863f", "comment": "Malware payload (NanoCore)", "value": "9bf9fcfbc256179ffcefaf215ee266ddeb535f0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700803264, "uuid": "4078d3cb-94f2-4dae-9ebd-7f5a30fe32dd", "comment": "Malware payload (NanoCore)", "value": "35cd0eef0e31c42a06e75a44b146edc12c5694a23d1f12648b971c4c37a44854d0a588e7edbbeecaf7eb230ad00a2202", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700803264, "uuid": "9e25707a-a178-4394-bfe4-cdc5aa2f0eca", "value": "T152D4230195AAEB62D1D84FF758F3149B4B71A3963A10FFEC8F8C21EB2616764BB10147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700803264, "uuid": "e9704acd-f248-4701-b096-167d01b310ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700803264, "uuid": "4eb0469c-69e8-43c3-92a6-5741167e9161", "value": "12288:Ajsj3HbgUeFedrkXmew74UCesjuCC37sDiXD/FhfgUT+MzYjMv43xK4ENzQK:dT7gUeirkX5wU31VC1Fhf/vUjMQ3rEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700803264, "uuid": "fd2249de-8ffc-45ef-a837-28f24a736ddd", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700803264, "uuid": "a01c75fd-07e4-4a0e-8544-b514a2bbc860", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700803264, "uuid": "078789ba-00ca-42df-ad00-e7cdcd84517d", "value": "SecuriteInfo.com.Win32.PWSX-gen.3677.14329", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334c2bbe-8a5e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700784768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700784768, "uuid": "698d5647-a36b-49ad-9dad-8dc5a0f5e858", "comment": "Malware payload (Formbook)", "value": "e5c00dbf4c84b7b79bea0182d2dd7e6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700784768, "uuid": "1bec8cae-2727-41cc-8b2d-20e438f70782", "comment": "Malware payload (Formbook)", "value": "6867aea0a81bab2bbdd2f0813185c930ee498c97e99421f3c769dabfad58a573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700784768, "uuid": "e00bddb9-6e18-4d00-8eaa-6769e5761d53", "comment": "Malware payload (Formbook)", "value": "c1b807d74af6551c703299a9ce7756a25e04819d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700784768, "uuid": "a2255bca-b9d8-4a89-b6bb-a0a4d70a644e", "comment": "Malware payload (Formbook)", "value": "8b1a9234b569e46f3bc92069032a233b571c47485171e1a7a4b581dae7f63e87d03655f3e89aeb7dbe8ffc04624be3df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700784768, "uuid": "1ce55440-f7ee-421d-93f7-56f7a54830fa", "value": "T199051255A2AA2F6BE97F53F90938910843F7BDA78273D2496C8270DB8171F514E20F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700784768, "uuid": "249be4d5-fab1-4542-8c88-e0f446bc31fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700784768, "uuid": "19b49203-8bbf-4011-94ec-0ddac69c0185", "value": "24576:gGKjtD/61g2k7SyB8SYjnaTX4iqeo3uagDHowiUQv:st6rk7Sy6Jn44iqe1DHsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700784768, "uuid": "19509772-c199-4a60-8485-a4c31a3982c2", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700784768, "uuid": "87d17795-6549-477b-bb0d-564987deba67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700784768, "uuid": "d2ea4397-9bd5-4d36-9ebb-987cddb5eedf", "value": "BSuHKTQogWYegWx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf37359-8ac8-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700830526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700830526, "uuid": "1872ad36-45e3-4746-85b9-472f0982a256", "comment": "Malware payload (Smoke Loader)", "value": "333630dba693ac270a10c2fcfdfd94b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700830526, "uuid": "cb1b742e-467b-4ec9-adca-68af2eafb08c", "comment": "Malware payload (Smoke Loader)", "value": "6aca6f303788c2fac33351f3ee7298e6fc873d747bf0633c041863ebeebb56bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700830526, "uuid": "16ecef83-90da-4874-b628-8e93487af437", "comment": "Malware payload (Smoke Loader)", "value": "a9b8fc2aacf46859ebee727a2217333a800f23a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700830526, "uuid": "d05d426a-ddfb-45a2-ab80-8f84b4d0d4db", "comment": "Malware payload (Smoke Loader)", "value": "f577e362ff37aea64b373bc262d17c4dd854d5542ae82f743010f96df36213a82565bee4a07b2da42a036d3108f48d0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700830526, "uuid": "a64da623-e916-4800-b030-a15de72a4312", "value": "T1D4446B1365D0FE3DC59207308E2CD6EC7BEEB8215F598B8776542F6A6A302B1D663312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700830526, "uuid": "68eea25d-0f62-4c61-b7c4-9629c42e3ce1", "value": "7c1db49ad6667947e0650b5a549f4e65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700830526, "uuid": "a25c3dcf-c3db-41f5-a7f8-09559ae7e957", "value": "3072:X1W2bBy9IFMXK5eTXjce15VAr5DX13RDZA8er5ROYA4:0oBy96GKwTYY/Ab3NZA8yC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700830526, "uuid": "1215d480-7974-4084-8207-47572efc714d", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700830526, "uuid": "5cf13970-6237-406e-a6b2-8aee9537eb71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700830526, "uuid": "5bd8477e-edb1-43e0-a38b-8f19a3460bb4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f2c8bc-8a9a-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700810494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700810494, "uuid": "08edc5e7-9120-41f0-89ec-42df83710d7e", "comment": "Malware payload (Formbook)", "value": "d400c125c91f0da96b71a1335d5c7e9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700810494, "uuid": "1c79324c-a138-49a8-8d9f-30e4fb9acc06", "comment": "Malware payload (Formbook)", "value": "6aeb335b3a8c4506ba69d98007266a0210930cddabc6d3fe6b6c0a28e59ae7db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700810494, "uuid": "bde12ad8-306c-4b6b-8dba-4678f6488bb7", "comment": "Malware payload (Formbook)", "value": "c5cadd640c60cc5ae5377fa8726c15f38808a131", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700810494, "uuid": "126b3178-07e2-4cb1-97e4-e336a25cb6af", "comment": "Malware payload (Formbook)", "value": "3bad60c43e5767aaf48ac875ed2686f5e9f06ba2e6933eea8b91049d42819d91845e03005a9651347e582da37d3b8709", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700810494, "uuid": "ff927633-ad64-408a-a9c9-d72cdea9b1a8", "value": "T1A8C42305A65ECBB3D9AD07BE15E1108207BDA16A9BE5EE6D0ECC70DECF13B049351A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700810494, "uuid": "f299ebdf-ef43-4ef4-99d4-3bbaa5d2a741", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700810494, "uuid": "2cdead02-db51-4fd9-9df7-1af70db91dcb", "value": "12288:nE+RIimQdL6iHOHpF2hJwy+atu6KVC94MVK4ENzZK:nE+evGOHpKavI4YEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700810494, "uuid": "6dd9dff0-7aab-40a7-b8ae-a33c71071818", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700810494, "uuid": "1979d1d8-c369-44f5-b4a7-88e08a762676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700810494, "uuid": "97f2e033-a3c3-4ccb-aec9-4a50e952d2b0", "value": "SecuriteInfo.com.Win32.PWSX-gen.17323.27284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c81294-8b1f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700867818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700867818, "uuid": "ad5e4135-68d8-48dc-8906-c3cbd1cf7df6", "comment": "Malware payload", "value": "110420eeb8d1004a45bca1a06e214705", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700867818, "uuid": "2ed03472-26f9-490c-af57-3457529a6c54", "comment": "Malware payload", "value": "6afc7d0eea79bfc7721b0299c38c99740b57766a1dee973f8ff7219f3cca9dd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700867818, "uuid": "1e93c527-ce52-4d0c-acf0-1e6c083d56db", "comment": "Malware payload", "value": "a0070b19dcf83a7f630f2a02fde93faac1a75633", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700867818, "uuid": "6a1e5d5d-1aea-4278-a755-cf1877dab9ac", "comment": "Malware payload", "value": "9722b121b502b7c2df353d6b0b8cf1a7956613ac6fc04af25c10e6ccf07a6a8ad97e87b4d23f28c6261cdaa783237561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700867818, "uuid": "4e3e20f3-3670-4582-9554-b17945bed16d", "value": "T176B5334F4496588DE3598A7080F7815C8AF2692750C85E982E7E2E8DFBB3F45CF87193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700867818, "uuid": "1d71919b-5675-4ab3-9e3d-84453d14c770", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700867818, "uuid": "7f05d7d5-808e-4589-99a0-319b2b9bbd49", "value": "49152:vem5fuJPWziYOHvEP4NI0Vo6PMsydVVnG:RduPEQC026PV+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700867818, "uuid": "018cd16f-9fbe-4136-a53c-2fcd58a01d45", "value": 2420232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700867818, "uuid": "b62e0c4e-837b-4bda-a37c-e1fb72e970a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700867818, "uuid": "a89cead0-7f5f-4ab5-8771-99ef067c63dd", "value": "SecuriteInfo.com.Win32.Evo-gen.6487.29370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3703c88-8ad3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700835261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835261, "uuid": "b65aacfc-05d1-4b41-95b8-107c4a8dafc5", "comment": "Malware payload", "value": "a35eccbda9319055269dcca3077ce777", "object_relation": "md5", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-111222", "colour": "#5AFC38", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835261, "uuid": "0e0544a7-d7ca-4aab-915c-693ed4957f27", "comment": "Malware payload", "value": "6b76c534369643ff03d1c7247f54ac312474fa9724a4b1682bfedd88f1e0c0d4", "object_relation": "sha256", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-111222", "colour": "#5AFC38", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835261, "uuid": "4458138e-0467-418c-8b83-b27cea060523", "comment": "Malware payload", "value": "16f2ddd1eede2132cea34332f6407f0e6e5c5831", "object_relation": "sha1", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-111222", "colour": "#5AFC38", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835261, "uuid": "697521e7-8d84-456f-bab4-cb3a0fa138e3", "comment": "Malware payload", "value": "461d786a25fedfb935505311ad7f23721a411d4371d7929d739e719246e2a234dc0807455c765c33061a46504e6c6ef7", "object_relation": "sha3-384", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-111222", "colour": "#5AFC38", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835261, "uuid": "885dbfc1-7084-4762-b110-e1178dfe1814", "value": "T19BE533E7C02105A3F060354ECB2F25589556ED6BAF7BC2FB0D27D16B0A57EBCAD18019", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835261, "uuid": "455a43e0-9eb3-45e1-ad95-36b4b38d5de0", "value": "49152:9wQGjvgggY85+uAVHCrKutm93GaRz+cBla9UCK+6/IubVBeAf0nhm/x54nuP5:9wQGjv4ZeLuM93GaPa6/XmrhmUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700835261, "uuid": "7321c247-ed35-4f8a-8f44-8e62d0dd2194", "value": 3055738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700835261, "uuid": "a4b28190-3cbc-4ff6-b380-059f555bc625", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835261, "uuid": "038aa526-835c-45fc-9c7e-2ed64a9921f1", "value": "Photo19.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f9e8cc-8a98-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700809663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809663, "uuid": "2365e38b-55b5-44ae-b261-589e8e4ef738", "comment": "Malware payload (Mirai)", "value": "fa46d84a02b1e8f1a961a4464fcf35df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809663, "uuid": "d87ca2b1-cb4b-4a71-87d7-f64e91c1f82a", "comment": "Malware payload (Mirai)", "value": "6b8f5e7d4a1073e554d832de01e2619eee471ac4782b36909e6fc47b5a96ed6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809663, "uuid": "5ba54271-7305-4a36-aa62-b7e577d9b6f6", "comment": "Malware payload (Mirai)", "value": "0cbc535f551715189296052fb946d6e02d44541f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809663, "uuid": "2c79b7bb-2c3a-4136-85e6-80b200dd136a", "comment": "Malware payload (Mirai)", "value": "3b962dd2cacb6e608a38397ea8b2974a0b8b6a674ec1842eff0f545abc24b4570a170b13d5eb72d78194f5fed31be4a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809663, "uuid": "cac89abf-c610-4e18-bd29-78cc8f5d1383", "value": "T14FD33A56E6408B13C4D61775BADF42453333ABA593DB73069928AFF43F8279E0E23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809663, "uuid": "9d419463-2189-491c-ae15-bf69e7ae072e", "value": "3072:mhlKvajzCJbI9kBTa0cPo0mRu1zDJ4M/9t9G:mavajzCJbIqBTIo02u1zDWM/9XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700809663, "uuid": "9f11ddba-0d00-4906-b633-e0c71b43eb10", "value": 142685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700809663, "uuid": "d75ac700-3a0d-4283-8d1d-198fc2bbb825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809663, "uuid": "389c1847-f6bb-4ff6-bc22-9855c7e02614", "value": "fa46d84a02b1e8f1a961a4464fcf35df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adffd7c-8ad0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700833851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833851, "uuid": "0359bb8a-0b45-49ae-afed-cd9b457a84b0", "comment": "Malware payload", "value": "608eec042a7a82172a1a3da69adf92d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833851, "uuid": "ccdd4fb3-a39e-44e9-bbc8-c96dd0cfa03d", "comment": "Malware payload", "value": "6eb56b561df74ccd6ce30fef0bc1c5e4b0218be5789befa97d9822113a13cdbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833851, "uuid": "ac3f818e-b443-4633-b1c5-49156ac92803", "comment": "Malware payload", "value": "d44f7ddbc9df36a62cf1ed47466e825a9ded41b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833851, "uuid": "b080028e-32ea-486d-8750-621ff5f7f967", "comment": "Malware payload", "value": "d4a4b629e508f20a4d2e49bdbe5bdc79fbc75b084143dd2af568b3156c7fc9120edf9e9c43bb1a758efbacda7b6f8819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833851, "uuid": "648b3a03-041d-4b6b-9a4d-8ea33d314c99", "value": "T1DD068E45ABD805E4E57BD630C52E9733D3B1B89A0775C74B0A64C3492E73AA34F7B222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833851, "uuid": "116f4887-8729-4fb9-9a97-cf8801e9eea8", "value": "ecd2d185b0dcad29ffdec78c2967ba4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833851, "uuid": "ff1a5b7f-3e72-4a87-aab5-d4440a9cd76a", "value": "49152:VUjKofcx7rY7QQCiy5faUAyEE1A2gFHNfioOCFUhv6:WdaPAyEE1/CFUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700833851, "uuid": "42f0e2a0-aa26-4f86-961a-f803a3ca2e94", "value": 3716096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700833851, "uuid": "848d0b3d-f4e1-4367-b3f9-11b333dc8d98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833851, "uuid": "41956ae1-7026-4a30-a828-b85cc172e104", "value": "60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f399e95-8af4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700849240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700849240, "uuid": "69f695a8-3634-4226-bd3d-7291cb2308e3", "comment": "Malware payload", "value": "6bb48fb086c28a51631ec396ce02b8cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700849240, "uuid": "e7dd2896-8e53-4f6b-94ce-a32640075d72", "comment": "Malware payload", "value": "6f3f9558f25679fdd6390552cda47ccf1f4e1957e4f2292926a3b1b7105e24ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700849240, "uuid": "fa764fab-e141-45db-9e23-26460506414c", "comment": "Malware payload", "value": "0b8fe96967eb224cec2ccf5b1475c1a1b68e0237", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700849240, "uuid": "ed62641f-2358-4a4c-99e4-81a4d0743d92", "comment": "Malware payload", "value": "30e38f79c4693317cfa2c076359d303185072f4ad744230b1294fc10a8cd5b4a1038f91f716030f1355703c62c726d9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700849240, "uuid": "2d55d993-9c7d-4b2a-9ce3-2287333a5332", "value": "T1B934681B61E0E82DC55743754F6DE7EC7B6E78215E60874A33541E2E0A322B2DA63FC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700849240, "uuid": "a10d059a-fa18-4263-9c0b-548afa4f1306", "value": "8bfa66e1ba641763b4c9c427cd6de9cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700849240, "uuid": "63e66be5-eb6c-4e55-a356-b65546782ff1", "value": "3072:pfJCBTu2EQh/Zlh4xJMQW7mc7Lk0YsO6k7cb9/EmpbA5QNb:Kpu2Eu/ZlO9WTf16mfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700849240, "uuid": "101813ad-47f0-4893-a078-497de1f931c6", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700849240, "uuid": "4dc032ef-64f9-4a96-9f9e-5627e274169f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700849240, "uuid": "cdaa4e35-6f0f-45d7-9e49-5b649a60ee0d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91cd633-8aaf-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700819889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700819889, "uuid": "b4701da9-b337-4b76-a4bd-dc9377db9dc7", "comment": "Malware payload (RemcosRAT)", "value": "411cdd684d90023b7de86156da1f3268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700819889, "uuid": "3d3425e1-300f-4bcf-b3a4-7c02c5c4e6ed", "comment": "Malware payload (RemcosRAT)", "value": "72c1f9955cf049df7f685398f377b596adebbd1f79110fbd9771157913a6b80e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700819889, "uuid": "f1f12110-3f3a-4d0a-9430-8949e5d86e22", "comment": "Malware payload (RemcosRAT)", "value": "edef944f0f1afcfee136ce5915b7d72aab7c0ad3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700819889, "uuid": "b5aa5c91-23ad-4c79-b242-75112b1316a2", "comment": "Malware payload (RemcosRAT)", "value": "ec3cfcfea93667f6a6a7eb87baa622791472a6bbf00804278b19e0eb9af4eabbfe0e05d0131a5429c7f8e404a986503e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700819889, "uuid": "590c1df0-6324-4596-8137-8fc56cc6bd46", "value": "T13C1523B1266AD7A7D2BA8BB44BFAA1460336D79F35A6CDF0686D50DE0D56F1043C1303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700819889, "uuid": "3d71d5bc-e8eb-4e7f-8741-5b83be8e6f2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700819889, "uuid": "e7ca7ca8-b85a-40f7-9048-0a7a93b520d3", "value": "24576:ioFVAR3Ui61meL8lc2vJJsxWs3P5JD+cdWTaEN:io6Q/9+kWs3P5Z+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700819889, "uuid": "4a4d426d-ef3f-4a8f-893d-6b0edb1bb88e", "value": 907776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700819889, "uuid": "d327478e-7729-48f4-b31b-8f173a5149ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700819889, "uuid": "0c6a422e-61ce-482f-820e-2c2d71cd1b6a", "value": "K98765K40000.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b147ab-8a76-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700795020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700795020, "uuid": "9926ffcc-ab86-4eb5-bb4d-8f5d9a15b16a", "comment": "Malware payload", "value": "b4ce50927cd3a7ab60d2d6522070cd69", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700795020, "uuid": "7613b54f-e8a9-4c8c-ae00-a8dc85d62c3e", "comment": "Malware payload", "value": "78622732081a2280320cbd61ae9c1cf51061ad534b537cf6010144e41e29bb67", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700795020, "uuid": "524ec6e6-39c4-4c48-8254-18ff84f764e5", "comment": "Malware payload", "value": "e18b3c9b952a6096a34aae2afba7e0a136ef40de", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700795020, "uuid": "739d0e19-7925-4a7b-9519-227da9f282c9", "comment": "Malware payload", "value": "bd4ffd0e8bfb37f3b4ae355fade804b56a1f76863b2699d68feb8df4eceb02df0ca1aad5bd06e19daa1d93b1ad1dbfb0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700795020, "uuid": "5ec0c9a1-481a-4c1e-95e7-d83d2578d809", "value": "T16125239CAB8FFA67C2CD487F92C7A74283B899879343D35AB0C8265550167DB8811FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700795020, "uuid": "e7c78d5f-02e0-4cd4-bebc-c47a11e08ac1", "value": "24576:egdqyM2EJ0JNUkDCfruOh+bTDcogbqQJqvuM4F8gv43VwT:4DKSk2frus+bTDcogUsCwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700795020, "uuid": "1980bd75-1f87-4288-90f5-2307c5bd60bb", "value": 1000448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700795020, "uuid": "b77b2349-60c1-4a80-8ffd-42d5e368207e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700795020, "uuid": "4a05145e-e22e-48e0-9861-e1ff987c8756", "value": "b4ce50927cd3a7ab60d2d6522070cd69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b285726-8aac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700818336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818336, "uuid": "0b9f3b4d-976e-4205-9069-222c623a9242", "comment": "Malware payload (Mirai)", "value": "82597e3ceffa5112fc3780e95bd68f51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818336, "uuid": "2cc7cf33-bccc-44b2-b16b-e36981a6f424", "comment": "Malware payload (Mirai)", "value": "78b3fed61a3737ddd4e751f7f5a651e5793ac3f636f3bb0dabac0cc3cf9f7bbd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818336, "uuid": "e3a83143-fa0f-44d0-ba88-b8d8f4b4e836", "comment": "Malware payload (Mirai)", "value": "2c56a892510f37c6fcf4ac13160371f9a6e88317", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818336, "uuid": "3c3abcc1-ece5-4239-8cef-e52d804e47ab", "comment": "Malware payload (Mirai)", "value": "8ce4d99f7eea54f1cbd1193635fdbc2ada1b29b8d25a9f50cc7163838103f96dfd479c3e14835fd562ff1225ea571cf6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818336, "uuid": "5dbe0e6a-76a7-4e7f-a8c0-c24ff9226bf1", "value": "T182E3D60D7E319F7CF7AD827407B78E25964437CA27E0D681E16CE6115EA028E241FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818336, "uuid": "f6d54f31-2c8c-493a-8c66-6a201b1abee0", "value": "3072:zKfbveex+0YDG9SENZ3osloRe9LYtx/PJ/FFRwSaQ4U/e:ufTewEk3198txhKSbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818336, "uuid": "63555136-3c3b-41ad-825a-05507597b9d2", "value": 144340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818336, "uuid": "7c81e7d8-aae2-492e-b56a-a860d223b9fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818336, "uuid": "1de8dc36-d684-4492-9a49-91e5d62f3fde", "value": "82597e3ceffa5112fc3780e95bd68f51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e439e9-8a62-11ee-8907-42010a9c0042", "comment": "Malware payload (AZORult)", "timestamp": 1700786413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700786413, "uuid": "2538ec44-ddf5-46f5-b293-b3afbd14bd39", "comment": "Malware payload (AZORult)", "value": "8a04e766a005d4962b10caa1f8140e3f", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700786413, "uuid": "a68d8971-5c66-41d7-b0bd-a73f56858cce", "comment": "Malware payload (AZORult)", "value": "78bb56d430c2b8c9298c46d125299f8d29f1bd42a61b07e4e8ba91252c371adf", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700786413, "uuid": "2e96906d-6c19-4d57-90e6-e60bdb093327", "comment": "Malware payload (AZORult)", "value": "b9310f39b6c5f9732d7b7ff45663303ddb07352a", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700786413, "uuid": "b4f7a0d8-a697-4ba5-a2e5-8a32d45b1a79", "comment": "Malware payload (AZORult)", "value": "c6f503dce6be9e20b70262846286f2114042907506863a65190010f81f014596bc3cc2aa36fa458aa12599e1f800f30d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700786413, "uuid": "01f83511-fac3-45e3-8ab7-fd46665859bf", "value": "T1D1B423267E60C95AD45363B2CCB456F2296A9D10C5A8824F25603F5F3AB01508FBFFBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700786413, "uuid": "aac1c768-d818-41c4-9a5b-405cc4c419e8", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700786413, "uuid": "f78d1954-401c-4b7a-871c-0939685b5617", "value": "6144:4Iw3EZ4yutzHG109En9vd9t4A75tEMY6uLUiAb9YzJofmOAhIQF7OxdBTaxXlw5i:iDzHGJ9vnGk5Cj61XYefFlwifro0dXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700786413, "uuid": "a7da3062-65cb-4364-acca-df9405b4cc9c", "value": 520392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700786413, "uuid": "289accd7-40e4-4d0b-ab84-8c48f03f8f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700786413, "uuid": "e6c42704-577a-4a3c-bd01-b1a60f6eedf0", "value": "LPO SHEET #440169.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46c24be-8aff-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700854134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700854134, "uuid": "c779542e-1ab4-47c8-b279-d4ca959c2d41", "comment": "Malware payload", "value": "997657711d04862af2338a6011b755f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700854134, "uuid": "60915cfb-dc15-4b55-b7ed-521ab47741af", "comment": "Malware payload", "value": "78ddcabfd4cbe5bcdf843d77d65d4f5b419c0fe606ca93e39802d279280dde73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700854134, "uuid": "b57077d0-9533-4e31-a07e-95a1b8e2854d", "comment": "Malware payload", "value": "b753c61e85018e9fde85a6dd2e3d4c6189a90a0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700854134, "uuid": "29ba8d84-7848-47ad-9a32-52be316fdc48", "comment": "Malware payload", "value": "d1bc1e2555f8abcd43485a097d14e3681148617937ae0ed4ddd87af9230c363fe2d8b2f10655b4cac7f07330984cb55a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700854134, "uuid": "c7f0e2cf-b144-4640-81e7-2f493e7b0e49", "value": "T1EB659D21FA08C0B7D09211B0916D6A7B95997A322BAF4CD3F7C05E6D01B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700854134, "uuid": "f40253d1-4b44-4b3d-9f90-7c18ee708597", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700854134, "uuid": "e22ee245-8cb3-4a7a-aac0-46637a180fdf", "value": "24576:8N+bPGUvbX8AdjI9Bahe/wz78RaiyhrbnC3OlKekN4srzEhbaLUCKWmRlsSmYTzC:8wyYjI9EheW7WaiUy3V6baLUCmRlnmYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700854134, "uuid": "4900782a-3966-4f71-85a1-78fc993146d0", "value": 1542384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700854134, "uuid": "2c0653c2-f368-42bc-a4d3-002668f8b6ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700854134, "uuid": "a3aab644-18f8-4dd7-befc-be9bfca1348d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b788b9-8a95-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700808554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700808554, "uuid": "51569e84-d1d5-43fb-a60f-f83925bb637d", "comment": "Malware payload (RiseProStealer)", "value": "409e9ff0d1c7a1c92a83d7a9f1fd05c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700808554, "uuid": "00dbf277-f769-4454-afd4-62e7042ad0cd", "comment": "Malware payload (RiseProStealer)", "value": "795d644bef80cab1f28a351919dbc91ab74d079c0850dc296a86abc649ea5a1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700808554, "uuid": "4d29026b-cca7-44e9-9965-59d4b0020e99", "comment": "Malware payload (RiseProStealer)", "value": "85ae975e7a932b1e95c00e5c44ba699d747c0dab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700808554, "uuid": "07000156-5b40-4026-9ba5-dc72db9d0365", "comment": "Malware payload (RiseProStealer)", "value": "839e68ed85ae2cfc5e47a8e5a2c2c2417c5fe4b8cfe0e026e5ab096b3b9c28bcd6a946f83d016f51d9179fb341786b3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700808554, "uuid": "ab19d3b3-5816-4002-90a3-add48cc0481c", "value": "T12A659D21FA08C0B7D09211B0916D6A7B95997A322BAF4CD3F7C05E6D01B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700808554, "uuid": "8c1d508b-dc64-4fec-a1e2-a5257054264b", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700808554, "uuid": "15c4c655-cd89-4bc0-9e5d-732f7a461b20", "value": "24576:8N+bPGUvbX8AdjI9Bahe/wz78RaiyhrbnC3OlKekN4srzEhbaLUCKWmRlsSmYTzC:8wyYjI9EheW7WaiUy3V6baLUCmRlnmYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700808554, "uuid": "b4ddede5-e705-4a00-a370-b974e4f8abda", "value": 1542282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700808554, "uuid": "fbd1d367-a244-4e7e-9491-04b14deef69e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700808554, "uuid": "9c151b01-d8c1-4d1b-972c-e6baa43083c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e37b23-8a77-11ee-8907-42010a9c0042", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1700795669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700795669, "uuid": "0f1e25bc-4887-49e6-a336-6d79528e04be", "comment": "Malware payload (Socks5Systemz)", "value": "ada98c0379e2a53383245625c7a71019", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700795669, "uuid": "ee4f7525-032b-44b8-a9bb-3f3c2733a061", "comment": "Malware payload (Socks5Systemz)", "value": "7ab1f94955138ddbee38c7cadfca83c235f2a4d22c3d9fb99baec7a69085541e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700795669, "uuid": "04e5043e-ca01-46e8-a694-dcb71050375f", "comment": "Malware payload (Socks5Systemz)", "value": "a5bd4c20336d117edba01d665ea009b243b589a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700795669, "uuid": "2ea362d4-3310-40c9-a965-6e1ae66f1a5b", "comment": "Malware payload (Socks5Systemz)", "value": "0a1956e57fabf585fbb4a787d987ed93b907577bcf7c398612a59710648b74a0339e8ce31346c6b843bad2e491e04543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700795669, "uuid": "4e706536-adfb-4bcf-bc62-52103eb7992e", "value": "T1C2D533567AE38D36D23CC8744FE5A80BD7733D4BA831925015981785EBF21A0631EFAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700795669, "uuid": "6e83427d-c483-43ec-89a8-eb6de2c9a0be", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700795669, "uuid": "be0132ef-51cb-4d1d-9e43-9debe07660a7", "value": "49152:12dKgqFC/iTqHv7bb9NfQSvzZxPQUlsMuiRPzGjNBi+tsvDcRY0E:wARFpTIXhJ51xlax/7TtsvIlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700795669, "uuid": "542a1c25-6e20-4313-b485-5453ab62d14e", "value": 3007652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700795669, "uuid": "3cbb7691-ec1a-441a-aa74-bcb4b13c4f05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700795669, "uuid": "2306f1cd-6fc4-461e-be56-3296cb50252b", "value": "SecuriteInfo.com.Trojan.Siggen22.14345.3720.32418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419c1ec3-8aac-11ee-8907-42010a9c0042", "comment": "Malware payload (CMSBrute)", "timestamp": 1700818293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818293, "uuid": "c70ddf03-eb83-4aae-b746-4bfd20261f6f", "comment": "Malware payload (CMSBrute)", "value": "f6c58c6f968a8216b9b92a56bd14d421", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818293, "uuid": "5317d99c-5a4f-4d5f-87d9-dcce3b9f8423", "comment": "Malware payload (CMSBrute)", "value": "7ab95ba29fd65216ae854a664092c3e2c0d7a7986ab8880bee77d3dc74a97467", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818293, "uuid": "5d37fb93-8d49-4f30-adf7-985952c1a7a3", "comment": "Malware payload (CMSBrute)", "value": "0f56dfcaa8eb7f717e737254ed4e9aa3a627e6e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818293, "uuid": "3c0b0698-20c9-4fde-a403-d8309e5876d8", "comment": "Malware payload (CMSBrute)", "value": "815dbbf1116ff407d6f38d6f7952a9b748f0eb269c2679418f58022c0fc2ffbf9a54d9db6a1cc3f19a53563006807081", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818293, "uuid": "7d5fe6ed-b6ad-498f-9db8-0e6028b815c0", "value": "T13095231262F0AC36E6670676DE19C3A477EFB0B18F546B8B33985B3B1A301E2C971355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818293, "uuid": "13b7a76f-f001-4f6b-8393-24beac815d31", "value": "256fc3cc654a45420e670bf949759a36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818293, "uuid": "548164ac-af6b-42be-812d-d86cf8351a83", "value": "49152:52pOlurcBHvEDrzmJGpKAmLWF4GWeNMTzUT0C:cxrmHvGrzmEcwFKeNOU4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818293, "uuid": "f2e88134-6eb1-4c17-95b2-23ca3a05900b", "value": 1991168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818293, "uuid": "a63652bc-1fb8-4b66-ac51-a2d84d145a95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818293, "uuid": "ded106d3-125b-45ef-aebf-e6835a1b8dac", "value": "f6c58c6f968a8216b9b92a56bd14d421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f78791-8aeb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700845488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700845488, "uuid": "68af9f2f-c397-47da-ba62-23cdc168bffc", "comment": "Malware payload (AgentTesla)", "value": "f45729234b3070cca15841c8dd270e3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700845488, "uuid": "be729033-f5ac-47d8-84cc-737cf9588690", "comment": "Malware payload (AgentTesla)", "value": "7b1cce564dc6d5d24828d9bcf583ab5fd64e3ef6574bff5f079a1c2ba9b043a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700845488, "uuid": "e2b3a2d0-711d-4db8-ba36-3060589f9116", "comment": "Malware payload (AgentTesla)", "value": "b0f9369445c6051f2687f2f2cfbb47772ad6a0fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700845488, "uuid": "f31fc1e7-32e1-4d2c-b145-68a4b19dc854", "comment": "Malware payload (AgentTesla)", "value": "4b6d3a21eb67173a2a106ed151dd54504d6ea99f9b7d4608146fd64244c42ecf5a8e1d704b3172405c6097b696697fa3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700845488, "uuid": "2bb727ee-f25d-4ce9-a525-807e62deff84", "value": "T188C423926E5E07A2E0CD8FFA29FB51D207F1639B3D82DBF99D9D12C24882301E557523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700845488, "uuid": "2a0d2abc-42aa-4ab8-af12-e8e4e4caf01d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700845488, "uuid": "32796d2f-910e-4270-aaf1-813f6d01f0ff", "value": "12288:pVO2QejE9CeLN1HsvT7JcThacSLKdQYxzatSK4ENz:pVB49Cj05SLixEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700845488, "uuid": "cd3b28bd-f20d-48c9-98c2-4cf16b6c4e26", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700845488, "uuid": "cbb01570-932c-49f6-b834-02312c3ef595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700845488, "uuid": "3d76c3ad-f287-4a3b-9a2e-6d04c211e149", "value": "REVISE FDA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591519e3-8ab7-11ee-8907-42010a9c0042", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1700823057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823057, "uuid": "4e9789ef-2014-4256-a727-8b359a34c610", "comment": "Malware payload (Socks5Systemz)", "value": "db3debf4dcaa5c7c3f9eec8bc2e8830b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823057, "uuid": "db05febb-9df8-494c-a479-901af301ab24", "comment": "Malware payload (Socks5Systemz)", "value": "7cc71c0b99f8adf4f66a6805a9d3ce285adff22bfc05f382b98b6a6984e88a43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823057, "uuid": "43cb340f-2adc-4bed-89ab-6c0effbafeea", "comment": "Malware payload (Socks5Systemz)", "value": "4217e82495471fee2481d507d1e7de6f0fb3283d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823057, "uuid": "0be9f448-d064-4035-ad54-63ed6ec4b90a", "comment": "Malware payload (Socks5Systemz)", "value": "4e0a340f1d74813685fff30239b43edb5a5e97b8700ef37446f77f3db3a136f46ac79482377e16b2b4559a3f9f7e883e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823057, "uuid": "03510d80-1776-4730-9553-a26bd8f7d30c", "value": "T14F4633AE97D0E53CD350CCB4C82F52902532B7BB36394984118D49ACB7663E8B47E7DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823057, "uuid": "1e900c42-e708-45ee-890a-dc722d6771ef", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823057, "uuid": "6780e836-8830-404c-b516-652b6411bce8", "value": "98304:QchHMKyDyc70SwAvO01JgBixtqMhlE4f+Ue/czLiRZvcFqhblsXlwagEblE:ny3l80DBl5f+2QvQus1zgCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700823057, "uuid": "706845cf-d60d-489b-ac9a-4211fb74e0b6", "value": 5418473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700823057, "uuid": "a9202ddd-f0ea-48cd-b873-d47f906230f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823057, "uuid": "39625cc8-d519-47f3-a381-e7b9f769674c", "value": "db3debf4dcaa5c7c3f9eec8bc2e8830b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fe8479-8ad3-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700835287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835287, "uuid": "8d8ee617-0e5b-45f9-8d93-1a9a1addd350", "comment": "Malware payload (RemcosRAT)", "value": "3dd58f75ad16b66a3c034bae89038393", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835287, "uuid": "624610c8-7868-4507-9b1e-0f6556fc5fbc", "comment": "Malware payload (RemcosRAT)", "value": "7d0094638be40437e64bb472a23d920cde1751b266427028175929b3507bacf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835287, "uuid": "1aff137b-b301-481a-a525-06fa86f60d37", "comment": "Malware payload (RemcosRAT)", "value": "3e60bf43e6e48ff5759e47dc82b81ac47896cbb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835287, "uuid": "d074202b-7c14-4d7a-870a-a962c67e8db8", "comment": "Malware payload (RemcosRAT)", "value": "09f0666d2b0d85780b8ec61d7e0b0a8ad6911214412b90333c5ca7547607dcaba6e993ac112cbc9640364766257f74ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835287, "uuid": "c32dcfbe-3ec6-4a64-aa84-f510862294a2", "value": "T13745F12D62F84F89E4BBA7F58928420547F2BE99553BE39C5DC170DB4E31B801A07B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835287, "uuid": "44afe0d3-2c2e-40f7-9270-9fa579c9badf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835287, "uuid": "af89277c-38ed-4ba6-8f44-24700d684109", "value": "24576:9AtD/61sJhHKLe5MrVUgkiu1agdEO9kTu3VRQX0EN:i6SHEusuIgdHSTulRQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700835287, "uuid": "db35ccc0-4871-47b5-b1be-ccac5efa9794", "value": 1217024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700835287, "uuid": "7a1053f8-256a-471f-a5b4-54cabcd30b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835287, "uuid": "19f5162e-e72b-42a7-a10d-ad43e7819a5e", "value": "fa098765456899.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b3f044-8aba-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700824558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700824558, "uuid": "7d368844-76ae-495d-8545-efa25c493451", "comment": "Malware payload (RedLineStealer)", "value": "404457be5633f688b8d42845b7137c55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700824558, "uuid": "848c12de-43cf-4bfe-8a8d-3efcee74464a", "comment": "Malware payload (RedLineStealer)", "value": "7d969fd0a02104e41e9e377433bde1344c5d919b352184d7de814fe787c95702", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700824558, "uuid": "7325d2fa-1cf3-4a77-923f-84b1fa9425ef", "comment": "Malware payload (RedLineStealer)", "value": "e0efd0b6245e042f9ddf00338108e4c2f55ee413", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700824558, "uuid": "951ba4f2-2967-4429-a526-50c0f4834dfb", "comment": "Malware payload (RedLineStealer)", "value": "6a7b6ab10e2dad1324de8ca6b8c383f3fa3d6852185b79159c9f4a74d7a066cf6b11c09ab5864bf19e8d54f662d94efc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700824558, "uuid": "b6477a4b-12a2-422c-847b-1e684f4d81e7", "value": "T1F454F5CDF570BFA2C94E423584D0813DD1F8501B1A601218F7FAE9FB2B28EFCA95556A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700824558, "uuid": "54df54e4-3664-4a86-b3c4-6834c99256b7", "value": "e9c29461f6bb86a322d0d99982a4fa42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700824558, "uuid": "0d2da12e-58b2-430d-ba98-77429440b41d", "value": "6144:QTs2vSRQwH3/oi4+DLpRCQfw7tWFdw/sZ7:QfSSwX/o6DlRCTt1/sZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700824558, "uuid": "aec8eade-ccb4-4866-977b-deffcb00a232", "value": 296442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700824558, "uuid": "c0e3255c-9e87-490c-a924-1254e884b3df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700824558, "uuid": "7f4a2647-6d94-4063-9675-c10458c304ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e86129-8a84-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700801342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700801342, "uuid": "2d62eadf-0c02-4d9c-8990-3162cf4c7852", "comment": "Malware payload", "value": "81a5b289b4ed6dca68af54ad14a229ba", "object_relation": "md5", "Tag": [ { "name": "404tds", "colour": "#C36DA6", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700801342, "uuid": "9ab4f0af-1c98-4f85-a2be-3d06eca96e54", "comment": "Malware payload", "value": "7e347a488aa085b1939d86488a6d204d0782604c9fad56731054da789b27edeb", "object_relation": "sha256", "Tag": [ { "name": "404tds", "colour": "#C36DA6", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700801342, "uuid": "e969ece8-0be4-4739-ad83-3ebc56754524", "comment": "Malware payload", "value": "5b6818f71a1aab6b61273a638ee28b4f3a3b4171", "object_relation": "sha1", "Tag": [ { "name": "404tds", "colour": "#C36DA6", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700801342, "uuid": "d92b75ef-a2c0-465c-9b0b-6828578ff9c3", "comment": "Malware payload", "value": "b78df1c085c3f41af67125f3a673e746ac6508c37605423b8b25e9ec6544f604518e0b9a036f22975604bb2c0b61b2ee", "object_relation": "sha3-384", "Tag": [ { "name": "404tds", "colour": "#C36DA6", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700801342, "uuid": "f6e80a56-8dfa-4ef1-9437-df93741c45ac", "value": "T1E7F0D4086903D797428FF19623DD898142721D517544C8B625D8DFE00E193345FED977", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700801342, "uuid": "cc5e4d4f-7b3f-4250-a69f-04e9319343f7", "value": "12:7rp+XfEGSK4ko0vMODAu7bvTErcQdD5lVkUWv:Xp+XcBK4YrDAu7EoQBjVNWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700801342, "uuid": "7798492d-f2fc-4d3c-87ab-c9e2818d6c34", "value": 467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700801342, "uuid": "8c810435-5404-490c-9a5b-94511c4192a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700801342, "uuid": "328923a7-7ada-4df9-a848-2b2ab92d4236", "value": "w1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3ecadf-8a80-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700799336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700799336, "uuid": "b384aec3-03a9-4656-925a-b72df6750c4a", "comment": "Malware payload", "value": "63c5bd278108eb7d8051dcf4c7a6bff5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700799336, "uuid": "f341cd88-63c1-4884-ae60-3f07bf46c20a", "comment": "Malware payload", "value": "7fcd09922b580b71af18f4a2e0d54c6a319dd6f266f00a93f25ed25aa2ef404f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700799336, "uuid": "b2cc54b1-68c2-4ec1-87ba-5e070c49f930", "comment": "Malware payload", "value": "29b41a87400d024351d3fc020d8a03c9897e277f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700799336, "uuid": "300b9202-831e-4ff9-8296-5d1ecdfa8e82", "comment": "Malware payload", "value": "dbbc44b153313c192f74b2980d4ad1add6ec101dc0bc53ef75d04e78a25be2a7343ae6550150dc5115dad51797282071", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700799336, "uuid": "47a2b775-788f-4d1e-a43d-2feac3d8c79a", "value": "T110D533567AE38D36D23CC8744FE5A80BD7733D4BA831925015981785EBF21A0631DFAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700799336, "uuid": "df07eb8c-eba0-4f07-889a-8bbbdac768ca", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700799336, "uuid": "d86ec408-8801-4ed2-9195-701fcba5ca85", "value": "49152:+2dKgqFC/iTqHv7bb9NfQSvzZxPQUlsMuiRPzGjNBi+tsvDcRY0E:nARFpTIXhJ51xlax/7TtsvIlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700799336, "uuid": "8aea1402-b00d-47d6-b34c-eae14ffadf69", "value": 3007652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700799336, "uuid": "8e66ed98-2ee6-4350-8a31-3f3c0a566190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700799336, "uuid": "19bdbf65-c9f8-4821-9bde-d3f1a5e23360", "value": "SecuriteInfo.com.Trojan.Siggen22.14345.5198.4120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2107e273-8afe-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700853457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700853457, "uuid": "befd2d5b-9f17-4f16-9c00-2275b207cc32", "comment": "Malware payload", "value": "a96366f2825f46e25e0f5c4a9611665d", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700853457, "uuid": "578f2875-5aa3-468a-b0cf-c234b237af25", "comment": "Malware payload", "value": "80cdae397418d46ed8686b3173f330716f0dbf3b44401d1954693b714555ad79", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700853457, "uuid": "b2e238b8-36fa-4147-b8c8-89c5ec88ce41", "comment": "Malware payload", "value": "5cf6c5cfb5d7d53309a99e9d368e90d725b8a070", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700853457, "uuid": "e2dee5f7-a1e4-43c1-a3e0-042e83a9012c", "comment": "Malware payload", "value": "00fbf3db16a2323379d0195613efdbf375476ee1fc6c341134f49bb27916b8ce99bee08fb5a3fdcec114c5d5722ba833", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700853457, "uuid": "0ae20a72-622e-42fd-b3e1-ceb3fd77d41b", "value": "T19DB48D2CB921189CBA79893AF085265296D44C87F4574DA3F5EE30C44F9A1FC21EFE1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700853457, "uuid": "f2b2e97a-0c09-4668-8ee9-6a01655271ed", "value": "12288:vYrvVEkV9lAnCuQeumA7bamHinE+EqcCnPyP+vPZXPCPP9zs3:vYrvVEkVGCuQ6AtuZrws3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700853457, "uuid": "f8738ea2-4c80-41e8-8b8f-7b0fed33c973", "value": 536738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700853457, "uuid": "d9277815-05c8-4702-8ea2-6fb73f234d1e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700853457, "uuid": "85f49938-fce3-42b6-a564-81a6f3aa2afb", "value": "SecuriteInfo.com.HTML.PhishingMS-ALQ.1483.7378", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51a41d2-8ae1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700841250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700841250, "uuid": "58bc413c-6294-47f1-98ff-aec4a412ec68", "comment": "Malware payload", "value": "37c4b76bb0bf904e91ac2eccc743ce24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700841250, "uuid": "60ec2e4e-e16d-4914-9e48-a062a8b8fe58", "comment": "Malware payload", "value": "823734abaab84186c17d516329241a85f89ef3a15e041264c8e119934167ec37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700841250, "uuid": "d68e0d38-08fc-4951-a874-e2ca1ee4882c", "comment": "Malware payload", "value": "61ecefe75b456168aa0c23aef7eaef05b53053a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700841250, "uuid": "de9bd63f-eee7-45ea-8d7d-e482ea1e2d46", "comment": "Malware payload", "value": "d2c48de423b1225abe1fcef725e8cf8b3f1e93f990a96af9dc77c46006cebb6401f9a39912df848e50d0bf75e0fefe71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700841250, "uuid": "ffca4a72-bb8e-4e96-a703-48ab9c40e1e0", "value": "T133457D2D39C48031DEEA10F74A9CBB7D42ADD0E1072547DFB1A816EEA7621F25B73192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700841250, "uuid": "60a5c5e8-125f-478d-b06e-e3caca6722f2", "value": "87161a064f5daa4a79ca02075d04f281", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700841250, "uuid": "0e2e650e-e29c-49fc-b4fc-2745f36ff3da", "value": "24576:0sAF4ySRcz/GWCwHXsdEhWqephrGrrEC9PML:0MOOWCwHXOEhkpGEC9PG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700841250, "uuid": "191b8f37-d525-44ad-93aa-3f0f525aab11", "value": 1191936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700841250, "uuid": "caba6735-b85f-4eeb-8f51-f894e956d98b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700841250, "uuid": "5d8f5a8a-ee42-49c2-a941-8caf77c8886b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625f18ba-8aac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700818348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818348, "uuid": "9816612e-e2b9-4908-8636-a354a7af066f", "comment": "Malware payload (Mirai)", "value": "b940cf6182b021b48ef6390452e4178c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818348, "uuid": "386b88e1-174e-4ee9-90bf-8c13a666ad3a", "comment": "Malware payload (Mirai)", "value": "830f40dd30494f648f472c57ebb006778788debb4bfd379f4392772be8d3fa99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818348, "uuid": "20cc9478-14b2-44d2-954e-58810abeaaaa", "comment": "Malware payload (Mirai)", "value": "85860d8582c02617c1662795ce388a376fc0976f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818348, "uuid": "13a7325b-6023-4f72-8fcd-ed4a84e610be", "comment": "Malware payload (Mirai)", "value": "11eafe1957b704cb12cb6d012fbe7ffd8532d6a56ddb51acf4efd71c1e0ae3b603128b153b1fd6ac48a6f3fb68ca82b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818348, "uuid": "3b4d5aa3-78f0-4fee-aa92-829569bf37cc", "value": "T1ED433B197A81B67CF3E520BCF02322E654F22F1C6F9DA2E354C2383EEBA05845678D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818348, "uuid": "3463d132-a30a-405f-b2f9-1214b5f5b6b4", "value": "1536:KGLVhRfvOUDX10AstnxbSAR3xgOvmmq39:NVhpOUL10AstnxVxgOvmmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818348, "uuid": "99c59dd0-d844-4e1b-9b1b-592898f31b7a", "value": 58824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818348, "uuid": "41602703-17bc-426f-9bba-b43110d9475c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818348, "uuid": "87466a3d-ee7a-4678-ba14-88a02c0a59b9", "value": "b940cf6182b021b48ef6390452e4178c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b3dbec-8ae4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700842538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700842538, "uuid": "6b3f6b93-76c8-4c76-8cca-1ede5ff394cd", "comment": "Malware payload", "value": "4ca9bce4e80249b5da539dfe0253a020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700842538, "uuid": "d6447652-7c14-49f1-bf14-6bd013e70de1", "comment": "Malware payload", "value": "8317ec6b484bb93b94883e8b9b354121716184ccbfcce47a3f732bed0c8d0a83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700842538, "uuid": "769d0ead-6347-45b1-852b-768395ecadbd", "comment": "Malware payload", "value": "e99fdfabded342687cf3753d8fcce21915a40f7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700842538, "uuid": "5bc9fa7b-06c6-42bf-b5c2-283d1507ef74", "comment": "Malware payload", "value": "bd51e163276b394a1c421ff33a0febc992e6d41749e5c62cbafb38cf6ba06abb9e75f24b8d9a6f5f3641b6c82729da44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700842538, "uuid": "7e90aec7-16bb-4aed-acdd-cb052b8bd712", "value": "T1C9347B1364E0FC61D47707355F2D9AEC7B7E78236E64874A23163E2E5A322B1DA2B311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700842538, "uuid": "5bb82801-4620-4e6e-bf3c-9f5f9e4e2fc8", "value": "c577c58a31abefae7ed25bcc269ae1b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700842538, "uuid": "da206cc4-91d2-44d5-8592-f1979f2238e1", "value": "3072:dr5HSAPlfsP9JO0QsVYI7Jb0NNFAr8Zr5ROWZb:zyAG++VD0NNyr8tHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700842538, "uuid": "e82707b8-1ced-41e1-8177-2d060974b7a8", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700842538, "uuid": "4a8107e7-acb1-4a63-8433-c3d8ac24c832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700842538, "uuid": "8ceb3355-5e6f-446c-a7cb-7f8ca0949209", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69aa08a9-8af0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700847566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700847566, "uuid": "bd188718-6924-4f0a-ab63-12b287bb2e3d", "comment": "Malware payload", "value": "4f15b504065febdeccd218862f564baf", "object_relation": "md5", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700847566, "uuid": "b98e148f-bd9f-4531-b019-706475efb12c", "comment": "Malware payload", "value": "8411d02f9c74679198a73697b3faaf3f83c4cc8fbb05af3ab9876b32089fdae6", "object_relation": "sha256", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700847566, "uuid": "460979eb-0f8e-4b17-b0d7-4ad67dfa0db3", "comment": "Malware payload", "value": "9fd9cda0de136c0f24b90551daba9c6580fa9337", "object_relation": "sha1", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700847566, "uuid": "13751e8e-3294-44f7-a470-59aac3271d18", "comment": "Malware payload", "value": "02efe49fc8d733b0c55bdca203891d1308c25711bd5ef19081b45f99adb23492476ae72a4764401deadf47e980e663c2", "object_relation": "sha3-384", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700847566, "uuid": "1b9392c6-7853-4f33-86e9-2ec7dd2d0711", "value": "T13CF423A41E9E04F10D0E3678ED91C6640DFB0CFD98D50BFE2D96DDA824D8A49F85C9AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700847566, "uuid": "df9ae0bd-42ce-431d-a771-de89a94238be", "value": "12288:NGQ25Tk7qHyCKyqraw4nxUpusTnNqtA7yTsK9iqQLnqAaHAgVFzohl1uUagLh:QTa/kqew4xU/TnNUA7yTsOmCggjal1uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700847566, "uuid": "ee3ecaeb-877c-49e1-a3e1-b3dff17cf361", "value": 743214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700847566, "uuid": "119990f9-6755-423c-bc89-adbb82c8638c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700847566, "uuid": "7c0a3778-7410-4ac9-b993-034beb6d417e", "value": "SHIPPING ADVICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db64832-8ab7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700823091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823091, "uuid": "7c48e6b5-98fc-4e0b-aed1-f50160efb845", "comment": "Malware payload (AgentTesla)", "value": "30e5fe8a4abbb20856722e8725bff2e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823091, "uuid": "e8dab20e-2091-47ef-9349-dd8c4cd348d7", "comment": "Malware payload (AgentTesla)", "value": "87889f8e467ad320665a7205170c8f238076d87303822694d3064b9511913169", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823091, "uuid": "fa2c3c8d-014b-4a3a-9f9e-870897c5905c", "comment": "Malware payload (AgentTesla)", "value": "0d72483b99ff1951e1d697d3dea365b551fce6b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823091, "uuid": "b6f8bc88-2e00-43e9-ba75-f541f511f514", "comment": "Malware payload (AgentTesla)", "value": "d4873743720f09ebad6df6084d3a23f983177affc832cc990f547f327fcb38c9be2a46c4fb89c9458158c5944fc7e825", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823091, "uuid": "b3c5e613-c186-4624-83c3-315b5379c8a7", "value": "T1C694230CB7C7A0D7DE9745F02AB68E6BD37F8628152502CB2B601F6998B7140D63F2C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823091, "uuid": "4b7b2e54-314b-4b3f-8465-5b6dab82e82e", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823091, "uuid": "2365b074-5fb6-4fc2-a3c7-7ef4f4b46244", "value": "6144:I1onyRuPBD7zAjmPJl/tWOZwskIXrcdecSkOpFlxVWp7AUqA44zUB:QoyEpbVJl5f8vVUZiCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700823091, "uuid": "fc53aa50-178d-4c9f-91f4-d7722ca52d21", "value": 429478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700823091, "uuid": "4212c56c-6eef-460d-ab57-0bfcf7abb763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823091, "uuid": "cbede023-a0e7-46c8-9551-bd40a159b036", "value": "RFQ#84839PRODUCT_MATERIAL_TEXHONG_TAN_CANGc.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b577445-8b1b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700866118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700866118, "uuid": "271fdabe-18c3-4820-a5f6-7c3d65591c41", "comment": "Malware payload", "value": "d17f059ad3690388662c9105990c4cf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700866118, "uuid": "2602c794-ab0e-491b-b23d-8c6d2619d693", "comment": "Malware payload", "value": "8a471d8d511a2138ebcb6ef1caa7516b0fed2acb1d95c3345a8a06d30652e496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700866118, "uuid": "abfb862a-dbb2-4cf9-9b3d-7fed777a02cd", "comment": "Malware payload", "value": "d41c411bd9b28248fa2b53352568a506e089181f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700866118, "uuid": "31d96448-3425-49ea-ac01-d40b6ede8b0d", "comment": "Malware payload", "value": "9b4208badcb8eebd2b8fd3d497a05792e6ebe83f89516b69bf69e246524baeb1e227ff572ab1fc49bd2e3db06c622191", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700866118, "uuid": "3707c838-63a4-4543-94e0-45b40887f334", "value": "T1FD74A643C6E53D44EA268B7A9F2F86EC7B1DF2509E49FB6612189E1F84F0272D163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700866118, "uuid": "7f2203ee-058d-4a65-bfd1-0449548ae727", "value": "5c80077e1547ffc6f55b1869a125ea4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700866118, "uuid": "73df9059-d86a-4e88-bcdb-4a34f9b018c8", "value": "6144:Y4+epvZREos7jPoQqL1uUu1wpwvswTGx:Y4+whREos4zLsDyiT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700866118, "uuid": "d51e03eb-7bc4-4529-8bac-41af63c2c4de", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700866118, "uuid": "e2cbe3db-c0b2-4b8f-8ce6-62cb8acb9d3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700866118, "uuid": "a5f17901-8769-4e7a-825f-8155aeba4fb4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f956ab96-8afe-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700853820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700853820, "uuid": "42eec89a-ea08-42d9-a5a9-85c1df553b4c", "comment": "Malware payload", "value": "98f71e20f65fd7a8d19cafed86948d28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700853820, "uuid": "53a92d76-180b-49ba-a25a-f75db4539697", "comment": "Malware payload", "value": "8a74855bc1462685f3f4b012621e613075a65faf8e4b1a40c5a95e870b710a56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700853820, "uuid": "a75255bb-9868-46d3-89e8-d8040be9a91d", "comment": "Malware payload", "value": "db633831918bb4d0de0f0d69ab389a6ba1b23b62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700853820, "uuid": "dccfc3ec-22ea-43a3-814d-d01ced3ae98b", "comment": "Malware payload", "value": "37480bd7ac7011ff61beab52d60ae3b53355a2abcf3b95a094ebe61b115004767d1ead25c04f58616ec7e0bf359fa97b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700853820, "uuid": "4b7c2dca-0b1b-46df-bd3a-a4bd906d3f51", "value": "T1AF346A23E7E0FC2DD15707355F2C8AEC7B6EB8225E65874B23101E2E5A322B1D62B355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700853820, "uuid": "784984cf-0af3-494b-92f6-03e5fc2f7be0", "value": "bd153cb170efdbdb1b1268a5a173f793", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700853820, "uuid": "25b8a324-39e2-494d-b1d3-02c7bfe4aef5", "value": "3072:GjICacyzlsieQI+dvSmCKMffb4QcDxL/X8eU5w+mb:QAZsQIkLCKMffbU1L/Xjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700853820, "uuid": "f4e7200f-70b2-4ed2-993f-b4c1c15a5d35", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700853820, "uuid": "5d27f2b0-beaf-4025-81ed-ce8ab1000904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700853820, "uuid": "1282b3fc-935e-4dc2-8073-e0b79a804e07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c20fbd-8a65-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700787722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700787722, "uuid": "18e69280-e279-4432-a377-a240904f10a8", "comment": "Malware payload", "value": "84d6854899e7c442c48d8852b3494b71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700787722, "uuid": "c75a0bf2-3d8f-47ff-ba6a-2b0a97a9b5bd", "comment": "Malware payload", "value": "8bbed58c768c4123970a67377ef324e3395883269bdc99a5bf97853eb551d70a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700787722, "uuid": "d065844a-c69b-4ab0-9cf2-91e913901057", "comment": "Malware payload", "value": "077936c86a4ef360e92c3733abfc6633193d9583", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700787722, "uuid": "0c7fcdc7-031c-47a1-8d5d-bc84bc860c46", "comment": "Malware payload", "value": "bd1761db0d43e8544179122c003e438bd42c987fb5f2dd678a7a60b6b020294b84cab2d86789283002ad5d4ffac65c57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700787722, "uuid": "b4bff4d4-13c5-4c06-95f7-990d42463d44", "value": "T15EF4010473B91F29C9BE5BF65821610547F2797F78B6E34A8DC660EA1223F006E91F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700787722, "uuid": "7409c71c-e92a-4c4c-a0a6-7271e7de50d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700787722, "uuid": "524ff2db-e823-4d32-84f0-c37e06ecff78", "value": "12288:s1CFpELXGkJldiJxzHxOz6Awe/DpDpCrUkIP1CLmZD+9Km87XvauYqD8J:s1CFpQ2k7CH0z6ALphkIkLUD+9Kf7XyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700787722, "uuid": "28090679-4a8c-4237-81e9-242a55fa7f4f", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700787722, "uuid": "c2b9c495-0024-4720-8436-82f6551b4735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700787722, "uuid": "afd30e87-6617-47f3-ad0d-20c126db6319", "value": "SHIPPING ADVICE DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e416d0-8ac2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700828043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828043, "uuid": "2eed5ce1-2c49-4b5b-b41b-38cf37d2d2ae", "comment": "Malware payload", "value": "0bfc62fada48290fef94b14993f0fb49", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828043, "uuid": "b9685025-9c05-445d-9dec-43306e821782", "comment": "Malware payload", "value": "8bff7c26eb8ade1c818ecccf2115150e677807c1c3ce8c2f4aa07ffb9cd66ef4", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828043, "uuid": "b8dbb19e-27ed-43b6-b389-061f30b7784c", "comment": "Malware payload", "value": "fe4ff53539ede8ebe4d4ab5a06d63951daeafc3b", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828043, "uuid": "7cd1df23-55bd-4695-9186-297eb1bc1605", "comment": "Malware payload", "value": "fdb8215b8da31ba2c3b0c5c302910e66f8aa2725f2f5a44cf2b8047837ecefac3b2c89e82b09eae10aa0db3cd0f41f5e", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828043, "uuid": "827a8960-2195-4001-bf33-ca1ccca06ffc", "value": "T156A1544973902581234F63BB5F6B70E2D66986BF3E584D4BE511B2AA2CC1C1DC9E2B30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828043, "uuid": "2b024b79-d75d-4862-a805-10d0c74a1816", "value": "96:5M4466K7A1Q3ZbcmER0g2PxlTqtSmAmUkxsDX1x/R7mX9:5MDrKeQ3ZbcmEOvqtYjwsDlx/ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700828043, "uuid": "12d6a023-131a-463a-92cf-2ceb75f33c6d", "value": 4872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700828043, "uuid": "3ff07433-05fd-40e8-a8f7-308b525947d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828043, "uuid": "1e31b47e-ad5b-4f3e-a6a6-5c5e9105bf01", "value": "Agenzia_Entrate (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94221025-8aab-11ee-8907-42010a9c0042", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1700818002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818002, "uuid": "7667f26e-22ac-489b-bf0e-b26cb3020374", "comment": "Malware payload (Socks5Systemz)", "value": "7ce08d32df55b6fa09d7bcd2b49cb17f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818002, "uuid": "a30ce11b-19bc-4427-a208-26e21fbf59a2", "comment": "Malware payload (Socks5Systemz)", "value": "8c60744412f0ba45553afea13c72ae7e5c9c687cfc85d6028041b2b91d553896", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818002, "uuid": "f1fb5501-c4d7-4118-bf2f-295ff069af9c", "comment": "Malware payload (Socks5Systemz)", "value": "f76e98fb9ed716fee162acfa0ee3ee29f07b18d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818002, "uuid": "9c2cf887-ca85-46f7-9619-6f4f9b7970d4", "comment": "Malware payload (Socks5Systemz)", "value": "19049cf18ff2d6d0b338a022d93379466723022fa0b343bf20419a560e62271bb36d1e268b6577cbaef9c10537be01e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818002, "uuid": "214ddb57-200e-4a26-bd71-3206ba3c2a35", "value": "T1D44633AE97D0E53CD350CCB4C82F52902532B7BB36394984118D49ACB7663E8B47E7DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818002, "uuid": "acd3c3da-dc1b-4441-8280-27297495463f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818002, "uuid": "81e5f387-810c-440d-926c-d248ba23c242", "value": "98304:4chHMKyDyc70SwAvO01JgBixtqMhlE4f+Ue/czLiRZvcFqhblsXlwagEblE:vy3l80DBl5f+2QvQus1zgCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818002, "uuid": "b9c497dd-b517-43e7-9c65-29b96eee11a2", "value": 5418473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818002, "uuid": "76b71749-3baf-4c6d-b914-43c1b6f95bb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818002, "uuid": "5a6c0f92-d252-4d47-818e-f91659829433", "value": "SecuriteInfo.com.Other.Malware-gen.5899.5845", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf43d452-8ad3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700835281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835281, "uuid": "91e11a4d-0233-4d2c-af50-105478dd283a", "comment": "Malware payload", "value": "b54702f7e532b9f96c07e8afdf5a54ed", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835281, "uuid": "ff7dd9a9-44f2-49f1-9e4d-df6dc01a0d97", "comment": "Malware payload", "value": "8cc48f95b1a247eda6d8d095b59083fcf66f6df8c7636e226fda3c84f4b05031", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835281, "uuid": "7b36883d-3f35-4073-a904-c0ad2b1fa903", "comment": "Malware payload", "value": "fce5328a4e8854111bc2deb49b5c11f2ead3e189", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835281, "uuid": "79b6e143-4ac1-4a8a-9453-5a311fb9d889", "comment": "Malware payload", "value": "5a2677bafaefb3ea82bab649f5aaf2a047cbfd8b0c4cffbd6bac9fa6fed873b2ef84d240252fc0bd47685d6a9e9656b8", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835281, "uuid": "17730f9d-f9b4-4534-b241-e740c01e4103", "value": "T13E354B22A3D14437D5732F758D6B86986C257E302EB4D95A7EF89E0C0E38B817D353A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835281, "uuid": "a17705f1-e64e-49ec-b3a8-aa1c70cec2e0", "value": "24cdc56b5fda73aeb4bb75aa4a21ffc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835281, "uuid": "ffbe577a-2ce7-446e-a6ba-a7dbd9cecc3b", "value": "24576:SVPc2oOjSBX6F9204jN76eOJd9eZEdRapWhmAMJ8vDjr5xyH:rOQ/O7wWhBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700835281, "uuid": "f5910cc7-9881-467b-8ad0-dbcb9bb0ce6f", "value": 1158144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700835281, "uuid": "52143ac1-1d47-45bd-9aa3-e0c3c02ea9c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835281, "uuid": "0de4f94f-e5a4-4e6f-94d3-b2add1781b57", "value": "1700835279cf05b6bf4fe6d487ee9228d5b980a3678cad8a5e6ddd4c88cd0321b9665dff25598.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cbadbdd-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864241, "uuid": "b9c3ee45-906b-419a-853f-c0bc3b00480c", "comment": "Malware payload", "value": "d9649126e11df5526521f6ae38f076c4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864241, "uuid": "17de9c2b-7c45-4b20-86fc-67634fa0470c", "comment": "Malware payload", "value": "8d1048fed38e75f78d68750772eb632ccca15251dc8bd0a24981516f3d154717", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864241, "uuid": "91b6fb16-9ca7-48b3-a6e8-19897d823dab", "comment": "Malware payload", "value": "1c6a9f4df126580007d813d06ec0efc908351996", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864241, "uuid": "1cbf62bb-13fd-410b-93c6-1b83eb7123f5", "comment": "Malware payload", "value": "8fd1c91d0e6337f98e48d1ea264376d6d809b610308ff616b398362698c6bb57fbd462b9820d6cc2667bfd5949e1aecd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864241, "uuid": "20b6a479-8b37-4d3b-8035-2255f8d1edcd", "value": "T173750822321EC036D56C02B0542DAFAAA19C7D3647A454DBF7D04F62BAE55D33A31F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864241, "uuid": "b6e1fc45-052f-46fb-b91a-69ad64c69177", "value": "2cb4f0c7dff618f49177af00f1358e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864241, "uuid": "2ac32409-50ca-4ab2-8722-0a428abf3ef7", "value": "49152:QVlf4p3BCLj5f8TCOtTj8ah9e2bt28nQ:V2Lj58Rr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864241, "uuid": "0c00130e-c1d9-4f04-9a66-f644ba01e1c1", "value": 1628160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864241, "uuid": "36943b21-ddff-4aec-9b38-2f02da11c6a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864241, "uuid": "b02bddec-bce9-4bb7-9f34-2cde9e790fd7", "value": "SecuriteInfo.com.Variant.Razy.969857.25186.6155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c8fc55-8ace-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700833035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833035, "uuid": "2fdc7821-64d6-49d7-8886-db0fbdd6922d", "comment": "Malware payload (RedLineStealer)", "value": "8e7d99f91d10a2836acf5a6b0eef0f23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833035, "uuid": "0fba743b-0aa7-4988-aff7-cb92afc80f37", "comment": "Malware payload (RedLineStealer)", "value": "8dfae05eff92ce87acd6c78f6d1ae08f9ae5d1537ac6cbd4ba11c5ed457256da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833035, "uuid": "5b474a84-76b0-4dbf-b05a-a31ab4b6da04", "comment": "Malware payload (RedLineStealer)", "value": "b7eaf5d30b533986bfcda436377ab85f5d3758d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833035, "uuid": "e3fbf28c-b8a5-4a21-bbaa-40d900e694fc", "comment": "Malware payload (RedLineStealer)", "value": "55d41011de54a7478ad405facd1d2405a33055d196e9eadcfc2f5e5c472946295aa359d4d739d45a185e336171a85175", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833035, "uuid": "e45f5291-8c5b-417e-9c31-6b6c994c0a05", "value": "T1655406D933B294F2CA2BC0FA6B2A8643237BA8755561D56A274235F1090D05C3FF7B6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833035, "uuid": "c13378c2-3baa-4a29-a676-ab900bcd7cda", "value": "3849bb39d12db209f7b27bc119469daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833035, "uuid": "4e891446-f79d-479d-8af0-1894ccbcbff1", "value": "6144:EcvO3SSjYlMRSPhjw6Gl/ncS3nSjPF9GW8nZ:EXAwHnTnS6Ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700833035, "uuid": "e1c1af5e-64a5-4860-9195-ad2078ae3b67", "value": 294328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700833035, "uuid": "b27464a5-f2dc-44cc-82da-8d1882216852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833035, "uuid": "1262334e-e22e-4abe-a550-44af6382f638", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b0dfd9-8ac2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700828037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828037, "uuid": "60f41a5b-7937-47b9-883f-dc4a2e3e06fa", "comment": "Malware payload", "value": "34a5dd0102028beff127a458276fdb43", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828037, "uuid": "c344e997-5360-4c02-a708-84b109d09301", "comment": "Malware payload", "value": "8e7f45ba404445ce4b890adbae3660c3a3d25a4e25d2cd5c1c63e84d9bfb293c", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828037, "uuid": "31f2e533-7a93-41e9-84ee-a91bdd29ad98", "comment": "Malware payload", "value": "0f428b7ecee697d5a4be044a776f5e37e3435fd5", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828037, "uuid": "3cd4bb0c-b561-4e69-96c4-7f1b4c261dab", "comment": "Malware payload", "value": "f2cc8a9a5974ccd6438b703305065c84b9ca14ce5ca805e031d3d3a37b61dcaf6ae57b7cbba5eca04080a2217688c126", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828037, "uuid": "c4404435-5e51-48af-b06f-a0b830cd9b8b", "value": "T1DFA1040C66949594538307E3BB1770C0F8F9D4DB3BA44DDDF120A998AC8C521E597F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828037, "uuid": "80e167c9-1016-4b5a-b1a0-7d9a602e8e21", "value": "96:a3w8+mAFu1VeheOC0uzmMdOs5GcgbrwXM8TGfJwAm/Ilcj2:a3wfFUegOZuiUfgXw86sw92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700828037, "uuid": "934db23f-3877-459e-ab0e-b6418c83cb7e", "value": 4850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700828037, "uuid": "2f8a5a26-9823-4705-9a43-b856f2676af1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828037, "uuid": "cbee0f7f-c1b3-4c0f-bc3c-2a589f3f2e1b", "value": "Agenzia_Entrate (20)(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d6b7e9-8ace-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700832937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700832937, "uuid": "90c3e54a-af60-46ca-a971-e81eebbf442e", "comment": "Malware payload", "value": "e7807ac712edf628b46487cc7f881e26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700832937, "uuid": "81c97e81-f609-412c-86b3-2730be862fca", "comment": "Malware payload", "value": "8f3da1cd07b0b75677db8728683206e463680c0e10333a35ca37977445426e09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700832937, "uuid": "ffc2f57c-f6e9-4dc3-adc4-b20202e67fb3", "comment": "Malware payload", "value": "a763d01f4dfa0e0067c8c740f5520729de190295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700832937, "uuid": "b57e316c-8e72-4afc-8eb1-05abf9b1a9b5", "comment": "Malware payload", "value": "91045ad645b15e02c92362cf0dad310860b7ea7096fbf854b7fe00d5d88810c65d5b4ccb8aa2ee6082a491989189bbc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700832937, "uuid": "a5cd96d8-d92d-4385-9d5e-f34136c70b85", "value": "T1E5739C5C37E54925E2FF5BF058F27642CA38EA575D03D22F24CA018A172BA89CD417EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700832937, "uuid": "68d61708-9c44-4771-b740-4088ba89ef03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700832937, "uuid": "762bd8cc-cdb6-4ee5-b651-ce200b44c777", "value": "1536:B8MQ8NcLvefQzKvZ53323McKbPa+yhcuHG6gReOwGFoKOiL:VQqcLaQzupLbPLyhf4ReOwkUiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700832937, "uuid": "0f913896-fea6-4d14-ba2b-f0a82e055225", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700832937, "uuid": "4113ce4e-e3b0-4cae-96dc-f6ca2bc646b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700832937, "uuid": "a9d35155-79e9-4959-940a-9ef943fb10b7", "value": "e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4839ca99-8ab7-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1700823029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823029, "uuid": "a6e710ee-e4a1-444c-9289-14bfd6c35fb1", "comment": "Malware payload (DCRat)", "value": "b90eee3b53b26955c799ee631bf1174a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823029, "uuid": "05c98002-6d42-46f7-939d-ea1c53fee37d", "comment": "Malware payload (DCRat)", "value": "8f3eb03464ce014099cbfc7a3aa3f79a9a4528930e523a936e526ea413b0b5e6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823029, "uuid": "e726170b-3148-496d-b9e0-8eacbde6849a", "comment": "Malware payload (DCRat)", "value": "179b336758e7c94570f7a10adb2ed20e89665416", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823029, "uuid": "560d4fbd-7447-4d29-816b-7c295586f963", "comment": "Malware payload (DCRat)", "value": "6248691a7f7da86a43cadfafd5f36282ce81ae7c49ae08f37e83ba7da126d97ff7213737bc9c4464ab22d161bf0fb314", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823029, "uuid": "3393678a-2da6-48b9-8ad2-44ad5baacd82", "value": "T1114590243DFA901AF173EFB59BD4B596DA6FB2733707945E109103860B13A81ED8293E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823029, "uuid": "6318f903-8d1c-4781-9a39-a9a99ab0faf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823029, "uuid": "13495595-253c-4ea5-bc5f-128703653c0a", "value": "24576:qADdteLS1VO6wLVqq0aJSw69voIN7y7Di0:sE86MVX/SwHmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700823029, "uuid": "1df7a2d6-c5e9-4aba-9ce4-d8a209e3e3ec", "value": 1205248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700823029, "uuid": "535f2e2d-c173-46a4-be7e-c92a8ab15b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823029, "uuid": "1295a2a1-2937-4352-8b4f-b578eabd926c", "value": "b90eee3b53b26955c799ee631bf1174a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91d3f5c-8aed-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700846411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846411, "uuid": "71f32efa-0975-442e-a20d-dafa6bb1298e", "comment": "Malware payload", "value": "bbcc06f62672ad441c660c21fe0306f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846411, "uuid": "45d5a2b4-90a6-4446-8f74-a4c8486737f6", "comment": "Malware payload", "value": "8fc0b09eeeed3341b10d954422cf92f2fba9bd51d88051cdcad13af0b92f43fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846411, "uuid": "45b72572-7982-4cfd-9732-ea7c44511432", "comment": "Malware payload", "value": "649923b9856489e118f70a0729aa5328403a8207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846411, "uuid": "b1ce0f51-6bc3-4987-a398-a2199328f300", "comment": "Malware payload", "value": "ea8b3dcee76b8233eb9132b52023c6887bc71566f5056e713ac1003bd28a5bad2ab1580725b012e0ba8e10d6f7c45589", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846411, "uuid": "e39a272d-88cf-4a51-9bc7-425d8115162e", "value": "T12036339330516139C4B1683284F643339636FA3AA1BFE1B5698D09DDEF93EF46108B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846411, "uuid": "4c1db702-2a99-4765-9e8a-8e04c986d6cb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846411, "uuid": "a90f9ed9-5e3a-4a74-8ae8-2ef37f43dd16", "value": "98304:Ad3L0TpNwgdnac+LdvXVajAqlxgc92ca6Qc3zQxHI7Fya0pYrAKlE:M3Lq6gdna/raEqwzca6QcjDopKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700846411, "uuid": "7925ad33-790e-4ba3-8be1-ff04c858b724", "value": 5179704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700846411, "uuid": "c9dc40cd-c202-4ac0-aa67-2a9b97ed96a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846411, "uuid": "3f076c65-5912-4d7c-b63f-184be109c6f1", "value": "SecuriteInfo.com.Trojan.Siggen22.15070.14720.7693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b33539-8b06-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700856876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700856876, "uuid": "6a64a796-4eef-4bac-80bc-a0b8e243fd56", "comment": "Malware payload", "value": "9dc450d4f032ac4854a6c70f194afae6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700856876, "uuid": "c704517b-35b0-4284-a1ab-b1deeaed3dfb", "comment": "Malware payload", "value": "91387a4e75e7e17acd8ffc08d87bb037a2217e967630c16c7681d006c1c0206f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700856876, "uuid": "928a14e2-f8ab-4ee2-9ecf-d254b2ab4d69", "comment": "Malware payload", "value": "df0750705996066dd0b1d7af2de1938c5939a22f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700856876, "uuid": "80530e1b-1f3c-4446-acf7-c3752f27d451", "comment": "Malware payload", "value": "78a8723f2daed503ff94e35c57433f801ef0b8c5fcb2213ebd42fd72dfa57ecec82210ac0cd24158f315dc84fecca133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700856876, "uuid": "5ec769fd-f0fc-4777-8aeb-8d983c177772", "value": "T15F348C2365E0BC31C6530775CF2C96DC7BEEB8625E66870B27581F2E5A302B1DA27352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700856876, "uuid": "71fc98b5-df9d-4153-af84-04a245228192", "value": "bd153cb170efdbdb1b1268a5a173f793", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700856876, "uuid": "da6542b6-b5dd-46a4-abf6-e78918de9fc8", "value": "3072:vPg1q9yO65P05EDeEyw5lJDj2OT1zf7zYU5w+Rl9V:O/O6bDeEP5lJDj2OT1Go", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700856876, "uuid": "cc9a5a26-4cc7-4c49-8f9b-4ffded36b935", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700856876, "uuid": "fc3079db-131c-43ad-9a45-ba6e7f6b10ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700856876, "uuid": "fb70e958-52fe-465c-b82c-3cf67d960921", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b93530-8a5d-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1700784313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700784313, "uuid": "8acf7016-d303-44f1-bd55-0e65d78b45ea", "comment": "Malware payload (NanoCore)", "value": "a8c4cdad67ebf05fa888878920cf061d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700784313, "uuid": "4c278f1e-0ef1-4d66-9e82-c9b6336b3a9d", "comment": "Malware payload (NanoCore)", "value": "91434e57f158bb81625776231e38663bbf467f0bec3048d4c49ed36461ed4724", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700784313, "uuid": "d1a52693-9fe6-43ee-8d11-80d65bf7c558", "comment": "Malware payload (NanoCore)", "value": "3188ef0d857b54649b4d7ee5143f917fb568b2c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700784313, "uuid": "e7aa22f1-d96a-4b7b-9c48-d85def5842e9", "comment": "Malware payload (NanoCore)", "value": "03261376dd9254ac123adf663a907fb6302b714e529cae612ad253b5aa42251b2825dc4f128d8f9023764704bf7c8852", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700784313, "uuid": "3d238570-615e-4ca6-b0a1-763d5d8c5392", "value": "T1B4F4BCF421A5C796C3B997FF282B91305B63AC165075D28C7EBE30C90EA5B830A41E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700784313, "uuid": "e2a919e1-9af2-4dc0-95fe-0862d7d5e465", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700784313, "uuid": "16d231ff-beae-4bb9-9e16-ef83258eb6f0", "value": "12288:wXkDp2iNkuPF33LL1uIYjdSwfue9/3qw0CUCjS32dTJWAdvfbt:dp1l5bL6jdSHU/qwHUCpxTfbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700784313, "uuid": "f0014dca-5a1f-47d8-a067-78d9dccd0d34", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700784313, "uuid": "8284d6a8-1176-4fb4-ae27-3aa8c3648590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700784313, "uuid": "358fac1f-1b56-48eb-91bb-1aa8e5805341", "value": "a8c4cdad67ebf05fa888878920cf061d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee186403-8aeb-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1700845641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700845641, "uuid": "139a99dd-db04-4311-9924-7d8e2e349b07", "comment": "Malware payload (njrat)", "value": "1257aa3a7c4ebcab95cf00c54565becd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700845641, "uuid": "93143a62-6b03-4209-a3a4-2d4f4a862db6", "comment": "Malware payload (njrat)", "value": "91b1b82d19155a4028599299e72779af33147ef437bbe72055550fe8315ce8db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700845641, "uuid": "009048fa-4415-4d28-89b7-d9d4e25dc782", "comment": "Malware payload (njrat)", "value": "1313d2c9cfaa7945bba0b7c41c2ddb9ef1cf1aac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700845641, "uuid": "d667d3ef-ceff-4abb-b519-82aded45d55d", "comment": "Malware payload (njrat)", "value": "285bac51c69a0309fbf30b2d6334ee98b7a751ff9bb8cf8e8d7944c6dfddddbff678afca1528e796de7efa1caf5c70f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700845641, "uuid": "3edbf014-f883-452f-b892-4e3fc3554cfc", "value": "T17BE208067BE94215D6BC5AFC8CB313214772E3838532EB6F5CDC88CA4B676D00645EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700845641, "uuid": "284e1f18-1477-465e-b1a1-d8eb320cd263", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700845641, "uuid": "ca70068b-32e7-43be-84cd-f88dfd9b32d2", "value": "384:d0bUe5XB4e0XWOnPw0Q0mS03AWTxtTUFQqzFDObbZ:OT9BuFI55dNbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700845641, "uuid": "69f2c9e4-f8c3-4682-92ba-e689e8e991d4", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700845641, "uuid": "9d46f1f1-a9f6-4d7b-aaba-a3f82268690b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700845641, "uuid": "3de5160f-81a2-4096-95c7-06a7bf36f48e", "value": "bRQk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffaf778f-8ad6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700836651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700836651, "uuid": "fdaf2750-cf9f-4d88-b064-1eac9dc10942", "comment": "Malware payload", "value": "ebf9d69a6fe1f189f0c7343aaafd7bc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700836651, "uuid": "533646fe-1b25-4d36-938a-c833b76f511c", "comment": "Malware payload", "value": "92abdb4b98aada22772501d4fa60457184ad5a71e07667f06ebd2e9aef53a6b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700836651, "uuid": "46f538a9-6e94-4ff6-80fa-13219f9bb2f9", "comment": "Malware payload", "value": "ace87f0b30e631c18bc5928d84d916c1dd4b16ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700836651, "uuid": "65179fcf-7de0-4d3a-8738-8396b63a62b8", "comment": "Malware payload", "value": "0c10826a57a7eeae541813725cb8f6870f9251aa0db36e1f5c7eeae6055b7ad8fda1ba2823cc2f3a0355fb9b8c009d96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700836651, "uuid": "a252d3f7-b5ca-41f8-a073-f8911230d5db", "value": "T15606D0023B65FE51C05E1532DACED05C07FCE8266B31EBA7AD593678E895B118C098FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700836651, "uuid": "408b44ce-7e8d-419d-aae7-77450fbc7c05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700836651, "uuid": "dccb7577-aeab-4d14-81ee-c8dacebe1f48", "value": "49152:nXr0QfVfnIYMcGMdhV5nxEGPY6rkxhJNX5LPqPrsQ/R2CtNXhyCPZs2mm++qd:nAYMVMZ4xBxCDseRZNXhLPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700836651, "uuid": "7b19cd27-e1ea-4730-8f33-a5ebb8a71b90", "value": 3743232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700836651, "uuid": "87cf959f-808f-4fb6-b13f-cd5e95213d60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700836651, "uuid": "93c8df81-1158-4e19-b9d8-e6c8c2e5613e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844b448c-8aa0-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700813251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813251, "uuid": "a4ddbb3f-0c10-45c6-aa70-9c8ef769e3c9", "comment": "Malware payload (RiseProStealer)", "value": "22d83497c86ab7a6edc78e37f4faf36a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813251, "uuid": "b7ce3b5b-0753-473a-8fb7-ef7126f95d27", "comment": "Malware payload (RiseProStealer)", "value": "92c2e718d39591d84c27e137e8b5e04a4fd391385f720d717ab4a28543b6c032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813251, "uuid": "25b9a580-538f-4889-beaf-08673ac10243", "comment": "Malware payload (RiseProStealer)", "value": "e2b8aecf6f2fe1db72e24482b77a130af76542eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813251, "uuid": "4f192e22-80a9-4dfe-b51e-4a5876658d62", "comment": "Malware payload (RiseProStealer)", "value": "6bd99179f31e9183e48ee2115008a1179abbb89361af70fdffab3b00cd334e1ceb5ae3af1ce2f14d23459be8d8a63778", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813251, "uuid": "1768f7f2-58d6-4e80-ba51-0eb13546f379", "value": "T167659D21FA08C0B7D09211B0916D6A7B95997A322BAF4CD3F7C05E6D01B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813251, "uuid": "f8e274db-f434-44b8-a8e1-ef73c99423f9", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813251, "uuid": "b646afd0-6cb6-4618-b4ec-ae28506f5b4d", "value": "24576:8N+bPGUvbX8AdjI9Bahe/wz78RaiyhrbnC3OlKekN4srzEhbaLUCKWmRlsSmYTzC:8wyYjI9EheW7WaiUy3V6baLUCmRlnmYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700813251, "uuid": "8395e9d6-a3e5-431c-b161-f26643744391", "value": 1542294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700813251, "uuid": "a731b2b9-acde-4025-a986-e0bcc794b2e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813251, "uuid": "fa5bda76-cda6-44a0-8993-41cbf56357c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43dacfdc-8aca-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700831182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700831182, "uuid": "b964eec9-a641-4a25-aafd-35aacbeeb570", "comment": "Malware payload", "value": "24e131e08d50da4318453640240675ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700831182, "uuid": "34e01257-c8fa-414b-8373-977999fce721", "comment": "Malware payload", "value": "92dd562bfeeda2c7ab44ec2ec80e15da68ba113098b6939265a2abc683598cd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700831182, "uuid": "c71d2a5f-72aa-4349-94dc-192de36eacef", "comment": "Malware payload", "value": "1d3123cc3b939a115f4216aad9d93a5ce9b711bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700831182, "uuid": "958a256b-7135-46b4-9774-83c7b2753d16", "comment": "Malware payload", "value": "215e005ad3a302a522c76394d7ec4eb4555a5ba2752e78e8ba614a853a1dc02c9307baedd13f7bc19b01ba9fa3a3358d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700831182, "uuid": "37316cc0-c4f8-4036-b56c-4caae5863100", "value": "T12806235DE39805F4E4B7C534C9A20617F5B27C9847B0978F23E9429E6F277A04A3A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700831182, "uuid": "f8ac4eb9-68da-4877-9909-42eea37520f6", "value": "39da3cace27ab9503fa46001ce968ea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700831182, "uuid": "33316329-227d-4683-ac2e-ca04a582e09f", "value": "98304:OBylBfKE2xv28xVWqNehAumRDngnu+xyw10ddUaK+:OIabfL/equm+bEw1bT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700831182, "uuid": "7028d5a3-287f-4878-b45a-9763b4ec2af9", "value": 3906064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700831182, "uuid": "db39eb59-2dbd-448a-bacd-d5ee90c12322", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700831182, "uuid": "a5b71169-09ba-48d0-b5a6-57a385c83d10", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8806cf0-8acb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700831807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700831807, "uuid": "a6a9092f-719a-4f1e-9e53-58713e496e7d", "comment": "Malware payload", "value": "4f17e0e8d7f6931d86bcef776619a2b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700831807, "uuid": "6d64a410-b2cb-4842-a4d0-c80dee14bb39", "comment": "Malware payload", "value": "92f3c06a0ba8bc92f1a39521ad2979b86ce409fe9892e5f578e23a48fd8aef46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700831807, "uuid": "f1359ee3-2e91-4a7e-b6d6-33b74d9f5711", "comment": "Malware payload", "value": "0bb4fd9f5b2ab83b6dee04480b8e48a5f72b47fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700831807, "uuid": "3a11b6c0-9c05-44e1-9cf0-50c2bebaab2e", "comment": "Malware payload", "value": "a41d281c0635bfb0a42bf9e35cc71d4a8e0f71f361048ec222312041f4b86d7403a03eff625444596649aa4a0fbe3ee1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700831807, "uuid": "96713ced-cc6d-4690-839a-7cb8b284afda", "value": "T1F19523136BD1FC31C85302716E6CD2DDBB2EB4654F15838BE3582F1B6A716A1E227362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700831807, "uuid": "d0d378db-9824-4a49-9f01-21508607816d", "value": "7c1db49ad6667947e0650b5a549f4e65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700831807, "uuid": "4579e4db-510c-4d5b-8dcf-6772ecb42292", "value": "49152:lu1Cicgvix2ooeL/DIk40DHN1Bl7BclwqyW:lusGIUeLhzxRyBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700831807, "uuid": "2a60b289-78fa-4691-96f7-edffb88be492", "value": 1973760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700831807, "uuid": "99ffd88c-e154-4843-bdcb-5f1709133338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700831807, "uuid": "b57d52d2-e756-4d8e-bc40-aa8e0c945546", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d956f6-8ae6-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1700843499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700843499, "uuid": "a7e8e1a1-7372-4690-94b6-b9466300bc16", "comment": "Malware payload (Amadey)", "value": "6866f4e7450d085b19ad1aa9adaca819", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700843499, "uuid": "a2ea094d-546d-42b6-ad8c-355521665e95", "comment": "Malware payload (Amadey)", "value": "93583dfa872b44e13e449cdfbbe20e64851dbe0e615f30b0313d2cb6a9b2309e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700843499, "uuid": "a998ff73-3701-4a50-8288-349ae85a38fb", "comment": "Malware payload (Amadey)", "value": "4afc3a0de610f45dbf8eb83da2a16052c2a81b01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700843499, "uuid": "a42f35e1-7b0e-4e69-8b7c-a5adcb44fde6", "comment": "Malware payload (Amadey)", "value": "626ac00151599e94e16f730af6257ce056ee1db57f1784b3cbfca4093d6aebd562724f4c7e27465c9ad603876c6374cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700843499, "uuid": "2fb8aa15-9ac7-4272-b303-1d39130a3794", "value": "T165658D11FFE9D59BD0BF6377A4A303251FB0E4856263E79F4D6822E61C623242D053AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700843499, "uuid": "ddfc4ba4-6740-45dd-ab5c-b8257ed2996a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700843499, "uuid": "54df556f-edbe-4d4b-8979-6d367745532c", "value": "24576:NQIsq2Q2GOAO4fCCy7gtsICmEly/nDBRyqni3xbU4eWxDJ3YsXv6+tH9ZPz1:NQIsq2Q2GOAO4fCZ7YsL8/KqihAsxDJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700843499, "uuid": "4d2139eb-50fd-456f-9c89-d92f9172ed91", "value": 1523200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700843499, "uuid": "6b956747-66ec-4e24-8d02-e301ad3f14ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700843499, "uuid": "bd243a55-0d2f-4877-bb07-3f871ccf4aec", "value": "6866f4e7450d085b19ad1aa9adaca819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db9e1f3-8ab7-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700823011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823011, "uuid": "fd139e08-f80e-4be3-b5e4-5b21556c71b0", "comment": "Malware payload (Mirai)", "value": "3f778ac6e32a4b7388f2e46e853908bb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823011, "uuid": "4ead5be3-d4ab-426c-a62d-ece18defb9a9", "comment": "Malware payload (Mirai)", "value": "93c33060cfa890bcfc070dac097e174c8f8848249bc91bbd48eaf5553d02883e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823011, "uuid": "50b3730c-3b9b-45c4-8bcc-18e477c6ff8e", "comment": "Malware payload (Mirai)", "value": "8b191c35b9da83d02b59d43f7bcc33545e9d7a8b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823011, "uuid": "3ed7b57c-ff8e-4c00-b317-c654866ac2bd", "comment": "Malware payload (Mirai)", "value": "ca85d64a3c9da97d94f738741d471776a9da6e03441bdb0f99cf7334e395eb98621627255395000e6382085a23b6eec5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823011, "uuid": "0cede70c-b598-4011-a659-f7a3d4704a95", "value": "T193632881BC815623C6D5127BF66E42CD372627E8E2DF72179D225F2037C681B0E37A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823011, "uuid": "150b7599-3c0f-419a-b834-81659c9f85fa", "value": "1536:XeCaOmX5HOH7IBMnvLLWHwb/yAM8N1pUUeSd88y96u4vQWV:OC86KwGWvUUeSdXWuQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700823011, "uuid": "a6bfb703-a3cf-4512-8c4a-ae3dd07b863d", "value": 70972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700823011, "uuid": "a9283293-2bd5-41ce-9895-a8e0acae1001", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823011, "uuid": "10a1477b-0889-4a69-82a5-5db56797bccd", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c7b614-8aab-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700818011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818011, "uuid": "cf521a91-faed-419a-93f0-bbed4c57216b", "comment": "Malware payload", "value": "a75b85a9502a6933aa0a9873ac3a6df0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818011, "uuid": "2823b901-c4d9-45ec-b7eb-adfc536c7f2d", "comment": "Malware payload", "value": "940d2c9ae3f5545cd6ec398089907f79c34e0c4341a23d2d2aaa7716378f3701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818011, "uuid": "93f97869-f21d-47eb-b80d-54515757927f", "comment": "Malware payload", "value": "b477e4eb9df62f6e3e80a6e3e54b4d2812c842ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818011, "uuid": "11868acc-484a-41a4-931d-b6b1e5604f61", "comment": "Malware payload", "value": "12288ae2c733c59d255612e3cf71cad9095b2e4f5c13f1e1a03dab0d0083988dc2adf6a31df0f26b851e403603e7f064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818011, "uuid": "895df337-ce6e-4d38-9fdd-c23e14205c3f", "value": "T10DC10F015EEE50DAF22707705BE7B37B1666F8B1152E62F870848A599F34BD0C822FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818011, "uuid": "980be502-ce31-4888-9dd9-b6c2c009fbe4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818011, "uuid": "6a7f5ac6-5442-4af1-8434-3e2db3eb7c6e", "value": "96:779Gll3VI2BG3axVYVGrUqD73T8j/nziMTXud3ojMXrl:H9G/33BGuUqDTT8j/nugudF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818011, "uuid": "45cbedda-4d1c-44f9-a228-44f79dd4639a", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818011, "uuid": "3eb8c2da-6c0d-40e4-8429-b9c422234ff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818011, "uuid": "10eb936f-5a78-487c-8046-4a16dd24ba44", "value": "SecuriteInfo.com.Trojan.DownLoader45.55850.3770.21280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3b5072-8abf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700826423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826423, "uuid": "04c694bb-52fd-443c-af8b-bfdd92aa05f7", "comment": "Malware payload", "value": "22c341d7c3f10ebb8f7d29212a1f0add", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826423, "uuid": "5fef196d-e1e6-4e28-8deb-ac95a2c88d0e", "comment": "Malware payload", "value": "94208d444f2e6290754c07c178fb30c31f942dce18aee825f4e6c5158b0e2251", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826423, "uuid": "0772998e-9280-4ee8-ac29-0ca31d0d0271", "comment": "Malware payload", "value": "9335bc2df751d0e66af9c5a3b0ff970c37d7f1d3", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826423, "uuid": "db94b98a-d20e-421e-ae37-33ee1fb060e7", "comment": "Malware payload", "value": "0d38fa7c488009d4fabd2e86584ae28095878ec39445ec9015d1e788d36c1b9de4d19fda53c35235385e96305c8ff8ac", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700826423, "uuid": "5a23a966-b8e4-4548-a3f5-bcb61a920b78", "value": "T1F7658D39C617BCCD17BE689584083EC21D681597C3699B2CEE8DA1B326CA501EF6D4FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700826423, "uuid": "2e6191b7-a6ad-4c3f-8152-66a5fb4989f9", "value": "24576:A/v3/d1SYLucxk7D38T1K779dEXMHMtH10tAgsCou0rThLF:AH3V1SYc7j887ng1PPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700826423, "uuid": "6581db88-8b52-4f31-90c3-f30acc458892", "value": 1544192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700826423, "uuid": "69aed1b8-6e28-4126-976c-1be695904da2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700826423, "uuid": "82a31d33-e31b-4bb1-b6cc-290b81452242", "value": "datascript", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ecd8765-8a86-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1700802021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700802021, "uuid": "6de7d618-e078-4afb-bbac-aadc14b560d3", "comment": "Malware payload (AsyncRAT)", "value": "2ebe821ab9400aa7f6ac0bde28a8e3b6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700802021, "uuid": "b20addc7-8d1e-402b-96de-81a37b17040a", "comment": "Malware payload (AsyncRAT)", "value": "944eb8574994410ac9a62b756a65edf360e78b97296a24e622781462ae599154", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700802021, "uuid": "e9d80d06-201c-4abe-976b-76b6bee82d74", "comment": "Malware payload (AsyncRAT)", "value": "86ad73d89145857aa2bf7291da0e0fcb31688469", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700802021, "uuid": "d82f9129-1707-4bda-8257-5e7df3984489", "comment": "Malware payload (AsyncRAT)", "value": "4b781f548b6d992e4a8bd33c3dcb3830af2fc785f479256ced37d3ed3061973fe1f28e64e3f4dbd940a54a422510e212", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700802021, "uuid": "8e020e96-c05c-42a5-b25b-2a69c32d1275", "value": "T1D3334C002FEAC127F27E4F78A9F36145467AA1677203E64E1CC4469B4623FC656435FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700802021, "uuid": "fd11a6da-cccb-468d-9680-c252ca918f2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700802021, "uuid": "c2745ee8-a7ec-434c-8899-734af0764cf1", "value": "1536:Yu4n9Tswb2IKDFv3vb+NrabFgAvgnddJWW:Yu49Tswb2IKDFv3vbdbFjgdyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700802021, "uuid": "56f88aa2-fd65-44c4-9a9f-b70aa6b56795", "value": 53760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700802021, "uuid": "e416da2c-eda7-40b3-b76c-3c6411673152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700802021, "uuid": "3e982436-f0fb-4a02-b7c3-67fb4a84042d", "value": "2EBE821AB9400AA7F6AC0BDE28A8E3B6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba0f381-8b0a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700858575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700858575, "uuid": "03d8995c-5ed6-4d3b-9be3-fbbffd6e97a1", "comment": "Malware payload", "value": "71a58cc03d3f5cd135b56b4f671547c4", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700858575, "uuid": "92a10563-7a37-40cd-976f-35de2c7db668", "comment": "Malware payload", "value": "94da320aa4a33c8507051b571ae9854193ddd5b8cbd597a786acf11231920805", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700858575, "uuid": "7fe3337c-a447-45e1-bb17-27c76c11b89b", "comment": "Malware payload", "value": "9bb1834f451ebb7e16b96cea84aa9e3f080bac37", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700858575, "uuid": "501ea582-eac7-406b-9132-653381d4b968", "comment": "Malware payload", "value": "06ec6f32c87b9738681e75bac04fe816d447ab35ef2435f1ca81b2d96d250877abdb526a90c3fbd816d41048d32e5eda", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700858575, "uuid": "87172ca9-192b-4f33-9965-fb2ffe542a3b", "value": "T1C50633181AC6DED3E226697E60BB5F0F677042378471BAC22F75EC1929DB1812B37871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700858575, "uuid": "2a578af1-f658-457f-b380-b23322054b93", "value": "98304:NXG2qtQvVYr7MOxi2FiN2P95EQlt/H2nt13bcP17v:NGavg7R5xP9t1Wnn3by1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700858575, "uuid": "4f74ac20-4aa5-40d2-a9b0-a104f6cfabdf", "value": 3987495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700858575, "uuid": "3851ccfe-43f2-4123-a863-7eec319f1dce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700858575, "uuid": "5974f597-0e43-4b1c-a0f7-2cfbbd1f21aa", "value": "Alejandro_FLRfcsjrkrgIIRXyxyfXMDVstdi.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa40be6-8ab7-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700823006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823006, "uuid": "b1928ad9-09d6-4614-b004-30681d78fe3b", "comment": "Malware payload (Mirai)", "value": "2ff0937d19ddd2d2a57b0a9b43a54850", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823006, "uuid": "8fd7540b-c92f-484f-8dcf-6c4eea36c4fa", "comment": "Malware payload (Mirai)", "value": "95a13a1543703db89ede1c5a310f5b0bfaa34ce0c94ed9fdf3212eae8432751c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823006, "uuid": "7e573a58-cb4d-42fb-9030-eaef13037ab4", "comment": "Malware payload (Mirai)", "value": "a582d6ff5cd35dcc2ee209aa92d9953a78114d51", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823006, "uuid": "44a0e103-a714-455f-b0f3-da2897d499ed", "comment": "Malware payload (Mirai)", "value": "04f8a523c2a72f82fc376abf11cea4fd29d941b1b2ba62332b0eb6c348846dde541c5c167b2f12fcb9bdaee47251a6e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823006, "uuid": "e3422377-def7-41c3-9687-3f49325643bc", "value": "T11EE32B56EA418B13C4D61775B6EF4245332397A493EB730699287FB43F8279F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823006, "uuid": "43e59703-b68d-42ff-9a4a-a857fc68e1d7", "value": "3072:jdpNh4LiR9g7/abHbz4NpaIJ8VIJ1FNyXb15AM/9VLkajW:jdpNmiLc/abHbz4NUIJxHNyXb12M/9vW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700823006, "uuid": "390c5324-6244-4917-8296-cb933e6cc81b", "value": 153586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700823006, "uuid": "2b50cea7-e78f-4c84-9b72-5320912e3ec1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823006, "uuid": "5cbef05d-9368-4446-92f4-20428255d284", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a013a09-8aa9-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700816965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816965, "uuid": "8126c6b4-6922-43d9-b691-728bc0a73ea9", "comment": "Malware payload (Mirai)", "value": "93799362d35ee9963beaa83cb1db78e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816965, "uuid": "fc26c21f-a6f6-4b30-9c16-5fddf85f29e9", "comment": "Malware payload (Mirai)", "value": "98575611028fa2c3ad328736a50749e63b7eedcaafd97feb679ca46fe9687f13", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816965, "uuid": "65c077bd-631d-4e41-9be9-ddb3fbf07740", "comment": "Malware payload (Mirai)", "value": "b8e5bd36a593062b5df3e66936b77697707e9f53", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816965, "uuid": "2cebe726-1b44-4fed-bb08-391b8c7e5fac", "comment": "Malware payload (Mirai)", "value": "d2c47a6641c4c73480a62fd16cf459ffa025c5b581910646d3cd8dbb9a18dfdce92ef564bb1c4a904e0507778ce01134", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816965, "uuid": "a1eb9a54-ed64-4fb1-97cc-2eafe5f6ed46", "value": "T10FC3F845FC509B17C6C612BBFB5E428D7B2A1798D2EE72039D156F20378B96B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816965, "uuid": "b1c15f48-f883-422b-af09-fcd7927810c1", "value": "1536:W2nHJ2ctPWxdhXUZFoAUIE4Vsme3TGQnL03ebrRd4LAlTmZwyw29dGa2KVsuAskU:W2nklJIFoj4bOaQnL0cD45yM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700816965, "uuid": "beddc9f7-a00b-4296-b3c5-fd2fe1f76935", "value": 125324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700816965, "uuid": "9356a6f9-b0e6-42e0-8bfe-c89296059bf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816965, "uuid": "90f698ed-98d7-4aaf-ae2c-699e6df94dcb", "value": "most-arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf6a3d5-8aeb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700845317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700845317, "uuid": "f179a827-db6c-4b91-912c-8ad6c5baea2b", "comment": "Malware payload", "value": "081ecd14cc7bc4c72d2ba701f3d6dfcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700845317, "uuid": "d3946a1a-27a3-49f0-a0c9-e8fc851d44ec", "comment": "Malware payload", "value": "9aed8f04dac114dc7912bc3d8a931715629c083b2d75b4361d554384f4d32177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700845317, "uuid": "c37cec2e-b346-4d39-a68c-f9f0ce87b7d1", "comment": "Malware payload", "value": "187cd5c7054ac5e093ae4fba35f150bbfc3df92d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700845317, "uuid": "2da57e84-7819-46bb-a85a-96ebe4c71421", "comment": "Malware payload", "value": "153af5930ab7938edc4e7dfc402ac711d937318ee2feec3f69316b455420162a04b72bed5b21c8bfbd29a31f4025e34a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700845317, "uuid": "9b38b627-e28c-4436-a2b8-665ffe0e2935", "value": "T1BE06D0023A31BE51C05E5D3299CED05C07FCD52E6775EB67A9A632BFE880B611C068DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700845317, "uuid": "3eff77af-32d7-475d-9f54-c6a334f92b26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700845317, "uuid": "dd3f8e91-b111-428a-b270-76fc2b4e5d03", "value": "49152:cpha1anQps08TAAFWC5c/vxJG/Kc6qSO8NDSoLFKxCKYtsspW+WEVQJE9W:cphaaAc7c/+yJNWoYxojv1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700845317, "uuid": "392daa07-bf0e-4753-b893-d77f33e20663", "value": 3732480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700845317, "uuid": "91fb0a26-a707-4a7d-a42c-a27c2375ae4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700845317, "uuid": "c9a5ca3c-5531-47dd-89e7-460649949eaf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc59089-8ae6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700843493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700843493, "uuid": "bb3c9159-296b-4040-8db9-3cfd2761edd3", "comment": "Malware payload", "value": "63a5ca4a9408322af7f4d8385f174f94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700843493, "uuid": "a7c3f59b-7a81-45ee-afd1-fd7463c36ee4", "comment": "Malware payload", "value": "9ba0aedcd3367448279922fdc5f2796897767a88b7098321cb8a3493f7ba81cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700843493, "uuid": "42a9a026-85c3-4dd1-8c33-e3c9c030e9bb", "comment": "Malware payload", "value": "6e0c8dcf0bb4aa3b677656ab4e6f79558608a3ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700843493, "uuid": "f1615866-2386-4ae6-826e-6bf5fa029596", "comment": "Malware payload", "value": "0fa6786ad26633b0aa6469e915c0e0560dc37ac63eaad61fedfa25febbaae4c022b0b134ce74930a814186df2be1c3e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700843493, "uuid": "27be038a-4c73-4b8d-b0c6-80312abe97b1", "value": "T1FFB4E05392E17CA0D53E47728F3E86EC7B1FF5504E196B6A12398E1F45B12B2D263312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700843493, "uuid": "4a7f6f9a-9956-469b-b247-2bf288aa5b37", "value": "3af1886f786e2122c71384398144c402", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700843493, "uuid": "5f1768b8-f270-4a23-94d3-60853771901f", "value": "12288:miRS1h7ZSiFQhHR1IBsyKhLhkDeeICILzWx3:rRg7ZlFWHR1IOyeWnmWx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700843493, "uuid": "2f1ad15a-a3cd-4e9f-92cd-1fc9cdb108a1", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700843493, "uuid": "86b8514b-4924-48da-b2a3-14ca08c95e69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700843493, "uuid": "ccfeaec7-55b0-46db-b9d6-4d2939d367b7", "value": "63a5ca4a9408322af7f4d8385f174f94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81315b5-8aed-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700846409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846409, "uuid": "f50669ed-79b0-4071-9695-a49bc55181da", "comment": "Malware payload", "value": "3c0bbb084b6c41e133fa0ee2fa177fc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846409, "uuid": "155ab179-4091-4326-acee-3287bd2c65f7", "comment": "Malware payload", "value": "9c62b2544b01741f139bd217ce34ef3a425b09adabbfd6f68a0c286c29d3ceff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846409, "uuid": "962239a7-b205-4753-a17e-f4393bb518fa", "comment": "Malware payload", "value": "f1c2b3a62215237ad7d3e25fadacbc0775608ca9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846409, "uuid": "43e47444-872a-4941-8107-7c4e2a103b00", "comment": "Malware payload", "value": "9a7f8e63158490a01932b8a897908e306768f93ba285642098747d40e7d2ad2f251b514e64885d9c3a79de8cd30faf29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846409, "uuid": "583b3c2b-bb52-44ff-a2a0-b4b9d401d1dc", "value": "T15963D70AF9819F01D4D731BAFB9F41493253AFB8E3FA71019924AF6423869DB0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846409, "uuid": "d4d7991e-e402-4afc-be70-63b04e9113af", "value": "1536:vJnyr235adwXOahlvdlsy+Bi3yre3s5YkxNapj:nJadwXOaoGyre3s5zNyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700846409, "uuid": "60d47b8e-4d7c-4ff5-9797-53ca10a4b598", "value": 69932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700846409, "uuid": "fe2f2af0-7248-43fa-948b-f980145972ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846409, "uuid": "a95dfb66-0fe3-4e97-b28b-9a16ccae6997", "value": "SecuriteInfo.com.Linux.Mirai.4306.3598.25493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4d87f5-8ac2-11ee-8907-42010a9c0042", "comment": "Malware payload (Quakbot)", "timestamp": 1700828032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828032, "uuid": "118ca2e1-55b3-49dd-b415-ffe9402d2fb3", "comment": "Malware payload (Quakbot)", "value": "6ec662cb2923bc72fbbfbce78331109a", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828032, "uuid": "c7e25c18-2237-4502-b944-a84de2de6c28", "comment": "Malware payload (Quakbot)", "value": "9cc94cedd85793b3be9cb808dfd7e326ba1386b0bae08fee1519c1df8ea40d26", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828032, "uuid": "ff1cee17-ff4a-4bbe-af59-7cb90aba3316", "comment": "Malware payload (Quakbot)", "value": "fe3d25c1d4164161c4075122b6f99de415da6430", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828032, "uuid": "a7bff144-3b0c-4045-a8d4-a41c62ca2e8a", "comment": "Malware payload (Quakbot)", "value": "b407d5fa0394fb58951663d4bc3004b5001709071b1cb08c1b7bf8d75d6fc7e4e08592b04c674fba7b4858800c1ac359", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828032, "uuid": "5cf04889-779d-4803-b170-8087650c2727", "value": "T1EAA1694E60D07CC92FCB93D27D2A6185E4A54A6E2F616DEE7100E8D4E8D0134EAD5E32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828032, "uuid": "5f9c3e58-caba-4645-9dae-08cb02d09949", "value": "96:l8rOmAMUpSH9hDks9gUQSOv0oKzPqHz8qZ/2EsL/eekJyK:2r8MUwHHDPgUJOJzRt4LGzJyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700828032, "uuid": "bb8c6dd9-d650-4635-a2e4-295730489526", "value": 4719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700828032, "uuid": "9f641ccb-9830-466f-a0b9-c46805f9d914", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828032, "uuid": "1844d76a-78bb-4df1-a772-938e48b023ef", "value": "Agenzia_Entrate (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337af646-8a98-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700809679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809679, "uuid": "11b33d73-cadd-4d0f-a38f-b47e7fc89961", "comment": "Malware payload (Mirai)", "value": "d7fa94a04cffe044321fc75e7c502a3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809679, "uuid": "91c3de0b-cccf-494b-8688-5374e9161615", "comment": "Malware payload (Mirai)", "value": "9ee15131c7649fac734585576150f7d530e7713758f7350c74f87fda71741107", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809679, "uuid": "37d3e84c-e154-4716-8293-650bbeee9b8e", "comment": "Malware payload (Mirai)", "value": "e7303507c593577a4fdebf3a22d0e94f7cc99b63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809679, "uuid": "5b854d1b-3b29-42d3-9112-a2726dbf6e98", "comment": "Malware payload (Mirai)", "value": "606c89314190322c21f1548d856cd5c81ddc5683e1f2f627ba8d63cde657c981d22f5a988f16e9d5811851c616d7d3de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809679, "uuid": "af53633a-bfc7-4482-8a59-08a55c40a251", "value": "T1D6532A9AF401CD7EF80BE37B4457090ABA31B3D512830B366767B963BC721A51963F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809679, "uuid": "244a3938-c9d4-4230-8645-d36cd78c1620", "value": "1536:/QeKl4J5fZodIeE0k8Jtzv9tRO8e8H73LqNiksmmvoU:/dKlu5xUPE0rtzDRNe8b9VBvoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700809679, "uuid": "2c83a71e-8a6c-4102-a20d-9df83c3ebfd7", "value": 63956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700809679, "uuid": "1cae56c0-b5e9-4212-be06-b432292bee3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809679, "uuid": "981949fb-8a5a-483f-ad78-4d7cc606e232", "value": "d7fa94a04cffe044321fc75e7c502a3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16c4be1-8ad3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700835311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835311, "uuid": "fceae9e3-ccc5-4e69-9ce9-72cdf790af3f", "comment": "Malware payload", "value": "10b7514df6f6298232589221976c170d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835311, "uuid": "d3f2169b-ee25-466d-ba70-b632249fccfd", "comment": "Malware payload", "value": "9f6599786b1b7f64b75d3b570209b0cd0286011c89591cc71321191fb637afca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835311, "uuid": "d5af3b49-72d2-419a-b8ac-ac262436b35b", "comment": "Malware payload", "value": "5553966e4f48213d66265038cb11a13143ae886f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835311, "uuid": "eba53bd0-714d-4e11-95ff-c80c186a87e7", "comment": "Malware payload", "value": "453932d8118e4e08cddf664cf019731038b8b61c0cccfb9f56f8e288c3027c15cbc27cad2d02c9525e777ed360cb4f71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835311, "uuid": "4a2534c9-1fb2-4b6a-a6e9-7c8617f284a6", "value": "T10215E12962B44F9EE8BB53F58468420517F6BDAE512BE39D4CC170DB0F72B811A07B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835311, "uuid": "b1dee7e4-2461-4d32-99f6-2453a1ab9965", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835311, "uuid": "170ec253-5e4c-40f7-bf13-9033dbff2ae3", "value": "12288:dDwMaylvcV2Sguse5+E6jD/62iN86LoMygvLR/njREGmieXIJLpF2N+YAUB/njYt:R9tD/61pJLRdEGvJFwUYV54PzPEENb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700835311, "uuid": "9b28c161-cb99-4116-a463-05ad3f318a56", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700835311, "uuid": "2e61cf7f-c7e6-41a6-b5b6-bb25834ef172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835311, "uuid": "661b0786-4c2a-495e-b7cd-02c812a8e0fc", "value": "Purchase71249018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2dfc549-8ab3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700821597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700821597, "uuid": "48837912-ae37-49ee-a5da-39e7acd07a13", "comment": "Malware payload (AgentTesla)", "value": "8900975707e0bc29713c65c92c87976f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700821597, "uuid": "5808866a-f78d-4235-861f-e483590ccba0", "comment": "Malware payload (AgentTesla)", "value": "a0fb4101ab860bee6369237f8929d102b36d25e3c8a754db8c399dfc6ff3e7ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700821597, "uuid": "5717ca68-548c-4244-adcb-a6d49b4f2958", "comment": "Malware payload (AgentTesla)", "value": "06539126ee1867fa8b779f36a1f9b5f55dd5f0e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700821597, "uuid": "a1d2f835-4a6e-4ac7-b45f-462c24e8410d", "comment": "Malware payload (AgentTesla)", "value": "c2cad583ffc70155d40bcceed489e5709308cae463d5b5883e126d322229e8bf1395e407f6a2b63322940a9dbf50f0c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700821597, "uuid": "55b40a42-09f3-4e3c-b05f-e0570409c16b", "value": "T1CF854C05FFE8A9DBD41EE3B1ECB2B6550A74EE445126AF4B2C14B1D61C323112CB266F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700821597, "uuid": "9fb1191e-3ec9-41c9-9ee0-99e583352604", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700821597, "uuid": "4f6265f5-efac-43ba-886d-5ca5078f6820", "value": "49152:zQKs42G2MO+OwfBP9dl9A1BE+xdZLh8yBhKd/g:/l9AjRBwd/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700821597, "uuid": "6b5e609d-cd6c-4cf5-a851-5ea742652d62", "value": 1858936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700821597, "uuid": "35b50c19-1bde-4a75-9fcf-e6c6aacfb051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700821597, "uuid": "250fcb8d-8926-4219-a81c-a3f18278697c", "value": "SecuriteInfo.com.Program.Unwanted.4610.15698.22459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d9b91a-8afa-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700851824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700851824, "uuid": "b660759d-50f9-4510-937d-abd4d3714f9b", "comment": "Malware payload", "value": "4017945bf7d63e7a959aa4da533a6de4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700851824, "uuid": "1092dd36-c3d8-4a97-a544-4e3e38960d78", "comment": "Malware payload", "value": "a12f4248bad65ffb4d5aef03bbce2954564385b46831972c27a184b7b6f01fab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700851824, "uuid": "ea2c9cb3-e983-4670-9b93-a8e4bdc53a26", "comment": "Malware payload", "value": "30e5d002471bfd44c99522e7b097dab6b2715a18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700851824, "uuid": "a1d5b72b-e8d2-4ff2-8f87-38964e08c472", "comment": "Malware payload", "value": "6b24c63e68fe20b50790bc08df1dfb3e26e49cece58aa1e9e318bc3b0cfd7e70c15ced460373885da181058e7d338561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700851824, "uuid": "66b725cb-e5be-41b4-9531-add860e0154b", "value": "T1BC34691369E0FC62C45243F54F2D96EC7B6E78226E65878E23341E2E5A336B0D6273D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700851824, "uuid": "d8c0da8f-6086-4190-9f1c-79227ce41f2f", "value": "bd153cb170efdbdb1b1268a5a173f793", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700851824, "uuid": "caa992b1-60b3-4fc8-990f-bd117467f344", "value": "3072:Rj9wzylmNYa6kzwJ16Ukom4ua/oPnlSYvkcT35hurCN5U5w+x41b:Pvlp00J16Uko+jJn35hJNPv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700851824, "uuid": "2ee428c8-dd93-40c2-9158-da40f087d321", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700851824, "uuid": "cfaa7024-4fc6-4561-bb37-1be273235fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700851824, "uuid": "57076502-f833-4f45-b677-3f41cd367dfd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565f338c-8a84-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700801148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700801148, "uuid": "59d8492c-b84e-4298-b64f-dd0b8d944f23", "comment": "Malware payload (Formbook)", "value": "474296e9771f4f3381571330ce5d0761", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700801148, "uuid": "9cc09ae9-0432-4e7b-828c-dcc03ffd8434", "comment": "Malware payload (Formbook)", "value": "a1862b102bcb996c43ce1125ee3c6ef98b5d02a0cee9f3b6052698e6a99a27bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700801148, "uuid": "50f42842-0974-4871-9587-4a0b84277f18", "comment": "Malware payload (Formbook)", "value": "aafd16cf8076743db24121e5198408642a618a3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700801148, "uuid": "f97638f1-459e-4d30-8cdf-d4b84bae7c3a", "comment": "Malware payload (Formbook)", "value": "8c4967a136a53362b1c80963e86f5bcec2cb4a002b7df417325c0624c082f002a58c7ce2ea799a93985d0815e682fdff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700801148, "uuid": "c3fc9bcc-6759-4a13-860c-2fbd3769c3a8", "value": "T164E412387AFF2B33C9B127F94534414083F472A926A1F35A9DCA91EA0566B010F91FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700801148, "uuid": "dd71d5e2-e574-450c-a206-a7f452dd35e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700801148, "uuid": "9a598d04-a4c7-4c19-a869-eb989086cac5", "value": "12288:R1k1ELt0bzdw4autdTop4+Q89HznBxwAX3nF5q:c1OJXugp4bEHDLXX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700801148, "uuid": "8ea03ebb-0de2-462b-95fb-a761443d36ca", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700801148, "uuid": "95a22c72-100d-4067-aa9a-63031f98326b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700801148, "uuid": "cc700131-385a-4acf-ab7f-7cb194ae23ec", "value": "474296e9771f4f3381571330ce5d0761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4306a5ee-8a89-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700803263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700803263, "uuid": "1082361c-9fc8-4f09-bf1b-8232be6116f0", "comment": "Malware payload", "value": "dadafd0e9cf90e6ec7244b1ed2a11eca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700803263, "uuid": "5f77af04-9389-46f8-a1b7-a11a35924690", "comment": "Malware payload", "value": "a2cd4272bc5085927aa3a532d849804bd609c252beaf76d3d0e6d9a1e4e0144b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700803263, "uuid": "65f9dbb1-9af4-41f3-b497-69c41d8f15a9", "comment": "Malware payload", "value": "98436daf69c89d07f4ab4bd2cdde6b5691d1b075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700803263, "uuid": "0ec0366c-a7bd-4b01-a522-14e76203635b", "comment": "Malware payload", "value": "0c6a18fe9001afb0be3030fa581f1efeee4367c8653c9a6f656d6db4d1e423838fea7ed4424920cc217a690b40e32422", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700803263, "uuid": "d74d089d-10c6-46f7-abc4-8d091dc49afe", "value": "T1BE351871BBE48727D05F5F32E46E372D5B71E8926312A74BC84C23B91DE23142D067AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700803263, "uuid": "84cc4acb-bf1e-4a96-bd57-c5502fbdf4f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700803263, "uuid": "f5cfc6c8-161f-43c8-9e69-906b4cd86f03", "value": "24576:fmfmE0bk3oLIK2RjfjKZEZlUlPs5pDX1cZ:fmfmE0bk3oLIK2Rj4EwPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700803263, "uuid": "efc2ea55-5bb4-4d29-a368-2f403bdce74e", "value": 1121280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700803263, "uuid": "d4491701-0a59-4338-8539-eb51918be67f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700803263, "uuid": "fb1cc6af-6c00-4df8-a611-765294489fca", "value": "SecuriteInfo.com.W64.MSIL_Agent.EDH.gen.Eldorado.29910.17503", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7ec358-8aab-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1700818013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818013, "uuid": "ad7bec77-be58-48eb-a703-cc2ef88c3caf", "comment": "Malware payload (AsyncRAT)", "value": "895e159d009d2f5f77e0411ec55e5d1c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818013, "uuid": "782d77e9-ec02-47fa-a544-4dfa8b39f682", "comment": "Malware payload (AsyncRAT)", "value": "a3c85ae937fa498fc73db79b951072565bbd13871e121ea54cbcd6a5b5ca962a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818013, "uuid": "58cbe53d-dfb9-43e2-ab6b-599eba25f6c1", "comment": "Malware payload (AsyncRAT)", "value": "6531925d61dd4188685b642bf5be98ba50702b29", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818013, "uuid": "05e9b2e6-7270-429f-b435-03aef790604d", "comment": "Malware payload (AsyncRAT)", "value": "193b9c3ea0ca7056606368db548a912a393a8051d026ce3115891c78901199b668d7fb224e0a758624ff2269c132b151", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818013, "uuid": "8ea27125-addd-45a4-a21a-c7a24dde4915", "value": "T1F983070B969878EEE01B9BB36D5B9F4DE678BE536D09CB052221074F50660CFE207D93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818013, "uuid": "e5deac3a-42f2-40fe-b398-6c04b9f7fffb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818013, "uuid": "12a8e39e-e88d-45b9-866d-35742c961db3", "value": "1536:FyJxJgYSiBgCnp5m3pEn2jCq/2K4FBLdqPeuyBZS/n4bHGbgyH8uK2t5QK2jr:FKgTiBD5mCQB/+RBZSNbgyHVK2t5QKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818013, "uuid": "9f7958f1-37c4-4539-bc2e-45d7d5000a2d", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818013, "uuid": "e4cbb5f5-404b-4227-9820-f8f719ab43c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818013, "uuid": "a6a52da7-09f5-4071-95f6-cf146963501c", "value": "SecuriteInfo.com.Trojan.InjectNET.14.31666.24624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f2a751-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864255, "uuid": "c3f5950c-61a4-47e1-8b10-714d4b0e26f5", "comment": "Malware payload", "value": "a897d0f14e0cc9ebf413f6bcb35e8a3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864255, "uuid": "cbe13049-3770-43b1-a6f2-d2d526d5a5ff", "comment": "Malware payload", "value": "a48b72eca106729c12d985f1737f2079ee075a6de4fab3a8784a64e5359097b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864255, "uuid": "0d468a66-8015-4866-83fc-5ba05578312b", "comment": "Malware payload", "value": "1485844a696cd3ba2c59541e0af1b19a394330a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864255, "uuid": "efc10bf1-095c-450e-9c78-f68b2b1599ee", "comment": "Malware payload", "value": "07fd5f66dee9ff3792e3d5ec10de58873af7c5dffb3ed41bbb1eea65f3d7921a9ed1da6cd115c0b47b361adbac2805a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864255, "uuid": "a14ede82-7003-4d5a-bd4b-95b983924ea5", "value": "T1E6D48D12F3D14837D1732A794D2B96946C26BE202AE0984A2FF4DE4C5F39B517E39393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864255, "uuid": "e8d969b2-d1ef-49b4-8494-43da4208165d", "value": "244e8fca72faf0258de3e13b2da2d4e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864255, "uuid": "e769838c-ed17-480a-b30e-304b8078decc", "value": "12288:/CyXxZz3jpuE0KHs7nytwgtr2uxxr5XYGstq888888888888W88888888888:60xp3tuXVnytw02iVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864255, "uuid": "2a4e136d-bc5b-43eb-b3aa-9e5bbb18356a", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864255, "uuid": "425136f4-7aba-4ab9-bc8e-c70c9c4b86b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864255, "uuid": "36e3c9b3-ee90-47d2-b6aa-6da5c6ac95a5", "value": "SecuriteInfo.com.BScope.Adware.FileTour.18142.18911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5025fee8-8a60-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700785676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700785676, "uuid": "07216b66-2252-468b-a47d-967f3291b83f", "comment": "Malware payload", "value": "fe02d4576a17fe76f9f0d0c3806e6b32", "object_relation": "md5", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700785676, "uuid": "9e89d322-fc34-4d59-87d9-9f58e488e79d", "comment": "Malware payload", "value": "a48e154e64a9d4ba4853c922dd6238116130556d87836f3f88b744561d7b508d", "object_relation": "sha256", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700785676, "uuid": "04db4e64-d6ab-4d20-9310-ad91c5955602", "comment": "Malware payload", "value": "99665cf57e0b3e3d7a65a314e9e725bc49072d69", "object_relation": "sha1", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700785676, "uuid": "99090554-5b97-46d8-b341-022385fed51d", "comment": "Malware payload", "value": "60bdb055ae397ddd18c49767e7687c5d2afd4297618a227542c6993693e388394ae22889d4872bc6c07bf013711aba78", "object_relation": "sha3-384", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700785676, "uuid": "f32a9705-abd5-432a-b8cf-045333eda9d6", "value": "T121F00570A48A2164F4975CB9E051213712A4FAD53813BFD71809D8DF9830D9BCF230D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700785676, "uuid": "da96aee9-311c-44c5-b1c7-b7a068c426eb", "value": "12:NYRl8bTvbYAKsMandB6I60PNmZxqCR2HSs/B2zyYgl6aS:iRATv0AtManUZxqCR2ys4Lg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700785676, "uuid": "c57eabdb-37c9-42de-a66e-815c98b25701", "value": 542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700785676, "uuid": "86d7585f-05b3-4834-aea9-f8342bccf240", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700785676, "uuid": "78b30b7e-8859-4795-8e2a-e6c1f9bf7b4a", "value": "FACTURAhdthkJ_j_kA(547).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309bc0a1-8a92-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700807098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700807098, "uuid": "c5c01cd7-6d67-4f78-8d54-8e540e98dd04", "comment": "Malware payload", "value": "21e36c7f8a7f8f810893d4ff810a6951", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700807098, "uuid": "8b90cddd-ddfa-4eba-81da-aea6c9819948", "comment": "Malware payload", "value": "a4cb8f801a1ffd8245756b273de1eb9d39331248b0caa10b1ca6a4eac1d9a676", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700807098, "uuid": "e3e2c5a9-a22b-47bf-8724-059c2f331445", "comment": "Malware payload", "value": "7466473162000e27cc8fbee09cce87d5dc3fb474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700807098, "uuid": "1dcbb583-256c-4259-8b97-ee7856e9e114", "comment": "Malware payload", "value": "af5a69f1a87677a0317a87766e89e5a099eb00bd516be63f95e3764a71edf95edbc84b53b39e852de76486e975e17169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700807098, "uuid": "4d2fc4e8-de1b-4233-873e-0d78a95bffba", "value": "T1C7446A1375E0FC61C4524335CF2DD2EC7BAEB8217E659B8B26582F2A69312F2D627311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700807098, "uuid": "b083c79b-a518-4b51-8427-73cb81558903", "value": "26174cd618191e0f458fd2f9d0ece6c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700807098, "uuid": "dd10df17-83c4-425e-8316-849f615d759b", "value": "3072:vjQ5SrT3zZtSpo3D9Ei0m396PLgYbBhtbC5Ru2Ao:76MT3zZtSpo3B9F396bkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700807098, "uuid": "1bfc5977-affb-4236-b794-6bf2f81082e7", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700807098, "uuid": "7e692f71-257f-41d1-b556-daa746f24e96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700807098, "uuid": "cb018359-21bb-4d88-bac8-3a5f1d29ac12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35854f8c-8aca-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700831158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700831158, "uuid": "f96b04c6-bb15-4eb3-839e-0c0f781373b2", "comment": "Malware payload (RiseProStealer)", "value": "3efc2519dbcc7b558ee68bb7987e62fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700831158, "uuid": "600fd791-4f54-4901-bf97-65d20c55e043", "comment": "Malware payload (RiseProStealer)", "value": "a556e789a0a05ab9ba9f4468b2e106f32c1dd8ba4837427d2a1ffc6238ef4b7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700831158, "uuid": "237de548-7fdc-4384-aeb4-71c4101912d5", "comment": "Malware payload (RiseProStealer)", "value": "58c1f9c9311db8e879e90eab654571c9f8bd5e9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700831158, "uuid": "83d872d1-ab7f-4055-8925-eecb1b7eb29f", "comment": "Malware payload (RiseProStealer)", "value": "1c768352393835d3ad1b27194926a68efebe41baa40fe88a2c8f9aff72f25bcdbe252375880795ce6aa1b7b355ce4116", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700831158, "uuid": "1f2e6f54-8718-49a6-b91e-1252ed7b8a47", "value": "T188659D21FA08C0B7D09211B0916D6A7B95997A322BAF4CD3F7C05E6D01B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700831158, "uuid": "d7bf24d1-74f0-4ebe-a441-f8f988322581", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700831158, "uuid": "ffcefd54-1101-4ddb-a491-536e1ee0fe4d", "value": "24576:8N+bPGUvbX8AdjI9Bahe/wz78RaiyhrbnC3OlKekN4srzEhbaLUCKWmRlsSmYTzC:8wyYjI9EheW7WaiUy3V6baLUCmRlnmYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700831158, "uuid": "6876a1d0-bc61-4c04-a821-ab415448d4a2", "value": 1542338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700831158, "uuid": "1673baf1-2279-4cec-b274-0ed09a1f0c09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700831158, "uuid": "cf329112-92dc-4596-a392-b8e5b57a5c12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6f11c2-8af6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700850124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700850124, "uuid": "2becbf5e-b152-426b-bf12-b9622d91cead", "comment": "Malware payload", "value": "6c955ecc795069d0d2f03efa82b4d270", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700850124, "uuid": "661d6730-49cc-4ca7-8922-5035b790f505", "comment": "Malware payload", "value": "a59390bce49571ab914c248d00f8d696bee97a6467eb080de73fa591c67662b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700850124, "uuid": "ecce8aa1-e7d8-4014-9b6f-377feeb59d63", "comment": "Malware payload", "value": "deda7cad5574c1a881b66c903dca72a963325f55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700850124, "uuid": "6a3e7e96-2934-4481-b75e-abda65aa25a8", "comment": "Malware payload", "value": "23b1a08326af0d9da956a2b31b0cb2bf49fd67684c6c89a42a34a7e739ce3d4d486d9d42e2b067b9a6b510ad7489aa82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700850124, "uuid": "623caf37-2e9d-4004-bf4d-32461a967bae", "value": "T1FE36339330516139C4B1683284F643339636FA3AA1BFE1B5698D09DDEF93EF46108B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700850124, "uuid": "76f8b565-97bb-45be-ab37-d41fa571c918", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700850124, "uuid": "3d764e9c-3159-4795-bae8-df5b8de34285", "value": "98304:0d3L0TpNwgdnac+LdvXVajAqlxgc92ca6Qc3zQxHI7Fya0pYrAKlE:A3Lq6gdna/raEqwzca6QcjDopKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700850124, "uuid": "6cc325ed-b045-45c8-bdbb-4fa237046dbc", "value": 5179704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700850124, "uuid": "cf241adf-00c6-4fa5-b2e0-5dc4de31c0e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700850124, "uuid": "b34fa93c-cae2-430f-a28a-f99c4f4951a7", "value": "SecuriteInfo.com.Trojan.Siggen22.15070.2937.31039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3979bd98-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864235, "uuid": "80e238da-32d8-4878-a05a-a96fb435f0a6", "comment": "Malware payload", "value": "90c7ed5ca940316b6187c3cd4b6b5289", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864235, "uuid": "40b33dc0-1b16-4168-8dec-2ef5b096d912", "comment": "Malware payload", "value": "a71410f8ed7cc4667a19c193455db5549191b688cde34411d1012fe09901e4e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864235, "uuid": "68d7542a-8e08-4e30-af6a-3c8c1657f989", "comment": "Malware payload", "value": "20430bc0a612b8a36ab474024d24c19eadf54d53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864235, "uuid": "6de31194-3ee8-4c99-9fbc-c0456cf087cd", "comment": "Malware payload", "value": "bd9cbe9b9b45466ccb14c11668b1b1efd5ef5ce7e6e81d6dd5c07479845f84c1e3b308685d2e56635af924a58479acc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864235, "uuid": "ee02f383-f358-4980-a51e-1ad97e92c0aa", "value": "T102234C07F5D240B9F1A1BEFC0D25E6D9BB3B7E311E29605997780E4B8D2A79008E8357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864235, "uuid": "06e43ffe-1768-4d5d-855f-fa03c6b2b882", "value": "2f4e4cb525bbf86c784775e1fd86d2dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864235, "uuid": "cbf4e5e2-b909-4e07-88ae-b439dab45dfd", "value": "768:WZ8qC6wsKMi/A8FVg9Kz0ppnZA0huZvrx+mpJM4dwr96mq8lYYt3:WgBAyz0W00vpF69tq8lY43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864235, "uuid": "ca8dc0fe-05be-4f9d-bae7-74bcf03c79de", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864235, "uuid": "c3d2c702-176f-4f39-950a-57b8fc759b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864235, "uuid": "5b0bca4a-91eb-4164-b1cd-2fb3a2cc2c57", "value": "SecuriteInfo.com.Trojan.SMSSend.4449.15748.30658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90968c6-8a9f-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700812937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700812937, "uuid": "cd2a859c-867c-4bc3-bbdf-d22fbdfa85c2", "comment": "Malware payload (Smoke Loader)", "value": "0a603a16ff9136c693c009e29023422a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700812937, "uuid": "d8a2f4f3-b30c-489e-ac5f-59e6fd9eb77e", "comment": "Malware payload (Smoke Loader)", "value": "a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700812937, "uuid": "4c6f6d94-3ccb-4012-8a5e-b3811da38dfe", "comment": "Malware payload (Smoke Loader)", "value": "22c858d81e972eefeb917ce9a227a3b6276ce140", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700812937, "uuid": "7348a16c-8ffa-4965-99c3-70e87757abdd", "comment": "Malware payload (Smoke Loader)", "value": "e94904decd9771f582099818d3676f69c9bc6773d33223c6a923a6bf280122149eaed2b0cb0720d8f41672cce71dde11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700812937, "uuid": "ba92a42d-4353-43c1-80f3-9a419a8a2751", "value": "T1BE44590365E2FC61C46207345F3C96ECBBEEB8609E65978727582E7A6D312F1DA23311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700812937, "uuid": "a5778b58-5828-44ec-ad31-9b09ce71d58c", "value": "26174cd618191e0f458fd2f9d0ece6c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700812937, "uuid": "4f946325-2704-452c-b25a-9be4edc06e06", "value": "3072:AtCrzYS4GBMBTMTHr7BZPvPLMg17/avcRmotnFcjC5RecAk:qqEskTMTLFtPLMg5/aEmobc+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700812937, "uuid": "38517576-e8a8-423f-ac45-2cfb8a2b4639", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700812937, "uuid": "203b2c0c-f2d6-4720-98bb-afe71c98b7a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700812937, "uuid": "fb535012-3140-4693-aee3-db7384ecaaf4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8091db-8ab6-11ee-8907-42010a9c0042", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1700822719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700822719, "uuid": "d6b056e6-4718-4b70-a9a9-386f44c13500", "comment": "Malware payload (Socks5Systemz)", "value": "2627e60464a55b507f4ca6bd340afdb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700822719, "uuid": "1dcdac9e-6233-48e6-90cc-6f572e62ccfb", "comment": "Malware payload (Socks5Systemz)", "value": "a8a7bb42efbc07a13ec6dbcd36228333820f892ff0afc9e45f796580bdc3ea49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700822719, "uuid": "e60895ad-9706-4385-bfee-5a36bce3ae79", "comment": "Malware payload (Socks5Systemz)", "value": "e9d57586f634ed0cb3fc21ac0df36ff1d38f2659", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700822719, "uuid": "b5491048-d22f-4f84-af18-2bf7fe60493d", "comment": "Malware payload (Socks5Systemz)", "value": "c59bde379499e687c5ef82120bfb89ab41ba11273db6dce3459735a7bd86c13aecbf074b6192d6812d7e4521c4a7eb33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700822719, "uuid": "09b2c5d2-374f-4b69-94ca-d956dc55064d", "value": "T1CE4633AE97D0E53CD350CCB4C82F52902532B7BB36394984118D49ACB7663E8B47E7DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700822719, "uuid": "890d7492-070b-4e6b-8db0-70627ddd741e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700822719, "uuid": "277e0856-4901-4c78-b20b-5d00507729f9", "value": "98304:wchHMKyDyc70SwAvO01JgBixtqMhlE4f+Ue/czLiRZvcFqhblsXlwagEblE:Hy3l80DBl5f+2QvQus1zgCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700822719, "uuid": "b5c027c5-b4e0-480e-b852-01aa201ba79f", "value": 5418473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700822719, "uuid": "4edce3bd-da21-42b4-a29a-772d471cbdb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700822719, "uuid": "35949935-8a99-4539-a358-67ffc4f8b812", "value": "2627e60464a55b507f4ca6bd340afdb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973ff22b-8aab-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700818007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818007, "uuid": "bcda6239-f743-41ec-9390-5da672725f56", "comment": "Malware payload (Mirai)", "value": "f46256dc8ff9bb0f6ddc777e391da4e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818007, "uuid": "8952fef7-d213-47bb-a587-c06c0b6b7c8c", "comment": "Malware payload (Mirai)", "value": "a95103bb10b7fed8be24446a5d05ff75fe60fc5660324b4aa71a0a1dd3e65c70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818007, "uuid": "4d28b060-6458-440a-92b5-730305f37434", "comment": "Malware payload (Mirai)", "value": "b77237ac2b73b03ed5c3ea3cf99030066138a489", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818007, "uuid": "99b00ce0-01d2-478d-926a-9b29e5fa6b60", "comment": "Malware payload (Mirai)", "value": "05cead66f67c5327eab2f03b187b594671cec53fd1c523cbff92ed466153ab35393e1467ee1dc0ea3f4fa133d2fec481", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818007, "uuid": "2ba6017a-b5ab-413a-8b93-f990b9ac4629", "value": "T160B3C44ABF510FFBE8ABCD3746ED1702398C954922A46B767970D828F18B14F15E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818007, "uuid": "3340d6b5-6bee-4867-9f6a-8dc1932d355c", "value": "3072:QuYeglti7K5C8OgNz/JVQjyjceS4wbZnzp:RYeglti7k1DJVwmcawRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818007, "uuid": "d2f2fe78-5f5c-4bf8-bc65-075055772480", "value": 110540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818007, "uuid": "646c0b1b-a7b1-4b13-9a6a-21be33a58667", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818007, "uuid": "9fee733c-0bb8-4257-8e1b-de7bb1a5933c", "value": "f46256dc8ff9bb0f6ddc777e391da4e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674e6587-8a63-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700787003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700787003, "uuid": "94b3df77-1a6a-458e-a58f-ea84aec698ea", "comment": "Malware payload (Mirai)", "value": "754c412ff118ec1d0b4b0a12640b83d5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700787003, "uuid": "4dc91cde-5670-4975-8cfc-8b5286fbb905", "comment": "Malware payload (Mirai)", "value": "abdcb6b64dfd4f2146a9a915b996afc6c12409ab5fb4c4be4dcece833ed5ad69", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700787003, "uuid": "32c314ef-ec97-49dd-803d-7361255749d5", "comment": "Malware payload (Mirai)", "value": "3cddb24fd6d7c0f721be84d485f15bc7a5782cc9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700787003, "uuid": "78233108-2196-4b50-b353-f44dedbdd87a", "comment": "Malware payload (Mirai)", "value": "58b42a19a062b0b407561245539ccee226095d1e514a108018f6aacdbfcf3f5e45eddc3631813a1a4afc3d31892de0aa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700787003, "uuid": "e513c8ad-d7fd-4ec0-94bb-1ca340bd0000", "value": "T19C63E74AB9819F01D4D731BAFB9F41493253AFB8E3F971019920AF6423869DB0FB6512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700787003, "uuid": "c96bf22e-3732-44da-a7c4-f79cd44b88bd", "value": "1536:RNJnjHaS3vaylOdl8y+hinn2qn8RYkxd6Jj:NaS3vacWn2qn8RTdSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700787003, "uuid": "ae2ca990-1b72-4f95-8149-7a773de2d855", "value": 69932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700787003, "uuid": "fc03fc7c-bef2-45c8-a4e2-12f5f5c67630", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700787003, "uuid": "7d62d429-9b53-4907-b038-e9b95365e0fa", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75633a84-8aeb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700845438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700845438, "uuid": "8179019f-ac7e-499a-b709-e97aa34e62c8", "comment": "Malware payload", "value": "bc9ae5fde063670508888399f65b2fee", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700845438, "uuid": "d298c279-f75d-4ee1-8fdc-38ac1666cb9c", "comment": "Malware payload", "value": "ac47215a8231818e4c424012c1527a3e70087739865b035be9b47fb75d34c030", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700845438, "uuid": "386883f2-ba0b-4b1f-b785-48adb5286b29", "comment": "Malware payload", "value": "8f86773a0da30ccb9e8ba9090a6a405d9a73c510", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700845438, "uuid": "ecd2a5fd-91ea-4228-a2e3-bb5753babd83", "comment": "Malware payload", "value": "5d1d0643e7087e47f0e2dafe380c86e3d4a40d1dbe2e007a6648e5f5eceabcb2724042f857f7687f0c274178953d3e7f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700845438, "uuid": "da6bc70f-eb22-4827-8357-18e69a59768d", "value": "T17BF44BF472D077D70F75694DB3CE40B23D54B457F0EEEE86228D0D1E928429899ABEA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700845438, "uuid": "67941b93-2c4e-43c5-a14e-682a15edeb8b", "value": "12288:O7oh5QoNGWGZyTPnjAmM9aZKTz1RpxFg+cO6lKc9NTu7i8AO7QXM3us4PXc:O7oh5QKGWG0rboasThRpxr56si854Pc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700845438, "uuid": "07e9afce-6cbd-4136-a0db-11c152c50783", "value": 730262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700845438, "uuid": "ddc86194-8281-4826-ba29-490077c44efc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700845438, "uuid": "3c704221-e640-4890-a0d5-8d5420b597b2", "value": "crash.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc46fd10-8ac2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700828055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828055, "uuid": "5e9610d0-8344-4f35-a4cd-57c5219e5a2b", "comment": "Malware payload", "value": "b93a7b29503f28158ae76c5b8fe681f6", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828055, "uuid": "30fc5340-7e2d-4c45-8e12-be037ec22074", "comment": "Malware payload", "value": "acd72d93a812038c0ac94edc7f01be247dcf522bb5c70d60a256ddeb30ff1950", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828055, "uuid": "cba365e7-144f-42b8-b7fc-e814a18fa49c", "comment": "Malware payload", "value": "8b0a3cee57fdcf8360911933c37924853ef16b41", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828055, "uuid": "813bf47e-ba3e-425c-a9c1-15af8f44da4a", "comment": "Malware payload", "value": "3099fb59a0548adfbeb550f7703834a2bdeca0285f32a6887d0806e9b5324dd4a045000836a3a3c9adc8d23639904075", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828055, "uuid": "a92704a8-b261-4308-bfab-486a5c03c20e", "value": "T121A1720521D0285413D72BFBFB2BA0C2E65D94EB3D564C4FB180ED8D6E8496ED6F4A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828055, "uuid": "2fa56b44-64e1-427e-887a-f8dfab9d2f13", "value": "96:1C34Efl1bSH+lcVkbmAVFkNFE34CneVBKbf8l2uKuwr:A3uelcVSPkjE34OIwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700828055, "uuid": "e2a6efd0-d844-467c-9a69-220a7c69e7ce", "value": 4823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700828055, "uuid": "7a17d3a4-8489-47ba-b13f-63347c658342", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828055, "uuid": "f469e54b-5ea1-47e0-b529-cec0d507b603", "value": "Agenzia_Entrate (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6363b5-8ac2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700828005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828005, "uuid": "9e85a99b-bf2e-4f9c-b5a8-3b4bfe87143e", "comment": "Malware payload", "value": "b7ca22f18c6a266ce3735d61ff873688", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828005, "uuid": "bbc55294-0c12-4228-bbec-94155ea3784d", "comment": "Malware payload", "value": "ae789c227c3e197e79fbacef2c50898288cb5d5d0c21349c58b835adc97ea2fe", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828005, "uuid": "b79272ae-1f07-4aaa-9548-94104d861990", "comment": "Malware payload", "value": "875ae41d2cf0712b2286332393ba5dce2ab37f91", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828005, "uuid": "53761132-2912-4534-9963-7fe42c2b8ac2", "comment": "Malware payload", "value": "cc1af8c935163a81e57d60cb955b551975f2812b918dd2605de30d941270e2ef88a14dbfca1079763b1b532bb34ecc8f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828005, "uuid": "7a132732-6bd3-43de-a001-b8912205fbb0", "value": "T1A8A1718019D260C8234B63E37F2E10E0E4B685EF3DD4991BD184E5D0A958967EFD9F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828005, "uuid": "609bde37-4c8d-4398-b16a-181430df1391", "value": "96:mAqHSCKS/elI9TWDhJxcSCGVXy3h8mAm53y3SwUP3PY96lBqk8jfXdqk5j/5HaJ2:mf0IQjxC3hWwISTP38wK7JavgbZ2kKlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700828005, "uuid": "4a967699-cab6-4d26-baee-5e6b802a6228", "value": 4629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700828005, "uuid": "f229be9f-35fe-4630-8a1f-2687d45e73f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828005, "uuid": "267f177d-f9e7-4c86-b4d4-8cad6de990fd", "value": "Agenzia_Entrate (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b2fd6e-8ae5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700842922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700842922, "uuid": "6476934b-3f38-42c9-aa9b-2031a1683bf5", "comment": "Malware payload", "value": "3ff8b69101e003bccbeb38b0917afdbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700842922, "uuid": "3d4dcf41-756d-4c8c-a3bc-717d80de53e7", "comment": "Malware payload", "value": "b1469fb45a4dd130dcbc7ac97b903122f4617f3086a067e2a9e0c88118ed493c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700842922, "uuid": "81d44639-1706-4349-9e24-29111f461694", "comment": "Malware payload", "value": "f664f509bdbd6f432e55a8af7d6dfc109930f0fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700842922, "uuid": "1ebb7852-30ea-4c74-a3d6-61faa5befa35", "comment": "Malware payload", "value": "255b9d8defbccc9f5713affaa8ef9977acdde858c782d4df1343468c44bff9161b10f341186dfe9f9a0113dceb3967f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700842922, "uuid": "ce754ce0-34fe-439a-8803-b6d05376c126", "value": "T12736339330516139C4B1683284F643339636FA3AA1BFE1B5698D09DDEF93EF46108B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700842922, "uuid": "2961f67d-2fd9-4521-9d71-3c624eea3b0d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700842922, "uuid": "60fe6623-9768-4ae9-949c-ed7dc350aaac", "value": "98304:2d3L0TpNwgdnac+LdvXVajAqlxgc92ca6Qc3zQxHI7Fya0pYrAKlE:y3Lq6gdna/raEqwzca6QcjDopKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700842922, "uuid": "7c81a330-a555-4333-a61f-4ccf8c172be2", "value": 5179704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700842922, "uuid": "b092b334-ec7b-4c2a-b478-24dd538ae80d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700842922, "uuid": "2b5edb95-4086-4487-b886-a5f56775efb4", "value": "SecuriteInfo.com.Other.Malware-gen.12805.23460", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404b7170-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864247, "uuid": "01546f1b-11f6-4f6f-aa3c-6e811b3a3449", "comment": "Malware payload", "value": "1a2853dc7e69cf45e8abaf1eca9eae22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864247, "uuid": "4c3dc4c2-702c-4ea1-940a-87562503ab26", "comment": "Malware payload", "value": "b169f5772d8d29c87e29a8d143fc8b94608246c7f84361cbd2a91f04088edf5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864247, "uuid": "4ae16e64-0e64-4f2a-b205-af5317bfda43", "comment": "Malware payload", "value": "d9c6af2cc9166284e49868cca31c8d77d53a0fd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864247, "uuid": "5fa4bf51-d6da-4cef-97e4-61a55b278475", "comment": "Malware payload", "value": "abdea45ccf3508a7b5e0c62b7b403e479e8a44ce31f8e33fb0a327068f1a9d6f2e27e659981b0633c8baad657ecfc347", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864247, "uuid": "ab464652-64f3-4c17-be33-e79a9b98ad70", "value": "T1DB751A23361AC037D16151B1642DABA6908C7D3997A598CBF7D00F2AB6E11E73A31F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864247, "uuid": "8f5c983d-8263-4fd2-9bb0-754e9ae0ee4b", "value": "28a476df8d774f1ac93059fd54e499ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864247, "uuid": "206436fb-6c70-4b98-994a-a86f6f5503a4", "value": "24576:eXPgquYg+8/M99utHS2sF+7EgXOBA71EczRvi8/0f1eKqwTYIeE+:ITuYg+8UE375GZ8i1eUT9eE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864247, "uuid": "810ea1dc-37ee-4542-aba8-ef058f72dd88", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864247, "uuid": "f51c8441-20b3-42ca-b539-8572b57fb60d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864247, "uuid": "8f947ea7-3844-4ba3-b898-1d7a72d76979", "value": "SecuriteInfo.com.FileRepMalware.16906.31630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e27c30-8b24-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700869805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700869805, "uuid": "5af25703-f842-4a41-bd6f-c9a780cff0f9", "comment": "Malware payload", "value": "7a3be58d923a70a242213dfe2e22348c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700869805, "uuid": "744bbb90-9913-446e-bbb7-cdc22b1a7184", "comment": "Malware payload", "value": "b19ada1d239e38203da9866342e9b80000d4781bbc1a0e84541fdc57d20f99e7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700869805, "uuid": "8d87b714-1066-43ce-a1be-b19f7f01c6ba", "comment": "Malware payload", "value": "c6c08156cc982313205e83794692901e32d61983", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700869805, "uuid": "f90e7188-746a-42d1-98c7-a8fb7f84e5cb", "comment": "Malware payload", "value": "6fa7e506a2bd7227058384887305d36c87456121f8699b0b1b46047271645b9744a7616387e1f06459ba8acb263f187f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700869805, "uuid": "f460fd0e-9b38-44f4-98f5-4bf70c5464e8", "value": "T1DD4339C4AA43D8F6EC040A3915B6E7B2A676F5391058FA93D7D9DD31A842F02B2473CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700869805, "uuid": "1db155b3-df17-4292-916b-aef02ab2aa9c", "value": "1536:M+OT2TWkdA4/4EbsSjc4tvGjBcXJq5yEFPU0VcEYOVQR:M+02ikdA4wSjNtvGj4MPBVr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700869805, "uuid": "0393742f-924a-4fe0-9921-11ee761ec75d", "value": 57988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700869805, "uuid": "f4cd6da3-b286-401e-b484-157d6c4cf34a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700869805, "uuid": "0294dc8a-5a23-4c1d-8746-75a391074421", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63026dde-8ad9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700837676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700837676, "uuid": "6b29f9f7-4583-4290-9737-1db0a0cdc7e8", "comment": "Malware payload", "value": "5603715070da3052695c47aaa9da5a5f", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700837676, "uuid": "7786b261-76f3-44ad-9b55-5d039b590c37", "comment": "Malware payload", "value": "b29ef6c7f3583388f66a9f63eb43b67986af6f58658a8fd7f64913dd0b6bc21a", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700837676, "uuid": "cff6e4c7-8885-4dc8-84c3-8c763462ee98", "comment": "Malware payload", "value": "0a931bf131202317d4218a5ccb34250a4c7b99ec", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700837676, "uuid": "3d925c7f-e85b-4d69-9da8-110260f7009e", "comment": "Malware payload", "value": "c7c292f0d4ffa7e7daf93667d30e43e7cb5a01ed2a7c5ca0aac388587a61717ae17c8bc010290aa6127480ae27847351", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700837676, "uuid": "618cf91f-7bd4-4295-b3b2-c29a37ee4bba", "value": "T16D45126572F0D4A6E2528B714C6AD13D96B27E008C2B4447B3EC3F6F73729C2C65B929", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700837676, "uuid": "306a9978-9456-4364-9b7d-0f348d84a737", "value": "12288:wMbMhqc1rFINZifjzdN2r6EIzlR6uCyj:pJ6rFIzifjH2W95Rnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700837676, "uuid": "81c06f3d-bc03-4c41-af04-8f6f8164af7a", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700837676, "uuid": "3c44dea4-8074-40d7-88b1-354e9d66bc59", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700837676, "uuid": "7438eedd-c98d-47ed-bb08-b5addc3fb10f", "value": "Order.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013c30b3-8a99-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700810025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700810025, "uuid": "6f874a3c-991a-4717-aea5-64cb8e670caa", "comment": "Malware payload", "value": "fee14513b3ee3ba358da4937900b67c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700810025, "uuid": "8e19104c-98a6-441b-b1e8-bf28e3314d4b", "comment": "Malware payload", "value": "b2e138ea3c9e6424d54f592ffdd5db5fd7cd5c762e34b76a598b0b6e709f12a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700810025, "uuid": "4de66f80-02d4-46a1-a47c-a6e9466f3ffe", "comment": "Malware payload", "value": "6a33269d694e59b740e198a8f616d42d3f95138e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700810025, "uuid": "81b0fc52-05ba-4ef4-a292-abb56aa0df34", "comment": "Malware payload", "value": "26f247095fa51c33a2858877bb35e6e1580a8117a22e8b664e3def393fd800d2b4fe90372583561ab6dd2437cd588481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700810025, "uuid": "b7f612ef-ff05-4613-b6b7-4f88ebbcaeed", "value": "T13ED4F1902ACAB3AEC4DC617297D04C5D1396BD4E579ACA803E8DC34B9CF5B02995F273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700810025, "uuid": "2aea393f-7f8b-43a7-aba6-3565344a1bf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700810025, "uuid": "88da8fe0-8b2c-4cb4-afc7-9054917dde9b", "value": "12288:+BfqmY2c60z8qb9Iu0kGmuCNYeyd3H9AHngmgTlrp2EmU8d1WWcjAIxJ9mp9:vEM8A30XgNtydNAHMZr0bHTbhIx/mp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700810025, "uuid": "154506fe-5521-4200-9951-1dc79cf00bcf", "value": 636800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700810025, "uuid": "2662f2f9-5d27-4d39-b1bf-e22b138bb88c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700810025, "uuid": "5a9d4f6a-5b31-4d80-91b7-da964aa1c19b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6d7c2e-8afe-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700853454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700853454, "uuid": "dac2b07e-8f12-4290-b058-6c5a3c1e73c4", "comment": "Malware payload", "value": "3e474a4074d79fe6c4e9f803ca7c73e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700853454, "uuid": "2516ae45-3b08-40e3-bce1-0049caac5e4b", "comment": "Malware payload", "value": "b3847299721048f770d01dd2d651114f3dc4b3be299d88851a309025430d9e8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700853454, "uuid": "2d5d8f0e-18e1-49be-8944-817b2bd03b88", "comment": "Malware payload", "value": "2c6dc7653cf5448a5b2a0e8e81fd68768bc0ced1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700853454, "uuid": "0b321414-4af8-4998-8e2e-b2c6fbc9157c", "comment": "Malware payload", "value": "dca04cb4048198d662679a4ad34f59174a4a911164be874bf8b119ecb6b36b2c58200a2f2ff7f85c923281407b8809bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700853454, "uuid": "67ebf0b4-6342-4f0e-bb41-4b3477376fc8", "value": "T10C539407BF41CFB7C85FDDB306F68A1134CDB89715A4272A3170EE6C762A58749A38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700853454, "uuid": "4264cc21-d19e-40a0-a3fe-1b8d56e84a3d", "value": "768:RodCjsivBRSFSzBHQMKwXoYt7O2sCeK0OLLZ7C2gXi3joees/bGepneeP3W199IF:BnkoBNh0KZ7faObG0V3Wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700853454, "uuid": "a8d09b2a-bfde-403c-98d4-f9ec514f05be", "value": 64084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700853454, "uuid": "cc8a1270-2409-4942-9ad6-0c505c09a0a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700853454, "uuid": "b26d63fa-f2d5-4949-8e71-f445b3d04a61", "value": "SecuriteInfo.com.Other.Malware-gen.21661.9258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae133d7-8ac2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700828026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828026, "uuid": "a1ef52af-406e-485b-8675-3d3d03b21ac3", "comment": "Malware payload", "value": "a836d0a1145a9ac8e96b27e6c0c56175", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828026, "uuid": "ec78088c-c37c-41a4-9f3c-f5d976acb59d", "comment": "Malware payload", "value": "b55c3b50ee60e2bbc581f031c318aecbd45674e92e441aeaa2d2ffc50ac84041", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828026, "uuid": "d1ba67e0-7d7c-48f3-9957-26fed8b8a278", "comment": "Malware payload", "value": "a6e5c67cf6deeb73fa808ff12e51755ba80b2ea8", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828026, "uuid": "8ced15d3-f6f7-4559-8a89-47935d5731c7", "comment": "Malware payload", "value": "3170ec07953f0c4a3a0e95b12426747683cef748dda56459b166f1fd8711963ef99ca22e3e6fd0c5f36f7a57031aa41a", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828026, "uuid": "590ec36f-5da2-4cb1-b679-68e80834f078", "value": "T1FCA1690726E46C444A653BBB3EA981F0F06D9F9735E7110B6380E8D5B8D4829DDD47B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828026, "uuid": "f62bbaae-476b-4f5c-9ce3-c8f98aa6b7c1", "value": "96:xiGQWl2gD74wvnJjUYZ2m5Z8HisseZmAMmwnHYr8Xj25ioDVLNcV1T3y:xiZRgD1PZUYZr8Hi4jMm8HYr8zUio5LV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700828026, "uuid": "dad62c22-bece-4128-afb2-40706b31dee2", "value": 4756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700828026, "uuid": "bbca773f-9187-42c2-a56a-b21819ca412c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828026, "uuid": "d75978a6-f197-4d3a-b61a-7f56646d371e", "value": "Agenzia_Entrate (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5da307-8a77-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700795546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700795546, "uuid": "5a39fa42-92a8-4845-8324-ec3d8c2424ac", "comment": "Malware payload", "value": "a73515f107be14c65b4a977cec4a211c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700795546, "uuid": "c08c7771-21c7-42a2-b4e5-ff2f2db97575", "comment": "Malware payload", "value": "b7679af91c842b241b0684f4e42174fbecaa22241dc5ad9d1b4d47efa8305a6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700795546, "uuid": "1d6c17bc-85d1-4363-bdbe-bb34d0f0394b", "comment": "Malware payload", "value": "debfa1811d6219aae456f55d1134a1ddc82c4ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700795546, "uuid": "71853354-d948-4964-a6d5-b3c97a0629a2", "comment": "Malware payload", "value": "c6929b808e3ca8896c74a007db9e9226ea85b1a4a9040d910497ff2ead8ab6298192c7b8da8a8bd6af9bdd0cc303ce16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700795546, "uuid": "a9687bd6-1f0f-4c4b-a22b-722228de3450", "value": "T1EA953C1132F94B59F9F30BB856BAA615083AFC69DFD1C6DF1251948E0930AD0B970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700795546, "uuid": "6c2b81ba-1773-4f6d-a971-077b80d38916", "value": "c7fb2b0f7d1b9bb69de473555ebdc92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700795546, "uuid": "0c3571d4-959b-4da6-891f-3c1b066c65d6", "value": "49152:OzrUs3rGXnI3Fsn6a3v/8dQnsMtJf53FtwlhcHE:Os2s6m8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700795546, "uuid": "59855884-dd88-4b40-a901-27b26a331758", "value": 2019616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700795546, "uuid": "611ad5df-f3cb-4530-8a22-d2d2f96db6e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700795546, "uuid": "23a9bbcc-267b-4e74-b73f-1dda51d2e9f5", "value": "ld.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f45aa42-8a9e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700812196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700812196, "uuid": "851650af-9c63-4840-920a-aed84437e5c3", "comment": "Malware payload", "value": "0fe96707641de54fbb85013e2e2cc47f", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700812196, "uuid": "7373c652-9fc1-4cc3-87d2-1251da4f3f8a", "comment": "Malware payload", "value": "b8c023010bbeb595ccf31e9d405e5fbd888d1649c2fa204adc9610b6b732d946", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700812196, "uuid": "00065e22-43f4-4aae-811f-19ca60cf57b3", "comment": "Malware payload", "value": "f8bb9f4ce3777d002641df00c0a43497951d1c0a", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700812196, "uuid": "55ad55c2-1432-43e1-a0ee-c0be571b5a75", "comment": "Malware payload", "value": "8bf9020d866e0ca9685ae245880b1fb8028e542b6c14c26b72b135175ca0050a1ca6381a0cf31126d8dc392d2feb9d57", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700812196, "uuid": "37f71b13-ed93-4b84-b01c-48f2373a7412", "value": "T162D2B543F3A7DD26E11891B01927C3C1306ABD494F6A9687729F7F2CBEB12706A4074E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700812196, "uuid": "ef8e5137-7dfe-43b9-b552-c4e93ec69c10", "value": "192:mOu83oAN39u6lfJ3LNkgcs8QeLQIRhInAMoWCxcc6McBkJ8fv0jJ7vJ0vVPEG19i:mOuCxTZVMiSHuT7U9jgbBkCDQxz99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700812196, "uuid": "1b976a09-635d-4c50-afdb-2c399fe1c840", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700812196, "uuid": "d76be609-32f5-4d94-aa67-4bb99125cfb1", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700812196, "uuid": "d1f541ad-5164-45b6-b4dd-b89c2f59232c", "value": "0fe96707641de54fbb85013e2e2cc47f.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0185137f-8aa1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700813461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813461, "uuid": "c60b5e8b-cb26-4e04-88c5-b859694a768e", "comment": "Malware payload (AgentTesla)", "value": "d1a249424c215c49e09dbdff90976108", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813461, "uuid": "476a97e8-d48b-4041-bffc-ccee920e4597", "comment": "Malware payload (AgentTesla)", "value": "b900561fb670c0e97d474ae9d54a8505010dd9b182823b1bca74e7242bc72102", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813461, "uuid": "8c4917ce-8e59-41ff-bc5d-f590052eb7e7", "comment": "Malware payload (AgentTesla)", "value": "7e36a2fd9c96a435ec6cbc3e1be4f838a8e98da2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813461, "uuid": "2766d7ba-d19b-4273-9bc3-7fb638607038", "comment": "Malware payload (AgentTesla)", "value": "a8edb07deb71e6594643d6e718dfd0ca4ef3e597bfc1fd8a44d846b514be6d8103c730dd6f56f2b82305675bdd721130", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813461, "uuid": "b179ee85-cb8c-47bc-8e3c-45a22982f593", "value": "T14CD4235936065F41D1EA4AF626E4260707B073CD9F54FF3C9FAC28EA9E26780E150DE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813461, "uuid": "d0413ab5-7d40-4706-b06e-c5acc74c3d20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813461, "uuid": "f17a1836-7280-4ccf-89d7-855c5bf922bb", "value": "12288:iRCzcFMK6YgdcYGMy3eWE+HgHtkBSu7ZOc5bXGMDrP1VKtOJnK4ENzWK:FcFMKPUcCSenyBiUbGMDrPOOJhEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700813461, "uuid": "66bfd9a2-9f71-4d04-93b4-0adc19a97a9b", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700813461, "uuid": "80b7466c-9c80-4930-9ce5-319a2ae927ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813461, "uuid": "0e4cb70a-f4ad-48d5-8009-8d5965d1b840", "value": "Purchase Order10874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d74930-8ac6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700829527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700829527, "uuid": "8d93e621-f210-4685-b2d9-02d0b380c7d1", "comment": "Malware payload", "value": "87798d1a7eddd0a0d867e928d90934a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700829527, "uuid": "331fcf51-9f36-4c7a-9abf-830322608e67", "comment": "Malware payload", "value": "b9a78c755ec072faac3a74b4904f1227775129a8bf112efa6a22ad6de487128d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700829527, "uuid": "a00bd7fa-b5e7-485d-83da-339d7232c3d2", "comment": "Malware payload", "value": "14983ddcf539e0237827dd2dda06be1a2a19db1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700829527, "uuid": "d20db88b-8923-4a87-8794-e11968c53d6c", "comment": "Malware payload", "value": "17ce820c2c372079220498982494e46d70037d9d865f6311c69aa6131c2bd71258b54ce59175478c84a0d97c7c9afe9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700829527, "uuid": "dfad3a69-43e7-45f2-af72-64a022c396d7", "value": "T1414633AE97D0E53CD350CCB4C82F52902532B7BB36394984118D49ACB7663E8B47E7DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700829527, "uuid": "6d38a447-51b7-45b9-a2bb-ad35f139984b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700829527, "uuid": "e5f97681-54a9-4e5f-9578-6f2d81548c29", "value": "98304:4chHMKyDyc70SwAvO01JgBixtqMhlE4f+Ue/czLiRZvcFqhblsXlwagEblE:vy3l80DBl5f+2QvQus1zgCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700829527, "uuid": "bfa8e1da-b75b-4f3e-be8a-2f1d756959b5", "value": 5418473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700829527, "uuid": "4b638d64-3664-42aa-a2cd-bd90f923d109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700829527, "uuid": "00927e3e-4f3e-43fa-ad29-d1c4c944c1f6", "value": "SecuriteInfo.com.Trojan.Siggen22.14944.5482.7510", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed249478-8af4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700849505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700849505, "uuid": "e65ad5f6-6698-460e-a325-d9c43bbb19b6", "comment": "Malware payload", "value": "984f81d6a1c0da37ed2d5b4dd307ee34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700849505, "uuid": "2204b7c1-3ae1-471b-895c-38f57d6e083c", "comment": "Malware payload", "value": "ba6b2f2aeaef0ad49ce9e7fde2464324296fb536f6b6d8626fc019e6eb612282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700849505, "uuid": "96b187d4-73ba-4814-a316-1a4029909d62", "comment": "Malware payload", "value": "a67d736f14d469549a9ef5015ababa655dab93be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700849505, "uuid": "94eb4cf8-64ca-417c-a8f6-7b88259ebb72", "comment": "Malware payload", "value": "81d6e6d0a2bb6c0d337e63451bb985977533d3769761b34cf0c354835205cf7f48fbe0a37e78437d8828b9dbf2421ff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700849505, "uuid": "a7aacc07-6b25-483f-9168-a67379b6887e", "value": "T160F4230801E1E1A3D91247F7DAF462B2AFE3ED14EA1A994B03D53F8E75365505B2EE03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700849505, "uuid": "f7a54d2d-0b74-4e42-ae47-591c35b57628", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700849505, "uuid": "833ac280-4628-4fd9-87b7-d5c66ff52734", "value": "12288:IbMrR2PgQ5NO+qxFJZ937KrtJXjABachoWeEhVV5r0KUMZafL14rBdeaBLFO7Sbu:IbMVy0vp7oJXn5W3VPaMY69deC2mTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700849505, "uuid": "a4b954b2-f9ef-47e6-868a-9a496661291a", "value": 776952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700849505, "uuid": "e4da6f1a-5221-405b-8611-0e00b8f7b815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700849505, "uuid": "6fb89a4e-9857-4f8f-89a3-4302308a3514", "value": "rCOTA____OMAGNALTDAMFOC231877756745758450045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b247b8-8afb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700852363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700852363, "uuid": "ddec240f-2404-4a5f-9357-7e927a6aa487", "comment": "Malware payload", "value": "3a0fc46ee9891365b4e1290c67985d50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700852363, "uuid": "cac774e8-b2ae-4a44-b46d-5047c143210c", "comment": "Malware payload", "value": "bbf35930603e2c79b466e38f249939ec19d6e8b8875868a03a607a92f39c62fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700852363, "uuid": "9de5a556-e09c-4c49-88ad-15b93b250245", "comment": "Malware payload", "value": "fea2de5126d8990a4b75219bc75ec9cd6c957225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700852363, "uuid": "a4aa7c6d-2e8f-488e-9445-ebad4a8fe668", "comment": "Malware payload", "value": "429544e5f9e62b308ed0e78aacccc0e96bef13d3ef7f265c664824f8d4d958b1314648c2ca48c39f3a28a5b9de0a52c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700852363, "uuid": "5362c39f-0d6b-49da-836a-39bc9b72c1a0", "value": "T172348B1369E0FC31C07203357F2C96DC7B6EB8625E61874A27141EEE5A326B2DE27316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700852363, "uuid": "067e4661-8545-4293-af9c-0000522b1b8f", "value": "bd153cb170efdbdb1b1268a5a173f793", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700852363, "uuid": "1ef988c6-bf03-401d-af8c-1d77e5f9cbc9", "value": "3072:pIINmtyehVO0aj1WMJa2E4Tsuot0LrBgqloU5w+KPb:LjyE1F/E4TFfLXwpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700852363, "uuid": "da3ff97f-9a64-4db2-b554-f32b83cc9448", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700852363, "uuid": "5c45e0e9-31bb-4f1c-a3bd-a8e81c8e89f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700852363, "uuid": "3ee1cb08-2c46-421b-a2c3-65396b3688a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23a7578-8b14-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700863203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863203, "uuid": "06ba0bcd-eef4-42a2-87ca-cacd8c4684c4", "comment": "Malware payload (Mirai)", "value": "b4ca37c99474dec41991dd91fcfd8130", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863203, "uuid": "0bf7377c-b824-4fce-8db6-3c15baae456f", "comment": "Malware payload (Mirai)", "value": "bc0f6791f18eb5cec64a7b6b40c554e0c718a039e192374cdc41af594d72a541", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863203, "uuid": "29faf269-150e-469c-87e6-d17b68b756dd", "comment": "Malware payload (Mirai)", "value": "6c28f1b78cbd6dc00ea5e0a0bd5c41398c3459d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863203, "uuid": "34d32844-2f80-44d2-8f46-aaa7688c40b3", "comment": "Malware payload (Mirai)", "value": "fa4618caadb30cb6f713e73728cce6c3ad4b5808c6c55d890a48fcd498c85785084bc9f092c2d1b237dae3a5615186db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863203, "uuid": "f19068da-c31c-4571-83d8-b8a8d240dfcf", "value": "T1965329C8A593F8F5DC140978307ABB66AEB3F13F7135E99BC3D82927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863203, "uuid": "0ee593ec-07dc-4ce6-90bc-b7c3cb3db9d6", "value": "1536:IoRC9170vwHbQXZ5+qXDEuXi90dSW7V/DjObeFt6PuQ4Za:PC917iwHbQXZ5+qXA594SWZ/XObeb6G7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700863203, "uuid": "6e0994ae-add0-4529-af01-acbc336b4d66", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700863203, "uuid": "fedc3a32-5b7c-4756-84f6-708d0ff4acb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863203, "uuid": "c9288c16-a089-4c06-867d-8505d4f8fbcc", "value": "loligang.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafa029c-8ac2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700827999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827999, "uuid": "56a93077-88d4-42dc-a80f-687935dc6015", "comment": "Malware payload", "value": "491522a168938dc516f9f0f862aaadef", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827999, "uuid": "0323b027-b071-4647-bc65-b811f0a7e56a", "comment": "Malware payload", "value": "bc2085bf3426e18ee04ad43d2e94bd922d09c4b9034e6caaf9553aefddf1dcbe", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827999, "uuid": "3442dcb1-145b-4dc9-b7e1-26f0ce0f0ad9", "comment": "Malware payload", "value": "2b09d2abdc17135c37c5f9099d5f00cd75257be2", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827999, "uuid": "68cd8222-7933-4504-9679-56cdafc3eb44", "comment": "Malware payload", "value": "3a36cd590476e4ff2d164064bdf03bd192dbf4d0cbf20243020439c842e0a38bc8906181d4e6710d7e21c186d2b007ad", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827999, "uuid": "8db61893-2863-42f6-a9d8-2240865bce93", "value": "T15AA181902251F4811B1A17FE2A28A8C0F35AF4C77B4088DBF61075DC7CC5469EAE9D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827999, "uuid": "2603e343-dfe4-433f-b11d-9c4ffc1b53fe", "value": "96:cauAqmAjXLc273g2demth1j/2O6Ojk2J8ieJwWPx8aaylEJ7o1KND5B+7whGAD7t:cauDLLXg2UmrI3PJwWPiLzJf+7whGADx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700827999, "uuid": "71365e62-0d95-4870-a138-45590d5248ab", "value": 4953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700827999, "uuid": "3c4b68a0-f806-4aaa-901d-adad276e3ca4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827999, "uuid": "e3651da5-b175-4d5d-86e3-e46781107e0e", "value": "Agenzia_Entrate (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ec9541-8ae1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700840976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700840976, "uuid": "13392538-e6c8-43da-bbb5-3b984c95feb1", "comment": "Malware payload", "value": "120f5961b3c43ae2c92ec5afba4a1ef5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700840976, "uuid": "d2d63b66-040b-46c7-9da6-8de29bf86b5e", "comment": "Malware payload", "value": "bc7fa6e57861eb4942491da3c527a7394c6f4e0dba42fd120bdcaad0fb3dd016", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700840976, "uuid": "ca0c77e9-2327-46c1-b1a7-d0457843af30", "comment": "Malware payload", "value": "875dbf4815b362e57261a336799fcadede2f7565", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700840976, "uuid": "077e4b7c-1d12-44e5-a763-2721402ae477", "comment": "Malware payload", "value": "c7a7a11853389efdbd25a369600f30fcfa0c3b63b99416ad7ecdf93d59f97976ddc2432df1bcbedf39b7e7972333d853", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700840976, "uuid": "1aeb9bda-7656-433a-abd9-69158bcfbe36", "value": "T197B6121A35CA8276FBAE1234562BF77B22B67FE00BB144EB67C059CA5D719D01072E13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700840976, "uuid": "c65f72f3-8957-4add-89e7-5939de6bbcd2", "value": "196608:F9Q7RE74zU+01IL24lDC5RXOE68HQ/IiLkNUuG5+IOM7bt54itdAv7vxfTC:F9Q7uYUiV5ORr6v/JwNKAMdtCvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700840976, "uuid": "e484c2b3-f613-437c-ac2b-aa91e01d9f41", "value": 11286016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700840976, "uuid": "cb0a2639-6306-45e3-b170-a2b47ced53e5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700840976, "uuid": "5b817ff0-7c88-4f58-b32e-cbdb8d37bcda", "value": "facturaSiinopagada.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9785bc06-8aab-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1700818008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818008, "uuid": "46aaf251-3d90-4700-8854-f85dc7a777df", "comment": "Malware payload (AsyncRAT)", "value": "1054513d78d30bb3895caf7263822bd8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818008, "uuid": "a4e01a2b-2670-4f17-86d1-213a72e85614", "comment": "Malware payload (AsyncRAT)", "value": "be36b65ee8717f81b7d084d1a9b5073af0e8151a3c2b17dc86886ace2abfd07d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818008, "uuid": "577cf394-b2db-494a-90bf-0a5c999db01c", "comment": "Malware payload (AsyncRAT)", "value": "952751c225b1ec5b39640a5611fac374f42a6d34", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818008, "uuid": "3c90df1b-09ac-4931-a996-2533e9c1cdb7", "comment": "Malware payload (AsyncRAT)", "value": "84872859ba7ce7eb6852dd709a44015988f429da99ecfde2cd0e94b9f3d0dd4b51b420d21c111ca8a5f85629134bc222", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818008, "uuid": "910ae1cd-bec2-4a6d-8cf5-57b4b46e8fcd", "value": "T1A0F6FB9C726072DFC857D472DEA82DA8EA5178BB931F4203902715ADEE4D89BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818008, "uuid": "8ba4d6ec-53cf-4c6d-9ba6-d33fe4b51809", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818008, "uuid": "b72ada7a-f72e-4732-9d51-a4ea47ca6679", "value": "196608:GHd6DOuDUI/6yocMIH6NhsfqxOLoeUwKj4+3X3bA4IQu14GzK5b:id6lH/sIaEfqAoeUwI4W3lu14GzKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818008, "uuid": "824885c3-be84-470b-8fd7-a20785813cf7", "value": 15363584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818008, "uuid": "6dad1463-ee87-441b-8b50-27fc6b670836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818008, "uuid": "7cae34a5-d42f-404f-905b-a94a800456d6", "value": "SecuriteInfo.com.Win32.RATX-gen.28046.3429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee156a85-8ad4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700835762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835762, "uuid": "8d4d8137-6a1d-42f9-8618-58a935acab9d", "comment": "Malware payload", "value": "027d515a189bc5925c5edf4ff818c0db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835762, "uuid": "1e983422-7420-4b2c-bc25-c9074a6607f0", "comment": "Malware payload", "value": "beded478da6c065077f2fed6baa6e048427599b9f86655f3d34451eb2dbf84bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835762, "uuid": "34b6ab9a-3a7e-435a-ad0e-ed6e7deb3da9", "comment": "Malware payload", "value": "5cb9815d2f210a55812247480d83cfa2d18afb55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700835762, "uuid": "40a73049-2925-4e55-88c5-d9e43aafae66", "comment": "Malware payload", "value": "83572a519d1298fe6dfb11ff6fac664dafa588b7134ba692d8bb62245ba4f5332315c503b6bd9c53fb4925a08ea57b63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835762, "uuid": "aca748ce-d1bf-4bdd-b45f-448818de8d81", "value": "T18636339330516139C4B1683284F643339636FA3AA1BFE1B5698D09DDEF93EF46108B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835762, "uuid": "a5ce9ed4-0408-4d82-9f31-7eec83a5ba7f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835762, "uuid": "e32c089d-4574-4b86-b210-91b92e966e83", "value": "98304:Td3L0TpNwgdnac+LdvXVajAqlxgc92ca6Qc3zQxHI7Fya0pYrAKlE:Z3Lq6gdna/raEqwzca6QcjDopKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700835762, "uuid": "8ed93a69-12ef-44ed-8ac0-4b872dec8b73", "value": 5179704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700835762, "uuid": "9d889373-d137-464d-a369-8f213b4316f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700835762, "uuid": "77ffd4ea-0b83-4192-851c-a6e5a5d790eb", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.21955.14414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693ca396-8a60-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700785718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700785718, "uuid": "e471ff33-d1f9-4543-8b72-c4a3e728fc5c", "comment": "Malware payload", "value": "1a7fdbed455f67a677c8ace3806c4ba8", "object_relation": "md5", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700785718, "uuid": "3ec7744c-9b79-4daa-9368-442480741169", "comment": "Malware payload", "value": "bfbbad2bc98dd0793a48b2da0ed8dd0ed561040109b0f2aea24c7266d5de9de3", "object_relation": "sha256", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700785718, "uuid": "3c53bf5a-a1ac-411b-a79d-d39b7831135d", "comment": "Malware payload", "value": "1b3c6df8e304db2aaa342e164b94dd0753ed3cec", "object_relation": "sha1", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700785718, "uuid": "a1a10044-ed12-485b-ad6c-ee09825b21df", "comment": "Malware payload", "value": "982a45a9b0bf759d30f98d88677668e4ccb28287c974fdc5857648be9a20cbaf7b8075cfbfda6ca94fa6e8f809e47384", "object_relation": "sha3-384", "Tag": [ { "name": "149.100.158.179", "colour": "#86DCD9", "exportable": true, "hide_tag": false }, { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700785718, "uuid": "85260d58-7c7a-4c21-80dc-bfa949a3cd4e", "value": "T1FEF054D5FF011927850D167B9C0A2FC895ED03C58408CB170543496E01E4FF3192FF60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700785718, "uuid": "5f1611a4-b05b-46f6-acae-f93a5d080669", "value": "12:oQSwKEoN32ullaDgOlkPeR1pFDTAgdpUSIg7CvV:+RtLllgDLpxTpy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700785718, "uuid": "c59ce70b-8b5f-4da2-883b-deb1038c69c6", "value": 501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700785718, "uuid": "da484063-2345-42f9-ac9e-bd5965c40348", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700785718, "uuid": "b2053c74-bd4b-44d5-b2da-a0ac448e69d7", "value": "FACTURAhdthkJ_j_kA(547).PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2929d49-8a66-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700788525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700788525, "uuid": "f93f19a2-4b7e-4152-9fab-ffa8a5cac0c2", "comment": "Malware payload", "value": "b34540ce9437ae65747e47961ce525f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700788525, "uuid": "58d2692d-88e9-422b-a9ab-7d286699375b", "comment": "Malware payload", "value": "c0ed304c43d241d95fbd3fc604d0a0cd25ffbd38d30339ea8f07228aa2d0e322", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700788525, "uuid": "12426187-f0a6-4d20-b21b-458cd6e59630", "comment": "Malware payload", "value": "b5cc9a9d29024193e838e0cc705c96d322995291", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700788525, "uuid": "c108d007-e626-4e59-b4fa-c10ba4b0e97b", "comment": "Malware payload", "value": "2ad90aaec18a448f1df15ddfd787629267bdd15d65a5e76521acbe370c4a64150521671e11095c090207073c3625cc82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700788525, "uuid": "bd355714-e9cb-4bc3-a43a-c740b602ce70", "value": "T1E7D533567AE38D36D23CC8744FE6A80BD7733D4BA831925015981785EBF21A0631DFAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700788525, "uuid": "e46ed208-71d6-4738-9073-75a072ba0706", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700788525, "uuid": "87eebdc9-b78e-43a9-9988-2e3fd417a997", "value": "49152:q2dKgqFC/iTqHv7bb9NfQSvzZxPQUlsMuiRPzGjNBi+tsvDcRY0E:rARFpTIXhJ51xlax/7TtsvIlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700788525, "uuid": "8b3a2e49-5fee-4741-b2c5-3f40a6b1ded5", "value": 3007652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700788525, "uuid": "8920f7e2-54f8-4b4c-8073-0236b0f01113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700788525, "uuid": "d3929f7f-4a21-459c-a10f-12a76c4bd032", "value": "SecuriteInfo.com.Trojan.Siggen22.14345.1679.13197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be56adb-8ae9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700844456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700844456, "uuid": "35cb5fce-5394-4bf5-a8f5-bb2a487fbf86", "comment": "Malware payload", "value": "b2bc8bafe794cf5915af57f64893d59a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700844456, "uuid": "ac325837-7036-40ac-81df-a51a050760a8", "comment": "Malware payload", "value": "c12992639964d2a088d42dae79194c8c4438fb774b810dcfcba9e7acb8c07ae4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700844456, "uuid": "3aa44d31-ef66-42c1-b7f4-b7d60c0de1f1", "comment": "Malware payload", "value": "7ec1e5738c3d69830676a36456ba2384441dc9e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700844456, "uuid": "d2690c4b-4d4a-4265-8375-bade673d7a7d", "comment": "Malware payload", "value": "a46dffb40718b0b583134c1d6435302a241260bad796a98f72a9510935c702fdc010a796bcf25818cd151306886b92ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700844456, "uuid": "55d3a32d-55a8-4e95-a248-1c3a66077d65", "value": "T1CED4230F33DB4BE6E08D97FE5CAA7017137222B664E6E73D5BD831C64956F009932682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700844456, "uuid": "5771a911-0f7a-4cc4-b043-399cc30032f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700844456, "uuid": "d448e85d-bd9f-442b-91d4-155d12a4f322", "value": "12288:w1maSdkPPn5P9fBlLVFP4Y8JMSImvZQI33TVxXDKEMK4ENzaK:TFkXn5P9/LzP4/qSIC3TDuEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700844456, "uuid": "f96dfe17-b2ab-49e6-bfd5-cc2e1ffcf5a8", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700844456, "uuid": "df50a791-eaa7-4d3d-985f-a6900f278ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700844456, "uuid": "a92074b4-daae-46ac-a698-12533b90f09b", "value": "TWZyM8b4Pxyce0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e171e589-8ac2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700828010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828010, "uuid": "7cc20dc9-464a-41af-aa43-616a1068f586", "comment": "Malware payload", "value": "806a7431a060c8403c1017e4306fcf09", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828010, "uuid": "76a3bb7b-547c-4dda-be38-5a2b1618c305", "comment": "Malware payload", "value": "c18eecb89e11f90732d33a8e1185c64cd99111f8cce2c591f39f51460dadb5e5", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828010, "uuid": "29e299f4-eafe-466c-a5a8-31bc6dbfbfe0", "comment": "Malware payload", "value": "dc5b7e52809a1132638a600512a1cc1435486748", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828010, "uuid": "51c2efd4-28b9-4f73-8ffa-a16b40d74b73", "comment": "Malware payload", "value": "25267a39fe7a72dbcd4aebd6f1a4bab5b47a172ccace22131f37ebad43d63290eb226a5cb1527ce9fe42a08082611239", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828010, "uuid": "5acd940c-a50c-4563-b80f-8a99368c189f", "value": "T14FA1854526D5E08C17AF4BBB3A7360E0E17CCA137E43E45AF440D8E9AE69660FDD4A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828010, "uuid": "edb3f7dc-63a1-4bdf-8046-fa0f4f88b26d", "value": "96:iwCumAg44C2k1Lr0J4zaXubwzemUBes9cmvyswjBd3flA2LuBm0L:fCcgc1LE4z9ocqrlAeus0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700828010, "uuid": "40b4e32e-e70d-4b88-95b0-9e63be5b91fb", "value": 4661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700828010, "uuid": "77b9f5bf-f231-4bfb-9732-c5ce2d26d9b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828010, "uuid": "edd476a0-4620-4f7b-a48e-896bcc14bbe0", "value": "Agenzia_Entrate (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c316de7-8ab7-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700823008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823008, "uuid": "76dad4ff-74eb-40d1-b6bc-654f1e8ceddf", "comment": "Malware payload (Mirai)", "value": "0b0f5c7adbee8788fcdf526693966fb4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823008, "uuid": "13055aa3-b0d5-4971-ae67-c0c03f3f8f20", "comment": "Malware payload (Mirai)", "value": "c1a555415d3b7b1a8515aece1ad5231aff6a1e97a14da33853f2f867404d290e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823008, "uuid": "f17831a6-bb92-4800-9d5c-1a5bdfc2a4aa", "comment": "Malware payload (Mirai)", "value": "54cca4d03544894864fc16bcee9a688b038f2b7a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823008, "uuid": "a7ffc34c-0e17-4cc2-b949-4fe058ab1826", "comment": "Malware payload (Mirai)", "value": "855d05e7acae1f95ce238ec0e37650535931bfafed7a41bbc185c0c47d5d8307f6d006447c47d0876fc29966e91863bc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823008, "uuid": "99dcfc5c-c0ba-4f08-adf9-b88b11610420", "value": "T196434BC4F647E8F5DC5706741136EB778B32F5F92218D743D3A99A32AC92601E613A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823008, "uuid": "be8659a2-3eea-4ee1-968d-ad856f7c84b0", "value": "1536:ka4CVvtTO8yJT/0fSGUPk+XU61TH6V/Ps06r6MB:d4CxtTO8yd/0KGUs+X31Ta9k0JK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700823008, "uuid": "47b5a4fb-7a0f-4f77-9443-14222ccbb4a4", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700823008, "uuid": "e71ed2cb-aba7-4921-b026-586bee6dfa5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823008, "uuid": "75c0e8e5-3722-4e60-b3af-a04d072052da", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf464b4b-8ad6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700836570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700836570, "uuid": "253503b1-aab3-4281-87cc-70e01b381c99", "comment": "Malware payload", "value": "f10765bf91422f4db9109b0adb8cbba7", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700836570, "uuid": "397a8fc3-1504-4d77-8795-fd8bb7952baa", "comment": "Malware payload", "value": "c3ca55ecef49dc84ada3efac3ca9cce75d215d7e4eddd5ee10246ada6a2cbbee", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700836570, "uuid": "23dbc695-6b70-4fed-af4e-8fe624d2288b", "comment": "Malware payload", "value": "3bb842fa299040a38203352a8a2f41d5312e8b16", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700836570, "uuid": "b3295e18-923a-4424-a8f3-3fbd4911d4df", "comment": "Malware payload", "value": "204dd339d8cee1f4bb0fa627ea1e80c40bba8e20e24a62cd8ee0044f2b5347f0a87ff3db431d681be573c7a2fb83975c", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700836570, "uuid": "9f2a3795-0cf1-48bc-9543-dd0d63c8c46f", "value": "T178354B22A3D14437D5732F758D6B86986C257E302EB4D95A7EF89E0C0E38B817D353A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700836570, "uuid": "4e10e9ff-d249-41fd-b6c4-96a739a39322", "value": "24cdc56b5fda73aeb4bb75aa4a21ffc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700836570, "uuid": "c9331008-ca1d-4b78-b65c-121b71da9d05", "value": "24576:izPc2oOjSDX6F9204jN76eOJd9eZEdRapWhmAMJ8vDjr5xyH:dUQ/O7wWhBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700836570, "uuid": "4b42ab61-0fe6-4db8-8a44-184af90cc203", "value": 1158144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700836570, "uuid": "5df5dc71-b45c-4559-af8f-45ed4cd8c8a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700836570, "uuid": "a0e9a72c-342d-484b-badc-cc7fe85f6286", "value": "1700836568565cde7adf8ec06f936f9cec437ed534bac72dedc438635aa6145ac1ccb0960d461.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b084e5d-8aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1700814094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700814094, "uuid": "3e1a2c4f-6b1c-494e-b123-e79f262eb0c7", "comment": "Malware payload (Socks5Systemz)", "value": "ebc89f16c0a4a8f2593987adbd5f3819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700814094, "uuid": "4901eeed-6a1b-4905-8ae2-63382ac73ded", "comment": "Malware payload (Socks5Systemz)", "value": "c3d4111d24b6f7df0512772413d60b1c973354e5cb6efb6b2991346fc0d32636", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700814094, "uuid": "97135206-db6a-474b-90d5-ae0c8d196d57", "comment": "Malware payload (Socks5Systemz)", "value": "f8a30f0dcd268b7905a2b912eccf25089bc5d73c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700814094, "uuid": "065480e2-a0c5-45c4-9be7-d120fa9e4a55", "comment": "Malware payload (Socks5Systemz)", "value": "e9890fad168a4c480f5ece9941c6005e730fd49755288ff2e4208a371357c261b8f2eb672a54dd7fdae4e0391e69e5eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700814094, "uuid": "9e205579-3ae3-4977-85e9-809079976431", "value": "T18F4633AE97D0E53CD350CCB4C82F52902532B7BB36394984118D49ACB7663E8B47E7DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700814094, "uuid": "eca001bf-249c-4c8a-9cd1-60b15cd3f8cb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700814094, "uuid": "5d2b303e-e1f8-457e-9fc0-aff17240d2e7", "value": "98304:echHMKyDyc70SwAvO01JgBixtqMhlE4f+Ue/czLiRZvcFqhblsXlwagEblE:5y3l80DBl5f+2QvQus1zgCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700814094, "uuid": "0a88e843-9415-4fba-836a-d3abca73bf32", "value": 5418473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700814094, "uuid": "5598feac-8107-4a4a-9aa4-dbda393e96d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700814094, "uuid": "2ffb804a-53e3-48f5-b4ab-b7cc351d2550", "value": "SecuriteInfo.com.Other.Malware-gen.16127.21824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b93a32-8aa9-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700816954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816954, "uuid": "393ab406-c9c6-47d6-b73d-73fc6b144877", "comment": "Malware payload (Mirai)", "value": "acfdd3d6f12862b2fdf47e6da837e281", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816954, "uuid": "2ccdd2b1-cdcb-442f-b793-cd9d638c7f9b", "comment": "Malware payload (Mirai)", "value": "c4067c3aef6853d8402c1fca1e2be05bc4292826302e5b843ad551e9fb67a566", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816954, "uuid": "e31a2f61-be7b-4f78-bb57-2c9269fbca40", "comment": "Malware payload (Mirai)", "value": "4c1028e82aa05c27a67fae20d1e0c9ee2ce5660e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816954, "uuid": "2944b8a2-6160-4b8b-9bdc-4fe2006bc73a", "comment": "Malware payload (Mirai)", "value": "6187149ba6101e85f19b8021522c4d2be11d5329e5ee272413e812f4eb0e659afac02e628554bb7649ab81421ad071d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816954, "uuid": "8eeadf46-5216-41d7-b18e-12f3616a441d", "value": "T118C2E696BC87A52BC2D013BABA2F2A8E336573D8D2DF3753D8154B10368665E4D32B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816954, "uuid": "782166a3-bf31-49f8-9aee-fb8663c5dbe6", "value": "384:zfQsuElYhs68AXpCfEaZenE24489G5gt6r6hswVTsSmJjZh0Fru7zzknZToo3/rZ:bl1Y+681YE2X0G5gErk3EzzgToo3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700816954, "uuid": "2e1267ef-942b-4562-b937-0032d81dff00", "value": 28200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700816954, "uuid": "34d2df5b-0a8a-4bb4-bc26-8d0acdbc32d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816954, "uuid": "bb3e5498-4fe3-42cf-a992-1fbd3170706f", "value": "most-arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a17280-8a9a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700810837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700810837, "uuid": "c9782248-682c-4b65-8842-5ce365d53a5e", "comment": "Malware payload", "value": "f641f1c9a55af9def78813906acd04ec", "object_relation": "md5", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700810837, "uuid": "f3d26dbf-654f-453d-a33b-9aea68e3f7b3", "comment": "Malware payload", "value": "c56c7b0966cff324007dd141d0298998c2a981d7a018abc9c27ec7d122efc332", "object_relation": "sha256", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700810837, "uuid": "2de64ecf-1a32-4bde-95de-f495742ebe50", "comment": "Malware payload", "value": "a7a064f014e1bf6fbf73310bdda62b55d0572a0d", "object_relation": "sha1", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700810837, "uuid": "cd110bf4-38ca-4539-a7b6-8a38e681f066", "comment": "Malware payload", "value": "f7fc338dfde18d3abdfe094c8df77e1aceae5b1285d88c9f9e68901e1c7e95392aac69013f0406b6012868dd93b8e951", "object_relation": "sha3-384", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700810837, "uuid": "4e35930e-811e-4b69-8f12-3aa6c56a398b", "value": "T100E4338C3EA71E589DD97F19B177228D1CB366653C990B4FCFE1AE241227724E28847C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700810837, "uuid": "2a5a5d36-6cb8-4f9c-b067-73b3c8843314", "value": "12288:LLTq7346JLzYnXieaW2A/PPD3CdUkQj1YBKn5YRomwL3:/e734QxPWlP/kQCBu5YRoHL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700810837, "uuid": "d03914bc-bb4e-4ea9-adf7-f4088f760832", "value": 691103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700810837, "uuid": "57f55e97-6a95-443a-9d82-f9762b6d0800", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700810837, "uuid": "cfd973da-e091-47c3-a6ec-640502088fb1", "value": "SHIPPING ADVICE DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a47610a-8aed-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700846198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846198, "uuid": "290eb2dd-f7c3-4351-b8d8-7e52135a7f3c", "comment": "Malware payload", "value": "83a83af81573b052af8c46cbeaa7035d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846198, "uuid": "e5bed25e-4595-46e8-8bab-3a0b07cac993", "comment": "Malware payload", "value": "c63f7bf40f81e3654685888a1f6731e1b87dc49edf0177de8503bba2389eee4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846198, "uuid": "3fd7f66f-2457-4771-aa07-eaa1657dde88", "comment": "Malware payload", "value": "6810d53bd3dba1ad8ca23dae997a22f5d3a8a173", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846198, "uuid": "3068e0ff-0724-4eb8-97e6-9454e447335a", "comment": "Malware payload", "value": "4d8de9964a682fdfded2f51f59aef11a7ca4c6c03a19557a497b6270c8131a25f555bba0ca87270af69683911e3e19eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846198, "uuid": "df5c6cc9-e4a1-4054-b497-a3db8a641f97", "value": "T104D42329774F8791D4DC1BFFCDAB81120BF2999A8590DE6D2DA011DF4F29B1083A1E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846198, "uuid": "4603973f-b5cb-4e28-b001-559f7a9fe3f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846198, "uuid": "cf4608cd-001b-4de0-846a-1a54853022ea", "value": "12288:h0XVmS2gDUPQaEL3f3yBFj1INMw8jKt/Gn+E8ireXYCSEK4ENzuK:h0XMSL5TzPyDpwgK5qeX9SkEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700846198, "uuid": "99736a3c-6df8-42a4-969a-fcc457edabd6", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700846198, "uuid": "3c2310a3-8b7f-4217-8574-697a1329ae9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846198, "uuid": "1989a890-a148-4eaf-a573-df75646ebcce", "value": "Purchase209746.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68124921-8aa9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700817069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700817069, "uuid": "752b95af-773a-434c-9275-11d285f3ebfa", "comment": "Malware payload", "value": "b483c722d53182cb7b35e0604b6603c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700817069, "uuid": "dcecceef-71e0-42dc-b6a3-89f3e050923b", "comment": "Malware payload", "value": "c6fbb7022c7beb3b4c840cb4d46b35f237a29ef70d6c400e673eedc55698d3c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700817069, "uuid": "5ff15584-a13c-4a83-95e1-45b36a83d0f5", "comment": "Malware payload", "value": "821a586245f977e3a6d2aae29c7a262c080cb5a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700817069, "uuid": "860a0ae6-d620-443f-87df-f1f1030f7725", "comment": "Malware payload", "value": "7e7df642bdaad847a71581c3928310e93eb483e896ea0411a578574135a9542ea9850d517d7c364da90a72dd9ec5289d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700817069, "uuid": "2f04fefb-ffff-4289-a994-fb38b2998599", "value": "T1ED95023B7A466448C12E4B71402D29C4B375ED862646C77E60DB32BC9FB22BFB74D486", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700817069, "uuid": "cb432890-e9bf-453f-b657-003c1614adaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700817069, "uuid": "dc5dbafd-37d5-4b2f-9cab-ef3c7f0f7d18", "value": "49152:vmMEPx6vQA7b0IyUWN/vgy0j3c6Byf1gTT:hHQAXtyBN/R0TE2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700817069, "uuid": "d2b8906b-34b0-4217-8936-999bb66e389e", "value": 1944576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700817069, "uuid": "fd74dc37-af35-426a-a66a-7e67cb8ab5cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700817069, "uuid": "aec48dbb-08ce-445d-b2d1-797bc3c4c104", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f39a89-8acf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700833445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833445, "uuid": "743f45f7-183f-42fc-b9d6-c61e040ec6e2", "comment": "Malware payload", "value": "63746dc7ec97f00513849559391cc172", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833445, "uuid": "36724678-f354-43f0-9cbb-e7e8680548fd", "comment": "Malware payload", "value": "c7e21c01ac1ac2bb360d67a1900475deaa9cf02bcd9e121ed3430a30bbb2c68e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833445, "uuid": "b2e9dc58-41b5-4801-a9bd-0d0454fb8eb2", "comment": "Malware payload", "value": "36fe018a44e093c0a53882aa6cd9ca7e57539fee", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833445, "uuid": "eb01e737-5d2a-4856-abf3-ea360548a5b7", "comment": "Malware payload", "value": "05390ffeabeb40f1142da249e57c58c1481c0e5692c3e198cd75c7449207a99712b585666d99a5f24dead9aa37c45e68", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833445, "uuid": "e9cd960c-9504-4ea0-ae7a-3dddf2a5b032", "value": "T11876238277498F2ECE7F41320DA28731721A9C978A62971F99207A9C9C77BD84F54FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833445, "uuid": "909f7cf8-9ade-4a04-8d83-45d104b5863d", "value": "196608:t1SCDYsaYR2jLKUcigrlfu2ovBoRSf231:t1SSRioigr4dv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700833445, "uuid": "cb655ac0-7daa-4f4b-946f-98db2445596e", "value": 7485669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700833445, "uuid": "5f464e4f-300f-4d00-90b3-f5da75c2c74c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833445, "uuid": "8dd1a439-6f55-42f8-b707-37ae5c3c157e", "value": "c7.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb170be-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864244, "uuid": "5d0de4b2-b17f-4349-b980-09e485553f8b", "comment": "Malware payload", "value": "db463b88a7da04e4f0e415dd97efaa1a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864244, "uuid": "35330ada-695d-420b-9df7-9644295d59ec", "comment": "Malware payload", "value": "c8e3d8668c9b831d99d923f5e633fae273c44349a269bcb181109b79044bf5a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864244, "uuid": "97bc4dc7-aca6-4aff-b3bc-3c490a8ad439", "comment": "Malware payload", "value": "f623184d0f1ff2ef020ed76ebf675a2a6214ef94", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864244, "uuid": "eba3fd7e-1855-4a59-a16a-9021a1aa4fb8", "comment": "Malware payload", "value": "3b9aab10ae3f6551eaacc887b4af59544d27f0c786b4d0d8302f64a24e896b7b1c3e0edc473f658d8841276afcbc9211", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864244, "uuid": "ef32d18e-8263-41da-964b-0044650da6a5", "value": "T129849D21B582C031E9BE0130397DABA645AC7C311B7549DFA3D85E7ADE341C26A32E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864244, "uuid": "78346c8d-2c4b-45c0-8c89-39c89fe1a818", "value": "f5f6b8d34e6d18ec5379a09471ce8e8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864244, "uuid": "48908ead-520d-45b8-b7f7-9770ad8c58b4", "value": "6144:uuPX9L999kznsr61Cv3sFvrAoY9hd9r2+4a+zXZqLPLNZPRC4V9j0mFwXyaHg4G0:uuP0zdY3sFvrAoY9hd9r2+4a+zXZgLNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864244, "uuid": "9364ef7c-8598-494c-abfd-7c90c6cedb04", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864244, "uuid": "7c1234b9-9077-4830-8fc9-4a1f72f58aa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864244, "uuid": "40b94990-8218-498d-b325-71ee29ff5d65", "value": "SecuriteInfo.com.Variant.Ursu.728265.25423.10315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27813971-8aa9-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700816961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816961, "uuid": "463f95ec-bacd-4d7e-b2ce-434e8bb70bb3", "comment": "Malware payload (Mirai)", "value": "20774a9ffc9de4a142e12ebf1776e415", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816961, "uuid": "fac65884-3a18-4aa9-8821-bcb79e741b56", "comment": "Malware payload (Mirai)", "value": "caae49f1df4749052d16a04e2c68d10ac5fb6a81cb94235fe0c42a26a9194d98", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816961, "uuid": "6720d5ba-1e90-40bf-997b-1f5e8c1dce02", "comment": "Malware payload (Mirai)", "value": "bf92bd1fd01ffa654fee170a3a739ab8cb8c1e0c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816961, "uuid": "fb898221-3084-4814-96a6-ceeb9e29c011", "comment": "Malware payload (Mirai)", "value": "25989b0703e795b008457ea97128354b19e550ecdeac23038d1d69f4490a2950776bb0d58b3a762e5229117660b12ebd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816961, "uuid": "e3715991-8b11-4b9f-a082-8fcf833ae99d", "value": "T1CAF3A85A2E228F7EF678873047B79A25975833D627E1D684D2ACC1105F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816961, "uuid": "17e1f151-21d7-4885-96b6-2404460b43ca", "value": "1536:W720yOxdwbixxj9kOnWAv7Z2tlG/FTzDKaEBeI74dMy3XTG3vc7X0KLkCs:W7Rdd1bKIv7ZysT6ai74/+E77LkCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700816961, "uuid": "ea25a676-4621-43df-8a8d-c216017e8b6f", "value": 165172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700816961, "uuid": "c27bfa48-9385-419f-96b0-530256c982dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816961, "uuid": "9299c5bc-f9a0-4e6c-9ed9-27cee2b6a992", "value": "most-mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02dc89ee-8ac1-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700827207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827207, "uuid": "55719d76-01b6-4fbb-97a4-e7d666703de4", "comment": "Malware payload (Mirai)", "value": "c167f88850ebbe8f3c2976b78ba1392f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827207, "uuid": "48ea21bf-a6ed-4bec-b4af-a3e44358b3e3", "comment": "Malware payload (Mirai)", "value": "cb4372a28b3e351b814a43aaf6c26fc86eb24263eb22a876e6a969a67b009bc7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827207, "uuid": "7774a583-f6a7-4251-ab5a-d720cb87544b", "comment": "Malware payload (Mirai)", "value": "6755a2d87f5d24150cadf950fca326eb7eb54762", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827207, "uuid": "915a93ef-5220-47ab-9884-992af20fc0cf", "comment": "Malware payload (Mirai)", "value": "eef801cd88752eba8be132dace78d47dd2291ae269e1e2be7b7be1aa66d8d75418d0410a1e34008fe782757d9c2c5835", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827207, "uuid": "dd736958-e8dc-4838-b63e-f2ea3f12164a", "value": "T103633B95F9825A13C6C512B7FA6E428C3B2513E8D2DF7203DD216F217AC781B0DABE51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827207, "uuid": "5883a870-624f-4a44-be7e-5974438862a4", "value": "1536:EnyorR4GArxIzbhT9e6xK8m97zJwAofEvzwvyJwbZnN:EneshZA8+79w+KyJwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700827207, "uuid": "792328f3-e1b7-456e-a06b-46a7351fa8f6", "value": 70972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700827207, "uuid": "e47416bb-89c1-4407-beb9-97073ba8bba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827207, "uuid": "1a980f91-f62a-454c-a42c-38092eff59db", "value": "skid.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41582a6-8b04-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700856334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700856334, "uuid": "ecd20590-a81a-4ec9-bce5-9fa4fcea4ca2", "comment": "Malware payload", "value": "3fd9ef7eec69f31b4dd83547f4fdf5c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700856334, "uuid": "61b1bcb7-8213-4453-93ba-58cfc6aad2fa", "comment": "Malware payload", "value": "ce8e42ad172f788ff8f4e9b434320fe9db4a5b549b56759e3d992f5e770d0d24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700856334, "uuid": "9ceb2921-34c7-43df-b086-5990f388ac85", "comment": "Malware payload", "value": "8bc5a11c9ed4753a69fc7bedc2bac66066194e54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700856334, "uuid": "f7afc36e-20f6-4271-bf83-eb5481161c25", "comment": "Malware payload", "value": "ed85a3b4d923002b19ee671e11a1bde6d626fb6910d2bf9437643b286761b9891af772563320c077e18ccb5f3220119b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700856334, "uuid": "5841243e-29a0-4245-a78f-b75e963e265a", "value": "T1CC347A1375E0FC21D55703354F6D96EC7B6EB8219E61CB4A2F142E2E1AF26B1DA27302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700856334, "uuid": "4c0ff38b-2ee8-4498-9446-6941e91271e3", "value": "bd153cb170efdbdb1b1268a5a173f793", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700856334, "uuid": "2deb9c6d-8193-44fd-bb76-75ae33849067", "value": "3072:NtRFQ8y6lATh7rrJH1lDD5cDMro3JU5w++b:n3C6lATh7r9H1l/5SMkP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700856334, "uuid": "e159991a-382a-48ae-b746-c1c2a284bb6b", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700856334, "uuid": "34af61e3-9383-4e7e-95d7-31f029bfc2ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700856334, "uuid": "f048eb96-f738-4e5e-b3c3-f0b24c6ff046", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7cc664-8ace-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700833000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833000, "uuid": "a43da4f7-3df7-4646-9463-5cbd3b4be14d", "comment": "Malware payload", "value": "f127b55a763f0b5838378eb8f4b05bab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833000, "uuid": "1d75afff-b384-4de6-b50f-ff3a9f365c75", "comment": "Malware payload", "value": "cf235bd2c46ce62bcffa21733ada4a8e13a6f2f8d4a88b3f3d3346c5949b5373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833000, "uuid": "96362b19-b5b7-4739-a12d-eed25e85709f", "comment": "Malware payload", "value": "c5ef971fc7aa5fc171c8e390d0b5e81af3db87d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833000, "uuid": "b803b20f-7ba3-4a81-a1b6-48426658b475", "comment": "Malware payload", "value": "24bead90f69c426dca5d4ab1746391c1856ec08628db302d2d560cafd4f2ebd4c479e9699005e032b601a9463eb7934b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833000, "uuid": "8bfa6aff-476a-4001-a856-e306e2c9f0b2", "value": "T15E65EE037A049B11C97C353A92FB2D2D63A1F9CB07719A0FDF057BA61DD62A69CCC246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833000, "uuid": "0230c8b1-a264-46d7-9d0f-26528740ebb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833000, "uuid": "e67f52e3-e230-43bd-b890-3e1cddbd31ba", "value": "6144:45kyU77IKUHOtznzxeClHkxejI3xyMFjVaxNgwCZuHuZx4F6vLcG8TJiOfUGZGkY:FNHtxUcG8VGcggaRDevszNThj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700833000, "uuid": "a0cf9198-da0c-45b3-b03b-8775fcfd27b3", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700833000, "uuid": "67ca686e-6836-4fff-be68-c2c86e704084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833000, "uuid": "1950c3a5-697a-4ec5-b70b-de3462e4c07e", "value": "cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c8b995-8aab-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700818000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818000, "uuid": "4622c023-fc34-48b3-a4ec-c375fd8694d9", "comment": "Malware payload", "value": "3ed2b4079de8367146d73a4eabbb527b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818000, "uuid": "621547bb-447e-48f7-a088-922ad5734485", "comment": "Malware payload", "value": "cf7251cce700eca1370e65fb29f0e5e960a44ac77347ffcaa7daab45f693a8be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818000, "uuid": "32eb1c77-e84d-406c-a314-cbfc60c7098d", "comment": "Malware payload", "value": "59ae6a2c2c6fa1aa8c7bffc04e6123c5b301c038", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818000, "uuid": "2faf8e73-206a-476e-9262-831436101429", "comment": "Malware payload", "value": "11e51fb22fd0257a6784825478c78a344cd511f36bb2772891c11ee3d5208dbfe8db63721767b84423f5ffd66901e623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818000, "uuid": "ffa543d1-e088-4316-bc4c-57b988a9603b", "value": "T16AC10D415EEE50DAF22703701BE773B70566E4B2552E62B871848A585F31AD0CC62EB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818000, "uuid": "22e9d9ac-603f-44e1-b889-4d2f9f121504", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818000, "uuid": "9049384a-627f-4b4a-91d7-ed16818210c3", "value": "96:s2cG794DCFyRr/nVIUqSGttZNtUq7GDpxSd3ojJirl:bcg94WFm/eUqS4LNtUq7QSdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818000, "uuid": "8fb576bf-b2c0-45c0-80b1-f44441a33bb9", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818000, "uuid": "f94bf4b3-a347-4bbd-ab47-fcf0b9c4ec9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818000, "uuid": "9a9469b8-5e21-421e-ae41-79c8d086014b", "value": "SecuriteInfo.com.Trojan.DownLoader45.55850.16253.27716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30571d9a-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864220, "uuid": "1668019f-95ae-4d6f-8abc-1d3549ff4661", "comment": "Malware payload", "value": "3f51277d40f700520600a53ea46956fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864220, "uuid": "099cf418-46d7-4989-9088-e948e50631dc", "comment": "Malware payload", "value": "d031dba06e6f21c4a0deaee93b9fa0ed8849f0d401ff26ca239e9da547030d77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864220, "uuid": "b9ec8b29-75f3-4fff-9fb5-0d89c6f27473", "comment": "Malware payload", "value": "6d0cb3e549331022b93beac4d7baf6eeaba63b46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864220, "uuid": "a3c52712-a79b-4496-a892-160b6bb10649", "comment": "Malware payload", "value": "31ae4dbadb778dda3a3a12a4df546e346a09393f84143111bf2a7e4f136a7a9fe02794080d1ae2571a152f6600919dfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864220, "uuid": "6e28131e-6da3-4d90-8dc3-05580e8212d0", "value": "T1F474A64386E23D44FE168B729F2E86ECFB1DF6508E4A7B665218BE1F44B1272D163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864220, "uuid": "6ae1cfe1-38e9-4d69-a1fc-8d07613d4d88", "value": "5c80077e1547ffc6f55b1869a125ea4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864220, "uuid": "9cfaef02-1b4e-47fa-9aa1-aeed457b3e0e", "value": "3072:2NcT4GeuhI4aR7eAvOPHsiQ26E7YPrchq45D54o+TrYdke0:f4GeFJaHT6EUPrcyhTGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864220, "uuid": "15650f22-ee6d-4aab-a530-9423ea2afa3b", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864220, "uuid": "cd3e0afa-b6cd-4506-b299-5d9042ce2983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864220, "uuid": "a0a76419-fe38-478e-b39a-5f2b20f6398b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3e7a7c-8b23-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700869371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700869371, "uuid": "c3d75eb6-003b-4d21-9570-c44f74c30f2c", "comment": "Malware payload (Mirai)", "value": "b2a8c3ad59eec6d35815f833866d4fa1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700869371, "uuid": "902314a7-5b9b-4b57-8a1c-9976cc099d24", "comment": "Malware payload (Mirai)", "value": "d08720eca83b82ffa356c35584dcf83a5db26f6eae8b4c288db82c27a9a80956", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700869371, "uuid": "3f4a6a11-0cd5-4dd5-a282-c983f18e1e2f", "comment": "Malware payload (Mirai)", "value": "2485ebaf13272761beec7f91ada2a0949a885795", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700869371, "uuid": "8f275542-a495-4837-9ad9-37c09054fb2d", "comment": "Malware payload (Mirai)", "value": "d80554421fa5c6ea22f777643c342aff52e4921f179822f6c54877b3a878aed4e2b969aca8f8d56c112eb0e59ddffa79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700869371, "uuid": "a2988685-98a9-47f3-b991-a0c021bcf24e", "value": "T15F531986BC81DA53C5D492BBFA5E41CC332123E8D2DF7207DD116F697B8A82B0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700869371, "uuid": "16ff0476-16a6-4815-905b-c36bea35ad21", "value": "768:FDAd63lBe+hu9rjbbv7cNN3LG7BXaoRTsDAFjwRNAPtJofCJJt0hkSGpgz+qbqOR:CdalCbv4pLQPBPtnOCSrhbqOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700869371, "uuid": "3f3c2964-48cb-4005-b1ca-b0159eaa0229", "value": 62560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700869371, "uuid": "ff776686-d00f-42d2-94e2-5c55ee23dd0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700869371, "uuid": "4ebbbb6e-d4b0-4673-a159-9e136bd0701b", "value": "b2a8c3ad59eec6d35815f833866d4fa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74267c4-8a84-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700801337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700801337, "uuid": "bb566208-df80-4c28-ad3c-1fd41905920b", "comment": "Malware payload", "value": "22c6f012d0ca6cc75bc759a4a72ca6e3", "object_relation": "md5", "Tag": [ { "name": "404tds", "colour": "#C36DA6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700801337, "uuid": "8cf5975f-ac54-4e8c-a88e-8cf66b2832a2", "comment": "Malware payload", "value": "d09c7908c39e2a3255811722903d37df6bf7a2083958abff5ded2732f412047e", "object_relation": "sha256", "Tag": [ { "name": "404tds", "colour": "#C36DA6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700801337, "uuid": "ff43bd03-77c7-45b8-97d2-7307cde75954", "comment": "Malware payload", "value": "c609de4c4cd525adb11631fa5aee773afaf8278f", "object_relation": "sha1", "Tag": [ { "name": "404tds", "colour": "#C36DA6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700801337, "uuid": "3e02c2ac-5099-470b-9fd2-a66b92eb30b8", "comment": "Malware payload", "value": "134d068a267247e713848b3113409a2ea19635c0cbb0808ecdd704ba2d542eb2a52447aecb9018c4a5c40a6f72fd5a7d", "object_relation": "sha3-384", "Tag": [ { "name": "404tds", "colour": "#C36DA6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700801337, "uuid": "bf7b2ec0-3f73-47fa-b3bc-47ad0b0bc340", "value": "T12C646B4AB3A900B5E177917C88578906EBF2B8160761D7EF03A0876A3F377D0997E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700801337, "uuid": "0358e444-0a91-401c-b36a-836a840180a2", "value": "b18406d2dbf0d91e0ddc9be8fc9257fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700801337, "uuid": "4b29f7c1-89a7-4d7a-8a4e-4061123c1ade", "value": "6144:I+cgwSgdJ8PQEOwqku85Gss8DohDX+N7aBnR:FwbkPNOOu85G+oZX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700801337, "uuid": "76370ed3-5872-469e-adf7-b19c800b9eaa", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700801337, "uuid": "e5c376ac-0923-45ae-ba63-ab033d4863fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700801337, "uuid": "7f8fe957-8a1f-4914-aa15-81064683702f", "value": "sdriver.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5256fc64-8b02-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700855258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700855258, "uuid": "974be2f5-2d47-42c8-bce3-d158d7c73671", "comment": "Malware payload", "value": "98210b9d4f43a89a9cf4ada70ebde64b", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700855258, "uuid": "e0bd6196-37fa-48f7-825d-241cf09719b5", "comment": "Malware payload", "value": "d0d0acae960f63394fee5b8739bd56b691f36ddd523f83b309c8fdce7385ccbf", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700855258, "uuid": "1e96a9ea-fd95-4524-a772-ea84330098bc", "comment": "Malware payload", "value": "98126cffbbc40498dc8357debc71f8e474fc002b", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700855258, "uuid": "549bc0fc-a3cd-4fed-b5d8-94f557310f9c", "comment": "Malware payload", "value": "9821d64142c1bcdc16f4535d0ba64177f9059aa1d25789528b5c2d429173f15c6b12bdfde59ed60a1dc37f2af12e5a48", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700855258, "uuid": "abb065f8-ec03-43a2-9683-ed604f57d1ef", "value": "T114A2E865FB59600D923290B6E7322AB6EE3BC477534248F0F09C7133EB944985776BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700855258, "uuid": "29ba0717-3663-4925-8da7-64ff33a68f99", "value": "384:zAr7HluP0EYxCuRilm8ewpaYdkC9LpoXSvITqcvJ86AjpD3FRfCMWJ28TOOKWJ2I:zA3Hlu/EAlQSVdDCSzE8D3s1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700855258, "uuid": "0f0a8c66-7294-45d8-b3dc-79c1dcc0739d", "value": 23287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700855258, "uuid": "36d8a1f1-0bf4-480e-945a-0e528d3f71bc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700855258, "uuid": "c69b350e-850c-4c1b-8db7-0f163fed5eb5", "value": "Remittance Advice B7571.HTML", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410f1da9-8af6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700850075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700850075, "uuid": "3a1924bf-70fa-47c2-846d-6f6eb45a09da", "comment": "Malware payload", "value": "b1886e56eee344b730dbd3ca44cc8545", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700850075, "uuid": "f80af4c3-d6c8-4b5e-aa9f-a361e7f156f1", "comment": "Malware payload", "value": "d363eb55ceaf45f4732d7626ecf984aa9a84893e17201397fed96d803f57412f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700850075, "uuid": "0c0e139b-371c-4da4-9ea8-9316fdf61427", "comment": "Malware payload", "value": "ffb3033939f598d3da17cea12624a0187a78b488", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700850075, "uuid": "50424064-d682-4445-a678-137618d4ccc8", "comment": "Malware payload", "value": "c9b7bc5d570b4ef43b34884458b095a342cd69768cd3ed8fee5945e037e3a472e0d6a616b2f58fd81f13dc22f49c827a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700850075, "uuid": "ce267cf9-34d3-472f-a10c-97ef33432899", "value": "T18D347B2365E0FC61C05647B44F2F96EC7B2EB8215E6D874E27541E2E1A332B1DA273D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700850075, "uuid": "66a8083d-44de-463f-8557-f50aeed031e7", "value": "bd153cb170efdbdb1b1268a5a173f793", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700850075, "uuid": "dddb6292-eb4b-4a42-ba73-3d74ed495d37", "value": "3072:05sRLyyxfsSrem3lRd5Ubwf+pxZYH7VReWFU5w+IxBb:1MyxS2fawmQHSYzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700850075, "uuid": "438aab2a-9fdd-4b5d-ba10-1509733c01f9", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700850075, "uuid": "8bf08ad4-ea16-45ac-9d4e-bdbb0a6862de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700850075, "uuid": "2c77f253-437b-4126-a99d-3b00f7b22e75", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ceb7f0-8b1a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700865734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700865734, "uuid": "2a3fc1c2-e0a1-475b-99bf-203fadba0b92", "comment": "Malware payload", "value": "4406e9c6faab7ab95c4e0550d7756dbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700865734, "uuid": "ad30da44-e96c-4f2f-b354-793f120d0967", "comment": "Malware payload", "value": "d381efbc2ea684b34bd852804284d9a9a27ce458be61ee375268d76681bec748", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700865734, "uuid": "ed7111f2-a06c-427a-9bd1-73410b6d9826", "comment": "Malware payload", "value": "ee4570ff9012accd0f314024c6b0610e8538d6e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700865734, "uuid": "fe12b749-030b-447b-9a0e-db68aa2a7455", "comment": "Malware payload", "value": "9ff110a4d315b6a5b6231c82d6fae541cbee3a83b7ea502775e18d1aaa900205ac79c4a5f36c6f34083533eb07be5802", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700865734, "uuid": "dea65937-cf19-45ea-ba00-aa6ec18873bb", "value": "T15D74A64386E13D44EE278B729F2FC6EC7B1DF6518E4A7B6A12189E2F44B1272D163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700865734, "uuid": "e13160bb-1a07-40e1-815f-e15b61c2b041", "value": "5c80077e1547ffc6f55b1869a125ea4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700865734, "uuid": "785f68f7-2b6e-419c-a189-f48ac5576a00", "value": "3072:iJVu4ae7hI4Z3Fk5gPFMmbdhmSt4Z8f+5Fxo87SqD54KVhiTrYdke0:v4aeP3F0CdhmSt4ZX7u8hiTGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700865734, "uuid": "a3b121ea-8e8d-49d6-8847-8cea7374a032", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700865734, "uuid": "aaea5d4d-2970-4f7d-ba72-a897fb7ecddf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700865734, "uuid": "19f790d8-90ea-4c38-bc95-348eb6e2ba17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d093dcf0-8ac2-11ee-8907-42010a9c0042", "comment": "Malware payload (Quakbot)", "timestamp": 1700827982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827982, "uuid": "aa6d9fac-56e3-4878-9de6-f82c55c2c922", "comment": "Malware payload (Quakbot)", "value": "7c715cab58eb5ff2dcc816a53e888157", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827982, "uuid": "f7a378ba-9f19-4758-880f-10de20267c31", "comment": "Malware payload (Quakbot)", "value": "d44752446f66cefdea0209201e82e1597af224f70db70aaf9f474ccc39303901", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827982, "uuid": "d71a0ab0-94dc-45d1-a05d-624c021ce844", "comment": "Malware payload (Quakbot)", "value": "43b9ed35e4fb544853ff4b7d97dac619b8614a5c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827982, "uuid": "9c4e567d-9cc4-47f3-bc28-faea3c612c00", "comment": "Malware payload (Quakbot)", "value": "37dbb9dc6ff0884053b26c6b943f9a3dd1a4dad32cf9b111e3fe65bf34dccc49c8c45d4e195977d7f2d5300f47487139", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827982, "uuid": "be055055-e19f-4d81-a034-48235623e71a", "value": "T1279184651BF45C800B4747D32A27B4C2E89AC4E339524A8FD530F19CBDD8729EF98A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827982, "uuid": "3a8b3c8e-5d99-4992-a159-ea9e3759133a", "value": "96:CixX3jWAQkbXXOLFDp9kA+gjwItw1z6YDHePOgRWsCXkmAMKfc3O/+t2a/gjZ0Fe:rNXOLJp9PP6u9fce/w2a/gN0F01Jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700827982, "uuid": "6b7e7654-bc0f-43ff-929b-0f5ee8216c36", "value": 4595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700827982, "uuid": "53ded8f5-474c-4625-8987-c78d1ca7a1af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827982, "uuid": "960cdc52-4b39-4153-87ee-2b4611ec9c20", "value": "Agenzia_Entrate (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ef666e-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864248, "uuid": "4a6cf3b6-cfce-4454-99dc-79c99640356f", "comment": "Malware payload", "value": "6cb40e6f199e62283df07f41b396b21a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864248, "uuid": "78419cf4-ab09-40bd-976a-6023c675d493", "comment": "Malware payload", "value": "d6831d36184ae91aae56a7fb7c91d7f75339429fbe5a1a0df8985d4884dcc217", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864248, "uuid": "62b44083-fe8d-46c9-9bd7-587d15288259", "comment": "Malware payload", "value": "92b53f52722778baa577e24dae2f951b258f60cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864248, "uuid": "3097490b-6088-4fa4-a24e-242823baec12", "comment": "Malware payload", "value": "51f4cae6541b955adbb860ebca2bfca7d9923df961ec208326da3c4d7bad90573a388807961540116465768ae2f11559", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864248, "uuid": "8626dd3c-d1f1-4159-8e60-eed404dbcce1", "value": "T15893F1CBDF14AF40C9918D3045ABDA399E31B5823938C66B3A99C5AE7CE13E07E4512D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864248, "uuid": "61cddf5d-7eb2-487f-a1ca-9de150a192d0", "value": "2905e1ef7316c93f009eceffa56624e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864248, "uuid": "75fb9250-abe6-41a7-afa3-899ee1458b1b", "value": "1536:FSBsNZOBTDeib6daQP6I6GBMb6ntShZhvPkQIxgrfRLOb33WfhnZ/dmTbi8:oBs+besA5A6tShZJMdNHWpZ/ED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864248, "uuid": "4269151e-7828-42f1-ac6c-d76159748a09", "value": 91344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864248, "uuid": "4db166c7-2c6d-4b46-bab3-2af8d6994b74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864248, "uuid": "16606a5e-5062-4ed7-b127-8a33925f8cec", "value": "SecuriteInfo.com.PUA.Tool.Sniffer.9.5300.12968", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32dfa157-8aa1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700813544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813544, "uuid": "9372aa65-4b90-46ac-8a11-e72b928bf729", "comment": "Malware payload", "value": "80625c4150f1f5a96e0eab29f1a187a7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813544, "uuid": "a6daf6f3-196b-4f81-90be-f222761c0a52", "comment": "Malware payload", "value": "d91a4804d3c191fe22b98d39cd726d93d823f702b9d3f6341c3e07e9440b713f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813544, "uuid": "f8ee3686-55cf-4bba-b9e1-0bcf00bac969", "comment": "Malware payload", "value": "94efe91c2cd5667f7254d01d5b0c693fa25a839e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700813544, "uuid": "c5589d55-5033-464e-9981-7d603bb52e02", "comment": "Malware payload", "value": "6158b5e0b609857108abf02a71691d5192c472ebdc769651efa82e839d42a346109c20247e13ee933bca69e8314be736", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813544, "uuid": "cdb3d21d-2033-43cb-bfb1-1957be9b0168", "value": "T1F814092035FB500CB2B37F661FE9B6E54E6BFB72692AA05E1045060B8B53E44CE91773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813544, "uuid": "78faf410-4815-4859-89a6-3b6d1917ce9a", "value": "3072:U0GCGK+FHGKGgG+G0GzG+GTGUG2qYae4nCFIGSNykcs7yyug:UKRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700813544, "uuid": "81e8ea2d-39b1-47a3-878d-f8c71f7b0ce4", "value": 203342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700813544, "uuid": "5dc5ed55-47a5-484c-be2c-d5bf28e4803b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700813544, "uuid": "2c2ac36c-d448-455e-84be-6f5687dbee6c", "value": "transferencias.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c0ef2b-8aab-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700818003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818003, "uuid": "95a32482-a51c-4868-a2f5-b936b138b13c", "comment": "Malware payload", "value": "142a3cc69d15044024d4ccd3282e20f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818003, "uuid": "e84646ae-9cca-4ffd-9669-d7f7436bd94f", "comment": "Malware payload", "value": "dccd94fcb5cd38b6077af35e7e85aaa867f263a9d00910197388e11e71c6b5e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818003, "uuid": "ac298aef-ade2-4075-8650-93c9b1682994", "comment": "Malware payload", "value": "a2ebe1b4cddc1012ba96c8e4dc0905d95501f69b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818003, "uuid": "2ec9efe7-a015-4580-a06e-9ec5efd6af82", "comment": "Malware payload", "value": "b9c7229ee0e79b4322ccdadaf9e3e17eb41dc102234e065e5e4c7e28429a0d647ac6e3aa7c3a04c0d4267c0ee3f5281c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818003, "uuid": "7593dc6e-6b61-44be-90a3-702330597d01", "value": "T1C6C1EF415EEE50CAF23707305BEAB3771666F9B1452E62B874948A599F30BC0CC21FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818003, "uuid": "b3ef036e-9130-4a10-9b1d-c77218975f46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818003, "uuid": "417f7707-31a2-484d-9825-4cf8f4dcb7e9", "value": "96:QxWt79OKCFyRry6nGNjtMIYVfAYBsVvk+1vGxPd3ojprl:QxWl9ORFmy6GNJMINY2vkBPd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818003, "uuid": "0c8cfc4f-f646-4003-a344-9e1da9b1ee08", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818003, "uuid": "1f3af1a7-9cf3-4d8d-b4b6-7d42222f95fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818003, "uuid": "d6132f18-5c0e-4641-835e-f7abd3465bb6", "value": "SecuriteInfo.com.Trojan.DownLoader45.55850.24411.16846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31063c11-8ae3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700841887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700841887, "uuid": "14cb6f2b-52c7-4dad-a08c-2eddb9f89574", "comment": "Malware payload", "value": "965b7cbab5230f0610ecd96184b42cca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700841887, "uuid": "13bbee19-4fd1-4aba-ae1f-11052d77dbdf", "comment": "Malware payload", "value": "ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700841887, "uuid": "24a2f426-976d-4e70-b020-08f9c160a117", "comment": "Malware payload", "value": "903524674e6ba12dc8fbbbb18d102b406cff4fc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700841887, "uuid": "f30869a2-4f21-40e2-a86d-5492ddf8b39a", "comment": "Malware payload", "value": "7839fd62b6bc83d9af892b609fa0051f3fc2beafebdafd4e4d24da7553442a30f2ec92c9812101e7c36dd8a43ad2c769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700841887, "uuid": "e1c2c84c-e289-4798-8cf1-6a6df161ce70", "value": "T1B444491365E0FC21C4D64F354E2CD7EC7B2EB8625E66974A225C2E1E393E2B2D663311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700841887, "uuid": "47f07dda-2293-4bb2-b479-8e092cccabfc", "value": "c577c58a31abefae7ed25bcc269ae1b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700841887, "uuid": "37edf988-2a5c-47ca-bef5-8e6015a4631f", "value": "3072:0Dpag5zPOTbWvICkrEj6eSgpWmssCMmWhDO5JqA8qr5ROVbzZ3:qb5jO2ZtJS2Wm5WQA8ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700841887, "uuid": "d6db5ca2-592f-4cc6-a5c9-776eec6b0618", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700841887, "uuid": "dc5604a1-1ab3-4272-b681-d2e567047138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700841887, "uuid": "9c319112-2f47-4b25-b4d8-3116a5463916", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d2b53e-8a92-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700807420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700807420, "uuid": "7b39c8dd-04f7-45b8-b877-4ed159cafdba", "comment": "Malware payload", "value": "7022cc78274f703ba16f725289348bf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700807420, "uuid": "ec61cc83-c301-4222-b7e2-5bc863734ebf", "comment": "Malware payload", "value": "dec12d44f8a5a867a5f52be9384dffc8b03524342976d0a5dc7102365eb9ba46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700807420, "uuid": "89c308ff-581f-4675-841a-d587d1660c95", "comment": "Malware payload", "value": "cd663180da82d71d659c0737456bbe208907c050", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700807420, "uuid": "746f947c-1263-425f-aba0-d2ab6b90b78e", "comment": "Malware payload", "value": "ea58644d41a96b93a5981f8a2196439e8685b41ccfa12b262357710efae3d30ac12a04cfe724f9077c958f1d25f2aa30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700807420, "uuid": "459857b6-6d7d-4b59-b6d4-e978426d0aa4", "value": "T1C9943B0EF944DF74C64D4BB44DD782BD98D0700B133725A89A29E4FDB170BEE72A582A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700807420, "uuid": "22ebcf32-2096-4c9d-aa02-0270c56c68a7", "value": "e60c4d3c8061af5effec4e9547cd51c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700807420, "uuid": "76f9eb6f-1b2e-48ea-95b0-fb792a70aa64", "value": "6144:kgrigjUFccbbRP8ZmgtZvD2292jkbG2azJ9hj3mzcYfBNHBdk2OjBVZ:kqYRP8ZJbxkTYNHk2CBVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700807420, "uuid": "dd3dd60a-2b7c-432f-ad04-30dca74ae5d3", "value": 420858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700807420, "uuid": "7aa09a8a-a34a-43f3-821e-06b5cfed84b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700807420, "uuid": "9529b8e1-c289-4a64-8531-88d04fe7047b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479ef047-8ae5-11ee-8907-42010a9c0042", "comment": "Malware payload (NetSupport)", "timestamp": 1700842784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700842784, "uuid": "8a2fc955-b161-4693-a018-8ab89f31e004", "comment": "Malware payload (NetSupport)", "value": "ad6ea8bf7ab9c659f5604fb2c97f3a0f", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700842784, "uuid": "dce10c9e-72c8-458a-80d7-93c4d7048430", "comment": "Malware payload (NetSupport)", "value": "df96827f93a93796c12a5a87ea111f1db25d04d0314ebeb69ef52ce16fd115f0", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700842784, "uuid": "10f6af01-3b75-4a66-af63-4f1dda9d9f23", "comment": "Malware payload (NetSupport)", "value": "2d40e197fff1bfbe6737b41e2a84aee37da8d7af", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700842784, "uuid": "e0fbae9b-71aa-4829-ba69-bbc1f6f0a3e3", "comment": "Malware payload (NetSupport)", "value": "0d39a7a4ad3cddac0e2246cfc5eb2f99a358d612f77719842b9d98df6c7364dff310c03136257a89e1c32c8d5c6112b1", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700842784, "uuid": "eb74f2e1-eda4-4905-8a35-c292a2ddf8df", "value": "T145C533512A83FB67C0E2F1BBD4ECBC562D2D6468E4FB36A7093FA4A2E535461C47E401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700842784, "uuid": "92a86354-cf10-457a-9a6a-e15ba3892b7d", "value": "49152:mlAQumelDlEDThXBJOhHLw6J6h2SFFGf0RBNTQfYc9jh23eWeB3/YSBm7WIqR/rq:ml7/FXamhRFY89YYc9jh23redpmQR+5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700842784, "uuid": "6ba6668b-acbe-4535-b81a-8d31b6aa5d7e", "value": 2562040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700842784, "uuid": "2f6d51dc-2641-47b8-923f-ae0318cea6c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700842784, "uuid": "c3117eee-771a-435b-af90-513452fd38d8", "value": "rtr.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e574604-8adb-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1700838608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700838608, "uuid": "f70308bc-b827-44a5-b544-5a02c3b040c0", "comment": "Malware payload (njrat)", "value": "1f4b7d2f534977627fa2a529013a5b58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700838608, "uuid": "cdda0e8f-d685-4dd4-80e3-565e93f699fe", "comment": "Malware payload (njrat)", "value": "dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700838608, "uuid": "8080bb3e-3063-4e7e-85af-f8f7231dcf5a", "comment": "Malware payload (njrat)", "value": "88077cc48814bc2743ab721f4ae6a5a09724e6ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700838608, "uuid": "626b4dcb-6767-4d2a-9f5a-a7036c52e1c7", "comment": "Malware payload (njrat)", "value": "fbd60cf42af8cf897f182b9a8fd2a55b247204301494ce807a3b0d1b690cf5137ab9cbf5d3badba76ebf6cfdf84ca735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700838608, "uuid": "80544ae2-32ab-4bea-aa3d-e35a37a6fee1", "value": "T159032A4D7FE18168D5FD067B05B2D412077AE04B6E23D90E8EF664AA37636C18B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700838608, "uuid": "a9f8ebb1-a22b-4771-984a-6295e908229c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700838608, "uuid": "acb1859d-6805-443b-9e91-f8f53713e7f7", "value": "384:FuSvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXz:4S7TZ38fvCv3E1c1rM+rMRa8NuUet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700838608, "uuid": "7b466488-8a32-4e7b-85fc-f88469f18a2e", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700838608, "uuid": "f1dfe9ae-4cd9-4365-89b7-7b97a4911da1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700838608, "uuid": "28c95c14-d0dd-45fe-93aa-f1c996cff7cd", "value": "1f4b7d2f534977627fa2a529013a5b58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82094545-8a9f-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1700812818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700812818, "uuid": "9d482d1c-8fd1-4da9-9f93-08b02788f55c", "comment": "Malware payload (AsyncRAT)", "value": "1b9b618c9ad5624110b2ef4abf527d09", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700812818, "uuid": "3e70fc16-9675-4817-8884-c21017dfd314", "comment": "Malware payload (AsyncRAT)", "value": "e0206c408fccffc8b23468425142e32f965cb4ce66a3da4029eead9011e7adcd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700812818, "uuid": "47108c3b-599e-4216-96a0-a6cc545384e9", "comment": "Malware payload (AsyncRAT)", "value": "07d552ca2c1c539363edfe62c1b863b0c399c3f4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700812818, "uuid": "02fde55c-63cc-447e-9713-579694b26ebb", "comment": "Malware payload (AsyncRAT)", "value": "d0411786ccc7cbda60f84a225b715b5cae7b44088e0e81e92773e52b1588daab9ae12c1b45659eb76bbabcab40210e17", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700812818, "uuid": "9cf835bb-5ee2-4a42-aa3a-d8c3abfb2d83", "value": "T19AE3AE592C9F4431C852D9705DEB89B2AA3DF57DF3E08286139C9CA2EB837BC115D3A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700812818, "uuid": "26378ef9-9cf9-466c-be81-058f18c23b52", "value": "d312c9bf7aeda2faa72683a5491a7109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700812818, "uuid": "171837bf-bd2a-459f-b762-4782b3b14b4e", "value": "3072:DfIczA1m3c4yCc1BlyXgpmqFYOrW82i4RKRz8EZ:ZU6TABlyQpzFYyWTxKp8EZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700812818, "uuid": "441e45b7-a91c-4694-9102-b547fef2b6f3", "value": 144700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700812818, "uuid": "767a34ad-da10-49fd-a70f-4f0110693399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700812818, "uuid": "1f5a72fb-97a1-454f-a392-52f539269418", "value": "1B9B618C9AD5624110B2EF4ABF527D09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd4a8ff-8ab9-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700823813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823813, "uuid": "dc0d6bbc-08cd-417b-8d12-e2b6047be4e6", "comment": "Malware payload (Formbook)", "value": "287c003f919180e57cf66343ff47789f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823813, "uuid": "63800c67-8a36-47c4-b1c1-f9ea8f793ff4", "comment": "Malware payload (Formbook)", "value": "e14808468255a0635af33c8889be55caa22ee2bab8cf8da21d76882ef7f36317", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823813, "uuid": "18e1dbdc-64aa-4807-8eef-2a0edb2c06ab", "comment": "Malware payload (Formbook)", "value": "b0171d7113dea955bb8d43e05d0bd8608b7b7e6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700823813, "uuid": "1d1a6e90-e180-4dad-919e-168e20fc0fbb", "comment": "Malware payload (Formbook)", "value": "9338a2a452b510bffc1c046de4ed79d7082d7c2fe6955a4d6bc3e40d6a4fb8ecf6aaeae7ef0cafac548922be25c913d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823813, "uuid": "ad1cc5c2-1268-4aad-a5e1-6ecfde989908", "value": "T151D42301720A8AD2D55D2FFE1EFB012607316199E4C5DF38CA181BF68A35F62E73159A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823813, "uuid": "23d53bf7-b8e8-43fb-a0f3-8b003b467d50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823813, "uuid": "bd407595-7381-4bcf-aad0-92be2be044a6", "value": "12288:Erv4NLHwk9N+XhtqcpOHWZLwPone+RlE4nMzAiBvmAmNnR1/JlYK4ENzqjvK:avUzuIHW6Ae+RyDvBENzL4EN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700823813, "uuid": "2ce6dd23-41a1-4393-8d31-77ca1cb8cc50", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700823813, "uuid": "82a2f928-90e8-4b6f-ae62-6f6898ace591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700823813, "uuid": "def6ab76-8fad-4487-93b6-f05503ecfe0c", "value": "rDHLReceipt_8939977153.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9773c95-8a6c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700790979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700790979, "uuid": "9bc26592-8f35-4157-aaaf-7e7536d26528", "comment": "Malware payload", "value": "ba8e15aaadb61fc7273f619ef1d085d0", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700790979, "uuid": "35015798-17b9-4064-9686-01941e2f7a74", "comment": "Malware payload", "value": "e1553112e4e158fdbb73bb698d222d49be9b13f98aeef543e9c5bee91f028fe6", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700790979, "uuid": "dcf8ac1f-26b6-41cf-ac1f-848f7d33d8b3", "comment": "Malware payload", "value": "51f4da4de31d3e86c974302788ff7fa2c481c47d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700790979, "uuid": "318831ac-8d4e-4b0f-b07b-09f69aa1469e", "comment": "Malware payload", "value": "13512e713a6ee7b55624c723f0c439561238bd3491041bf0847bb51287fc34ea61abeac4c413a6111b3d2a05c81a4737", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700790979, "uuid": "46103075-d318-4860-95b6-055c55511a49", "value": "T18135E182B348A427CC37C93946FA4B6B97858C504967A3271965F62C8DFFAC04E85FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700790979, "uuid": "26deb555-d3f6-4213-a891-81b24ec73c79", "value": "24576:EWLMuPNtc/+no7kp6vIUXOfnl3Zjzn9fb:EWPWRkEN+fnzn9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700790979, "uuid": "780c20f4-c55d-43b7-8149-8a84cff1191c", "value": 1097114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700790979, "uuid": "9f76409a-0039-40c0-857e-87853d5a3068", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700790979, "uuid": "befa007f-6ccb-493d-aa19-2641ee99d744", "value": "Ultra.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3502465-8ad8-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1700837408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700837408, "uuid": "00ee1e26-36fa-40d4-8b40-3b82dbc10c3a", "comment": "Malware payload (Stealc)", "value": "ce3e72eb8c900e2639b26ffd78f26a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700837408, "uuid": "b4f26243-136c-40e8-9d5a-e2e0bbe6ac19", "comment": "Malware payload (Stealc)", "value": "e16f1f21e987f05866f79e0df4dd036306876fb5f52f9c0a2de6dce828d2cbce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700837408, "uuid": "d4500b08-58d5-4ade-9ad7-0eaa8873255d", "comment": "Malware payload (Stealc)", "value": "3a1f1480d5e4bf96532eb6fd1b1861232f2352b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700837408, "uuid": "eaaf63e3-1210-4558-9ee1-3b17e0eed107", "comment": "Malware payload (Stealc)", "value": "a3a36f2f24cc40bfdf9f2c3d51148f5f55e6363144ec5299c7887b0cddf410f24ba652cb3dc4d3d05bca310cf68e31da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700837408, "uuid": "527f9389-ddb8-4eb0-af1b-0b8c8cc75db7", "value": "T111446A0365D0FC31C5524F354F2C96EC7B6EB8629E75974A2238EE2E69322F2D663311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700837408, "uuid": "c7c40cac-c54a-49a3-9215-355da9183750", "value": "c577c58a31abefae7ed25bcc269ae1b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700837408, "uuid": "5baf5fa2-e8fd-4797-b4e0-c2bcfbb2ca32", "value": "3072:SX7atur7VEusAAcQndgY6a7/nLmc5AX7qT0b8lr5ROM3:GOur7VsDvLGq0b8Bh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700837408, "uuid": "03dce86d-89e1-40fe-91f2-228e8c41f5e0", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700837408, "uuid": "be68438e-d308-4c6f-a8da-ad1b27ce5ccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700837408, "uuid": "94d276ab-8051-46be-8f3f-bbefeff61ec3", "value": "ce3e72eb8c900e2639b26ffd78f26a6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1538266-8aca-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700831473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700831473, "uuid": "6db295b5-fc32-4b9e-bed5-05a2b11969a5", "comment": "Malware payload", "value": "da64bf2617c676a9dfd37677ee011faa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700831473, "uuid": "ffac8d51-4c38-4be0-a3cd-33a8e58671ac", "comment": "Malware payload", "value": "e198fa82dcb7b38b544c5d0c5357c9e22fb905566eda64114200a77fabd9e756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700831473, "uuid": "f9d3e6bf-fa88-425a-b7a6-540c3a13a2b1", "comment": "Malware payload", "value": "4fba7e3323c7c2e8ea55c6c42464b7019e7dcb8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700831473, "uuid": "57daa15c-53fd-46a6-948d-9ae2932b2d3d", "comment": "Malware payload", "value": "41e78b9a3a56be81d1ba259765b738d693f9bf7acc269606b7f0aad89a2f260d0a4c5f831e52263e58161cd833384e48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700831473, "uuid": "c9a03567-7690-4e51-8cae-13f3d89a17b7", "value": "T159467C589253C99DB53532BBDE4C93A1B0EB74A6AB394B42CB28077671933CBF81443D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700831473, "uuid": "87dbc69e-fa2d-4ee4-bafa-e10e2f95ad6a", "value": "3e108abbf5b70ba74c91cc0339a005dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700831473, "uuid": "6d1d1d4a-83e3-445a-b1c4-3df4446ee873", "value": "98304:AT769iKezewaL5yM3fLdV7kvI6C6eO+pa96vymwEzShIexG4:/ppiIs4paYGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700831473, "uuid": "dccc9761-9a9a-4930-a8d1-c422467ff181", "value": 5552128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700831473, "uuid": "7bc8f4a6-4d6c-4507-9ddd-f600fdb19dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700831473, "uuid": "61c202e8-08d2-4f0f-be74-8d0b0a118d1a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7785c0-8abf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700826366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826366, "uuid": "8a0cb8ee-8ad7-49c5-87b2-41f404e300b6", "comment": "Malware payload", "value": "be5a10563c1ce12aae0f4229ccfa010e", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826366, "uuid": "e54f72f9-b502-4fd8-9270-865e5d849b53", "comment": "Malware payload", "value": "e1a47dc75eebeabde9abbf125cfb762a5fecd56f13d4da16117d8c7ee13efae8", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826366, "uuid": "ce581dad-e053-472d-b996-683a04d399b3", "comment": "Malware payload", "value": "362c9e097c00087efe2cf462c8837e3db53021cf", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700826366, "uuid": "1602fbd1-5a39-4708-897b-c4df1b82ed5b", "comment": "Malware payload", "value": "7ed6b995858787fa6bf3daaf63478ed633890f20e99757fa943650db9fafa0f2655ae151925f4c1a4cde209274fe4eb8", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700826366, "uuid": "823adcd8-b933-4693-b0fb-397273b86d47", "value": "T11E354B22A3D14437D5732F758D6B86986C257E302EB4D95A7EF89E0C0E38B817D353A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700826366, "uuid": "9c0369fc-e6b1-4e71-89be-78d6445ed8d1", "value": "24cdc56b5fda73aeb4bb75aa4a21ffc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700826366, "uuid": "7b5b836a-eeba-4ed2-ae98-79ecbe58c185", "value": "24576:S5Pc2oOjScX6F9204jN76eOJd9eZEdRapWhmAMJ8vDjr5xyH:rLQ/O7wWhBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700826366, "uuid": "c2458f73-4b81-4c24-b7dc-3ad1eebc3ba4", "value": 1158144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700826366, "uuid": "28ecff8e-c2f7-489c-a0e0-4fda5a640a70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700826366, "uuid": "575d9997-8e66-480e-942c-84da6883c4ff", "value": "170082636494208d444f2e6290754c07c178fb30c31f942dce18aee825f4e6c5158b0e2251416.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e01ae0c-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864243, "uuid": "2f281cfb-5401-48c9-bc1b-e5fac5323edc", "comment": "Malware payload", "value": "e12770f6a6d71e52bcf82f35aea4d319", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864243, "uuid": "decb38ad-7b33-4874-93c2-21329586158a", "comment": "Malware payload", "value": "e1aadd17601dce6da43199f1fb75ef5c4348b1e048a7ea6a997f0423a1514e84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864243, "uuid": "38bf1065-df99-41a2-90c4-0eea87467943", "comment": "Malware payload", "value": "eed461102affea28b603d153ca937b9281d20698", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864243, "uuid": "f6ad4911-c1db-4a69-a3c7-9a31bb5d33dd", "comment": "Malware payload", "value": "2861543b66dd5b7b961723f9705051ec6b6f2c1af4cf767be5333593fc3cd220d909ff0dd98478f9c4a1d6131cb61fa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864243, "uuid": "88d0717e-52a8-49ba-9dee-43b80eb06720", "value": "T149D47D22E3D24437D07356795D2B8698AC26BE213AE4984A3FF4DE4C0F397917D39293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864243, "uuid": "3d5b5a41-0a7d-4049-9e16-33e209b9e4cd", "value": "244e8fca72faf0258de3e13b2da2d4e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864243, "uuid": "b62717a5-2ae6-404e-a6e2-be08f41eea00", "value": "12288:Tpt9WpYb0iFYg8/KF+o8hpUmWT+vFBtEWhuq888888888888W88888888888:VLWpYbqgv+o8haT+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864243, "uuid": "a750bfdd-dd02-414f-87e4-bccd30aa7ad8", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864243, "uuid": "65b34e3f-6d9f-47d4-8207-fb2728d380df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864243, "uuid": "c30b5035-6faf-4890-911b-dd1cacb639d2", "value": "SecuriteInfo.com.BScope.Adware.FileTour.32757.885", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45277ca6-8aac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700818299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818299, "uuid": "8461163c-615e-4b25-8cd7-10bd662fd40c", "comment": "Malware payload (Mirai)", "value": "2342d035420176cce625e79556c230c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818299, "uuid": "d48c8fe8-dda4-4ecd-b79f-2c20429f67ee", "comment": "Malware payload (Mirai)", "value": "e41d9828be590bdc559767b856f6610f9d2b2c93b9011d8e1282efed483dcc82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818299, "uuid": "622672f8-9420-4f68-b90a-a5007ca92167", "comment": "Malware payload (Mirai)", "value": "23b7cf4d4348c4eade3757923e9f7671fd5b53fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818299, "uuid": "8e153d73-f1f9-437c-b888-93d55897d118", "comment": "Malware payload (Mirai)", "value": "933f516ff39bf79051ef2a1b5ea2831013ec6f6ae5fa91cca10482deb0226152a1290522758704a82a2cfc34b6e18d63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818299, "uuid": "c55f228d-ce76-4ca0-a865-a50262ed3e68", "value": "T1F0834955BD825A22C6C523BBFA2E41CD372163E8D2EF7207CD216F1177CA81B0D67A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818299, "uuid": "beb09802-171d-4b45-8d75-599915f11fe9", "value": "1536:br55u73LjC/7TG5B+FFebewPxXhnDCWLPKWjGNHcdhZvY4sEvQwbZnB:br5A73C/7MlyqRnDoWjGNHaY4IwbZnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818299, "uuid": "54162f1a-5c44-4673-9e4b-894433ed6131", "value": 87364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818299, "uuid": "c00dd8e1-618a-426c-bc1e-a1f017f1dd47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818299, "uuid": "06f63ca9-d2f6-4fc4-8abd-c447e975a573", "value": "2342d035420176cce625e79556c230c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42932897-8a78-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700795961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700795961, "uuid": "3c2cee63-bbf6-4d3e-ba9f-e6c74b127a80", "comment": "Malware payload (RedLineStealer)", "value": "bac3dffef883860ea809bc59011a8143", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700795961, "uuid": "8fc8e0f4-1fc4-40ff-a63a-9a306bfa376c", "comment": "Malware payload (RedLineStealer)", "value": "e4a2a9dc792bd2fdd98dc31133107f881580afc0508ef788537cb900dee7efd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700795961, "uuid": "3d67caf6-f60c-4f54-b161-c9ab22d04d95", "comment": "Malware payload (RedLineStealer)", "value": "b37de5526397ef86b29f10a85d7e4c95f7f3f923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700795961, "uuid": "7f275c5c-d579-4521-bf1b-9188d5111d1d", "comment": "Malware payload (RedLineStealer)", "value": "b259357a4c4a0a0a253e98563eed986cd9664095f6a09c87a318fcd17f17ebd0b4b15f48a955e8af29da7f5d0b28bc74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700795961, "uuid": "a72767f9-04af-4b9d-baa1-f21e62640af8", "value": "T1D3D53312D6D886A6DC26433668BE42D31F71BEA160314ED76FD99AC608315F93C3B723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700795961, "uuid": "6208b002-e7be-4140-b3f0-75a5243391f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700795961, "uuid": "ab5ad5f6-2f7e-4901-8860-c0007771624d", "value": "49152:20CrZN4cusO8ePTdK5RsKpuIN6tpeaRrKMvXdiAb6NeDQfZcFaxxD:TCFzOPTdK5RsckPrK2tl6NCQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700795961, "uuid": "eaee5d19-d50c-4e4a-9e65-06f869386887", "value": 2840576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700795961, "uuid": "3e9a2463-5d18-440b-aaca-725a8b385500", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700795961, "uuid": "3f9efb74-b947-452d-8e08-662a4b484c75", "value": "WEXTRACT.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd1c8ad-8a98-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700809668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809668, "uuid": "b94bdd8c-961e-4844-b4cb-ab7877e50b6a", "comment": "Malware payload (Mirai)", "value": "341b8cdd9001f8b11ff7806d869a092b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809668, "uuid": "7e8e6182-0cbc-4c0e-9771-5bb6071a4fcf", "comment": "Malware payload (Mirai)", "value": "e54acdac17bf7fcdcb6d1b1139f598708211b539a85e6c89da4252fb9a317a67", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809668, "uuid": "bff7c132-18ef-4319-982a-1eab6e982682", "comment": "Malware payload (Mirai)", "value": "8326f0a61ad6aaacdb7ea1591f92d65923147638", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809668, "uuid": "eb221070-d7c1-472c-824c-92ddf35709c6", "comment": "Malware payload (Mirai)", "value": "a2b2d713abeafd9a636129b7e0486f656794a6426cc1e572ef037938bb69800b527168f2eb9d9a1d77908ffd9306bcbf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809668, "uuid": "59b99d69-ebe0-4c17-9568-cc7c6b6d4c11", "value": "T13D433B17F58281FCC48AC1B4066AB63EED3271FD0379B2A667D4FB362D95E210E58C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809668, "uuid": "a1132615-ec93-49fb-b7bf-fbcaef396179", "value": "1536:O3AIk30vaBCSe8jOQ7Lrh22/io+tUjZKYPLO4tgGgf2t:cLRyBHe8jOqLrh22/iJUQYPLxgGgf2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700809668, "uuid": "755f7819-0119-4bde-ab6f-950b7a293f75", "value": 59328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700809668, "uuid": "9d075526-6d08-4bdb-acc4-ee4e4b5b1584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809668, "uuid": "24a77232-6c96-451a-bdf9-01cdad8b29f6", "value": "341b8cdd9001f8b11ff7806d869a092b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79fa8925-8abd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700825689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700825689, "uuid": "603c2569-7661-464b-95a2-9602e3e0ab8e", "comment": "Malware payload", "value": "a5b46c889b5f5b13ecacf1611c1cc043", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700825689, "uuid": "0c6799c2-d19f-430f-86fe-499a1aecb0d4", "comment": "Malware payload", "value": "e63ea2e99a786b31f18ccff6e7590aad5cc41cc497d48e68f6eca1ec376c0387", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700825689, "uuid": "ec441cce-20c9-4fd9-bcb2-ad3b5f7e0bd3", "comment": "Malware payload", "value": "55c46e2ce7ba35a0330f3cc3123aa02f8f5f3d31", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700825689, "uuid": "582d2547-8a93-48cc-803e-b382c7c6dfb3", "comment": "Malware payload", "value": "2810d45448092ef184fdf2e7ea81e0d7c16fc6259035ab02ec9ecabda2a5d802ec6f81823b92984ac6b400a8be3d801e", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700825689, "uuid": "03156ac8-f71e-4dc7-b59c-3cfbb323f0d0", "value": "T160F433245C42F5C2B9E6ED29DE93C34DC8A754884D05F3DE1A2AC032F63AD9309AD4E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700825689, "uuid": "55e957f8-54a2-40ba-ac0c-c40f98f0a052", "value": "12288:VlG31TaBpyLpwCTKfhdtDJ0/Qi1vqo6dULdiu/mNHhNYsusxqYHMJXVsWN:XG31TSpyLpPUNe/rqo66Rp/aNYspxqHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700825689, "uuid": "0020becf-bed7-42c1-96dc-5e416f753a9a", "value": 751099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700825689, "uuid": "53efc69b-5607-4efd-a810-c0249e78afe7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700825689, "uuid": "aeff856e-e320-4418-8ed7-fca41f935f3d", "value": "Payment_Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a49562-8afb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700852493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700852493, "uuid": "3b7c8978-8f61-4451-a17d-8ccb029f8448", "comment": "Malware payload", "value": "b9c20332f401c94658b1792afe3e9769", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700852493, "uuid": "ae89a779-3b3b-45c1-b02c-9d7e79ad52f9", "comment": "Malware payload", "value": "e7c3e9205407fa28b92e2999e3901553f23b3d31c543b93a757ced717ff1a111", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700852493, "uuid": "e0e06b96-52df-4fff-ad11-919dfa0cce0a", "comment": "Malware payload", "value": "37dc46835c4fbaad83d04faebd50e020504daccc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700852493, "uuid": "e85176c2-b8df-4572-bd63-6be5098959dd", "comment": "Malware payload", "value": "baf991a3f13fffc82ebadc515a5d333be5a765f37f012e99fe877f9e05bff955f7059e6bbe23344848c492ca289f561d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700852493, "uuid": "fa4fcc38-b2f0-4548-b94f-c88df73763bb", "value": "T189B42338DEA0C23466851505E3C37BC14DE9DEB7A2A5B5A7268F2A1077F50FD69BB003", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700852493, "uuid": "0eee1f3e-f9ba-47b6-ab9b-263cfe75b2f5", "value": "12288:+M7b+kCcgZoE1GnFMYhom2gp0wuZ9LD7IXphUAT5eDi4:QP+kaFBWwyRIY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700852493, "uuid": "b62f38b4-5856-499a-86eb-a5d7c3f6e781", "value": 525852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700852493, "uuid": "af2bde58-76d4-43db-b037-42729f939846", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700852493, "uuid": "2f2008d7-725f-4190-bd9d-11c87ec8f974", "value": "gmpopenh265.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03bc54e4-8ac3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700828068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828068, "uuid": "f399e0a4-f491-40cb-b1e1-59e2f7cb2ef5", "comment": "Malware payload", "value": "26f8d4e0fa9ccc196ed833b09d1a4f2c", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828068, "uuid": "3b041775-16c3-4f16-a2a9-9b22d5d5fd09", "comment": "Malware payload", "value": "e85fb3d342b41c2db3564ca16b7bbd3d5741381e269e57a1e44369dbe568c0e9", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828068, "uuid": "01ec8487-4f3e-4d0c-a892-36091d7a6037", "comment": "Malware payload", "value": "5b01f29dfb72ec4aefe86641486cd7c0d3da4843", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828068, "uuid": "c6a3a4e7-8271-45a7-b704-6c50a0a28180", "comment": "Malware payload", "value": "421e4f37d7501fde876d2ed488af600c27f452283701308f01574faf6874850c319ba3ea6dd1ed3345f105c5cf324881", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828068, "uuid": "33f3a2a5-1ea4-48b7-b1b5-bd5f448293b1", "value": "T14291B76432BC185183965FE7BF6AE8D2FC9969D33D45DA1B90006C60FDA09A7CBD4334", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828068, "uuid": "ce5e84db-8f15-495c-a7e6-52d552e0bf15", "value": "96:npymAElwhPTp7IQL6y1nyMG0qQwLYyPGV68P8CtYyQUM5rcDieIy+viJzvqSIApc:np4fbIm7hyMGT4yPGV68P8/3Bcuep+vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700828068, "uuid": "b2d1a1f1-afcc-4098-a1de-20efd0680137", "value": 4551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700828068, "uuid": "499d1f6c-57ea-436a-97d9-76a05489035f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828068, "uuid": "2233d5b1-1f74-442d-9ae2-367a127fb2c0", "value": "Agenzia_Entrate (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2524818a-8b16-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700863772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863772, "uuid": "a24b4ac1-731d-42e7-a47c-ec6976cc9186", "comment": "Malware payload", "value": "e553527ba2bf6163b7f390f80b62d303", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863772, "uuid": "af75a3cb-795b-4c64-b337-22710f4a48ab", "comment": "Malware payload", "value": "ea6901b382c4b8202e64b3a588846f936cd3c500057e535fc1ed9d0a5a305540", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863772, "uuid": "7b72028a-b48d-4ca3-b1ba-876954019306", "comment": "Malware payload", "value": "dea3f683033a039b7acb8ab447f7d1a8b1fcf4a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700863772, "uuid": "99a472d4-f215-48e3-95cc-e385e75a476a", "comment": "Malware payload", "value": "695fc6d77dfd40b0c5045ce1230e730d40112aedd569389882db13212ff374869987f900921f5ef6530b060500a180c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863772, "uuid": "380b27fa-2967-47d1-aa6c-43d50640a086", "value": "T183347B3365E0BC21F652B7344F2D96DC7F2EF8230E66874716582E2A5A306B1DA37316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863772, "uuid": "2b16744d-484b-4154-96db-aa4cb2f91507", "value": "e9ad50bc63efe5521ad556ec46de70bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863772, "uuid": "e83bbdb8-45c2-4c35-ba7a-2f3c5c2cf6d0", "value": "3072:L0odeHi4deFhI4jghGnZYzQLdPXdDAVp2GvmpJmwJD3VhMCy0ABPcw54NV:wir4defghySzQLjDA2AAmqC0AFKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700863772, "uuid": "6b039192-f841-4e04-9508-636aa5140373", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700863772, "uuid": "60188a4b-18e2-49bb-b097-c1ffc6510e7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700863772, "uuid": "4e3fcb78-155e-473f-80b2-8fa99ec6a615", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a17e1e-8ac2-11ee-8907-42010a9c0042", "comment": "Malware payload (Quakbot)", "timestamp": 1700828015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828015, "uuid": "f669a312-82d4-4876-b480-18fbc46227f4", "comment": "Malware payload (Quakbot)", "value": "ab17e115f6cb33ad39d97248e06c82d6", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828015, "uuid": "a9e732e0-620e-4fc9-a24e-cbf9d8d7ba21", "comment": "Malware payload (Quakbot)", "value": "eb0e60bef5d8996af82b98cd977bfe1847b8b7de4efdf5b2f75f4e36dde29891", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828015, "uuid": "0e1c6fd8-47cf-46a5-bc98-b237b8e53add", "comment": "Malware payload (Quakbot)", "value": "8e1784b3dfbeea4643d7d6abebd164e1aa4bd259", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828015, "uuid": "ccd5bbd9-36ff-46a9-b3f2-5de0399621b3", "comment": "Malware payload (Quakbot)", "value": "4aeb7cd6eddaabdd7f93b71b9432df632b1730a9eb3698ffa30c18d7aaad1d12c733dd247aad3a4e91058d28f66ed543", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828015, "uuid": "164774ce-f0e7-4896-b87c-b4ae8576712c", "value": "T159A1A40863E03494075FA7B39A2A72DAEC5E493339A11C1FF854DA88BCE5911CF99D34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828015, "uuid": "80cc769c-4c31-48f2-85f3-5fc9e84f6fc7", "value": "96:GTQmAOtYv2jkqWwP5jiV6nJG7/+yzK6lRi51YRld+0muGxNGiOTEVxwKiWpz2V:GTSqYvlqHP58407dxlRufTxjTZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700828015, "uuid": "8c170b53-4165-43db-a657-d1e6711225b4", "value": 4841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700828015, "uuid": "403ca20e-89c8-4993-bf57-afefbf91d961", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828015, "uuid": "e9c76318-1c73-4e3d-9d83-45bb4768453f", "value": "Agenzia_Entrate (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad7b269-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864238, "uuid": "618e28b4-8dfd-4d45-b87f-ce9224806c7c", "comment": "Malware payload", "value": "1ec7ba0964cc1524a7c98deb194357c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864238, "uuid": "dd805b59-36d7-4134-8946-52da925b7a8b", "comment": "Malware payload", "value": "edde99a95bd2b9330e10febdab31b8ae81ca0ecd288d7cdaf6d20e3dacdb4164", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864238, "uuid": "da30a4ee-272f-4009-a464-a0b3b39b960b", "comment": "Malware payload", "value": "59ef01474d6a3e415ddf60d833043c3cb0388cc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864238, "uuid": "dcd3869e-e9f6-44c4-a488-b82355b7516c", "comment": "Malware payload", "value": "702e6eaed17ebb249249ba1dabd1467c23c4ef1e3430407b0c2dad0260c25e0de4ee446b32193d76d4c9e28718f824da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864238, "uuid": "abb817d3-2a5d-4bb1-a773-4ab0b97d8fbb", "value": "T18E32D72617BB40A6E2F3023875377BEB45DE5A301B615E2643674A7F4E632D0AC4BB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864238, "uuid": "ef2b52fb-8617-488d-8bd6-6801533493cc", "value": "b0bc9ea9700daee04d20b5139bd927f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864238, "uuid": "28e4ce2a-60ba-4d66-8982-74aa1488fdb1", "value": "192:2B8FOne9fkvEac5DRvjeEHrBlLq/JDeh7ra8y6KRo7Dk7LaOT7c8wX5StxUgnX13:2B5eyvEac5DRvjeEHrBlLq/tF7tx5nXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864238, "uuid": "731f1253-8c5e-46cd-a04f-561f6c1edf1f", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864238, "uuid": "05e2b6f6-f8e8-42f3-8965-8cfb50fad075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864238, "uuid": "eca7c45b-e518-494d-bc56-90f279a2ac31", "value": "SecuriteInfo.com.Variant.Razy.371415.10678.7711", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7df6a6c-8ac2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700828048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828048, "uuid": "6148fb9a-a113-427d-81b2-62db299236ae", "comment": "Malware payload", "value": "9a90456f0af759beeb68955457d2046b", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828048, "uuid": "c1be549d-15ef-4509-8500-8e5f88af15ec", "comment": "Malware payload", "value": "ede35243f1b2d8f5f602894e96b3ff8e9de8c922231f62290208175cc3ef7591", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828048, "uuid": "5e9a01e4-0050-4248-b5ff-ea10d5f2f1e4", "comment": "Malware payload", "value": "97cee15b565fd25cc1a1fbd54317a42ef1bb1eed", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828048, "uuid": "8f765842-8f18-413c-b43e-a171772d5f1e", "comment": "Malware payload", "value": "1765b6e1d552170f8222276ca89a12c1225e80ff1687682ec8b200a007163dae1877aad889d042b9a5f6fa4990ff49fd", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828048, "uuid": "159a75ff-1b71-4581-9baf-42a0a912e5a6", "value": "T1ACA1954623D02C84B21B1F53778AA5C0FE8CCC4279A1DCDB711598ACEED1834DED6671", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828048, "uuid": "859d627e-af83-4e01-9866-a5fcdac0a8b9", "value": "96:2oVBgmASoDtsSwif/SwR8PDOuey5VuyLmc3B2lEOmFWG7vG5c1pA:2oVUSItsXY/SfPDpVuoOvgvGe1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700828048, "uuid": "c3eb41fc-693f-4845-9fbc-fd14b173c03b", "value": 4727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700828048, "uuid": "22c85fa8-fd4c-42dc-8fe5-3c9229055fd4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828048, "uuid": "f5c59d5f-b383-432e-9301-f10bdd63ed71", "value": "Agenzia_Entrate (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7e955f-8ace-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1700832912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700832912, "uuid": "8046b9d0-9814-4ca8-807b-61e16b9aa4bc", "comment": "Malware payload (DCRat)", "value": "88cc26f5d63af5fcfdc36accae0db04f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700832912, "uuid": "a88ea58b-9471-4c9b-ae46-82781228c12a", "comment": "Malware payload (DCRat)", "value": "ee2f4598d9f48283bdd46bb0c9bd70f250a257e89bcfc2fc03275b913230d358", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700832912, "uuid": "dc29e1f1-579e-40e6-aca2-4feb72a01c6d", "comment": "Malware payload (DCRat)", "value": "46d7627f0a00cd378684555e30d7bfbe78687143", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700832912, "uuid": "7983f472-b9b1-403e-bbd3-8fffd20fc0fc", "comment": "Malware payload (DCRat)", "value": "4fcf30d06fe1b994f60fd51734a046fe523bc5289fd19e6d90d15faba4dc4cac03360e280c16be987a87890568a38adf", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700832912, "uuid": "32823713-fbb3-40dd-98b3-9fefecd5a081", "value": "T1582723CB62AA4EB7C19267748583132D69C09D71B565D74E358E3C16B822FF48EC23F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700832912, "uuid": "5a2ddba9-3a1c-4817-b4c9-b80da68fc6d2", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700832912, "uuid": "40b7d028-7bdb-4793-b3b7-b363d2e0e404", "value": "393216:WDfxovk0AJIh+vncZ9YvMQRVbjUU+5+NBoTRdDzWjWl2xEIYYOoq:WVovkNJIh+vXMwVb3+5+Xo1dva9FYYFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700832912, "uuid": "9d39f3f4-3c86-4fb5-9fc4-6cd287699fce", "value": 21357056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700832912, "uuid": "234b07e8-0262-49ab-aecb-7a6fb0726512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700832912, "uuid": "4c1d24ad-5a88-44d0-b593-770bfccc8723", "value": "88CC26F5D63AF5FCFDC36ACCAE0DB04F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b989012-8b17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700864239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864239, "uuid": "b4edecf5-ce8c-43c1-aa0e-eb2ea14498e5", "comment": "Malware payload", "value": "beb6cf811be4d5eee2c473236f6d9fc3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864239, "uuid": "a08e5643-95a8-490f-b74c-1382c47a5626", "comment": "Malware payload", "value": "ee82372d2d498ef446bbadab333fbde05ca2b2d4a8144618174056a2849046f0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864239, "uuid": "ae47b4dc-69c6-4a35-8822-a0740b962d9b", "comment": "Malware payload", "value": "6ece6f57c623d44258d1a03db652d8f8bcda6e00", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700864239, "uuid": "2fdabb27-ac21-468c-90bd-22aee8173d3b", "comment": "Malware payload", "value": "4d0a84baeca1f3407a5d56c4e6acf427bd1ebf01a481db92fc4a0bb53749697ddfe74e21248e40a007132885ab9e71e6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864239, "uuid": "f3d4d314-e8c8-4e3f-9a26-4336883d1895", "value": "T127751822731EC136D15D02B0546DAFAAA08C797647B098CBF7D01F66BAE54D32A31F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864239, "uuid": "888f948f-eafb-4159-bcb2-893e87df8836", "value": "4253f2b05ca29dd0c2035e80e70f3221", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864239, "uuid": "c99bdab4-ddf6-4001-bc60-602d22fb3529", "value": "49152:Phkk56XU2GzpNcxBNX08nD4lq1/03l3w5AwtTlZqtUmgkZ:KkB257B08nD4lq1/03lYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700864239, "uuid": "2cdf3ad5-cfef-486d-815f-9fe8026641ac", "value": 1653760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700864239, "uuid": "2532b562-8542-4847-a135-df987d197f6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700864239, "uuid": "77d5f08f-2650-40ff-b936-ad71965bf798", "value": "SecuriteInfo.com.Variant.Razy.969857.29340.10966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c045e1-8aee-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700846586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846586, "uuid": "f705b442-e6f3-4bf5-900f-a6c34d5edf83", "comment": "Malware payload", "value": "19808287dd44452a6da3596468487675", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846586, "uuid": "da7338a1-0a2e-44f7-b08e-a9139f4eb282", "comment": "Malware payload", "value": "efd7a52121867b0d7a60b0fd609fc47726002033662736d309a1b94aa857fb98", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846586, "uuid": "d397354d-5a33-4848-82f2-89d9e6151b94", "comment": "Malware payload", "value": "d485f9eaafe0bf0cf7eb77173e6050b54ba05611", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700846586, "uuid": "534daf1c-dc10-47eb-b393-9e52b59d6f40", "comment": "Malware payload", "value": "df4007fba61eb3ce7ffb46aa42f4221145f324e62c07b2965d8a0fedd2992e5c7c7f0c62234fb6e98167898a71c485d5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846586, "uuid": "10eab7b6-2ac1-4cd0-96e0-05b647d2076a", "value": "T151B41ABD65DF654AFEA18C302FFCBBA1C77724A9C657C6F044E9A03025204A7DC16A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846586, "uuid": "88389be4-63af-48eb-bc22-5c3d82bc2781", "value": "fcfbe5457e76d2ac347d7db113c0ca3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846586, "uuid": "2c522686-a578-4e9f-af3f-ddf1dd188843", "value": "6144:ERSCSg+gfUYRjOuVZFGNRwND7Pypwwf/43wWPpoApvmJraTKzv:ExN21wwCwTA8rSKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700846586, "uuid": "96f7696b-d445-406d-9105-1dcb595b089f", "value": 539883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700846586, "uuid": "803f4574-23b2-4e23-a7ce-f3d88e4d4e07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700846586, "uuid": "00a8f6e4-25e6-41bb-bbef-e51b9348b1aa", "value": "therapeutic.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adeaf374-8aa7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700816327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816327, "uuid": "53c841bb-9927-4f52-b1d7-88f88d4337d8", "comment": "Malware payload", "value": "9a563dd07637abf44d8359c722288476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816327, "uuid": "7c5c25ce-8e9e-4c2c-bea0-b9e619bb154a", "comment": "Malware payload", "value": "f1006206f4b22dec5ca9ab8419c222b25261e64628dfe0d6904901430314720f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816327, "uuid": "590e5cce-ee1e-4f45-be6e-f1221a83991f", "comment": "Malware payload", "value": "78dd978f4a90b4b9b2180ca8e69f4e7e5bdfc748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816327, "uuid": "c886f9a2-c3d4-4076-bc4b-ca04fff520d8", "comment": "Malware payload", "value": "c6b4f280e6c25f994b2e8aecd78ee4b5e2a65fd047d89716976acb9820bdc2bf77bed38f47fde258833136348e6f6d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816327, "uuid": "cb57e4d0-d796-425e-aa9e-741c15cec3f4", "value": "T13E373315D0C40AE4E4D2A63788A98912E632F96013A4C7CBC3B8E1672FAB3D54D7FF55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816327, "uuid": "e4847062-5be1-4dc4-8762-233c9b94cf04", "value": "20d446c1cb128febd23deb17efb67cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816327, "uuid": "f45d0d1e-864d-48ee-b427-c94ed3d39557", "value": "393216:Pja+xguneHi+2ohcyLAVarD1j3/w2W+eGQRe9jo7BGcRtlXAXWBh2t1WosPD:7a+jeHiRyc0CqD1jjW+e5Re9MbZAsAp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700816327, "uuid": "be1b0c4f-27bf-4a10-9ddc-7157c5483724", "value": 22827440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700816327, "uuid": "60a5428f-d75f-42e7-8ef9-1fb70d3a86eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816327, "uuid": "34439b4e-ea76-466c-8c50-66a5f8beaca2", "value": "Romeo_Juliet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2e6f65-8aab-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700818014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818014, "uuid": "f1d77886-f695-4c24-997d-ba901f865a47", "comment": "Malware payload", "value": "21bc89b62236a92090a9b9732ce09b5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818014, "uuid": "0741f805-2e28-4788-878d-d5743bd6f609", "comment": "Malware payload", "value": "f111e483a57a3b7eb2ab0d1e773445796106e411f98482e8ff12c0da3b673e2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818014, "uuid": "0b1b2fce-be6c-4fe7-a115-2692e3a1127e", "comment": "Malware payload", "value": "c5f64406c8ebe694d853a867d32e0f0912f86272", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818014, "uuid": "8f61c7bf-e273-40bd-9619-33d0c36e4ea3", "comment": "Malware payload", "value": "5bf36fd02158b7f8c291903fd5bc16bd3a6b7abb26c02370d01b103549de4264e9df9b8838f3f09150914d2b2ce8b9e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818014, "uuid": "9c6186fb-6f25-4e2f-8270-e316fc13a05c", "value": "T10613980A6AE14932DCBA9ABE677763F007AC6F92685CE5551390333AA63C1D67C01F34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818014, "uuid": "d4cbde99-a3ec-4ace-a1f4-e14c707d22ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818014, "uuid": "ff963d62-7c24-433e-a18f-4248f962da86", "value": "96:jvZm8MrZx3iwSndBq4H5kdc6PkBNNlRGGadekHytUZfLJh6OZZR/YmWZrzNt:j4R1VXcM/G7qfLJh6OZ4mWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818014, "uuid": "fa0abecc-5d00-48dc-b987-6c51d5a9b4db", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818014, "uuid": "3a7e7e44-9aab-4682-bf87-de683c008da7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818014, "uuid": "d4082883-4ff0-4072-91d5-23e807da6335", "value": "SecuriteInfo.com.Win32.DropperX-gen.18132.23189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d94fc6-8ac1-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700827205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827205, "uuid": "375265ac-b829-47f5-a0a3-a94b13fa444b", "comment": "Malware payload (Mirai)", "value": "9b09009808f9e2b2749e24e11399e9c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827205, "uuid": "8645a428-d8d0-41d0-8f0d-b199631e3309", "comment": "Malware payload (Mirai)", "value": "f1c1b08a0c77d27472dd427f114e6a69e0ece14e5a0f6abb3c71ec70039eb677", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827205, "uuid": "c65f08e8-27af-47fe-aec2-44a447a79de1", "comment": "Malware payload (Mirai)", "value": "0c27b5f92c5c331f469cbf61c56a9c7d13da5932", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700827205, "uuid": "84b4521c-c425-48f3-9781-0395322a3cc7", "comment": "Malware payload (Mirai)", "value": "13cd8a3ee9eb6171e3be64d56118eee9754d5936a9fe6c3da1093b319af1a5f72a34f23aa130734a0e03e8eb1e475739", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827205, "uuid": "38346e8b-a558-4a9f-ab9f-497591db0187", "value": "T103E33A56FB804F13C0D61776BAAF4249332397A493EB73069918BFB43F8669E0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827205, "uuid": "e1599888-5f8f-4fe0-a296-474034643405", "value": "3072:IVtbnM0DBM+7oKazTWSn8+xayeCXM95ywbZnIcXi0yM/9reIC:IVtbMulsKazTWSn82aykjywRIcXiBM/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700827205, "uuid": "fe853397-f65f-4268-9827-7488ab82c77c", "value": 154968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700827205, "uuid": "f8d90219-43ff-4126-b0b1-7766a55991c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700827205, "uuid": "09456fd4-038c-44d6-9287-ad052cdebcf0", "value": "skid.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48170897-8aac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700818304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818304, "uuid": "a88786c6-01a2-4a10-aefb-ccf21b3f605e", "comment": "Malware payload (Mirai)", "value": "cd536ebd9613b3a66ec277e477211787", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818304, "uuid": "25667fbe-6088-4846-a9c8-0a3bad2f04cb", "comment": "Malware payload (Mirai)", "value": "f3263c9d646537b9060d7feb2f9b1c82c5ac2bc517b3a52d01d4a84dae775285", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818304, "uuid": "45d46c58-8a47-44c3-9a8a-f445349f2a8c", "comment": "Malware payload (Mirai)", "value": "1c3d8ddc68be3a76ed9f9c740d99fdaa11fd23e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700818304, "uuid": "d8718322-9664-4dcb-9dee-19cebc83e93c", "comment": "Malware payload (Mirai)", "value": "d24d303d1750579139bcbc880191aa7810cdb8a583facbc07f0bda075140751a7b408d2b16107132ee39fe7596c31597", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818304, "uuid": "8f7cc11d-20ac-4db2-9270-22600abf0a43", "value": "T1B0A36BD0B6042C32C19D1D3B777A9B4A3B6301D45AA7E101E450EBDEFB8B981AF548F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818304, "uuid": "43ef99c1-65f7-4c60-a94c-5c36618716ca", "value": "3072:IfsB7JSfUpGZTalQXzpLakYNgRRexQ0M6s/xaJwbZn6V:asB7JSfUpGZTaQzlOgEQLxaJwR6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700818304, "uuid": "9e7a13a5-40b2-4939-915e-7d3f9c05f078", "value": 100620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700818304, "uuid": "d1c53eb6-791b-42b5-a446-b4c87132b199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700818304, "uuid": "07f569a7-8a2b-4ee5-a1c1-4385e6cee875", "value": "cd536ebd9613b3a66ec277e477211787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8922a0f6-8a97-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700809394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809394, "uuid": "8ecf7f66-a893-4310-905c-bed4960f0dca", "comment": "Malware payload", "value": "3df7213ccff94c48a7ec6e2fb04e24fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809394, "uuid": "c143e2f6-e8b4-42af-adfe-a7d4d863a904", "comment": "Malware payload", "value": "f40601bf9a0a2c75535148015009cc959be5729f736a0d08cecb74305a5b7af3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809394, "uuid": "03618825-7f98-4100-9274-b9e5bcb9ee1c", "comment": "Malware payload", "value": "01120cfcfe17f30c8aa406dbb4d6b8ee4bbd1d8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700809394, "uuid": "d434997b-6dac-4390-92f7-2a3382eebf7a", "comment": "Malware payload", "value": "a9f7ccc297bd116e45efcf1fc24af236f92036a64eae4f459edc32fe9063e9947e9e5e79fbd5099e22d8943c945732c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809394, "uuid": "a89bce39-ae24-4670-9fe5-96fc940d713e", "value": "T1497633A0B6E189BBFB4604F9C611DB54D1BAFA6A5D2201E3A3C28F4CBD7F564821510F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809394, "uuid": "b1a95f2a-1cec-4dc7-8cd6-cada634d78b3", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809394, "uuid": "9efebc10-12f8-4813-b741-60db3f1d6933", "value": "196608:91OM6NWLCIg+wLCuZ0LiQswIhIp2FR0qo3:3OM6NzIBwLCuwiQsTlho3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700809394, "uuid": "12aef264-d68d-46d9-9845-fd4673905927", "value": 7492272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700809394, "uuid": "50a87bc7-9d34-4700-9ee5-848b7ded8133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700809394, "uuid": "d222ca98-66a7-417f-9723-39d6cfc4a5eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227b631f-8aa9-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700816952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816952, "uuid": "f5fff6a8-0441-429b-9be3-8447c3d38f2a", "comment": "Malware payload (Mirai)", "value": "4972bd4cb2b08faff4c1f1db614215e3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816952, "uuid": "c2f38a01-09ce-4bde-aa9c-20fdca3b04bf", "comment": "Malware payload (Mirai)", "value": "f51bf1189b307dea0c737a3fececff0d30242e4d74e7479906183c3e55fa8954", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816952, "uuid": "60022700-ff3a-43be-91e3-3f2ad4d3de8d", "comment": "Malware payload (Mirai)", "value": "451549721bafc3041971ab24e76088457687884a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700816952, "uuid": "fd8cfbbf-69e2-4db6-a375-06447a94f1db", "comment": "Malware payload (Mirai)", "value": "4bdea4af9a47a9547f220341cb931c23c032bd6029093a3574227a44d7274c5cab4f1f2a89e46e5dead8d64fd546da75", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816952, "uuid": "dea3d28b-773f-4c71-b2bf-3ab4207d18d0", "value": "T109F33A46EB404B13C0D627B9FA9F42153323AB64D7E773069528AFB43F8679E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816952, "uuid": "570cc376-cf4c-458c-b0b6-0e41e26b9071", "value": "3072:IjDK/aCLUfy5yD5ayL2SS5Vc0FZv2G2450ozM/RKZs:IjDK/pUf6u5ayL2SS5Wy2G2a5zM/RKZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700816952, "uuid": "d0d64ecd-1667-477f-9e02-c787cefa78ab", "value": 171596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700816952, "uuid": "e6fc1c07-bf1e-4e0f-8cfd-d04132ca7228", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700816952, "uuid": "73f882d6-52d6-4b9e-bce5-ddaba5f756be", "value": "most-arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d6d004-8a7d-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700798325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700798325, "uuid": "97e7c833-febd-4cf2-805e-de10732dc14a", "comment": "Malware payload (RedLineStealer)", "value": "7b0ddbb8af9effda98de6c77e138baf2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700798325, "uuid": "35528bbe-181b-4e4b-818a-da1c58d99d61", "comment": "Malware payload (RedLineStealer)", "value": "f7a1d39832ffeb8e521d78612d2e509e7bc14d96a98b1db48191f7c23b893caf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700798325, "uuid": "47e99f2b-0d55-4621-95fc-fbd25c2508e8", "comment": "Malware payload (RedLineStealer)", "value": "6e25fb1a025e00aecf945add16dbe4266d0a3331", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700798325, "uuid": "69d51ecb-e3c5-410c-bb3d-974b16787f5b", "comment": "Malware payload (RedLineStealer)", "value": "9373619a527197e2f6acd0a154b7f5d2dffe7094a088af51c34d5f44af1b77dc32855f8e322b59db326fa806e96ac120", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700798325, "uuid": "0f3eaaf7-1346-4e2a-a781-1d4f3ef8c1ce", "value": "T11CF533A41DE6D801D653D5F2D8FA8720B942FDD80DB4ABE12A4B6E0BF40DF2B055F906", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700798325, "uuid": "87d22ce3-68e7-41e6-8825-58b7f9a75afe", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700798325, "uuid": "47789693-491c-4e29-9840-bfe9ffce61ec", "value": "98304:zQGKcbOQv+aA5fPLg/RCcFvQEoNILNFTtD/lTi9m:zQGKTQG7hACG9KILfT/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700798325, "uuid": "075ccc20-d214-4cd5-9cad-2a76d79c685d", "value": 3336192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700798325, "uuid": "3ef11b49-6e16-4f78-92a7-acd60c796553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700798325, "uuid": "39682659-55bb-4738-965b-9417ba4126dc", "value": "7b0ddbb8af9effda98de6c77e138baf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a515fa-8ac2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700828020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828020, "uuid": "108ac7ad-0f8b-4723-b098-50bcc4743556", "comment": "Malware payload", "value": "9e000231a5d939a94c24d2a7d99a621c", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828020, "uuid": "f6655bd3-df2e-4533-a7ad-be55f2fae6bc", "comment": "Malware payload", "value": "f7d754f9ffc3c49a09194257f260cb3ba8eb370743e68654ae26b9a1732e4b59", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828020, "uuid": "300de712-cd77-4998-8925-6861abbda851", "comment": "Malware payload", "value": "d74605bee86f436d961be3e165e9a3459d138aae", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828020, "uuid": "d1cd1b8e-fd0d-474d-9309-c8a8fedfa359", "comment": "Malware payload", "value": "06e153c1ffcba388a134ea742610ccfa7bebcd7ff3da07562654867710096e53d132483b6fb0e9cfa7f417e7693152cb", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828020, "uuid": "0458d18b-7f04-4d5a-a794-ddc44352f2de", "value": "T19B91A60827D1685402A34B62BB6F25E0EC6D8DB77C10988FFB8197C4EE88A59D0DA731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828020, "uuid": "a6e47232-595e-4696-b73c-0f59b56fbb0d", "value": "96:wvlpeFeicdd/rfCYo8Z5Dw4vKdGvAgiUvO6mAPxE4dCZwjOlOzVbUz:wTicd5KYospydGv+Ilq4dlBbUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700828020, "uuid": "27420cac-2a5c-4a7e-9ef6-5ec2c6ae1b2c", "value": 4582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700828020, "uuid": "284bafd4-93bb-4e68-bd37-842ae6884461", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828020, "uuid": "dc95e4fe-3fa2-42bc-9dc3-67963c0941d8", "value": "Agenzia_Entrate (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790a0c11-8ae2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700841579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700841579, "uuid": "4b95c8d6-17a1-4c2a-a8f0-4a86432888e4", "comment": "Malware payload", "value": "f6e97bf1df0d6b573683eacfafdf8a64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700841579, "uuid": "f2efa9d9-a2e9-4b32-936e-f92dd2a92c3d", "comment": "Malware payload", "value": "f8387edcff6a84de4faca34b7514533d4590711e3a06356d8b9ec1f4d94f172c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700841579, "uuid": "9ad54913-d2e8-4406-8ab5-87d3fa98de7a", "comment": "Malware payload", "value": "7f6abb3431a35e67c1cb85557f83ecbfb1aaf58d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700841579, "uuid": "c5b41254-46d0-46f8-ac68-172bfda4516c", "comment": "Malware payload", "value": "80f230a508ae6beb4830adc14972ca0b5fcd1ca8b73e410d21e06057f62e5d03485e0ad77441a6978287cc0c24607eac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700841579, "uuid": "8d49549c-7acc-44a0-96ee-9842a1335c6b", "value": "T12A446B1365E0FC31C5520B314F2CD6EC7B6EBC625E658B4A26583F2F69322B1D667312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700841579, "uuid": "08012f17-b729-4df6-947c-0ab53a6f6162", "value": "c577c58a31abefae7ed25bcc269ae1b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700841579, "uuid": "5e803947-97cd-491f-a8f9-eb951ad236df", "value": "3072:IFRM2f8BZr7qTuIoC2p0HQAYC8efx2cWss8Dr5ROD3:I3f8BZr76loCw0wBC8cxdWss8DS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700841579, "uuid": "11d02a4f-4208-4e88-8bdb-10c716e9cc38", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700841579, "uuid": "fc86ab8d-3c9b-4b63-8e75-e18e73feeb0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700841579, "uuid": "c63992b7-0ebb-4ac1-9fa8-ae2d984b1d3d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227785f0-8a80-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700799343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700799343, "uuid": "7014d436-d0d0-418c-a206-372b7fb1ab2e", "comment": "Malware payload", "value": "6fc02fa818d1a04689cd1a932f869342", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700799343, "uuid": "7ead9859-f3a9-40f2-a307-6500a8b61d13", "comment": "Malware payload", "value": "f919c9d3b9df0bef10d3e570da5be5b54aaad2305334073e9fa78b6e39df4a9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700799343, "uuid": "f2f27f4f-0b50-4ad0-911a-ab220faebc31", "comment": "Malware payload", "value": "8cf0a2ec2adb3ded9995f5350b552d739c984678", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700799343, "uuid": "b5b9855c-1db1-4fc1-9b60-79f65dd9fdb5", "comment": "Malware payload", "value": "5bb3568899298db416764ebcb9b9e4ca5a641454198c90e09d123d8827519c5c11497918d4049ea4e08fbe389834aae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700799343, "uuid": "e1eb996a-775b-448a-bcb0-31dd25da8016", "value": "T100D533567AE38D36D23CC8744FE5A80BD7733D4BA831925015981785EBF21A0631DFAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700799343, "uuid": "eab7e939-b057-4720-a9ca-8bf2273da13f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700799343, "uuid": "9308c280-8052-4f76-8683-2935927dc84a", "value": "49152:T2dKgqFC/iTqHv7bb9NfQSvzZxPQUlsMuiRPzGjNBi+tsvDcRY0E:aARFpTIXhJ51xlax/7TtsvIlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700799343, "uuid": "f84a8204-8389-40d6-a6d6-8b918018f196", "value": 3007652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700799343, "uuid": "0ee04c0a-6b15-4a7f-8efe-eb52609a1004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700799343, "uuid": "13129100-ac1e-4752-98f8-c5e342531dd4", "value": "SecuriteInfo.com.Trojan.Siggen22.14345.4884.15114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd7ac21-8ac2-11ee-8907-42010a9c0042", "comment": "Malware payload (Quakbot)", "timestamp": 1700828061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828061, "uuid": "7141c8e9-17c0-426d-bf7c-dba4ff5f5e5b", "comment": "Malware payload (Quakbot)", "value": "e1cee00d9d160473244dc178945421f1", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828061, "uuid": "fd8e5184-9459-4637-86d4-f6d76ac8e4aa", "comment": "Malware payload (Quakbot)", "value": "f9eb3705c832ced7bb739d4c18c863e62802f45b4ba01b4a5bc138a986772bdb", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828061, "uuid": "20ed4da0-de9a-4f33-9876-a6d08c3845bb", "comment": "Malware payload (Quakbot)", "value": "44046f9edcf64cd2ffd1678c5505b2b4b75f8c26", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700828061, "uuid": "73710d82-94ca-4d93-9c3f-e446c594e01b", "comment": "Malware payload (Quakbot)", "value": "fbe6ea543135715182e5354fabb1a1711f2b6fe9f525530eeab0c63930ab8f7534eece0e093c1d50e9ade10a752d7990", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828061, "uuid": "c63708a8-71ef-4d28-b2fb-16337b6b5278", "value": "T155A1204411D028A816D72FE7FB3BB081E06EAC7A2AD1059F7956B49CB885F16CB81E31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828061, "uuid": "1bacdda3-dc4a-4518-ad08-2d37ea62d83b", "value": "96:ua0UPi+ElhvFPQcHY964IljjxmAmWd+0OtJOuuiPSl5YpSYZXuvf:3i+Er1Y961ljjrRd+TtJOuub5kX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700828061, "uuid": "dfd62112-b90c-4462-9169-5d6d4119fcd2", "value": 4701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700828061, "uuid": "167dc104-5660-4049-aaf7-44dfc98dc6ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700828061, "uuid": "5b5983b6-21ba-49a5-a578-798e2f2540c0", "value": "Agenzia_Entrate (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff1e845-8abd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700825699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700825699, "uuid": "a9cc920d-8af5-47e7-ac7d-76c15ae797b3", "comment": "Malware payload", "value": "50e0e721da1d74d0ac79664fe275401a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700825699, "uuid": "f85d92cc-5170-490d-b6f1-6d4a3570f2b1", "comment": "Malware payload", "value": "faccadefb87003e700fc9f4843962e41421bf9fba1d087008e987c476fcb27fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700825699, "uuid": "e63548d3-0829-4c0e-a129-3defd3dc168a", "comment": "Malware payload", "value": "ffedbadf0ea89b34224c258ae45e3f5a6509dd3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700825699, "uuid": "85598b6a-3cc8-4f27-956a-9b2831f7bd21", "comment": "Malware payload", "value": "39c8351123ff29fc0352eed8d86e72a7ab35dea39c2543a0e989f762d883f70c2bcf0d967536f0b4fee5821eb9c725fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700825699, "uuid": "9ecf329e-26af-490a-b422-7950c3b4f48f", "value": "T103757D01FFE8D85BE46F6773A4B707204FB4E88AA272D74F194562A61C523252D063EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700825699, "uuid": "3d5350d3-fbfb-47f6-bed8-5c3bb45a632b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700825699, "uuid": "07b5206c-a90d-4670-8b6b-842048e4dccf", "value": "49152:BQWsU2i2gOCOofakJtdvF3/XtQEkwiyH:bdp/dyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700825699, "uuid": "c68a0cde-d7ff-4dd7-9767-0014655e09b1", "value": 1602096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700825699, "uuid": "b3a926de-f545-4e5b-8236-fb045c339d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700825699, "uuid": "e30e8128-af5a-4423-991b-dd67326672ae", "value": "Payment_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6adbdf-8ac7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700830201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700830201, "uuid": "eacf63d9-9025-4c50-abde-1e3644d1de33", "comment": "Malware payload (RedLineStealer)", "value": "bfe8dd445dd77bb3694f0ce5feb8741d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700830201, "uuid": "6b928c0e-3ffd-4e4d-ba59-508a9732d3a5", "comment": "Malware payload (RedLineStealer)", "value": "fb973b744b6fda7b7316ebfdd50c6fd8a9976047695347143c15525b37834b46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700830201, "uuid": "a2fd77ba-0790-4459-9aac-735e9880e4c5", "comment": "Malware payload (RedLineStealer)", "value": "cf500cfe76cda42817db77774af294c0073db250", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700830201, "uuid": "2ba83f33-159b-4809-8473-0a667ed845ce", "comment": "Malware payload (RedLineStealer)", "value": "3e7ee72cd309ebdf825064ff44c63352ddc56f5289c53eeeb898b4486afde1dd702140ebc2d0ebf1030e2e6562e1d098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700830201, "uuid": "7d07df0a-d939-4f95-a596-29b582a3283e", "value": "T1A4944BD4A9F7D5B0DB2382F99FB8AAD2CF6F494001828EA9775422F5245D48C13B637C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700830201, "uuid": "e418d1f7-6f1e-4530-9afc-a64228282369", "value": "15fab2ef4d0a9713549d177164401a7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700830201, "uuid": "41a42954-7824-43c4-adf7-912a5dcf7813", "value": "6144:zQky1G91dNzfptuxo4lJ0lFVnSWvJpJ4pXM9aULf+Hcx:zQk8QtuTYvVnH4p+LBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700830201, "uuid": "54f498d5-51d7-48fc-bd82-7e7929ca6058", "value": 418180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700830201, "uuid": "4873ccb6-c22f-4b5a-9910-62c6cfe7e5f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700830201, "uuid": "4403bcb4-fc02-4e97-b4f5-18186abfe5c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e905a4b0-8ae2-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1700841767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700841767, "uuid": "95f699e6-ea39-42a7-b460-8cab8bd52bb0", "comment": "Malware payload (GuLoader)", "value": "67d588e17bffd29e8dadbc569e68b4ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700841767, "uuid": "081d252a-9058-4e62-929c-fd8a65353fc8", "comment": "Malware payload (GuLoader)", "value": "fbf36dec7765e512c6e5d08fc0f039a0ece0335e8df127e9f4a72ff2b89c3b4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700841767, "uuid": "8197ed12-a503-49ed-9892-3f2e494ea041", "comment": "Malware payload (GuLoader)", "value": "805c1d00fe0f176937c233e1db0d6c0da2a90917", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700841767, "uuid": "77ad6b92-aec4-4038-bdd7-efb6b194a0a5", "comment": "Malware payload (GuLoader)", "value": "53b08ea0fb89015871ec6297959b60aba39c830f16d5c35a0f406919f9fe81cf795252d92e8246288c303fb92999c20c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700841767, "uuid": "50ad8066-8e6b-4cd9-b838-3ffbee18caa3", "value": "T1A784225A26B005EBE4079BB257F2FB5A6AFDEB2204B08C4337550E7B1C653C6AD0C351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700841767, "uuid": "dbaf6f5e-5c25-4f8c-aeb2-b70dd4c695b0", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700841767, "uuid": "172d0c4e-4af3-4253-aeed-f2cd6f6eb443", "value": "6144:c1onyfedJjExibcFHk3knPhwt1OWRiM5+ZwhNvcKNDvanBHvm4q4U8XA+YUw55pQ:koyfUJQxiiHk3kPhEPRiPZwkSDMtvmK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700841767, "uuid": "ef1147cc-81cb-44a2-b359-aca9d0872a01", "value": 393032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700841767, "uuid": "87431120-034a-4dff-aefd-f8b9631e101b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700841767, "uuid": "e8130bcc-f12d-4207-b449-6ab08893b564", "value": "Demo Project.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b6a18f-8ad0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700833658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833658, "uuid": "8778a10c-f977-40c3-94c4-aafb27c80539", "comment": "Malware payload", "value": "f16c22b491e1bd20f677515c4f87e807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833658, "uuid": "68de3428-380b-42fe-91a9-c8f90b3a34b2", "comment": "Malware payload", "value": "fc4c193bda7aefe0460d5072afafde40fea9d2460e6635274b96340fb46d3223", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833658, "uuid": "ebeda310-5196-42db-94a1-a937bd0d6894", "comment": "Malware payload", "value": "14c2ac75ad47058085af5e99ad930bce442aed79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700833658, "uuid": "d1b0b25e-b67e-4d89-ab31-a14057c57466", "comment": "Malware payload", "value": "5b94cc06a22cb00d445ce8aef1b4b4e7c96fb3207fa05a92701430715721f8123c5c5b9f9684c93bbd94b78b4f8533c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833658, "uuid": "927424c7-2e2f-4e45-8782-be5340e7a6e8", "value": "T1737633AAA3D14EF5E4A7853DC2C28904DAB1B1270374CA8F03E466B61F17AD48D3F752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833658, "uuid": "cf6e6457-1f4e-46da-9ab7-5c803f58fb51", "value": "20d446c1cb128febd23deb17efb67cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833658, "uuid": "ef5587d4-65e9-48dd-a38a-9dd4b1f1688d", "value": "98304:y21zH6RdVfB2FS27wjcyuT/9vUIdD9C+z3zO917vOTh+ezDNh79vmJ1nmOBN9n4u:yG6RsXbT/9bvLz3S1bA3zsn97+0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700833658, "uuid": "c3e970b9-1396-4e91-86da-01ee62a99846", "value": 7333237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700833658, "uuid": "e9055f4f-9713-46a4-a6f8-6e910276c7d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700833658, "uuid": "1f3cbf17-50d2-4082-84a6-77e34b0dcbab", "value": "f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f36265f-8ab4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700821859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700821859, "uuid": "d4d8db4e-b755-4ac9-a150-65a79620c3b0", "comment": "Malware payload", "value": "95f031ecbb2ba8a86551c70169871321", "object_relation": "md5", "Tag": [ { "name": "147-182-170-15--9090", "colour": "#4A0206", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "empire", "colour": "#D9A909", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700821859, "uuid": "4e4644c9-a117-458b-beaa-84c214d404f6", "comment": "Malware payload", "value": "fd650fc7d322583aead494862f38c46638d2c87a284307e2b5f8334ff4fbec90", "object_relation": "sha256", "Tag": [ { "name": "147-182-170-15--9090", "colour": "#4A0206", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "empire", "colour": "#D9A909", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700821859, "uuid": "bef90f3a-26eb-451e-915e-cabd9f92bd94", "comment": "Malware payload", "value": "d91db680420e997bf21a06a8d7d451ce218adceb", "object_relation": "sha1", "Tag": [ { "name": "147-182-170-15--9090", "colour": "#4A0206", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "empire", "colour": "#D9A909", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700821859, "uuid": "71e18fe4-5dcf-41c5-8026-f13c747ba270", "comment": "Malware payload", "value": "b521f368f1c737bc0f055c35056e11768e01a4afff35854d02f2f6b87b10c4d5cd11a3da2cfac7b7bc94c53140fb3a23", "object_relation": "sha3-384", "Tag": [ { "name": "147-182-170-15--9090", "colour": "#4A0206", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "empire", "colour": "#D9A909", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700821859, "uuid": "70f46784-c8b1-434e-9d41-eee4d8d68332", "value": "T17851A7BDC531BCE8462C7BC889952D6A11DCD643C373CD94EA002CFA7560319FF294A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700821859, "uuid": "2ea58a29-ab18-40cd-886e-afa6dd4159c8", "value": "48:hwrnRGwqUJ/gE+9053kTOdmI4SIEFkES788a4QUF//3AlxOBqUVc/iZ3GDKiYa96:+rn0wqE/gE+DO4I4SI4XS784ln3A+8+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700821859, "uuid": "df0134b7-95f2-4efe-ab97-64de9154a13c", "value": 2871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700821859, "uuid": "d44bc579-29ef-4e90-bb35-b87c66bb7465", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700821859, "uuid": "7084b5ef-cada-4e60-a562-8a54784ee00c", "value": "231124-19-PsEmpire-d91db6.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92524d6-8aa5-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1700815568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700815568, "uuid": "dbbc39e8-5614-4157-9704-a8e5fe1eccc1", "comment": "Malware payload (GuLoader)", "value": "083cf27f0703433b2827025630fe2b6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700815568, "uuid": "b24c579e-3561-4787-801f-388d8eb0ea3c", "comment": "Malware payload (GuLoader)", "value": "fe479fa5c57245a8b257da545576183f47dc707d8518c4a0fccc6b925ddafb25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700815568, "uuid": "eff7e186-374e-4795-8146-5b12257143d4", "comment": "Malware payload (GuLoader)", "value": "942bbce96c29c576c083f14e92f36e98820c0923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700815568, "uuid": "b2fbafe1-8756-4134-a32b-010318bfd2fe", "comment": "Malware payload (GuLoader)", "value": "2047661b9f0c892412f1bdd88e21dfdf01192d23652eed8a748c19d47e7e023cb2ed30b586635d7abb0fab22b94a80a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700815568, "uuid": "a7c94626-7507-4fe3-91f4-9e0f418caddf", "value": "T1482633027A34EB73CA1D99720DB592CC4A13FD7022609A7DF6687EAC3DB57D64012B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700815568, "uuid": "59e47362-f1af-4de8-b213-3b192435bb0f", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700815568, "uuid": "1c994f98-a778-48db-b3de-48f50eb82388", "value": "49152:vs7OO75f2R6Hjz40wOUNvzsaSSq7tceaMget9WD5W5VN+JCuyz9p7kuc7ioYRpuO:+fAEHbwOGz5ytu/scOoYOQsBRNOtzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700815568, "uuid": "65b420fc-887f-4e81-8037-b018410098e9", "value": 4550733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700815568, "uuid": "157a391b-0ee6-42c3-9eba-82fc02e8914d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700815568, "uuid": "ce00e8cf-6493-4dff-a691-a8158561b6b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd70f06c-8b00-11ee-8907-42010a9c0042", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1700854578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700854578, "uuid": "d9c3d6ad-fa13-4673-9745-f98f93bd7129", "comment": "Malware payload (RaccoonStealer)", "value": "d8d88d5850ac88aa2069cdeb0a232a89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700854578, "uuid": "ac550520-9284-4ee5-8274-2eb5b677b502", "comment": "Malware payload (RaccoonStealer)", "value": "fe5d827752446c287c581f1c20b559f66b477e98ddf453d3fbaeeb6419aa792d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700854578, "uuid": "316f446e-8eeb-4a62-8bd6-6aaaa05ab26b", "comment": "Malware payload (RaccoonStealer)", "value": "d361fd111d2a5145670a5f8739915f2786cb111a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700854578, "uuid": "c17548cd-34de-4f8d-8c75-a4378b6dfc7c", "comment": "Malware payload (RaccoonStealer)", "value": "224a40e3d77f081d4397969de2425c62bfd44e9cbf01911ad2c772bc680caff11580295cb300df97a51037b146202c77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700854578, "uuid": "f7279b69-9324-4925-b8cf-1f8f1393b173", "value": "T19E24B42AE344551DE83E433DB40C38B09F70BC56E16FD32A55BA3EED683BB498A145D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700854578, "uuid": "86d25ce1-781c-40e6-a8fc-072583a86afe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700854578, "uuid": "ad88fc98-edf5-4bec-8081-433eccd21cf5", "value": "3072:6693FTitU7pNgcAfimrHV7+9IWQ8ARSdhs1Sc9eOCd4NpKSo:669V+tU7pNgcARrHV040vs1SstCd4Nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700854578, "uuid": "31709d28-8c5a-4313-ad84-10638ad0439f", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700854578, "uuid": "e061f8b8-4571-4912-b9f1-9ce6dafda39d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700854578, "uuid": "74c084c3-c0dc-452c-8b37-91a1713b1d78", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }