{ "Event": { "published": true, "date": "2024-02-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-02-09", "timestamp": 1707523382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3e239e00-cef2-46fc-b4ea-db909a07eb41", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e7da96-c6e1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707438353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707438353, "uuid": "df1935e9-b346-4b83-b0b2-7c3fe2bc39f9", "comment": "Malware payload", "value": "10186744d2274a0c8dfaf7edc97a3b22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707438353, "uuid": "b499a009-1079-470d-bbb1-9b9a0db09f9e", "comment": "Malware payload", "value": "00b2c7e8081f61edd2c3bcd7010fe975b912317c9dccef5a14772ff9fc7ca542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707438353, "uuid": "af5922ed-3643-44d1-a4f9-bd67541c4496", "comment": "Malware payload", "value": "dea684ebb7e391fc444204b1171ffba694f761de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707438353, "uuid": "d7c08a21-4734-4b3d-b434-296e4b4f02a9", "comment": "Malware payload", "value": "271b5757933c5413a39001adda33d8bef1e7911ffa737e183bf631be04bc0f1afd81afc53b5be197bcd51f0f1ad045f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707438353, "uuid": "74f2a910-388c-40a9-9010-8fe1346f57db", "value": "T121B56D1A6BB501E9D1EAD17CDA079A03E176784D533059F70A808EE21F673E19E3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707438353, "uuid": "fb6c26ce-6d50-469b-bd7a-23bf45a8fa82", "value": "ec06ad610b14eea5855b4c9e24db6908", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707438353, "uuid": "b417fff2-ac6b-4845-8101-dd0b754a7e1d", "value": "49152:zHl5FCUSGp7+8TLKYvysmhsVMrQ7zgrT1pV:DlySDm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707438353, "uuid": "59007895-7779-4632-b5e9-0ab55281899e", "value": 2357248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707438353, "uuid": "0c1bc07a-95b4-4eab-a180-bc17b9271706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707438353, "uuid": "0a834e0e-d383-4328-bd4e-e19e69045550", "value": "SecuriteInfo.com.Win64.MalwareX-gen.21905.31803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f774ce-c754-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707487770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487770, "uuid": "b3bd997b-a81d-4c7a-8bb4-bdd8eab59abe", "comment": "Malware payload (Mirai)", "value": "c903f9acec3a42054895d7e0be049f69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487770, "uuid": "82eef921-37e4-4b19-b7b3-ec9305b435db", "comment": "Malware payload (Mirai)", "value": "01a730caefceeedd021f0d506fe3103a2a2b1e21df1fb5c622b439fd8d23ba70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487770, "uuid": "0a589993-7a51-4ba0-9a2f-8037d30745d2", "comment": "Malware payload (Mirai)", "value": "ae83b63c998704b8e77066bde5b440480fe78dd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487770, "uuid": "0164d72a-0946-4fb3-8bde-488850973285", "comment": "Malware payload (Mirai)", "value": "c8aa0fc340c0188684893e47ad296c721f116d34d4dbdb4dc6ffaa20f42862e0f69ddd6df97bf88cca799dcc146034c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487770, "uuid": "3af2e260-7aeb-4622-8e6d-67a005bfe521", "value": "T1E843B54E2E218FEDF76D873487B74E219759338622E1C684D15CF9012F7024EA46FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487770, "uuid": "72caa928-504e-41bc-b9ee-62d9bd7ec4f9", "value": "1536:BLDWDWD4v5Ca5FasLiRUZaDLOPdU8lIwUpsyQNLcF6PqD4:HEcsLiRUZ5LcF6SE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707487770, "uuid": "1f3d463c-e8e8-4bdb-927b-929b050d3f7b", "value": 59540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707487770, "uuid": "bf531e95-2b20-4ec9-b8dd-3375cc16ceba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487770, "uuid": "72cea14e-0ea8-4a04-8775-48e8c6e761a0", "value": "c903f9acec3a42054895d7e0be049f69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf0ad24-c78e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1707512718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707512718, "uuid": "a12756b4-9b67-4530-b508-72b1e22c693e", "comment": "Malware payload (AveMariaRAT)", "value": "08b6a2749172417cbaa1a010639329c3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707512718, "uuid": "dde64a6d-c036-4015-aa3a-d2f99d15298e", "comment": "Malware payload (AveMariaRAT)", "value": "0246d4eb99473ba449b98548167d0767b68b075749a8962d0573851f505689b5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707512718, "uuid": "f5e9072a-f66d-466b-9d52-6864e32285f9", "comment": "Malware payload (AveMariaRAT)", "value": "6590a1646329161ee305abb2700e1d09d8b52faa", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707512718, "uuid": "b355360e-48bf-44d9-9f20-3515533e31b6", "comment": "Malware payload (AveMariaRAT)", "value": "2cca6107040568f2d0c6a24de638fa0b4e1effa9bbfebbd8813cef02cb7dcb9d96c6b51abd0236656af0d2b143b5d161", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707512718, "uuid": "66c1c4cd-1eeb-4185-9f8f-3872e7efaedc", "value": "T11E056993627CE9E3F86D3DF4910157A496B26D52A131E18BC89FBCD2E5B3B83C9005C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707512718, "uuid": "9379ed78-13c6-4517-8353-b9ce66a3e414", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707512718, "uuid": "1b6fddc2-a719-422a-baea-0829f9f14445", "value": "24576:WuU/YJIS5ypFpGIr9cxGDF28CJXtfI7Khk9bSJzFzbhx:QGIr3vCJXtsKhkG9Nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707512718, "uuid": "0d0d7cba-58c3-4478-8cb6-3522ee0bd915", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707512718, "uuid": "d5503690-c856-4c49-b7e9-72a17f49a07c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707512718, "uuid": "8717414c-9b69-4523-80b3-d2f853e5ec1e", "value": "08B6A2749172417CBAA1A010639329C3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b2d9bb-c6df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1707437267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707437267, "uuid": "3f6f8587-ece1-4be8-ae4d-a4d4936165bd", "comment": "Malware payload (Amadey)", "value": "d679362e4ad8b2356ba5fca51f2fde6d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707437267, "uuid": "e8a7b98b-d3e3-4405-8810-0b1f28558829", "comment": "Malware payload (Amadey)", "value": "05d27dcb95c2da2c2f50a9c742aa5a6076541e5cf8c082d7e3ce2f52621bb97c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707437267, "uuid": "fe4444b4-1235-411c-801a-2d2d95872fd4", "comment": "Malware payload (Amadey)", "value": "4003fe4ada8917f3ec3ab777b3091222c40402e0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707437267, "uuid": "f2efa6a0-fd02-4204-8d38-f49835bdc731", "comment": "Malware payload (Amadey)", "value": "f6e9a729bb2082b90581fa66c4d64078213b9d148f80a8f7bacba2d9ad6fe406b80717be154f5566adeedf568a5c2cde", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707437267, "uuid": "260e25f1-8fcd-4ec5-a9e7-36385c04e2f2", "value": "T1BD03D017A83558BCD47894B571EA78022A1CA1839AA0155C94D2BEBAB5FF361383F63C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707437267, "uuid": "fd40aed7-e44f-4844-a7cd-554923800f16", "value": "768:lumWYEIkGs24tsOuha/whIdxYsmaGD2ULb0fla:5W/IkGw5udCdtQLb09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707437267, "uuid": "f2eff609-032f-4935-a408-35aba07b1b64", "value": 41369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707437267, "uuid": "2e6ab048-aac8-4bee-b6ac-6aab1b7064a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707437267, "uuid": "05228af9-1686-4778-97a3-4eda2d22611a", "value": "b55b2c5e4231ca2d7a08de7e7716b6eb4d840540fd1509bfe7d225a690bf9d23_dump.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20d9500-c797-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707516483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707516483, "uuid": "2e99d526-cd8a-4721-b433-722ae30dcca2", "comment": "Malware payload (AgentTesla)", "value": "e8b284404b7faf3102b8ce2be6562152", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707516483, "uuid": "f9813dc1-1629-40c9-a944-6be3d9a00775", "comment": "Malware payload (AgentTesla)", "value": "078c182d90f6f1af74954ea737620e309438238175c3fc8f66b08b82d71c7472", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707516483, "uuid": "1a69827e-ffd9-4aa7-b126-a08fb50023d6", "comment": "Malware payload (AgentTesla)", "value": "c1da85af3ddb06074a7f7bae6d7d50150f545651", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707516483, "uuid": "0454b1dd-9c88-4929-85ed-df3e30b1fa21", "comment": "Malware payload (AgentTesla)", "value": "a076f2b5f1f696992902677360d0cb9bac3272a945519fbc75112359442acec0509b6411060cba96343cbb728e92139c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707516483, "uuid": "c4142cf9-bb7d-4b1b-9ff4-fffb7eb65190", "value": "T116D4230838BCF703D4FB9BFA50B4A1005772A5251C91FB5A6C9A11F63DA9BC08E65F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707516483, "uuid": "0cc73c6b-1303-401a-866f-ebd6b721413e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707516483, "uuid": "dcea6bed-e727-4a7a-a314-9d0319892c07", "value": "12288:2AxLvnA7BAVJWUAtDgJG2df2l0KdY+U9uDLFnwPUfdaqnV//Qy9btmuSp:2Ax7nA7gTACI7l0kY+U9gFwPQ3myZtip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707516483, "uuid": "c19c0164-1cf0-4997-b9fd-2856e0ae57c3", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707516483, "uuid": "e970a9a8-a0ca-4e7b-a24b-f04d94d06893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707516483, "uuid": "fb25a16b-174e-4d48-a672-8cb4f2aad441", "value": "z1CVMarianaAlvarez.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb329159-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707488152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488152, "uuid": "1eb6171d-0f31-46fc-a5f9-0bb1d6604b3c", "comment": "Malware payload (Mirai)", "value": "bf5da2a5290d704337a96e9a0f1ef2fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488152, "uuid": "b1d0e20b-99af-48de-a515-1497b7e66e0a", "comment": "Malware payload (Mirai)", "value": "09cda68dfc3911da0f0ceb10f92cbcff50b351be3913ab6669dcd6a71e6e1705", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488152, "uuid": "e4ffcde9-71a8-47c4-9d82-fb13e47fbac1", "comment": "Malware payload (Mirai)", "value": "55489ddbb9c7b9494c675460eb26e1041f7f9a25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488152, "uuid": "df432d24-d8cd-404c-9166-52d08229d434", "comment": "Malware payload (Mirai)", "value": "90dd88f5ab1e3f1b5c437d39b1e0b8ccdadd6cddc53b9392d1a28b7543405156a405324c6b88bf1aad75c456cad347a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488152, "uuid": "c09036cd-2603-4255-8cd2-c101983bfd5d", "value": "T190F23A85C642C6F4EC1215F020376755AF76D536AB3AF65AE3A93635EC0379097033AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488152, "uuid": "fad1382d-76ce-4554-a313-09655f93c9bc", "value": "768:9V1fbj4cQFjnypzUrKMbFYBjSJTsj+15DbICSGHqW7G8QoXP:X1fbj0byUeWFM+tsjADbIrGHm8vXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488152, "uuid": "aa9e42ba-407e-4f1e-9815-68a94c9f0e42", "value": 37648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488152, "uuid": "ec41a56c-5ecd-4a0d-933b-c72f6db9154b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488152, "uuid": "bdfbcb74-b045-48b9-9e45-6673a9e20136", "value": "bf5da2a5290d704337a96e9a0f1ef2fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794fa9ef-c73c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707477304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707477304, "uuid": "212a2ece-a721-4f54-b8cd-30dd88fabd74", "comment": "Malware payload (AgentTesla)", "value": "607fc95eb9fd37fa79d5b9e0be681582", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707477304, "uuid": "25c66ceb-fa87-4a00-b5da-ad5e81e03df7", "comment": "Malware payload (AgentTesla)", "value": "0a06869ea7ce6fcbd872d14d7bbf27ea06fd6f0ec098fe4824fc41c9fc30c644", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707477304, "uuid": "4004c5a9-b0f6-4c47-8cf4-88b5afe3933a", "comment": "Malware payload (AgentTesla)", "value": "2888fbf3194de644dbc88317c9adf26ef80bcac5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707477304, "uuid": "002c2c4c-3888-499f-8f3f-c039ecab6775", "comment": "Malware payload (AgentTesla)", "value": "4a85f2de111fb43d1a2c09d8c0da9b625ed6437708a3d682131204507e168fb867b60cdd1afa3b520fba62a720a34c6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707477304, "uuid": "c679d36e-29c0-4c71-a520-2d10f78d162a", "value": "T187634B0C7B9EBB23C2EC067B98E67651477494A2F34FFB6B78C4025409A73F65812A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707477304, "uuid": "ac36e5df-e82f-4a18-89fb-299da33711b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707477304, "uuid": "af85ad11-3ec6-40f1-8fc7-9d2c0bf95339", "value": "1536:OyeqBbp/jO22MrCKNE0gHIslwlevAVa7rdCL54E6emTlMB:OXrMeyK5z3dCqCmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707477304, "uuid": "eeb028a3-dec6-4b48-a515-49295d8876bd", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707477304, "uuid": "d0797f01-e59c-4dba-8102-2e01414c0ef0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707477304, "uuid": "9e63cd7e-48a3-4a4a-abed-5b0e20592162", "value": "transfer - 7678-7689926398.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabeb2f1-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1707493385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493385, "uuid": "cd4c6dac-679c-408f-ba47-8b43bd8c2fcd", "comment": "Malware payload (SnakeKeylogger)", "value": "8372c6e789284d2e07aa36d67b51b1c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493385, "uuid": "37c22649-7034-4358-af3d-79f1bb5a87c3", "comment": "Malware payload (SnakeKeylogger)", "value": "0a502f2e9bc9853efab9088f64a1082edb24ccab2800c1f072cc8c453e552203", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493385, "uuid": "f30c7afc-bbc8-4be7-a609-3e6472fab5aa", "comment": "Malware payload (SnakeKeylogger)", "value": "027f8b31345997a519cdcb505a40fabc0d7cfa9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493385, "uuid": "5527fcfb-c7bf-4f93-a372-d5f44874b19b", "comment": "Malware payload (SnakeKeylogger)", "value": "fd0591a5ffee9810728e0e60119fccb8e9a859520279140be96507f6f4aad09d858b4cc155e558089b2189a055e63944", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493385, "uuid": "4585cde8-2c7c-4275-a1e1-de67d8d0fce7", "value": "T1F7C42206B62D3706ECED87F12452A2940B70313F6C89E7599CCB15EC4A5AB855BB0E3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493385, "uuid": "d68c23e1-733d-4d68-8de0-27d5181b7889", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493385, "uuid": "826679c5-efce-46d3-9745-75c8836018a3", "value": "12288:VxEd6VdEMiYfrUM74aWr7m9a1mso4QCRxuZp6NNNWeRX9:VxcuddrbzWrfqCjoYNN0eRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493385, "uuid": "6ab37174-0280-4ada-b998-2510b77c89b5", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493385, "uuid": "92030476-91de-48ab-a1c6-3f7094278612", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493385, "uuid": "69d4b80a-fb91-43d2-a702-06afa142fe66", "value": "hesaphareketi-01.(170K).pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be2b739-c71c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707463376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463376, "uuid": "d8b92296-b3db-43e7-88da-b8a9f42d980e", "comment": "Malware payload (Formbook)", "value": "c3e4af8772b7cfc52af6a1fa2f7598f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463376, "uuid": "3172d199-2bc4-4c6c-a95d-5d6950e3d5d0", "comment": "Malware payload (Formbook)", "value": "0cae14234a421c5fa50da5945027c7d75167ae1c6517d7ce8733b4eb91b4c221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463376, "uuid": "b755db7c-f430-4fe7-aa1c-14ab9ead2341", "comment": "Malware payload (Formbook)", "value": "bfaad19d9067b0595f7d798aa344d218bbac527c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463376, "uuid": "9db04fd1-873d-408e-8e60-b06c0e267c6f", "comment": "Malware payload (Formbook)", "value": "c8226db57f54b5b1809aa483123deb74beda19ff9a143cb5d2be674bb39f158e2093cf85a32be17930ec386de9ade76b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463376, "uuid": "382a47a5-ecae-4061-ba81-3ab27a004634", "value": "T108D423945FBD2F07E63B83F11566A1200FB5060F946ED3362E0F44DA8EE5F0226523AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463376, "uuid": "198670fd-a68d-4dba-981b-47214aeb0ddf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463376, "uuid": "3028c671-f20e-4654-931c-3fee527e2044", "value": "12288:klxEd6/6QadJcGc9P3C6bKS4LebzRDeHsYczIoOt4jjaE6O5LP6zJK:klxcU0K7PSs4SbVDky/j3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707463376, "uuid": "ae9bc835-9b92-4590-b830-9ff4c4614514", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707463376, "uuid": "d3f79971-9148-4a7d-b439-1283d1fe197e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463376, "uuid": "179cd552-a4c2-46c1-82e5-1c5cff21a824", "value": "C9B284.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f7e920-c741-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707479370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707479370, "uuid": "ccfd8daa-18e9-4fc8-a889-d131a1d9c3db", "comment": "Malware payload (RiseProStealer)", "value": "8ff72b28f884e621996adfb787ae9fbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707479370, "uuid": "768b673c-7773-4daf-a69d-c1bf31d8fe18", "comment": "Malware payload (RiseProStealer)", "value": "0e5159fa0db346e48ccbb3398a7e83a9e5257c3dd8ff0e4239d2ca602b77d70f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707479370, "uuid": "8efa8316-9866-4b27-9548-80220905e2ca", "comment": "Malware payload (RiseProStealer)", "value": "b6049ede02e71b33a31aa656e6b0d541bd043744", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707479370, "uuid": "298e3c4b-e06c-4615-9e06-5530502c9645", "comment": "Malware payload (RiseProStealer)", "value": "3fc20e42d04bb3930b8ccd5c9b0c41588812b9cbdcb262371519d8a4a3a1ec70ce0cc2772d78b78e16500c97d756f319", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707479370, "uuid": "a8cbc572-d94a-456d-bde4-1abf8e1d54ff", "value": "T1FFB523CDBC40A447CAC4A53088E2FAF9123FEC95A94290DA7CED7F977676A150523D2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707479370, "uuid": "e7f6dffe-c966-44c8-8635-3c96e2b7feb9", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707479370, "uuid": "e01cd75a-1d4d-465e-bac5-66989b95ddbc", "value": "49152:+wFh0yf4702eWE6kjzB21+QW7j0+SOkilsGvDq9s5:+yA7AWizMXW7j0+SAtDq9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707479370, "uuid": "58d245c0-3672-4a88-bf97-ea3cadf1224b", "value": 2400256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707479370, "uuid": "9889eb46-ab3d-4e88-ad5b-e4170d0a0cdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707479370, "uuid": "782d2d98-3133-4c70-94c9-67bbc0234afd", "value": "8ff72b28f884e621996adfb787ae9fbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca5a436-c74b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707483940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707483940, "uuid": "330b6e22-e816-415b-9c2f-20a11ace833b", "comment": "Malware payload", "value": "58b04d71e53c817574f1c8b9abd9620f", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707483940, "uuid": "5f4d9783-05f3-453c-903d-704ffcfc1fe8", "comment": "Malware payload", "value": "0fd52ebb37e4e5c41756133e47215547478097f9a6ff170cc442cb21276e3f36", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707483940, "uuid": "8da6be66-c777-4803-b638-cb8e81d1efb3", "comment": "Malware payload", "value": "ba1a39bcedd7ddc7f069e96e220035d5c4844d32", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707483940, "uuid": "c6bca439-a02c-4e56-b77e-1fad6f725162", "comment": "Malware payload", "value": "c0b958f748eb4b4571b886f3457885a9df8141a7551f0c64dcd5d025410fed77f858f764a9ae81eca4f8135c01a320a6", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707483940, "uuid": "18a6957f-8a3f-40ce-9c77-9f5c13b34dfe", "value": "T14D45F12B5EC6B995C1998933B3A955DC02F59E2FBCC5E367188C72F4CB3538D22025A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707483940, "uuid": "b87d3f9a-7e40-470a-b92d-e1377d9d31e7", "value": "24576:A/s41GsJNI55p3HbCgVQu7hdmr1ObrhzE24b/x:p41GkybCguue1yhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707483940, "uuid": "c3954b93-1461-4451-9c0c-c1934539d470", "value": 1195443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707483940, "uuid": "52179919-ed72-4dc0-a989-78712487094d", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707483940, "uuid": "c3265e43-4023-4dfc-a99e-908b8fdb2b24", "value": "Promac S.A.220172615415415.PNG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fa5d71-c768-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707496389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707496389, "uuid": "5a85e1f4-3259-4bf6-9113-a19f92792708", "comment": "Malware payload (AgentTesla)", "value": "4604dd1b1ac5eda3891484dc0de93c4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707496389, "uuid": "23097c37-99fe-4806-9a4a-7340067f5829", "comment": "Malware payload (AgentTesla)", "value": "147efabe21da4bc60279698da6574f9330f3cf3ae7ab3cfb3495926c6a1237ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707496389, "uuid": "acd45fa2-4971-4a06-8067-ecfb8fc5946a", "comment": "Malware payload (AgentTesla)", "value": "5600fb314428aa4cd0c0b4ad8a62f093b5931583", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707496389, "uuid": "8c7aaa85-9187-45c0-b08c-75b623d8a3b9", "comment": "Malware payload (AgentTesla)", "value": "25dd9ad77d8e3526634e69ee039e3ad1591b0fcd32ee9f16b0093dbc1cab79b81d7930244aed7054be3c98bb94d719a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707496389, "uuid": "01383bef-b737-4d91-a65f-45389140ed03", "value": "T187E423E53778FB63C05D47B5843C31201B71910B784BFE7D998A12BB0F5A7A28A17A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707496389, "uuid": "cf6db05b-5484-4ab6-9107-7a2f8a6114d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707496389, "uuid": "0ae4a627-8044-4790-a57e-759152f6a0a2", "value": "12288:66xEd6cnaekPdVc9aIHsjtIh4pmMxXpzW5bM93gikrTqRzKLlnrbP:7xcvaVvc95ItRmEXF3gPTyzKbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707496389, "uuid": "a0701cdc-c8be-4c70-893c-73d9a5c41933", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707496389, "uuid": "f957de3d-59c9-4a20-bd31-a3f273f75792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707496389, "uuid": "aa8082f6-0b8e-4df7-b361-e7416b360cd1", "value": "4604dd1b1ac5eda3891484dc0de93c4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1833c4e8-c76e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Zyklon)", "timestamp": 1707498616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707498616, "uuid": "f06eb785-91fc-43ff-9e71-1d177f8715ed", "comment": "Malware payload (Zyklon)", "value": "bfb76b993b916cde7d4f7c24dac36298", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707498616, "uuid": "79f07346-5b89-4b30-af8c-5adf88804fae", "comment": "Malware payload (Zyklon)", "value": "1620913545f60a85ce934c8df97224e111a86b9f4c5ed9f51ab57a13985db4cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707498616, "uuid": "0dfcc487-9ae8-4e54-a2ac-b3c5105255a6", "comment": "Malware payload (Zyklon)", "value": "c7dc036b0d8b4b514cbd64d4f068da478359886b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707498616, "uuid": "f535c530-ea85-44be-923a-ad8b689c31b9", "comment": "Malware payload (Zyklon)", "value": "a48b2969182ece5592c135d273d6c316edf34fce29c0008e5dc4032acf4905fa8937fc3fe1fe9a2fd3ad730feb92dd69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707498616, "uuid": "48209d0b-25c3-4ad3-9624-f30ede975c3f", "value": "T19706F04B96B24E73C2647B3185E7402F42B1C7367912EF1B364E14D1BC06639AB9F2B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707498616, "uuid": "eeb1feda-913a-468d-a072-375759a2d5c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707498616, "uuid": "7b4fee89-8168-4348-be20-889231b3c4f6", "value": "98304:AcVI4XpYArOMNZCEBhOddaRdUy0q4Drn1L9YQn:AyYArFNZWkydv1ZYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707498616, "uuid": "153842d9-208b-4c68-b169-88a744a96476", "value": 3773952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707498616, "uuid": "01a4b889-6751-461f-8256-375276c06f7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707498616, "uuid": "29aa40ae-def2-4415-ba00-444829d26a68", "value": "bfb76b993b916cde7d4f7c24dac36298.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1467cdf-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707493343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493343, "uuid": "8cec6562-3d0a-4613-97ce-2bd958476544", "comment": "Malware payload (AgentTesla)", "value": "10343d51fd7fe4ebf396f1b4eeb483f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493343, "uuid": "dcb1beb9-c48c-40f4-b4b7-39ff2e355067", "comment": "Malware payload (AgentTesla)", "value": "181a2b0c643ee92803163521ebe68a693e56df4066089f10008708a3944b531b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493343, "uuid": "c131b63c-73ca-4ed7-b116-ca91f249e6b6", "comment": "Malware payload (AgentTesla)", "value": "50aa8b8619ad135b49e8f8f2bddeab8f39f8cbca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493343, "uuid": "9e5d35ea-67ac-48f2-a4fe-da3a3efac458", "comment": "Malware payload (AgentTesla)", "value": "a2f32efa3081353395ad81f3382ba8d9f30cee19fd37e137c78d6ebf7513fb0672164fd19330d249de76ae8efbf92c22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493343, "uuid": "e7288a7f-9f45-427d-8977-e059b038a32e", "value": "T1B1E423427B2CE7F6C4AE473A65D099011331E757A241EB3856E2AAFE3D433D2CD1426B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493343, "uuid": "ffc5b6be-b46e-472c-a4b2-66d197055547", "value": "12288:KwLzgOTLmAcy61GnOsNw3OPHHBB8yWyQkRTf62HxQP8srjdL6PGE9x/O1:hLzgOHmh+ONO/HBB8ufFR6fdL6PX9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493343, "uuid": "ab139b6e-d144-4cf3-8615-a816aaff0cdd", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493343, "uuid": "2660c373-6478-4fc2-8670-9730ae0df1e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493343, "uuid": "a8753a78-e9d7-4c88-8c85-58db80195fca", "value": "Dhl Shipment Confirmation.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f25c707-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707488105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488105, "uuid": "bc989305-49c4-4361-8a6b-82bd3fea256d", "comment": "Malware payload (Mirai)", "value": "134e44c415e35d12f23ab8782f1654a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488105, "uuid": "c972d493-adf6-4190-a3ee-27e1dddef28b", "comment": "Malware payload (Mirai)", "value": "1a609497050e86d096fbe3540aba3126f1bd71a049abc52fa82c7990e6bf4b2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488105, "uuid": "dece05fe-777f-4216-b0eb-a2d00d20896e", "comment": "Malware payload (Mirai)", "value": "bd469a1f4f6ab7b3331ff5d90c2b9d38cc75e3f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488105, "uuid": "d7a1ac12-defd-4634-a071-dc5295459cb3", "comment": "Malware payload (Mirai)", "value": "5120cb206b1fc6cb215296a50d1c317288b4dae163a8da9010fa7ac869aeb8eaf5728cb99ed3f07be1f83ef15661f3cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488105, "uuid": "24797f0a-7c1e-417c-af9e-82b4feaf5d88", "value": "T168B2D0A487D1A706C2B0B435D37C8F965F3B06E4C6F639262A2092BC968149633FC6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488105, "uuid": "d6a3ed7d-d199-4afc-9dd0-ca3b1e8f49b2", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BCOwhymdGUop5hu7F:4GaKQFH0rs3zWoDDRsjt7LB9U+BCOwso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488105, "uuid": "c1d12cad-c88f-4aaa-99e0-8f08decc5834", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488105, "uuid": "d2c4b01c-5e61-46ea-bd02-01428f746d83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488105, "uuid": "a05b1f40-14d9-46cb-b1c9-31fd1e4ed1af", "value": "134e44c415e35d12f23ab8782f1654a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bd3252-c720-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707465272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465272, "uuid": "29adbd74-6e9a-419f-8021-257ef590e30b", "comment": "Malware payload (Mirai)", "value": "87f9e75d18d3e6a4362e9ef97096a299", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465272, "uuid": "c91e213a-412c-4c29-9c6a-a58fb9eb922b", "comment": "Malware payload (Mirai)", "value": "1ae60071849cf618fee7dee87a4cadacf9c1cf2d80e1c5ceffc71e7475ee098d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465272, "uuid": "c0edd647-d929-486f-b7ac-f72ef9cb42b1", "comment": "Malware payload (Mirai)", "value": "136478b54506532abc0d886f6652b51a3c65ba07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465272, "uuid": "0b4ad45b-1f5e-494e-8245-7295f5b8a14c", "comment": "Malware payload (Mirai)", "value": "90bda1ead89686251a423be20a545c7663b5c94f28d7577924dce2fba088bdfabc99930cb5d43bb824dddf2805b07e89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465272, "uuid": "d2833db3-5b7c-461e-b625-8d651ff31cfb", "value": "T1C983AE63C8192E98C55A8238F1E08E791B23F41091932FF9A9DBC7691057DECF5263F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465272, "uuid": "9adaac6a-9c3b-4f6b-89ca-d538cdc789a9", "value": "1536:QG/PnmlZd/m9GxaaG4LcHeFv8/IcKJk1n7zioQC17kYXM:QGnnQ7O9qc4LcHeBqyJ6ziXmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707465272, "uuid": "34a18953-af35-4abe-b054-9a23cbb8672e", "value": 87392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707465272, "uuid": "d7471322-5a28-4a0b-a679-9a61dbfbf824", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465272, "uuid": "fbf36207-3bef-4ef8-be55-32e935c1cda0", "value": "87f9e75d18d3e6a4362e9ef97096a299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93251ce6-c74c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707484219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707484219, "uuid": "93da69ec-3600-445c-8acf-5eee1440b064", "comment": "Malware payload (Stealc)", "value": "20e4fe1b334a51891f9768f988e5312a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707484219, "uuid": "f867ffa5-f57b-4971-bef2-ed001056da66", "comment": "Malware payload (Stealc)", "value": "1aeb4e6da49a3c64982769757dd769cedccb7a12223be887b2ab6466667b2073", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707484219, "uuid": "9d7c038d-6005-4203-a23b-4a774aee5621", "comment": "Malware payload (Stealc)", "value": "d4256ffdca3c7a9768b1d982d66ba5007bc519eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707484219, "uuid": "1370eebd-c94f-4e18-a431-a60e158c9182", "comment": "Malware payload (Stealc)", "value": "f08d22dd85ba66a6ef7c4cc4749fcd42cf964902fc5b7d42bf3a90b92559234c8c928696471b4409b3ae62d949279317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707484219, "uuid": "a723517c-25a6-436b-95ec-8843a11bf70d", "value": "T11736335999E901F8D1CB5779167748BFDEF271B488A8CF345AD28C8280B39707A4B13B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707484219, "uuid": "8b431614-d396-42d7-add4-8ab6da91a34b", "value": "ff33b72f1452cd94b71dbdcc219273f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707484219, "uuid": "8959f271-b18d-43d6-9510-571704d8ac65", "value": "98304:8flUPXsBHxAkgJHAvN9+dYom7Sb+Qwo5/89rpj3qWihdMnPx:IUPXspkHAzMHm2bv61WhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707484219, "uuid": "00b184fa-c31b-460a-972e-473037069782", "value": 4942848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707484219, "uuid": "62e3520f-e7eb-46da-94db-62e8e3725c18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707484219, "uuid": "22e2dfea-67db-4545-9b45-ed6efd3cea86", "value": "20e4fe1b334a51891f9768f988e5312a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04874015-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707492999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492999, "uuid": "96294d1a-82af-4023-a4f3-a5be875492ef", "comment": "Malware payload", "value": "cd2b5a09efdac0ffbd76111f44733138", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492999, "uuid": "23c126ff-0146-45f1-925a-e10d2bfe6135", "comment": "Malware payload", "value": "1c6b4fadf6a74e1dfacd17468bdb0743ec21a1bdf3fcd4c3f58bf727efb1c74c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492999, "uuid": "c9f98b0d-80a5-42bc-a644-111c78256aab", "comment": "Malware payload", "value": "6db6bc9dba96632213d1077155725f388237e268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492999, "uuid": "bdfe5bbe-4b38-41b9-98ba-7b15d0e5856e", "comment": "Malware payload", "value": "3c1938467f51f480484ee5afad1c17a22b5b31aa05355038edcfba7db985f6faafa0ad688defe702324638e562d3ab74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492999, "uuid": "6b4553bd-0a78-418a-a3dc-ff436095e546", "value": "T1B0639E6067AA5A3EED9F4779A86220100738F24776D3D79F9FD8405D18A37C08722BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492999, "uuid": "188241a8-e5d4-4827-82bb-a9bb09c9c908", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492999, "uuid": "1bb3578c-5258-4ef7-a151-e93417d01a71", "value": "1536:wh+EWewjN1pP1H/hhWIJ5gZEMTOZTpqI0lI3eiQ:w7MZP1f9J5gZuTQI0lIuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707492999, "uuid": "19fd5861-1db5-48db-b87d-1fd28edb663a", "value": 70504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707492999, "uuid": "337eccfe-2129-4540-bc0d-38b109cdf2af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492999, "uuid": "8e79f0f5-af27-4734-8904-c85aa9557845", "value": "cd2b5a09efdac0ffbd76111f44733138.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcb3c94-c6f8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707448055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707448055, "uuid": "713aa9f1-8388-4d69-ab87-1d23760d8b7a", "comment": "Malware payload (Mirai)", "value": "e0c8d768097c35c2e7b8a2e1293d7d6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707448055, "uuid": "e90afb07-8fc7-4b40-b2fd-febe9955e54e", "comment": "Malware payload (Mirai)", "value": "1caf6cb8c875765591c886eb046ca4566b78bce6b9b69f52d441810acf42a387", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707448055, "uuid": "662e46b5-807c-46f7-849f-217b13f11e19", "comment": "Malware payload (Mirai)", "value": "b93b199c985fad0edf54cde5f495afc3d33e6c72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707448055, "uuid": "57f8927f-afa1-403e-8544-c11cc0755d13", "comment": "Malware payload (Mirai)", "value": "35a0d5a2f3927ba8ed67c8f33152a68645f420b4dce409a4c271e77d471cd23911d38f486a91285fb15cff9d1dd6a246", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707448055, "uuid": "93b3ad74-fd36-4336-83d5-31d9f55331f2", "value": "T10B93C609BF650EFBDC6FDD3706A9170625DC651A21A83B367534C828F64B24F4AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707448055, "uuid": "7ec46847-2fa2-4452-8b1d-1bca7e936411", "value": "1536:3a75czTB/ibDEgwrFYpI8nr1YyCSh/aA3sZMQSchcknkH6:K7OzdeEg3j3h/a+s99nkH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707448055, "uuid": "4b442de3-652b-4b25-9e85-05395967bd0b", "value": 93076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707448055, "uuid": "79105a51-5755-4b63-91af-31d6b5bfbad7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707448055, "uuid": "82150cb9-80f0-4e58-a879-79a06ca7a49b", "value": "e0c8d768097c35c2e7b8a2e1293d7d6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f830d4-c747-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707482083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707482083, "uuid": "fe003786-7b3a-4ded-a8c6-8c41fed1218a", "comment": "Malware payload", "value": "5134e6925ff1397fdda0f3b48afec87b", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707482083, "uuid": "997367f3-42b7-4cdb-99dc-3bc8f34a0479", "comment": "Malware payload", "value": "1d59bc782e532780da0364b14a1b474a8cb8a5af50c8124159bf5d943bd050f7", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707482083, "uuid": "e8c4339c-523f-44eb-bbbf-5f01be33b794", "comment": "Malware payload", "value": "e443dc35f4d1456284d93463392f137e9c9eb883", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707482083, "uuid": "cf91646d-af0f-4023-abef-4703a4513bdf", "comment": "Malware payload", "value": "91e4fb96014d6c3052f6f2819d1ba73ccd8b769da2b096c16a4466238b5d0b9fd54fbe10f017c981cb55e64424fca4dd", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707482083, "uuid": "ac75d2cd-d146-449d-a027-b7ecce059f18", "value": "T1253670E9B3B185B3F1CFA035942875CD2D70B8573109E25B9B3376919A225FFB2AD600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707482083, "uuid": "1dff06db-faa3-4142-90cf-841cca3c5054", "value": "e923fd2ee2558942eafbec4a9773e68a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707482083, "uuid": "52469ac1-cf4a-43c6-ac80-13210e04f6ac", "value": "24576:sieRfHJIGN2GmofJymJbRLe7ozFVMVYDnpe/iniPG1XAPfuEzOzdQ8g3LEsPgt/F:k1grij200JFsGGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707482083, "uuid": "deba01da-c4ec-451b-bcec-7cfce0eccdd3", "value": 5160448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707482083, "uuid": "f3b9c5f2-cd3a-4fd4-be79-7dd76b3d6c84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707482083, "uuid": "15f93ca2-d52f-4076-adf1-9ba752d8022a", "value": "1d59bc782e532780da0364b14a1b474a8cb8a5af50c8124159bf5d943bd050f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326ab2bd-c721-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707465588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465588, "uuid": "b743e824-2147-4cfe-a91c-9a274ae2c2f0", "comment": "Malware payload (RiseProStealer)", "value": "78381401bb3b7d0af0d2c7896003f7bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465588, "uuid": "42b528a6-a19f-42ca-a121-02650dffdc72", "comment": "Malware payload (RiseProStealer)", "value": "1e612571131d0b3cbfa9b5b60865815e1ec79703920d6834509e6792d068a49a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465588, "uuid": "1b6874b3-6d6a-4bc8-bb69-6c0a2b965f3d", "comment": "Malware payload (RiseProStealer)", "value": "b7684564b7ede67faae6773030960a1f3e68737a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465588, "uuid": "3b96504b-5612-4197-8c61-87ed3f582da0", "comment": "Malware payload (RiseProStealer)", "value": "a28a0cc46b82f5fc7917ad77214a0422431288030cf11a0a8144772ae93007d9f8da1a950fc4ebdbca4515edd3e7a3d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465588, "uuid": "faec1997-a2a8-4e72-bda3-e95c072d42ae", "value": "T134B533496B6A9164D82C09B1D0E398351BF30487F1B6D9C63EC9E6E83F117D0DAC7BA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465588, "uuid": "99d77ebd-6ec2-404a-b091-89b8fee2d8c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465588, "uuid": "45780139-f4bc-42fd-aa70-86e177c41f16", "value": "49152:fPd3Q5c3zVS10KM+q7mXgFLK6lmluHQPNaATXG63btgjaTqM:dQ5cpS1Hqe/NaAK63BgjaTqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707465588, "uuid": "5aba4848-c92c-4b60-bb44-3c401a748073", "value": 2486240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707465588, "uuid": "1a22737c-ed7e-409e-89a4-849d14864ec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465588, "uuid": "3b771856-d93c-4691-a80b-c5fa70e99651", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4d896d-c720-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707465279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465279, "uuid": "4aec7cd5-c78a-4b65-af32-40bc4680ef17", "comment": "Malware payload (Mirai)", "value": "ef07d2f030ba0ad81345e416211dda79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465279, "uuid": "a3265b0d-3047-4589-a2e4-4de252c52152", "comment": "Malware payload (Mirai)", "value": "217ff6df6a95dd5391ec93784d39536b9207b0c1042cb8155679a80ef4193d83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465279, "uuid": "640e7333-15ca-4a44-bac8-4db25bef63ce", "comment": "Malware payload (Mirai)", "value": "e291af584b8943bf95cc6bd329802e0ebece1c98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465279, "uuid": "b4a4ffd0-4a08-45cb-a350-907c1caa9922", "comment": "Malware payload (Mirai)", "value": "ee90e27c828520d2ca917199c6995449c840bfa3934c0eb93a31cd3a10b5a2fb264d546585df3ebd10242ef9ba459028", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465279, "uuid": "7e85b2c0-98d8-44e9-b9a5-3d7f1280b6a1", "value": "T15FA2C0B01244F64AD7A03873D95846AA9B754EF0F4B63895390C8B2E40C5745B7FD58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465279, "uuid": "3f9d34a4-e84e-4eea-a45d-fc40c8915fa9", "value": "384:TJr5zC/5TQrnpEY9EOHBN8yzfxztjFc77Jb1A+RBy5Z4z+mdGU5eT6NujgMg:MhQXEOHB3hjs7JW+Rm4z+3UQeFMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707465279, "uuid": "62a9907e-7a99-4f31-9975-7e6da8d00311", "value": 22196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707465279, "uuid": "11487b85-e6da-4529-a029-5bad6b31349b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465279, "uuid": "90d565a7-0d98-4fca-ada6-c8a82bc4885f", "value": "ef07d2f030ba0ad81345e416211dda79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b202d5-c71b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707463285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463285, "uuid": "30851b94-a68b-4a06-9460-0c93bb58bef0", "comment": "Malware payload", "value": "609f06d02963f54cc04a2234e31e0272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463285, "uuid": "59f505a6-1769-4c44-8176-aee421122246", "comment": "Malware payload", "value": "2235d317ac8a4fd9e94cb8f5549a2ef6e055497776887b6deddd7a87882a6990", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463285, "uuid": "c998202f-5bd7-4463-a2c4-0ec807863827", "comment": "Malware payload", "value": "bbddab14a4dbae11b757a9ac6ec1dcaf66e86932", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463285, "uuid": "fbbd3f0c-c880-4c79-839d-c50cca5f8bc9", "comment": "Malware payload", "value": "bc9c57f034cad21c8e4b7a8e4595431c718fbba78ea602422eb27f03c31f42e75c6ac8f64f900cd58a9dd8cfcdb05513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463285, "uuid": "4a3dc991-81b9-46e7-bc57-eae604cc4b14", "value": "T1B3E42312FEA88BB1F4A957FA16739740C7B586265250CF6C6ED024CE7B23F605382793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463285, "uuid": "aa2b9794-75f9-4e3a-8b35-af842ebd5f5c", "value": "12288:ESLzgOTLmrhODGNn9TkFO9YGk889lk3HErdAh65ehLKuhXdSz1ibIKPS4hNBoQ9g:ESLzgOHmd3/kFL184qEry65eEuPSgbIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707463285, "uuid": "5e3ff5ff-3ca9-4a5d-81aa-50de0aad2732", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707463285, "uuid": "11858dbc-9d84-4473-a236-5fabef133115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463285, "uuid": "637b58b2-25fd-4a06-9a99-48b61f6ce233", "value": "PO-ENG-104499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813c1469-c720-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707465291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465291, "uuid": "badbc8b2-20fb-4098-baa3-1346820d03b3", "comment": "Malware payload (Mirai)", "value": "6d6822b8017c871223dc7e8fb05be29b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465291, "uuid": "2970c0c3-afa7-4379-892e-b25ab2fc18b0", "comment": "Malware payload (Mirai)", "value": "2246a4073bc4744e6cb8e1fcd297fdc87a57d81cc10a560181f38da50caddd59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465291, "uuid": "d5fe8467-cc76-4959-a45d-38a50e772f48", "comment": "Malware payload (Mirai)", "value": "8fba69a707237d5908f119acedfbfeeb38375641", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465291, "uuid": "da1d7485-6269-4565-9d58-c66c99f78ac5", "comment": "Malware payload (Mirai)", "value": "e2059d3c7898e163908c1c542ac9096a28ed60b1aa0bbc20a9a8d10e84afd1233951746d220583af99be12143bee94bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465291, "uuid": "83bf7ed4-90f9-461e-b2d2-47f206e9289b", "value": "T1F403F1A1D7746F88D46F32F95ECE86C063E28D4F32A2EDE392568FF0695110F6015DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465291, "uuid": "8a6a28eb-8a9c-46be-b324-927436edaeca", "value": "768:6XqgfK0sXk60IQtS03uyDOXmuUtPz7kpGyiPIjeKfvmtENYUJ4uVcqgw0t10tLyp:gzK0c0ICr3zaXUN74GyuuHoy4u+qgw0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707465291, "uuid": "7545c325-543e-4c49-9776-63b0fa6d5900", "value": 40932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707465291, "uuid": "3fddc6fa-347f-4747-9143-649d85b4a0c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465291, "uuid": "1ba4126f-428a-43bc-968b-30887cc5ac2d", "value": "6d6822b8017c871223dc7e8fb05be29b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541cf79b-c751-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707486261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707486261, "uuid": "c8499717-7a93-4ceb-9e86-01b4d8a08692", "comment": "Malware payload (LummaStealer)", "value": "24f779d69f790e56d9e1c4fdd6d96c86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707486261, "uuid": "f2ddcdb4-4356-4c62-9221-3d44146ee3bf", "comment": "Malware payload (LummaStealer)", "value": "263ea5ce55f4a953b49f6f49287394c511fd890913b4617a9b4953b0a8f9de75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707486261, "uuid": "f3f6826b-2f75-45ea-855d-1ec6a98e8d35", "comment": "Malware payload (LummaStealer)", "value": "5d546d3c187d2ed3f6ffa07390900ab1029d3283", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707486261, "uuid": "383d0bf8-09df-4fd8-9e6a-1f6290ee0557", "comment": "Malware payload (LummaStealer)", "value": "b0cffd70d65a783e07d9b6fcd54129f7163da7b3b9e6c917fc5c28bb64faa4851aa4c4e10ac735743e2d7c5354928186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707486261, "uuid": "604106b9-bbea-48d1-8599-31e1c688067e", "value": "T10A3633F25E9D1C8AE2258BF0A005C1419C5FED3A7EB8D92C592F3925D7F319D1BE0682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707486261, "uuid": "8a3137b2-c8f0-4d1b-a557-7e9eb1dde15d", "value": "e351b8a3dc5b9dce1395c5465107ea51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707486261, "uuid": "5f96fb9f-924f-4b24-8631-76ead9ff6166", "value": "98304:r7UHemPdguFDFGHkby74ycoAfZM1XhUWJyXXR9dooRurVy8R3WPOel3aq0l79:HhmquFFGDs/oMZAXhUwyHR9kyrPOtq0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707486261, "uuid": "0c363ac1-3cbd-45b3-ac1f-e19a263079e8", "value": 5001017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707486261, "uuid": "e39f12f0-422a-4328-bd81-27f5439d4a7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707486261, "uuid": "12bf7d4e-dbf8-4cc4-975f-9ae6cec99391", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e5c704-c797-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707516488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707516488, "uuid": "2dc20cb6-1051-443f-982f-bce9ee33959f", "comment": "Malware payload (AgentTesla)", "value": "cee609e4e4bdedc2f4aec74d4a8b4308", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707516488, "uuid": "9264718c-bb75-48f9-8b4f-22f92a40610e", "comment": "Malware payload (AgentTesla)", "value": "26a1066bb2f10e324209c5911df5851f37624c482f7a545b01cc73674847bbc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707516488, "uuid": "8d722b4a-efd8-4c5a-80d2-3655aa7df1ed", "comment": "Malware payload (AgentTesla)", "value": "8ac4356d6b2e07c989f463e31c0084ea6a6ad32b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707516488, "uuid": "36dd52fa-8aa0-45b1-9c66-bfe328940745", "comment": "Malware payload (AgentTesla)", "value": "1f12a94ee867cbd23ca3c38eacf3fae8622ce6e99ac7e8f42337b4a6914707dac519aa37cd73683723fa5315524ed503", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707516488, "uuid": "cdd44b37-02af-400d-a941-cdb2317ccf56", "value": "T1B915AF32F5CBE036C1E27270AEBAF355563E692D2629D1A737C829219D708417B17F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707516488, "uuid": "0904bd8c-168c-40be-ba73-d8b99d74ee7a", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707516488, "uuid": "2561fbf3-ae62-4a60-8904-95a664655a6e", "value": "12288:jhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aeA8itecfjs1CaF6WU59:pRmJkcoQricOIQxiZY1iaeGfMPF6WU59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707516488, "uuid": "ba7db825-04c6-457a-ad2d-ad8b2469dc12", "value": 927067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707516488, "uuid": "65992f53-3467-46eb-9654-b1c9132d3156", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707516488, "uuid": "8952915c-6f42-43b1-b708-b329f2c33879", "value": "z60InquiryCMD789420240702REFDSCM66fcvfhf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089790cb-c72c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1707470243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470243, "uuid": "24da6c32-23b3-439d-a79f-2b4425a4b7d3", "comment": "Malware payload (Adware.Generic)", "value": "db58ece60b1a4723fe7c4830452dee0a", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470243, "uuid": "e9a981ba-ff56-44d8-9dc0-a2951ebb90de", "comment": "Malware payload (Adware.Generic)", "value": "26e4c5d88140bc0683066e261943f392f992e1d5e594ca523593dd164a57c398", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470243, "uuid": "2d3352bf-a029-4632-9b2e-3090056131de", "comment": "Malware payload (Adware.Generic)", "value": "d434fc0e15329afdd3f6e98f3b511da194f0aff9", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470243, "uuid": "2138c935-31fa-47ff-bc11-c7e66ff120d4", "comment": "Malware payload (Adware.Generic)", "value": "f219e2152b7aedcd47d98dff63f656c5850855d370d658308f6f31cfc0cc1681191cf73fd67db680b087d710268af53c", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470243, "uuid": "8524de90-d6f8-43ff-8a60-4e6a58555e09", "value": "T11316D007E3D182E5D4631534512242B99B77AD95A3B4E0C37FAC792A4FB29C0DA3E273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470243, "uuid": "e1bfa2b3-68a0-49f5-b978-73a8235daf02", "value": "82e4194a6930014148202efc0c8ceb1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470243, "uuid": "90ffeb56-0fd9-495a-9acf-9504cbd2d8a1", "value": "98304:gtNZl33RZMmUFqnbBjnpzvJSIf42T5B7FJYLrB:gjWmUFqnbBjpoIf35B7FJYLrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707470243, "uuid": "74a18cec-4490-4b97-911f-cc7c6d66c318", "value": 4227952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707470243, "uuid": "4cab58bc-9159-469b-9358-9bce72ca2492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470243, "uuid": "ea4499dc-317e-4d89-9665-fb9f955d6325", "value": "SecuriteInfo.com.Trojan.Siggen22.58997.12513.10430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3391cba-c792-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707514391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707514391, "uuid": "d03dad27-02f8-4fd3-91a7-f42c267e5166", "comment": "Malware payload (AgentTesla)", "value": "7b42afaa8d13acf084d3784cbc0bd4c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707514391, "uuid": "942ba0fd-c04f-4f93-aebc-a7a367911262", "comment": "Malware payload (AgentTesla)", "value": "2721334b6e632df9c325337f43656c1e2ed4afb5e0e1e1b74a55055346d3200e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707514391, "uuid": "a90a5a3c-cdd5-4aee-ae4c-505933a38e06", "comment": "Malware payload (AgentTesla)", "value": "dfe0a822cda6a2a90d503eaa53c057573ee7ab32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707514391, "uuid": "121d38af-e66d-4ec9-aaf5-6ff57b3f8f8f", "comment": "Malware payload (AgentTesla)", "value": "3af5740f07c90b6821a2617038f331ece03591be0dcfa6ac07a15d38de16faa0773228b75fe8ecdd8ab178067d1eca18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707514391, "uuid": "fb7156f7-ea9a-4925-bbdc-a72cf8d7697a", "value": "T1F5340F027F88EB15E1A93E3782EF6C2453B2B4C71633C60FAF49AB5514516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707514391, "uuid": "e718f77f-25de-42fa-b790-9c6e26feb87a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707514391, "uuid": "7a2e050c-c8f2-4d42-9dcf-5a8064d52a6a", "value": "3072:AxydbqayiqP0KJEfC+w99dTHo9rG8KaG5jnTqtSjufzz:1xqayiq8T0lsq8KaWT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707514391, "uuid": "c7c8f7b2-650a-4257-8679-7cfe81512ebd", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707514391, "uuid": "ee98559d-1928-4a17-a7fd-3be8c6b634b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707514391, "uuid": "a93a2a86-21b5-44f2-824a-93123de2f17e", "value": "something.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0ba252-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707493389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493389, "uuid": "c81c321f-8a26-4116-be5d-fb08cc22a15c", "comment": "Malware payload", "value": "e916ed5d32a73416c25784e9f9f60c59", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493389, "uuid": "cd9d9cec-980b-436d-b255-e646545dd69d", "comment": "Malware payload", "value": "280a0898b89da36ad47b73f46244acd090a685e9df96c3419cc70423774f4874", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493389, "uuid": "6d974fec-3435-442c-8784-96d3966a779c", "comment": "Malware payload", "value": "de65f442f09721e5a00fe3a94ae8659b04800a7a", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493389, "uuid": "dc837009-26db-4a35-bd4e-6d0c0f8e93fc", "comment": "Malware payload", "value": "4aff392b46633db9b30a1dbf3c00e93f3730aaf1aacdb2b080701f95dcd3893d94b07ee85918cfbdf9cacf1efd586308", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493389, "uuid": "8e28ccea-e50a-41ad-86c8-bb5df8ef1c09", "value": "T16B13D02CCE998E14DA1F50759C1FB5A543D6A9938281EF470E2DD2CB1589CD0133BEAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493389, "uuid": "0f8ad200-3a14-4e43-b7fe-7d87adea25f1", "value": "768:iHvAI+Evwssn66KkefGBIJYfTH+niSpMvDHfTv+nWvFFiKk/fJqt7jd7Rn+nwdtH:6vAEvwT66KnfGG1BsTfTv+oFFi3/Rq1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493389, "uuid": "28f90831-591c-4bdc-8ff7-a6a5e45a7bf3", "value": 43198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493389, "uuid": "46869c2d-c175-4b53-bcad-f7dbfb94861f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493389, "uuid": "ee48a18d-9419-4ddd-ac76-1e9eb997a34f", "value": "New Order________xls.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7be298-c717-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RaspberryRobin)", "timestamp": 1707461389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707461389, "uuid": "86c04f65-4b7a-42d6-a381-fa579628732f", "comment": "Malware payload (RaspberryRobin)", "value": "47c7dfccd255731047813c9cf85aceca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707461389, "uuid": "e91059e7-51fe-498d-a8e3-168d10d31dda", "comment": "Malware payload (RaspberryRobin)", "value": "283efbdf352b2fec3d5dbcad0df4786c7c640d9e821a11f8fe0baeac1516bc51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707461389, "uuid": "cc99e904-b565-4792-909f-04842111046a", "comment": "Malware payload (RaspberryRobin)", "value": "e99f3d7b48ff50d33e2870e7d185c1ac58fe0d06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707461389, "uuid": "3915742e-2024-4123-b495-5a07178f47ef", "comment": "Malware payload (RaspberryRobin)", "value": "5df17f588ae3d5890e4397fb2d1881f71dc4fb6792e7d33160cdfd902b0dbfa21605fa4b598ffc6b9f5211883b63a94f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707461389, "uuid": "5831c94f-716d-4118-93a8-f989e6b19a28", "value": "T1AD95231237C58032DAB31A33186187A29A3CBC61CFA64ED757E53D5EDFB11C1AA24793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707461389, "uuid": "2eb93fab-b024-4d5d-98a2-b4aaedb36c8e", "value": "10b73c5f7fc148e21f974da703236659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707461389, "uuid": "63e90ea1-77ee-4a78-98c3-11692eb2cc0e", "value": "49152:anGImUwXQHz36XgAO8sBI216CnVQ4wrc91MDHic:aGI2QT3Goa216B4wHCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707461389, "uuid": "05afdaab-2029-4e7c-a782-2b2fde97b726", "value": 2042083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707461389, "uuid": "81e81fac-4c9c-4f25-901f-8891e9d018ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707461389, "uuid": "7f3b1142-5d6d-40c8-9ccb-68fac5b18afd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2e51d3-c797-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707516478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707516478, "uuid": "9ec1ad04-7779-423c-b40e-234b2ff90753", "comment": "Malware payload (AgentTesla)", "value": "7b156291980ef5e7a822c9ff7761d3f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707516478, "uuid": "87bd1e5e-4cb3-44cf-a743-8136e5f144f2", "comment": "Malware payload (AgentTesla)", "value": "28d228cb0df8288481652b963c82276224a94fc8774c8092faff73ec2791caa8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707516478, "uuid": "c9edd218-2bad-405e-9fd1-503ceae25a3b", "comment": "Malware payload (AgentTesla)", "value": "7b769b0b047b9abfa9b16bfd0d6d6aff871bccdc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707516478, "uuid": "5966d774-acf3-48ab-b2f4-c6988fce30b4", "comment": "Malware payload (AgentTesla)", "value": "f418794317779647fb53940b619bff25d5d476667a97b2aff9e965abde8e09091279fe3b6e71bf83213f3c5b8a910151", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707516478, "uuid": "1a4edb9f-4df4-45aa-996d-159b461a2ed2", "value": "T153D422486294BE27C5AD6DF65860105213B6A4EA3793F7C56CCBB2D33AD37C14F086A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707516478, "uuid": "00ba6b5d-a065-4c98-9d23-31adcf48f423", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707516478, "uuid": "82a79dca-b9ae-47a4-8408-adec6e21c147", "value": "12288:GJjxLvnA7wQ4XVbJDfZYIGAaesHed4+D8ULOzEhxm2Stl1TsN7I90OQIJy:ox7nA7zCryIGAZs8D8Tghxm3CN7c0OBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707516478, "uuid": "6125fb36-6308-411e-ae56-ffe6273c2464", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707516478, "uuid": "db04d620-652f-4757-ba38-d2a1fa9a9068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707516478, "uuid": "c79ea0b5-47d3-43e3-aa34-7a601760bc29", "value": "rDocumento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc777d80-c754-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707487751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487751, "uuid": "98ab8c82-9815-4b95-a180-501c6c1426b3", "comment": "Malware payload (Mirai)", "value": "8adf3427f0127ef9ebaa37209e90d672", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487751, "uuid": "367768f4-17f9-4142-92a1-1cdc9916fa8e", "comment": "Malware payload (Mirai)", "value": "28dbb9ed76bcae53a0af5cd1947690a058ff14a5f147e0ed65bdd9c2e5a5ef3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487751, "uuid": "c280365d-9d0e-4008-b29d-545843584422", "comment": "Malware payload (Mirai)", "value": "08894ebaa5a642004f84a8848b41e4fe21b858b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487751, "uuid": "02e8f328-17af-4573-83e4-43429621096c", "comment": "Malware payload (Mirai)", "value": "d931e4f57067a2fd19c63c6fc737d332f03adbd6e6937bd390a991c33052368104cdb5548a516a50bd84fda9a09af790", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487751, "uuid": "69b69c77-39e9-4a6a-97a1-eb752a855b97", "value": "T131C2E030A7ED1CB1C7210572E7B856C9BE574FBDEAFB3890114087BA784290569DA8C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487751, "uuid": "8e482fa1-a6e7-4f4f-a0a8-6c93c3dff6f5", "value": "384:Aot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE6kwhymdGUop5hAL:A8soTAZ3alkXLvFh8nNEss3UozSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707487751, "uuid": "8983cee0-0b7c-4eb8-95bd-134f226c814f", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707487751, "uuid": "87428f48-d5ea-4a69-b30e-dbd10db4e733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487751, "uuid": "fe3c8f17-4b34-46b2-8ef3-88770d4df77e", "value": "8adf3427f0127ef9ebaa37209e90d672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a0ee09-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707493395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493395, "uuid": "835a5b49-ed88-495b-90ee-bfb1905e77b1", "comment": "Malware payload", "value": "b34b73d17dfad8282855f675fcf0b33a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493395, "uuid": "ebcd129c-57be-4fa2-a055-c3d6931b3ebf", "comment": "Malware payload", "value": "29b264e726c384dcd17c03b64e86a741d35254ae29fecc1c5db9fd4131cc4b4c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493395, "uuid": "93f5b64d-ae7e-4215-86a3-b29f12db245e", "comment": "Malware payload", "value": "d0feb59a9c5ff23c7b66a595d80accba2e258990", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493395, "uuid": "2864c625-d706-4260-bf61-ff9fca87a74c", "comment": "Malware payload", "value": "c68106c97f858b07d3be9d6d0a0ea9ca70bea6177d59a952af56210a9fa207bcbee962b1d54fc4db7422bb94fe3f63a1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493395, "uuid": "c2ef8f28-fca1-4b8f-b411-636188525343", "value": "T1E325AFF875047DE6667F526BDA96ADDC13B626638ACBA4CC80647BC305A3335FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493395, "uuid": "6e9fc916-56c0-4abf-9932-0c882fae770c", "value": "24576:VvmFZqk4OnAZn5UK+8YAyvwd4QvUVSVtxxpYEz3X5vlNUtqSE+FYJDPaK:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493395, "uuid": "1cc27d9f-9ac2-475d-9707-59d2bcae1d06", "value": 1035844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493395, "uuid": "eb063e80-ae73-43d0-ac25-d4559291f643", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493395, "uuid": "8680a17b-1d52-419f-8ebc-1a4ac18c873e", "value": "Quotation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb0c51f-c75f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707492234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492234, "uuid": "af186e57-31b4-4a8b-a9df-61c4bc55181a", "comment": "Malware payload (RiseProStealer)", "value": "22bcdfc5882494840b272828fe2267e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492234, "uuid": "699cd6ef-f2a9-4d65-8273-e812337227b1", "comment": "Malware payload (RiseProStealer)", "value": "29f973eb617a2d99d19379f7045fb468ae275dcc82e07fbef840483a65c3bc9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492234, "uuid": "5436b703-482b-4d8a-a882-1e848006097e", "comment": "Malware payload (RiseProStealer)", "value": "6f24b49c7e1d9b1d9bc34bccb121584517a1d8d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492234, "uuid": "c2d57fbd-3eac-4307-8477-377afb351259", "comment": "Malware payload (RiseProStealer)", "value": "d69ea2d3441db06656c655ddab2913853f81fe340f28313b8c712a0acc08e9e65ee5e1b571e5e3947166841b7f61c21e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492234, "uuid": "fc4ca69e-4911-4af7-a941-13bd1f81c515", "value": "T1136623441BD9A099EC46BCF4C6A5F96FB2E53A340138C47C69A156CF9EBED1CA333085", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492234, "uuid": "c5fcc4ca-4b9b-40b7-a67c-95bf0b9eb1e9", "value": "46afc61b34fb8e20ac7399f0df86ba31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492234, "uuid": "5cacbcfd-ad68-4f3c-8f16-55f691d3aef4", "value": "98304:2bi5mYCbAjvjEWWdhtpl0cNRkyvPUJSxG81rXLUiG6p+WYpQvWHK8i//J62EjJ3i:mOwATsh4M8JSxG2LhG6cgYKz/M2EUjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707492234, "uuid": "38a96b8d-10df-4492-be72-ec84ca8279b5", "value": 6520400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707492234, "uuid": "086bb362-6643-41ff-b7dd-566548bb2ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492234, "uuid": "d49fee90-79dc-4003-bff4-a02f726572b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10379bee-c732-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1707472832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707472832, "uuid": "fe14af3e-7b62-4c31-a139-3418fad39440", "comment": "Malware payload (PureLogStealer)", "value": "f060e1a84b603969a72493cce47d1bfc", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707472832, "uuid": "9f5c8e1f-ce9b-4083-9a1b-0d4ae5de3d86", "comment": "Malware payload (PureLogStealer)", "value": "2c37a930ad046882f536891357b66e9f548b94f6186902241c764afa308b3752", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707472832, "uuid": "f0603259-24e3-4d67-a76e-5ef9b233ccf3", "comment": "Malware payload (PureLogStealer)", "value": "13ff6a2700c35d08da68020d121f6910f7eb3a39", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707472832, "uuid": "c1e69cf4-ea43-4367-a212-3a819b8208c4", "comment": "Malware payload (PureLogStealer)", "value": "d3009c0f62133ebdd58a9a7bfc9becb3fae2bb1ffae38b5bdb2b9a1fd906270e0f29cba23bac193ce600ef8b41446414", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707472832, "uuid": "5e935cb1-938e-47bf-864c-eafdc15e359c", "value": "T126B312D125F51692FBDC027262D695B506D062E2CFEBE8256CB12E0C70771389B7CD8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707472832, "uuid": "0f343602-80b2-4a66-948e-b103edc7f7ba", "value": "3072:VK3esH2WVi/OI2+k+gmNqSiloeBZr3Nuf3fD:E3ee1I2+ICe330fD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707472832, "uuid": "9f48b73c-f57c-44c2-9913-042ed03853be", "value": 113218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707472832, "uuid": "e3a7a531-3e79-4edf-a912-7ea136c30350", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707472832, "uuid": "0629f609-0b96-4d2a-a840-a8096290db18", "value": "swjft_3891SHYRD 27691A DO30A2L A27104Y AH38S9D DHY683D H7202848Q0 DH6413.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ccce336-c76d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707498194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707498194, "uuid": "e77c9ccc-d8bb-4e46-9246-7f141f8672ca", "comment": "Malware payload (RedLineStealer)", "value": "cb8f88cab9ae04a52314cbfb8f2dfd54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707498194, "uuid": "586e9dfd-645f-4655-a676-7fcdb826b648", "comment": "Malware payload (RedLineStealer)", "value": "32a5f3c77b99a25d50fb9ac08dd213d7c2f1dfa1102c807f5884865da1a2a3ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707498194, "uuid": "7c63c6a6-6422-4786-8c85-7a7655c29737", "comment": "Malware payload (RedLineStealer)", "value": "f85688ab1b6277943c42d310b4f484cfcdf651b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707498194, "uuid": "5b76b053-b592-4328-b3a3-75e344116367", "comment": "Malware payload (RedLineStealer)", "value": "737b0feb34d516e56c3637d8d43305a04a9cdf7694f69c39843c636fc3102521ca94684d5bdf13b8b62c7775f3109a52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707498194, "uuid": "ef42311b-ac2a-4bab-8ff6-2f2796deba50", "value": "T1DEF4121834C1C5B2D4BB053044E5CF3ACE3970229B799AE7BBED67A69E113D163391C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707498194, "uuid": "5676515b-b47c-4dff-9a64-a3b36089933b", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707498194, "uuid": "82790225-acaa-4f79-aa2c-23b435d2c5f4", "value": "12288:Oh1Fk70TnvjcPMEo3CjRJEhBw9qX9ouU/tmxHs+EkpXIzu1PaEaqGU9US6gGLkvB:4k70TrcPMEoyzAEqXOuoYxOAd1PaEaqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707498194, "uuid": "96e1f0d5-4ab0-440b-87a9-6e39186538c1", "value": 766944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707498194, "uuid": "c8c44a5a-d6ca-419c-9f16-fcd3ec4ff16c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707498194, "uuid": "69cce16d-c825-478c-b8b5-d5b1da12a129", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86fd458-c724-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707467155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707467155, "uuid": "d0d0b159-138c-43ef-9c7e-302eddab5936", "comment": "Malware payload", "value": "16175d176fc8515c4bdd5778a934c33b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707467155, "uuid": "f9f25d95-6972-40f5-934f-a4f6a3c9ff82", "comment": "Malware payload", "value": "3440b4fc74f51d5104deb38924ec821f7f7b8ecd585667f84d4743dd305eb2ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707467155, "uuid": "4bdd3850-bf23-4027-9be8-3947df549642", "comment": "Malware payload", "value": "94a542680d9de2726a2d4ecbeced79233d4e7739", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707467155, "uuid": "5061c6dd-cf6a-4490-a010-26b5ae6504a5", "comment": "Malware payload", "value": "2121f285475dcf58ed128f270abb0953f91316243e46ebfc34bd9d72d5ce6a0c774621118c9d062ea760bac821279091", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707467155, "uuid": "157d237d-50c9-4565-8470-323bfaa64996", "value": "T12DC2958FF7439473C55852347CEBCA6474B3D4B86B159B4311AF926918C22CC9FAEA0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707467155, "uuid": "542e0f4f-a431-44e8-85a4-fe38e933a7ff", "value": "192:GKjFowqQFLcXzH3XMMCkTvR1tYN/5FCIflKIzhzhzhzhz4zIzhzhzhz2qExEFEFF:LkQFAE7II1111E8111aqWaaax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707467155, "uuid": "7cb69a71-0ae1-4b42-9fec-f69f1888be96", "value": 27512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707467155, "uuid": "20085cbf-e2c6-416a-815b-6859d67923c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707467155, "uuid": "7fcceeb7-b0d4-457b-a9e7-cb9e46206aed", "value": "recovery", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ee78ac-c754-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707487505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487505, "uuid": "0469a9a5-85f3-4f1a-b54d-b6056a244b8a", "comment": "Malware payload (RemcosRAT)", "value": "1291a06a395fb852059a6ceb0e3eeb26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487505, "uuid": "c9054353-6227-44d8-bbde-adf140d84ca8", "comment": "Malware payload (RemcosRAT)", "value": "344301a6f73b73afd98c763519d52548b0ee3a76824d033712ddf3ec0115f549", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487505, "uuid": "80f38c20-210c-40cb-a203-649c4dbb442e", "comment": "Malware payload (RemcosRAT)", "value": "d2817ad9ae07ebac664f4ecc73094847266592fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487505, "uuid": "927fa007-c833-42fa-9a2c-a9a266c90a38", "comment": "Malware payload (RemcosRAT)", "value": "c9f02e5db0e7868062353f619276509613a95ff1dda336f9185facddb0384d20ec0f7e6d395b734e23c01c84cd7c87c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487505, "uuid": "75148bd7-c580-4a44-b9f7-bf2d9c79fd0e", "value": "T18D25232273B5B36BC6AD0BB546B85981B33564093BDAE72E6C88A0CC0D73B45DF11727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487505, "uuid": "2c49cdf0-d14a-4afd-85aa-0eea4d2c61a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487505, "uuid": "f971b97c-f55f-4cee-a3e7-290e662700f8", "value": "24576:b1Dxc69WYtZlNj16hhTaQabNSXgOf5clRreL9f73Sz:b9xxrjshhTa1NOslRreL9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707487505, "uuid": "8637c984-13fb-4a38-b237-5f9c92ee00b5", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707487505, "uuid": "05cd37a4-694d-41c5-8210-8cd4230b1c0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487505, "uuid": "333025e8-2d00-415b-9b2e-82bc7e3572f2", "value": "PRODUCT LIST-CALAMARI9804870.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd576547-c760-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707492933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492933, "uuid": "ef47d4f9-e112-4985-a119-b9095d6a3b72", "comment": "Malware payload", "value": "765dbefb236af203d8a123e85a4fe393", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492933, "uuid": "70533476-8b8f-44ea-9be0-400bf171397a", "comment": "Malware payload", "value": "35b8dc2b62942cdb09f89fae3799fb25f6e670982cf04b57bc9bc456af2881ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492933, "uuid": "af9812ed-0ad7-4bf7-8e55-3147b8510fc3", "comment": "Malware payload", "value": "23457e69be38cd2f4bb22740fc6e87de10705e63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492933, "uuid": "591cb994-b515-4e6d-88a8-0776c8457aff", "comment": "Malware payload", "value": "aa789ccb10a9c6d0288a2a5c8935c29d294a43a3e9edf919a7fd6343dd43b9011ab80e1096732b24db2d7529ab6f3cd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492933, "uuid": "e20f1031-4c85-409a-a821-0bd839d8a7d7", "value": "T15BE533F8E6A29031F96365B20574E3A17A3F382129E2C41F3628366E4E70795671D73F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492933, "uuid": "df61b9a1-331e-43ff-951d-67c465b4f7e0", "value": "41a023181e1b42ebf113f2f55f4ea949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492933, "uuid": "1400448b-d7f8-4565-a629-cd1ef3f4d04e", "value": "98304:jRiQz4pOTp5RuYeRwwvRUg7+PENlNTPnh:diK4pOd5RuYeRzvxCPENlNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707492933, "uuid": "3d2d12e7-0bb0-4e5e-a984-0d642cb154dc", "value": 3318784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707492933, "uuid": "8f495099-eca0-4eee-ba96-449ce206fc58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492933, "uuid": "bc7eecfa-4f4d-45c9-859b-e92148bd36b6", "value": "765dbefb236af203d8a123e85a4fe393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334410de-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707493078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493078, "uuid": "acb480c5-f05e-454e-85fa-3dd53c096d47", "comment": "Malware payload (AgentTesla)", "value": "2dbcba6a2a6605f66ccad571c2a786fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493078, "uuid": "d28ef2e4-8f8d-4cf5-b194-7a6d8ac533bc", "comment": "Malware payload (AgentTesla)", "value": "36e1eb3c6ad20066059f186f76e048e2a24ef2db69216a0eef6d16f3f439ed6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493078, "uuid": "a7d3ecd6-ae42-41b9-a77d-d3f0f51b34e2", "comment": "Malware payload (AgentTesla)", "value": "04f363f70567839cf1cf0bc64b8aa54ee94acca7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493078, "uuid": "4f9d2229-e216-42c1-b8e5-1b2a74b84c6a", "comment": "Malware payload (AgentTesla)", "value": "e4b78e471d5999a03e33b891bb2a6a032bcff1ba804b935534484817250af48064ab9b7c909e50d45fb21789381c736d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493078, "uuid": "828d84ae-c4eb-4734-b17d-ce719d748379", "value": "T13F7412B4B6A2DA6BF403657D4CD891C31229FD51CFD1E5073244BB1D28BCB829B16AE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493078, "uuid": "92de7584-2df4-45c0-81ab-c685c0f4fec1", "value": "6144:/ThunGZP8VNe986NCLXQ6ay9M0OkDjfJK5RPL9duP+zcwQhpT7kT0fjZ:/Tkg8VM986NCLg/Mak3xiRT9cWzcP3jZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493078, "uuid": "28d8446f-e07c-4a1f-8bef-d3e781a598f7", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493078, "uuid": "c8dabf70-869f-4446-ac2b-e856da36c0f9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493078, "uuid": "2c6f6685-c1e0-446b-b6de-9c7481262456", "value": "Application copy.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95113fdf-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707488088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488088, "uuid": "046e95e7-1677-4071-9d7b-c72b52f12e30", "comment": "Malware payload (Mirai)", "value": "64d4bca5cfd98d5410025bb893ff1a79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488088, "uuid": "29a9b5dc-52e9-411a-b9de-994fa9d99ec8", "comment": "Malware payload (Mirai)", "value": "37c16e528bfd6504ccdfc9338a94c733e20924f69af3624b616ec9695aa47b6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488088, "uuid": "b2d48262-071e-4923-a8ed-e3062b4ef62a", "comment": "Malware payload (Mirai)", "value": "6e33c5ed144a0944a2915effadc5ebdba2cafb4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488088, "uuid": "91b33054-3d85-4ac5-b47a-3a0b2332aacc", "comment": "Malware payload (Mirai)", "value": "a331eecb83768b6b830b38d624fa4abd8fe12efe46c078375f90d82a91f4f5239c82bbc8eaa8ba4f351f4b5f731d2999", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488088, "uuid": "67c4e177-2b0e-4cc1-8938-ffc41a46798e", "value": "T18B33F2625BAD29E291B05377BC33EC1A969C17B85D6B30D72CF05A1577C48024FF2686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488088, "uuid": "71efa120-4bf2-4118-9244-07c5b59538d0", "value": "1536:69O/ZMAXIxNUk04LcPqF1aBexo4opKZbf:69O/ZNKykLGqFUFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488088, "uuid": "c22adb18-4d1f-41b5-93c6-f81b0dae2444", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488088, "uuid": "593b631a-0a4e-4e33-8c16-f4e1462c6f9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488088, "uuid": "547252b1-6ab4-4d04-8cc4-7cfd3b3df929", "value": "64d4bca5cfd98d5410025bb893ff1a79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9087a626-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707488080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488080, "uuid": "9509d7e6-451f-4f99-87a2-f99607e7d0c4", "comment": "Malware payload (Mirai)", "value": "73d5ee30df807d55de0af251958fab27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488080, "uuid": "9420a8c2-22b1-4716-b4dd-e185c0f7c096", "comment": "Malware payload (Mirai)", "value": "3864b226c51ac8ea88b7e2c288b651483fc356e0615826213ee81fb3769421f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488080, "uuid": "20453d5c-7cc5-4647-b7c7-4e94577a1143", "comment": "Malware payload (Mirai)", "value": "f773828a99debdd03c4b27c51f35ae79e8b87a05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488080, "uuid": "f300054f-118f-4a43-ac19-9fab940e6402", "comment": "Malware payload (Mirai)", "value": "2a1789c05c5b793d1a6e6c392af552cf3f2533c71b3c678131a1f3529724e21d69b68230a22bce817ac0f40c0afb0cb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488080, "uuid": "03b6b85d-e085-4590-8dd2-1f8c16a8ce60", "value": "T169539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488080, "uuid": "066ad449-1d3e-467d-9839-22bea6689b4f", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488080, "uuid": "39fa83c6-1230-4f42-8c6a-3bb8283cc197", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488080, "uuid": "dd7d8e2c-6e34-49ce-93ef-ad46d53e0385", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488080, "uuid": "086bb0bf-33b7-4912-904a-694aced80f30", "value": "73d5ee30df807d55de0af251958fab27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c658d779-c754-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707487741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487741, "uuid": "b9f9b0e1-aabb-479f-b4e3-9f27918a90d4", "comment": "Malware payload (Mirai)", "value": "56c3fc45ccdb3f7c72d7061fddb13b6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487741, "uuid": "427cc55d-ad24-49f7-b907-24fbc3abda79", "comment": "Malware payload (Mirai)", "value": "3b7c1e492ed9ab094b7379893f06d21945110335f9b2264dc3aec724033889fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487741, "uuid": "3d3a529b-2729-4b71-a74b-34a50a6b7780", "comment": "Malware payload (Mirai)", "value": "c899e4985e1bfeae6d7df1b7d5bfd0bcdb73e37f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487741, "uuid": "ba062aae-1559-40b7-a55c-c08bb994d23f", "comment": "Malware payload (Mirai)", "value": "dba0343dac587c7373f3a88ade64d81f6d84f9dd3ab9603959795419cf1706f0021111e92dd516519d0d7a9b3ae43620", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487741, "uuid": "3167b67b-a86a-4d36-9621-366847b40d1c", "value": "T13C13F884B9819A16C6D0237BFA0E83DD372A73DCE2DD7313DD156F52378A92B0A6B041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487741, "uuid": "873b3bd3-20f7-4be3-8256-4afceed0da27", "value": "768:VCCXHYzP305oYoa7osEobmotqIHZJgvaFYL924cBS/djYlUWfC:4CXwzEZxmiPgvtNQIdsmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707487741, "uuid": "7709bae7-366c-491e-baba-1665a273201f", "value": 44196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707487741, "uuid": "9d52acf9-63e5-4a85-9b0e-b92589d438b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487741, "uuid": "afc503b8-14df-4c0e-8e74-fc3effda81e6", "value": "56c3fc45ccdb3f7c72d7061fddb13b6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c1951f-c754-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707487497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487497, "uuid": "e3c831fb-0cac-4525-8e9c-8db2c017053d", "comment": "Malware payload (RemcosRAT)", "value": "2ac809d63f4c998d856ac2ee168571c9", "object_relation": "md5", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487497, "uuid": "0a27afce-7bb8-4fac-89bd-a301444d3f24", "comment": "Malware payload (RemcosRAT)", "value": "3c39ad7a4b905753bf61192905544679c8ca2d645358c87d51ae290cbcd8f46c", "object_relation": "sha256", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487497, "uuid": "d1c07299-7c32-4428-ac89-603bc9c62fff", "comment": "Malware payload (RemcosRAT)", "value": "795778db6c31c29768dc9f0c576cc1ab3a62e259", "object_relation": "sha1", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487497, "uuid": "f044ebf5-5d3b-4fd9-ac33-774b4e6b52ec", "comment": "Malware payload (RemcosRAT)", "value": "7969ad87811cd3e6f84535aeab95147a5dd8b015ca8d756307603696714a245abce74e26fc64c1d1e7282ac72602e898", "object_relation": "sha3-384", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487497, "uuid": "624a7680-5807-4656-869f-df867175b7a0", "value": "T1FB1533918848D4A7CA90673514C2D2B19FC3622E3F16FD9FA0D776A14FD38BE042B65D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487497, "uuid": "8340e3a6-f5c4-4a12-beec-4d8fcea7aa83", "value": "24576:kLirJIb+nRomhgAt0lvLjmQEhAYj0E/NiI1z7ge:cwJIbWZgAtkLjmQEhn0YkMzEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707487497, "uuid": "176feabf-611c-49ea-bcb8-9a75f882d7d6", "value": 951873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707487497, "uuid": "9bf9ed3e-aa0f-4ff5-b5f4-6468bc5c0497", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487497, "uuid": "a5c7c1d7-6518-46de-9f5d-f3c29dbeeb01", "value": "PRODUCT LIST-CALAMARI9804870.R01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d443206-c6df-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707437260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707437260, "uuid": "0329942c-8ef7-46f4-8bf8-d946a6c64b38", "comment": "Malware payload", "value": "4b4c1d7ba897856c66ec46fb531d1035", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707437260, "uuid": "4108dd44-e4c9-4850-81b0-3b077052e990", "comment": "Malware payload", "value": "40e0623f9aa9dbf20563c3788e104806f07b913c9f61b0791fb5106e37d0cb46", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707437260, "uuid": "40c1d3ed-d287-4901-91c4-ad75eba7682a", "comment": "Malware payload", "value": "5bac9895c08835ebd8ffca705012080e8b9d1be3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707437260, "uuid": "a86b3fb2-a199-491f-94df-9fb78f9b38ee", "comment": "Malware payload", "value": "a554e46cd3b5916dbae98a8c2a02e58ff22674e13af1ab700c98b4d606557f7d325515a6ef08bd2f54efdab358b37ad9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707437260, "uuid": "8bd4208a-41a3-49a9-857d-59536547a292", "value": "T10913D01B9524597FE43850B131EA38022908B676899014195FC27E7DB6FFB90293FB7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707437260, "uuid": "0b4a06ed-831e-4701-8e63-ba33c7709a8b", "value": "768:YNbvbVkumWYEIkGs24tsOuha/whIdxYsmaGD2ULb0fla:YlDWW/IkGw5udCdtQLb09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707437260, "uuid": "083a3c35-6c3a-4638-bbe0-51bc3a08f22a", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707437260, "uuid": "89493124-e1a5-4fb5-ae31-aaeb1a999a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707437260, "uuid": "9fcb8ddc-96cb-4110-a314-fdfa5ba171b4", "value": "b55b2c5e4231ca2d7a08de7e7716b6eb4d840540fd1509bfe7d225a690bf9d23_sc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d90465-c747-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707482027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707482027, "uuid": "cc944ba1-c95c-4bc6-a70f-15a0cd3cd5df", "comment": "Malware payload", "value": "bb0048ae1d3e43380a4d9a0a7571913f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "libcurl", "colour": "#968013", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707482027, "uuid": "5dfda3fc-c9d2-4499-9988-7b26c5c5653e", "comment": "Malware payload", "value": "4250dce6d835682cbb05a07dd5d7b201e2e6ebe6270fa130e978716abfd2801f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "libcurl", "colour": "#968013", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707482027, "uuid": "0faa8dc3-6ca7-450b-adaa-ad1c9196ad13", "comment": "Malware payload", "value": "2351637ff345ebf901cf36ecb62cfcb6579a2f72", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "libcurl", "colour": "#968013", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707482027, "uuid": "a0cac2a8-5124-4a58-9c90-5774df32fe5d", "comment": "Malware payload", "value": "90c5355af2b5a41f25b9f312f2d1b6d455557b0dd4347d1024ec5580bbef93e6235bdeb9eb961b0970805d8250930476", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "libcurl", "colour": "#968013", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707482027, "uuid": "4e5d71d1-75fe-4e1d-b809-a78541ac731e", "value": "T1F245029ED8033F45D325D86B1A8E95243DEB01BF5ED2AF13712A79939FC0989703A44B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707482027, "uuid": "b6d78136-3bc7-482a-9c83-cb94f73940c6", "value": "24576:Y9bRJGqD0XHjZ1jh82lzmHhi61Lr+KB1Rg+daPr0Rw:Y/JGeADZY2R6dpXdGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707482027, "uuid": "bcd8f4e4-b835-4728-baad-bc7be8e4fca1", "value": 1223436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707482027, "uuid": "f50bbd70-04e8-4ae3-a977-a543ded28da1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707482027, "uuid": "b89a652c-faba-4b44-bcb5-bf77addc55bb", "value": "libcurl.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d7cb7d-c7a7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707523093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707523093, "uuid": "c208fab3-f339-4d2b-9a97-8b5d686c5e58", "comment": "Malware payload", "value": "4eecd4fcea4e52761d1b5b266e28b4ba", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707523093, "uuid": "008101fc-c898-4c6f-ab4f-acecfd8eba31", "comment": "Malware payload", "value": "436a1fded3f33bd7dcf50a3d8a1a7e737cc87ed11afc1df8850e3ad0d2b2aa08", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707523093, "uuid": "de334a75-ffb4-4a3b-88ab-b9cb344f9d6f", "comment": "Malware payload", "value": "184242ac1b50d0daa58be19531ac25af20acf3c3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707523093, "uuid": "e99c925f-b95a-44be-a474-63c1ad5ec895", "comment": "Malware payload", "value": "6cf6b557b4c54348d100d1668e1021d09f925ce76a9c209cd41d79f9ec11a3cf71f329c3465d9a39bee6c6aab8ef3499", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707523093, "uuid": "868e7466-fc9b-4314-8367-a66b93ca4279", "value": "T16A92E17D6B7FC32D3586BBD022A417985220BD8817206D3A6ED4D8D7B658B610CF31DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707523093, "uuid": "a02cb4ae-7b86-4f20-a4cc-f4b28c04290c", "value": "384:rqsWZ9JZ30sa9LmElzmEd9OAibg0y4T0AN18Sn8Gm22ZmvBK5p7oVc81rmTVnf2e:msenZ3070EXVcjygjX3BjJVhizd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707523093, "uuid": "df4c3180-8be9-4d4a-9b34-d5ed4566f5d4", "value": 20861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707523093, "uuid": "d0cbed53-0316-48be-9c15-1a73a94193b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707523093, "uuid": "f3479c28-4218-49be-ad15-32a64d1db906", "value": "FDA-0986789009008.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c271904a-c72c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707470554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470554, "uuid": "de6d8010-16d7-48c3-bb2d-7989fe0c614d", "comment": "Malware payload (Formbook)", "value": "02c357ece4ba299dada28f0d6e3b7a53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470554, "uuid": "cc7ecefb-fda8-4ec9-903f-667769d98788", "comment": "Malware payload (Formbook)", "value": "4603736b5846316729db29c6335b177210b8eb9c487624a1d1381a99db690203", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470554, "uuid": "2f53c16b-7e4c-4ac0-917a-9ea3e8566a0e", "comment": "Malware payload (Formbook)", "value": "86a975a3da3421cb7a7bde85e15998292a13a471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470554, "uuid": "ddaa5900-020a-43c6-bec9-993f1555262b", "comment": "Malware payload (Formbook)", "value": "4f9767c57f047cce7daf856f799f3d7bfe68138adab75657db50e8d08aba9270f5247b7694f9cfcd4a94ce7091ae8417", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470554, "uuid": "cdc81df1-b720-4cc5-8ee3-4ac104f811d3", "value": "T1D34512C977D4C4A0E95F147C39B65C2D02AB3D66DECDA801B44A7B1D84F3982A83F19B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470554, "uuid": "eb2b22f2-4a39-4b95-a8f8-1b058167bb85", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470554, "uuid": "ad146936-69e4-4108-b0f2-225241858852", "value": "24576:/UjH+ezsOOT3NmZp0d/KWpBrnU/OjuzjWDJ+Ak+QhLfFJt:MjHBOT9m70E8BzUAuzi5k9Ljt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707470554, "uuid": "df804595-5f77-45be-8b90-f38885b9c529", "value": 1214560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707470554, "uuid": "5df0e9d4-5313-4f1a-bde8-ca71ac024ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470554, "uuid": "13b18cf7-bd81-4682-9c84-26239b17562d", "value": "10026+sparespdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acff0642-c70a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707455916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455916, "uuid": "3b0c44df-6096-48fd-afe9-93d99cd711c6", "comment": "Malware payload", "value": "e93fe90df7de0359422d7c602440c378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455916, "uuid": "688e8b7b-7ce8-48b8-9e7a-a9302a8bd556", "comment": "Malware payload", "value": "463b4f64306ca3cc850bf4e05816a80e38f49ec02495e55126dd7b1a76458621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455916, "uuid": "06a03af9-938a-4dfc-9c17-b02b585ba692", "comment": "Malware payload", "value": "67e915ae95894730725a0bb16ca5a0bfd06bfd56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455916, "uuid": "67cec8e6-e760-4b31-b2df-70e16f3a1a0f", "comment": "Malware payload", "value": "412f63db4988f2b79f67ff5ea0f87aac66d0433d16767eff3d497e8ff7309367bb08096d78cb7f729838a9c8dc161212", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455916, "uuid": "e0218c0f-12bb-4c4d-8937-a5baea5ee251", "value": "T1CCE2298571E685F0E523F131EE313A2BF4B53CD4875985EA0BF48CA48FB223155CBA96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455916, "uuid": "f098fd78-227c-4d73-8ec9-b3db6015ea7d", "value": "62fb25b9588e9fc9e2dc3a7779a9a3e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455916, "uuid": "c184ffe5-da6b-4856-b89d-6429e36a1ade", "value": "768:gRCxJci+w6k+danEf1SGpv7LHGo/C0ZgWW26W6u0:UCCLunAmh2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707455916, "uuid": "2864a5f0-7801-46ba-94db-64de4edd33a6", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707455916, "uuid": "c054250c-41db-4b4e-8eb8-463438abbc46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455916, "uuid": "41f397b6-ce21-47d1-b9f9-76068314a096", "value": "SecuriteInfo.com.Trojan.GenericKD.71545003.629.4420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adad07a0-c70a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707455917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455917, "uuid": "143fb4e9-0185-42fe-8489-e748c06ce9f6", "comment": "Malware payload (AgentTesla)", "value": "c785c006864dfb2722e38ba10a323e70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455917, "uuid": "cc33c2b7-bb9c-4ccf-b50a-48dc928930f5", "comment": "Malware payload (AgentTesla)", "value": "46af3345cf41ac579b9556b69437601ca34f5cbff48fa3b65b5066105aefe99b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455917, "uuid": "ed26c6b1-ad84-457e-b6b8-1782dba15bbc", "comment": "Malware payload (AgentTesla)", "value": "540929282b50b5445128adb2d379634e46343ace", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455917, "uuid": "e25a453a-2adb-4713-8026-37fba5a83e97", "comment": "Malware payload (AgentTesla)", "value": "1f03a6262891bd61dd518b55af2e2017eaa2baf1eb54a81184eeac1a067ebf116938a8d870e7faec6894120a493ec974", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455917, "uuid": "bd13b88a-2cfc-4ee2-8dbb-d74ca9594696", "value": "T11DD423523E393322D5B643F57834C0100776616B35D8DAE85EEFA2E31A73BE98241DA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455917, "uuid": "cb8e9528-0ba5-4b65-80c3-84e1c0e3fa58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455917, "uuid": "5216c5a1-95eb-4a00-8f6a-b80793137d9b", "value": "12288:ehxEd6ZaHzzu5n2XRUY5bWapRtK5l/KFEEcomMSW7Gerc4IlN8cK+:ehxcxnYHY5W6RcTCFkGol9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707455917, "uuid": "49af2218-bd7c-439b-baa5-eb4cac13d134", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707455917, "uuid": "234b87d3-d57b-4e7f-9526-34ac1a903db3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455917, "uuid": "87baf6ae-93c8-4b84-a8c0-d1b4c676a35e", "value": "SecuriteInfo.com.W32.MSIL_Agent.FPI.gen.Eldorado.18004.31256", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9367bb-c768-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707496400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707496400, "uuid": "9052179b-ecf2-47e6-8bcc-b104cb1e232d", "comment": "Malware payload (AgentTesla)", "value": "90fb055a494bfa4e3bc0f88802fea60f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707496400, "uuid": "8ffd4f6d-1029-4520-9774-24cfb5fe4877", "comment": "Malware payload (AgentTesla)", "value": "478821ec576b698628c22fad9b48c73564eb85d7a46991810584836ccee81f3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707496400, "uuid": "27e2390f-ef6b-4218-b2d6-c10ac14de1e0", "comment": "Malware payload (AgentTesla)", "value": "82d8a3746ce1d8e898495f77ee834df22c543e4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707496400, "uuid": "52e6d357-392f-4c64-b55f-769ab958718b", "comment": "Malware payload (AgentTesla)", "value": "0803a838d9ee5d21e90ac6136f4c6301fe0715130c27aa1c03d47986b35baf16cc56948d780ddbe5c9a925a5ef7e6f67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707496400, "uuid": "fa4e15f9-8075-40d6-99e9-f7687c1b91dc", "value": "T1C4340E037E48EB15D5A83E3782EF6D2413B2B0C71633C60B6F49AF661451682AD7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707496400, "uuid": "a97215e3-4cf4-44b6-88a8-e80653dc1d48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707496400, "uuid": "25f3d21d-43a8-4631-b3a6-9ff032b322d5", "value": "3072:8ButR1BdDLc91r6ugZiaG2BQsK5RD/7rtb2h:8ButR1BdDI9JVgpvBQsWz7Zb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707496400, "uuid": "d3b92ab4-f850-48c6-9ae7-f7c5df6b58a1", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707496400, "uuid": "eb244336-c4cf-494a-a0b7-9ea1366d17c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707496400, "uuid": "c47f7dcc-f580-4e8a-bd2f-1904704f1b4b", "value": "90fb055a494bfa4e3bc0f88802fea60f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85939479-c720-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707465298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465298, "uuid": "37884db7-a8f1-482e-ac81-416eddfe937e", "comment": "Malware payload (Mirai)", "value": "1d1c4dc7e56707a49a275540434f4462", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465298, "uuid": "f2683360-4f07-4c11-acfb-18c99fcab156", "comment": "Malware payload (Mirai)", "value": "4abe518ed4f46b9e4203c3809867adbf026c1ac86bb576bb1460bec094e66052", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465298, "uuid": "6ae5a6da-9948-4d61-aaa2-abe8a96a1830", "comment": "Malware payload (Mirai)", "value": "1826c74584d124e5467bbfbf2b84c22ce111d39d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465298, "uuid": "62b52c59-f378-430f-995f-624916ede84f", "comment": "Malware payload (Mirai)", "value": "b63cf13642d3203cf069d58bdc8d6606bd48203bf9bf45c0988515ec137d81ffae1ff3e5ea188dbd48d3518924088078", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465298, "uuid": "55815e34-0873-4191-a944-9afc8a2535ed", "value": "T17913F1A043C9B158C471CA318578D785F27B0E3CEA126EBB1C3C0765B1E3536BEA861B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465298, "uuid": "2a4ee7bf-a865-430e-9149-ed3b75cd37a3", "value": "768:ro0WZbR8J5ysfSXc2ad8uRvVrfGgMmpFdjQP9Of8ajv91tF8f3UQev5:JWZbR8Kzs2G8+vtfGgR5j0OfL1t2lev5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707465298, "uuid": "00cf47d5-2ce8-4140-bf81-68b9e7a6adbb", "value": 42204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707465298, "uuid": "e212f94c-3e3b-407d-961d-eb46db1e3e9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465298, "uuid": "d555112f-04e6-4e65-95fe-a92c8ad09915", "value": "1d1c4dc7e56707a49a275540434f4462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d203974c-c754-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707487760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487760, "uuid": "dd25a974-aa24-4167-816a-bbfba68d67b7", "comment": "Malware payload (Mirai)", "value": "b2286200a62b700ae2790e7dc6a605e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487760, "uuid": "c6eb6529-0595-458f-8292-765b63a855a3", "comment": "Malware payload (Mirai)", "value": "4bad434e35c6ac856ea06d0c1ec594dfe79c5aedbcd4620fc3234ea1a205d8f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487760, "uuid": "e5a74d27-ce31-4783-936e-4801087bbbc9", "comment": "Malware payload (Mirai)", "value": "deff17faf10b5e86d19322e5c7085d7ed18f9f97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487760, "uuid": "2e1003aa-39e0-47a0-9b8b-6b0955e0bd8a", "comment": "Malware payload (Mirai)", "value": "4a404d31fe30158c90e35489a85d139ba802e962e3ad72a1637182a4052960b5a292b5d4301b08c9bf421c4a00b96a22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487760, "uuid": "4d28e2ed-2825-4135-a609-69d38c9dd467", "value": "T144E35C46EA808E03C4D61776BAAF424933239754D3DB73068D28AFB43F87B9E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487760, "uuid": "751b2d42-64f2-4d53-8ee9-a1b3cbaa9f51", "value": "3072:zv77jzmI47aSDV2u4AUDjNLPMvEn3ExYM/9QzjTf:73mj7aSDV2uJUDpQEn3EmM/9QvTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707487760, "uuid": "0423863f-09ff-4167-8ac7-f1a73bba6d9d", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707487760, "uuid": "5b9e4dd5-48e0-406e-878a-a26ed0bbe9b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487760, "uuid": "a29a8c07-1744-422f-acb7-b09b47deb29f", "value": "b2286200a62b700ae2790e7dc6a605e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6a4c38-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707493363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493363, "uuid": "44248c42-b729-4198-8d8a-c89400e76949", "comment": "Malware payload (AgentTesla)", "value": "a0c7c6fe55924e70c2358ef2bf8ea4f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493363, "uuid": "4e017667-fa41-42cf-afec-5036fac7dd14", "comment": "Malware payload (AgentTesla)", "value": "4f936fd1478ff8c2750edaf9ab108d051002ba894b7ae91c9b7ffcc55dc7ee26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493363, "uuid": "03482a83-b921-4b49-9bce-b06066f6fd48", "comment": "Malware payload (AgentTesla)", "value": "c3e2c1f96595bcbb453f24dbb3709dd57e45c101", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493363, "uuid": "333a127b-b969-4d05-9564-92553cc33a72", "comment": "Malware payload (AgentTesla)", "value": "238309ec43792d31bf2e3c4febed98e1c375a48f0137911bc15d61d4997c304838370f4ccca6a23dc038ca5c35bbf281", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493363, "uuid": "4b6b4366-7b6f-48bd-9bf9-ec24ff2b2bc3", "value": "T15C458DB3239D82F0D3B1617379066F266F6B78AD15E1F45B2EDC093EE42011293E9663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493363, "uuid": "20e7f4c8-522f-4c8b-bd55-72889dabbc22", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493363, "uuid": "90c8999f-8c52-45d2-96f6-680876e72a42", "value": "24576:Etb20pkaCqT5TBWgNQ7awkJZBqm+X0FAU6A:tVg5tQ7aw2Bqmhr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493363, "uuid": "e5812a48-1ef7-4d67-a6a8-a2e66e30a531", "value": 1264640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493363, "uuid": "908982bd-5f8c-4cec-a802-25a35a6effb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493363, "uuid": "75620f68-210e-4332-b674-42b30e7104fb", "value": "ESTADO DE CUENTA DHL - 69502.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700733cc-c719-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707462256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707462256, "uuid": "cec58b55-be57-4b4e-8d2f-6beeb0b87bec", "comment": "Malware payload (LummaStealer)", "value": "30862fecf7b6eff6b318feccc621d737", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707462256, "uuid": "6b99e6b7-a753-4a0d-bdb5-ebd9230a82ec", "comment": "Malware payload (LummaStealer)", "value": "4fd0f59fc43439d5040c5d59f90d40a33a656376d7d0d04327b0d364a726031f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707462256, "uuid": "99d8377d-48f9-4c9c-a885-6b4d92f01bb1", "comment": "Malware payload (LummaStealer)", "value": "292a0253b61aa8850bbc1eccd480218782d27801", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707462256, "uuid": "b06beb34-d304-4c93-8431-2e106479e3b0", "comment": "Malware payload (LummaStealer)", "value": "f8a9e12e80478753c0b3767b05861c4863c3755adc682faec52ec94495885b893fa66b3921e999919cbc7fb7ab92bed3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707462256, "uuid": "8cd4d2ce-6255-4cf2-b38f-e3009d8cf3c1", "value": "T115A4011432FAD032E19722B15934C7A54EABB8666171EACF5FD7057D6F24AE1832830F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707462256, "uuid": "6d0e2a27-cbc4-4abc-9433-0fde04113af8", "value": "55e8353f802707422a3462a3bab24fd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707462256, "uuid": "f8899cc0-faa1-48fb-98e7-742779dcc22c", "value": "12288:YW1CbcEm/MuuRSfRZlBP9XrQ6NbrAJVgW:0bp7ROR9mebUJVgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707462256, "uuid": "d6effc3e-966b-4ab3-8f21-e8be07d9cbc1", "value": 453120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707462256, "uuid": "879cace0-7b67-4385-a826-9190e8c81371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707462256, "uuid": "5043d626-e842-4df2-b735-1a88552bf85b", "value": "30862fecf7b6eff6b318feccc621d737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d26df6-c754-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707487765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487765, "uuid": "55709f6d-e5f4-401b-889d-c3444b1f967d", "comment": "Malware payload (Mirai)", "value": "5fe46fc8b080848d73daa6d5ef492cae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487765, "uuid": "70d2b0bb-43e3-4298-a02b-7f31559b88b3", "comment": "Malware payload (Mirai)", "value": "50270d187d3d859e3782a7749b8e1b9d13e8de79eebb04d851b218e331fb83ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487765, "uuid": "572b5e6e-b188-4093-b589-99feb70eaf22", "comment": "Malware payload (Mirai)", "value": "362e470d8a1c06b64e46f19d4c8aa1d25b2864ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487765, "uuid": "8975a9bc-1045-4481-9af6-db28dd7f9dd4", "comment": "Malware payload (Mirai)", "value": "6a9da60241bc5972a2663dc27fb93dcd3c77f5a93ebf95a320134b4c9b1e1d22a3a957328f8ece45837bd04392abd310", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487765, "uuid": "379292d1-50a1-474e-8045-c5ea0952a50e", "value": "T1AE939309BFA05EF7E8AFCC3345D92745288D655A21A83F79B930D928B21B24F15E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487765, "uuid": "06b0fa55-7fd6-4f09-9e56-b6ac535bcbd5", "value": "1536:a5DnSB+v59jQm2r17xk49d6xZLu8vJ4TGo8S:a5TSB+v59jQmi1GFrvhrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707487765, "uuid": "3a0d7832-0599-4730-838f-01ef21b75a29", "value": 92512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707487765, "uuid": "bc1c167d-1989-4f5c-8365-c2f3c7ba9a11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487765, "uuid": "aeb760a1-bd53-4830-9ffe-f012c78e6d12", "value": "5fe46fc8b080848d73daa6d5ef492cae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaebc939-c70a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707455912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455912, "uuid": "6249b089-fb1b-4abd-a230-07f597c04e40", "comment": "Malware payload (AgentTesla)", "value": "5a3c3d1bfd19b96afbe7c082b13156bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455912, "uuid": "c1314151-dafc-4e3b-9272-a986895a845e", "comment": "Malware payload (AgentTesla)", "value": "5075a65afd749e21105953c0f322e92f061b7ccce451125aaf86d8903be82a08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455912, "uuid": "d29c5ead-0d30-463f-aa6e-52ca4f684776", "comment": "Malware payload (AgentTesla)", "value": "f8681829a75b5edcdd5d6be20ba801794ac265de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455912, "uuid": "8540c490-9012-49b8-9220-d2a7b82ef729", "comment": "Malware payload (AgentTesla)", "value": "3beb34bfbd7833f30353bc5a843442c20cc5546abcebd46c874225b93cfd10afcbb7e278fafa4c3e1e15bb40a86e8f80", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455912, "uuid": "10f4863b-625a-441b-afa7-e72675be30b4", "value": "T17574754283D86B2EC86F193548E3431F4B36BF03170DAB89656419A57A26FD3680FF78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455912, "uuid": "c8712295-218a-41e2-833d-e624c337ee06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455912, "uuid": "08a20f0e-bd7c-44f3-87ff-426254db4c88", "value": "6144:HWVJgEjP3YPkp9Y7ku7uJDtYICCudD5rtC8Q6fCw8wE5v5ir+ra4QAJdTD6LD4we:HWVJgEjP3YPkp9Y7ku7uJDtYICCud9rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707455912, "uuid": "329fcd66-9b45-43b7-9715-ac9812c99c80", "value": 359952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707455912, "uuid": "9ff716d3-b5e5-48df-a7df-2cef0603b601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455912, "uuid": "cdd4eedc-7bc2-4ba4-84ac-d84025b5b046", "value": "SecuriteInfo.com.Trojan.PackedNET.620.713.32671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2abe292-c71b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1707463334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463334, "uuid": "300b3d9c-1e97-4063-8314-505e9ae5fe88", "comment": "Malware payload (DBatLoader)", "value": "b029e715d110a6fae5c2dba6af17e101", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463334, "uuid": "ac656fcd-eb91-4d7a-8371-6710919df9bd", "comment": "Malware payload (DBatLoader)", "value": "517e2fa5e107a458f382dce0def885aa44ef55749f75432811ff205e025e623e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463334, "uuid": "fe2f7e0a-3a19-45e3-8ca3-d71a95bc35ae", "comment": "Malware payload (DBatLoader)", "value": "fae12f61a023abcbbec1a27d147ab3d2f347d6e5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463334, "uuid": "8ea2fbcf-917c-4e24-aae5-e92c13bffd69", "comment": "Malware payload (DBatLoader)", "value": "dd32bfd6f34bd66c754f139cfd1b998b1e04c74e0d6f8ea0d5ef3fb206734feb322ade4f58e5cae68ea4363b6a198c34", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463334, "uuid": "af40e59b-c64b-4c4f-89e8-53ec0a6f4a54", "value": "T1D7C5DF3845465ED9FB488BE58748D7DF2D68342BB12AD32A4DAC916111BF4B7CA3C0EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463334, "uuid": "995d0087-1960-4c49-9ce6-8ca1bec5f237", "value": "49152:V0Rqhg1OTb9q9haAOxrosriRdAcYK+BdfjoceCD:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707463334, "uuid": "b956b58a-ffb3-479d-9674-c4577a9d3a29", "value": 2542403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707463334, "uuid": "97111200-92ce-4cd3-b873-a486fdd222c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463334, "uuid": "79eb5a22-eb97-4dd5-b114-4df1a6fef13f", "value": "Repeat_Order_#020823.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed951f4-c75b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707490654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490654, "uuid": "bdf3f381-9cc8-46b7-8f89-19379f5d4d3f", "comment": "Malware payload", "value": "b1fb19cb429f231a45b83437d5e59a71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490654, "uuid": "79f5854e-c1db-4f99-95ca-59980ef0f570", "comment": "Malware payload", "value": "555687ca3149e23ee980a3acf578e0572da556cf34c87aecf48596834d6b496f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490654, "uuid": "ea9a48b5-1102-4eaa-bf25-4a5c774e59bf", "comment": "Malware payload", "value": "e9902fe0ac8f047fab2257c8140d3095531e3345", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490654, "uuid": "1be6606e-16f7-4ba0-b8aa-c5dd052a2933", "comment": "Malware payload", "value": "2b61f7187ba1ca30e73973a432160b02c9d42e628c4c125ea7f204cd63992033aaaf483c9d011abfbb4640c6c0204ce2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490654, "uuid": "54546b52-729c-4d89-9ddb-a796bf61f045", "value": "T186956B23774B4732EED5027505A1BBC5492CBDF01364108B66847E8FFAB97D10B6EA2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490654, "uuid": "e940d94a-9aa0-4384-8eea-5ee2d18212b4", "value": "354dabe5f488619b3472b5636bcad57f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490654, "uuid": "b70a225f-84c4-4699-a88b-6a8191799ab8", "value": "49152:ToUXWwvkaHNUQd8GhXFQLcF3xXY45AFSG1efwYTw49rmiDAX8t4S4p4uKrtI6w:TNmR6Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707490654, "uuid": "64d20f25-c6df-47f3-af8d-d216a91faaf8", "value": 2006016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707490654, "uuid": "9a1688de-5032-4b2d-8d23-9f79ca786b48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490654, "uuid": "034e452d-c5df-4ea1-b649-5dfd4048e79d", "value": "Ifhfdhjkshfhjkgs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e48305-c734-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1707474015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707474015, "uuid": "ee6c2251-78c8-4d5c-98b9-a92564927c78", "comment": "Malware payload (njrat)", "value": "b12468b0b0b902a0dd3f239e0a3b1854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707474015, "uuid": "74f767dd-f9d7-4df9-849f-2d7550f6ed58", "comment": "Malware payload (njrat)", "value": "556d747cf7796867d2ed4537d6a206d665f2555e9f53627fc1bc44147285df9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707474015, "uuid": "300cc2c6-5a88-4d8a-9a55-0b2b60c3bccc", "comment": "Malware payload (njrat)", "value": "c91a1d8406b300d020969c1a9b5d25cf9974d119", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707474015, "uuid": "1133665a-715f-4028-97ac-898f42d73cd7", "comment": "Malware payload (njrat)", "value": "439a75dfe1975caaeffee7f68159b68c0f4b5bf0ec496f4b455458590cf4829640c1da39110d9eba4f6dc62b21851835", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707474015, "uuid": "b45af2f4-4ec4-4db9-b895-9e15433e2f6f", "value": "T1BC13E74DB784E175D5FF8BF1A4A2B2850BB1A01BA902D30F99F114D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707474015, "uuid": "d1e17e7d-a233-4461-9f0c-cc452b120cfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707474015, "uuid": "becfd53d-38f2-427a-a52b-a1a8ce385149", "value": "384:IZyo1Cj8syWvHDieKveEXMsJEAflz8Iij+ZsNO3PlpJKkkjh/TzF7pWnFRgreT0I:+z04pWfDi5dMsj/uXQ/ocZ+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707474015, "uuid": "b5626758-e872-4617-a2e5-5fb4e26edb6f", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707474015, "uuid": "27988116-345a-49cf-a4e9-ba314f0b9140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707474015, "uuid": "b7e6ccb0-4717-40c4-b382-f596f3fe3d9b", "value": "b12468b0b0b902a0dd3f239e0a3b1854.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d62a72-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707493074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493074, "uuid": "37cfd065-8669-48ca-a20a-6d75b8a98f42", "comment": "Malware payload (GuLoader)", "value": "4e9da14a7e07654d673f3785cf58e316", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493074, "uuid": "000adfdd-8e57-4e3a-8580-d66481eac024", "comment": "Malware payload (GuLoader)", "value": "57717904ca09bbae18c3370f06e481a95de630e53a9d8aad52bc7695e8d56a77", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493074, "uuid": "8434f5a5-7051-4d6c-a67f-dae71e02ec1e", "comment": "Malware payload (GuLoader)", "value": "eab4f695187eadfdbce33d02028a1b0058c4920a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493074, "uuid": "52809c3b-0af2-4ab1-8020-870921863f9a", "comment": "Malware payload (GuLoader)", "value": "b83814db6a7b99fbcd49277a32d2830323a81d89f0b23669da8c9296dc9faee80e6d139cce7b18dbe58fccf89ab6194d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493074, "uuid": "dc5a9726-44bb-4364-a73c-4ec3bcab747d", "value": "T17B74223CB3F2C757C157A83888D485D5BB1DFC69EF82E4473542B71D2438B82829B9A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493074, "uuid": "3619bc81-3a54-4a02-9df2-94290b9c5dba", "value": "6144:5ThunOZP8VNeZ6NCLXA+53wzWt8ACiw4jrqGiP7O0WDCufC256dFedNORyd:5Tk48VMZ6NCLwS3lCsrqX/Wuuq1FKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493074, "uuid": "f26e818a-9da5-4da2-8ffc-915a6bf60d2a", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493074, "uuid": "1904d173-53a9-4bc8-a44e-9acea5925158", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493074, "uuid": "4d756e91-756b-4a34-b651-5e71719e07c4", "value": "order-N001688908.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba22e00-c729-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707469255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707469255, "uuid": "5786a82f-5980-4510-86d4-6efeb32f4c7d", "comment": "Malware payload", "value": "19a4ba36256fe3d944e49200e7752da2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707469255, "uuid": "be8b8a6d-c95c-4671-b0d8-bd6f86fea627", "comment": "Malware payload", "value": "58a8314dd00e67a4159404825b7c6a33e310b285a3b59665c0b99380b3b3a2de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707469255, "uuid": "96703825-1709-401a-96f2-61e08fe7520f", "comment": "Malware payload", "value": "af628980dfc75f32e71f67984bd4f455102b0c47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707469255, "uuid": "bfc55c30-3ca9-4ffb-9948-35fb386b78bf", "comment": "Malware payload", "value": "cd1a2d607fa55f2ae878ad9c3034edc3ae02f62a05f3e26bf8ee274823badfd85a209117cb165d7c174ef9bf3155166d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707469255, "uuid": "054e2638-2570-4f09-b986-60bad297a7d1", "value": "T1F7E4236083AD6BE6CC7A87B25976A9D5C7F4E36B6114C6A54D9E40C825FBF0081E0F0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707469255, "uuid": "f40af973-15fd-4a13-996a-2aa325d3a975", "value": "12288:zv1LzgOTLmSd0rxnP9AGw07mfGfneXvFOigFlJFjauGvT1dx5BxzmIgx6wGS:zv1LzgOHmSexnSGwfGONOi6rcuQTZ5BV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707469255, "uuid": "cb46c8bb-c88e-4730-bcd9-6cccb1d73ffc", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707469255, "uuid": "7b1d3d77-0f68-4813-ac18-1b758493a03a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707469255, "uuid": "8f658c6c-6990-4f12-8908-0096a6f8b2fd", "value": "scaan document_docc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d850e24-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707493202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493202, "uuid": "e45cc832-b2f6-41ed-92da-3a054f1985a7", "comment": "Malware payload (GuLoader)", "value": "c786d5b5985131587f2802e8111d8727", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493202, "uuid": "b3aa4472-08e6-492d-9b56-8330097cf3e0", "comment": "Malware payload (GuLoader)", "value": "5ba323292d4c798442ce9acf59fd80dcd79ee389dcfa01c40a108619e58c26b1", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493202, "uuid": "46f5c051-5104-496e-bcfa-ccdb9bb15645", "comment": "Malware payload (GuLoader)", "value": "93396c268768c962ed9e474f552ef296fe1c48d3", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493202, "uuid": "35a56368-0e91-4ceb-a36d-e9fd1d314906", "comment": "Malware payload (GuLoader)", "value": "fe89ed3f7c9ed67fa8ec739cb468b82cbd89fc9bb57700e60d2f1aa7882109a0d376af29786c39052910da48a58bbdff", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493202, "uuid": "ab484019-d500-46a4-b68b-f74276328853", "value": "T1CB934C70EA542B990E4B27AEFC506981C57CC11705376265FEEA039D700A4ACE3FE7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493202, "uuid": "619956b8-f1b2-4a21-aefe-ab7129c8173d", "value": "1536:HWqS+oiKSUnGyWbdS/QLqslMcJ/wlMDhPRDT8S5VaqSHPrIVrQOUdd:2qS1xGyWbs/QLqclJ/OMDhPRES5VEHTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493202, "uuid": "7ba4263e-4733-4c6a-a14e-ad5fc9cf4fb0", "value": 95350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493202, "uuid": "200bec07-a1d2-402c-b164-6dea63ff6bb9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493202, "uuid": "08d35cdb-1b1f-4fd4-a4de-deca8fb25609", "value": "purchase order..vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600f5a33-c6fa-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707448915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707448915, "uuid": "9ac13337-ec70-4dc0-958e-631b8199e381", "comment": "Malware payload", "value": "342e15e46de6987abe2e5623aa182acf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707448915, "uuid": "b34a6ff2-455c-468b-bbb5-a221711fd74e", "comment": "Malware payload", "value": "5c40e5cdfebc059661b804d0757b2b58f15ea6fd74a84b3cece092c5b71c294c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707448915, "uuid": "bc2b16b6-f2cc-4d23-9010-7f4e1cc779de", "comment": "Malware payload", "value": "9f940d08bc0d37688fde757a1f73912e8a254c4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707448915, "uuid": "dcc8f046-4f24-458b-93c6-052d80b4cf31", "comment": "Malware payload", "value": "4bf5c7dfb04d86bfba1fbff5b508f641b40da4c2ad15c7f787176a1cdebdc4065b6114918ddb89df5f1a5c3ac444ea55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707448915, "uuid": "775a9340-daf0-400b-92eb-2abb0eb57d36", "value": "T1B1B69E93F78381B2E9D1517610AFE7379630AD090B1596DBF3D83E29A5313E1393B18A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707448915, "uuid": "4a1b76ed-f025-49ab-a70b-b539fa8e4412", "value": "806fc0b96bbb7d4a7bfec088168e0468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707448915, "uuid": "fed477e4-c770-4439-bd36-12d6a2e8af06", "value": "196608:vw5QgkALtDhMedzjecdLJsv6tWKFdu9C7:rALhh3CcdLJsv6tWKFdu9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707448915, "uuid": "1badc823-bae6-40a9-b985-266cf9baa8de", "value": 10973696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707448915, "uuid": "adc3782a-6bc0-411b-91c4-68454da8e407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707448915, "uuid": "1fd56336-aad5-4f2c-98e3-fa4e6bb02ec9", "value": "SecuriteInfo.com.Variant.Zusy.529732.29561.43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc763eb-c715-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707460613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707460613, "uuid": "e4cfb58d-3ec1-41c5-aa36-db50192c5697", "comment": "Malware payload", "value": "c33ef0999ee7945dbe29dcda936a73ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707460613, "uuid": "4a96651e-900b-4fe7-bd66-c17ea949e9ea", "comment": "Malware payload", "value": "5d1c1002b8db3bb207c5a48d75b878ca826f96678e70bfadbbaeaaf9cd07f900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707460613, "uuid": "b07b2391-098c-4ae2-a507-061c34d661c5", "comment": "Malware payload", "value": "0ed78f78294801d8479234703932ad6a11b2924b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707460613, "uuid": "696436e4-ba87-4e22-8592-cab67a5f1171", "comment": "Malware payload", "value": "1aba3b43c4e79a3acfaa2174e33b887c8ca300c16b50540d86527664a97cf610c2b4932ef02557a316939d17eab6d528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707460613, "uuid": "57ea9a0d-9c6b-47c4-ba03-a17f9b7924e7", "value": "T1AF7319476A5686B1D7544BB00CBA7BB887A6D88D8F248FD763C4ED3D28366D07C3620D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707460613, "uuid": "a9491c4e-3a4a-420b-b20b-d8d6e089af29", "value": "ada5caa864c68414d96249a2eb287ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707460613, "uuid": "632fa290-38a9-471e-bbc3-32402a093495", "value": "768:+x6pKUt9u557PfbZFYZ9oSBXEEh39zHMHVKG8+CFwy8yejx8dat0J3TnUVgenjso:mbX73bqyCExXVSwyFU8ItI3TUljoQir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707460613, "uuid": "443c797d-efb5-4169-998e-03c5a2dc55dd", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707460613, "uuid": "a1d442b9-15d9-42f5-808d-67a0469861c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707460613, "uuid": "b4b12465-390c-4ae7-8c17-dc328bfbfb9f", "value": "SecuriteInfo.com.BScope.Trojan.Propagate.14261.17569", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521b3d21-c751-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707486257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707486257, "uuid": "331a6203-def4-43db-8f34-554e5614ec7b", "comment": "Malware payload (RedLineStealer)", "value": "69a5485a5d23416545685cf0c55716d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707486257, "uuid": "226d4f26-9b94-4146-81a3-502bcb7b1ef9", "comment": "Malware payload (RedLineStealer)", "value": "5da6ee7b6e398c742bc73d76ccfcd546c66884c13b8057035e666701580ae7f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707486257, "uuid": "9eaf4983-0ad8-4d5a-b6da-f7bfb7ff2bf1", "comment": "Malware payload (RedLineStealer)", "value": "43bd23507a5476940060082e8c6d81ae38938a9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707486257, "uuid": "2ca2fd49-ea09-4678-b1f8-3e67c5c558f3", "comment": "Malware payload (RedLineStealer)", "value": "e136a246fa22c16d01155d9c7bb8070d3cf2eb821f85e7720397191a88d10e0d0655a50d066c98110ff37b95c9728f1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707486257, "uuid": "8107bda0-ea94-4bdc-b0f6-41f0209cd92f", "value": "T113F4122630C1C972C5B7017140DACB36AA3935B10BBB46D7BB9D52AA6F613E1F3352C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707486257, "uuid": "f804ff2f-c0d3-4fc9-861f-7041e140de7e", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707486257, "uuid": "d988c7a3-e47b-42c0-b2e5-b01a8466d4f2", "value": "12288:3h1Fk70TnvjcpSBVuhcgNPfbSffuO1X9fj3sbLEVb9ZTGSLkW2tvPPEv0vJ2K408:dk70TrcpSGhcijSffb1X9r8fEbZ/Lf4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707486257, "uuid": "a169eec2-5d18-4ec8-bf71-819bd006441e", "value": 766432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707486257, "uuid": "9de350a1-0c17-4364-aeb8-1271cf14078c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707486257, "uuid": "0d02d726-0297-4d22-bcf6-7a2e260b5ca0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac34e3ba-c797-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707516473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707516473, "uuid": "a830ced2-d69f-4c1c-8a24-9498e6b13916", "comment": "Malware payload (AgentTesla)", "value": "6aea722782e592050ea7ffe595a73342", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707516473, "uuid": "3d52ce51-52a5-4020-86ef-7c47ba093e30", "comment": "Malware payload (AgentTesla)", "value": "5e2bd91d7a20ebc09bbf62a42dbacfe8677ee5da819aa9e67c855b2b38eea412", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707516473, "uuid": "63e3ba2d-33bf-4cf4-a9ef-25d9e997b742", "comment": "Malware payload (AgentTesla)", "value": "0f44f516a9125d2c6f20c186e29560084b4c02ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707516473, "uuid": "369df557-4c51-49f3-a05e-ec8be6db9e33", "comment": "Malware payload (AgentTesla)", "value": "6df8d7023507901bbc91888e98a5e0398c9dba8e207f449a795b2aa57b01b599fb522a29a1017ad2312771629bf9da99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707516473, "uuid": "d1591a89-1bd0-4ce7-8052-d7b33079fe5f", "value": "T15BD423CAA945FDA26198D53B9816835FF742E33013D38F9C7902E2A3432C699794EF4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707516473, "uuid": "bec9abcc-5b39-4ca5-bb88-c0dddc66275a", "value": "12288:I0a9ikvs+TscvDaVNMIg8knighBPMa41mKxJf4lGPc7iv4D:fa9Z3G33ngTPYXxJ7c7O4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707516473, "uuid": "0ca08e75-0d99-42ca-9fa5-6025b4e6bdc0", "value": 628865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707516473, "uuid": "6cca4fee-ccb6-43dd-a149-fab3b7463dc4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707516473, "uuid": "07da5b20-4e06-4e43-b50d-96092ac1cd8e", "value": "nDocumento.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321e8e9c-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707493076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493076, "uuid": "fea596c5-157d-4377-a2fd-5f6ba15f7f32", "comment": "Malware payload (RemcosRAT)", "value": "2f32d826be509915a2b54b276eb00ca8", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493076, "uuid": "e70f800b-6bf5-4f6b-a302-5623c0ec39ca", "comment": "Malware payload (RemcosRAT)", "value": "5f11619c3ed14f547d0f61389ea478cfc8932afce298e3a6f5fa589ee5f59527", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493076, "uuid": "d95ecfd0-22c7-4ca3-9d1f-eaf38edf2eb4", "comment": "Malware payload (RemcosRAT)", "value": "6f0210d9b40f16761ece4d2a7708bc63e277df32", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493076, "uuid": "f8d45088-1a27-4eac-9b03-0de13a36c721", "comment": "Malware payload (RemcosRAT)", "value": "e269c8869a328d66be08ae105e5042e094185185d6123fc613e31040f448a89799aca87809269c7f71409e498cb2c4db", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493076, "uuid": "170be777-158d-4bc6-804d-2563b954c42f", "value": "T14594E051BE818B1BE44A43354DF74BAA6324FC418FA25A0F324CF70D3DB57A46D27A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493076, "uuid": "62b24fd7-7bba-4453-b8a9-14c3add3a4c6", "value": "12288:GTkc8VGD3bVBFMIdGnqL1SJKB54H4wtN+an:xoD3bV8qL1SJ84/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493076, "uuid": "f726f115-2b75-4a90-99a3-2f5eb12c33cf", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493076, "uuid": "243478d4-50f2-4d81-9487-dd675db98874", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493076, "uuid": "dc86c169-fbd6-4570-83c3-83efbb99e90a", "value": "PaymentEUR41000.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca43fc6-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707488127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488127, "uuid": "d0c37789-7b76-4762-8c63-c5dccb37cfa8", "comment": "Malware payload (LummaStealer)", "value": "c7c2ac43e521e3ca094b44e64926b357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488127, "uuid": "a7dace5f-6962-40b1-82d8-d4de715613f3", "comment": "Malware payload (LummaStealer)", "value": "5fbc3fac963101d1eaa13298c8e4b3ea831816780a6c52646ca99935271a709a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488127, "uuid": "41ed980c-8962-480c-b696-7ae0e18c3d9e", "comment": "Malware payload (LummaStealer)", "value": "7f58dbbba2d7a7524296e3b89504f94b7fd37ad8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488127, "uuid": "63c7982a-1825-4ce4-83f1-ff34b038a64b", "comment": "Malware payload (LummaStealer)", "value": "d0fab73bad5873a0f574ddf762b3e9bac05eaff729772abbb0a083d35b11e398341a43484b34401a6b40d07a8db7ab93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488127, "uuid": "1a9221ea-d205-4c10-8eaa-0cb491da8b92", "value": "T1D8865A07EC9145E5C4EDD230896686667B71BC484B306BC72EA0F7283F36BD0AE7A754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488127, "uuid": "e68d5de8-9e20-4a74-9556-a18715b7783a", "value": "c595f1660e1a3c84f4d9b0761d23cd7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488127, "uuid": "9b4a8198-5efd-4d57-a9c0-a1fb2a781e7e", "value": "98304:r3rgWI+D9St1ISARLIu/1XPlbEhaNfipqMjos2HlBaUFV7R9OY/ojZ7W:rccAOSA111XP6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488127, "uuid": "5edf6ee9-22e1-4ee8-b3d3-d4ecb0e3a293", "value": 8548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488127, "uuid": "335a9de5-514b-4f2e-b087-7a88e8b3939e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488127, "uuid": "d2a1ad83-bda2-4d86-9a92-9441eb8bbbb8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00348d36-c760-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707492562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492562, "uuid": "a316f784-428d-442e-bbfc-2a4e0f4911af", "comment": "Malware payload", "value": "7c56576c8c26baa5a69ac88169f04b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492562, "uuid": "43235422-f292-4298-a149-67bf259df8cd", "comment": "Malware payload", "value": "6025287605e660ff65f34ee9081d2a8a25cfdca61fdd584479c2812dad84030a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492562, "uuid": "f4314670-81b3-4a73-86c8-f41795d30eff", "comment": "Malware payload", "value": "d7377ff4b975e59f5d584f98bf6a6812f76af6bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492562, "uuid": "a9ce526b-d83a-4963-9aab-fe9d60737b78", "comment": "Malware payload", "value": "57b32ee468fa281c4fbd8bd66e387c466b327c43095be53b78103fbb40da7179310fd6cf45d8156c1d175c8d4824d1af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492562, "uuid": "1fc7a3f5-d251-4bba-97b0-793746533b96", "value": "T165956B23774B4732EED5027505A1BBC5492CBDF01364108B66847E8FFAB97D10B6EA2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492562, "uuid": "9b36364b-f9cc-4071-906b-ca5a3591f2d7", "value": "354dabe5f488619b3472b5636bcad57f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492562, "uuid": "1d3a7698-6cd8-439c-b669-cad68bea8a7d", "value": "49152:ToUXWwvkaHNUQd8GhXFQLcF3xXY45AFSG1efwYTw49rmiDAX8t4S4p4uKrtI6w:TNmR6Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707492562, "uuid": "05228c38-9cd3-42e8-b129-98b4f81d059e", "value": 2006016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707492562, "uuid": "feeee921-9fc4-4248-bb1d-fd5932904048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492562, "uuid": "5767df66-df23-4247-9b38-4d06bd4f3378", "value": "d7377ff4b975e59f5d584f98bf6a6812f76af6bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1f5065-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707493071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493071, "uuid": "7e0db175-60b3-419d-aa9c-d12d6942e46a", "comment": "Malware payload (AgentTesla)", "value": "1d8f18d37c238d7eda76bb7fa8988795", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493071, "uuid": "bb1f5a99-f407-4c78-b9c4-0642e3f3a928", "comment": "Malware payload (AgentTesla)", "value": "612f90f8d93289451ebd511c7995ae4f5c17f3edbfefa82214274f1601db1523", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493071, "uuid": "090499d5-aefb-434c-8a12-37d2e95b3d89", "comment": "Malware payload (AgentTesla)", "value": "7bfc352cb91a32495a5c08f9b2675fb7f4cc3419", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493071, "uuid": "fdf35b17-97d1-4b98-a094-02e80907fe3c", "comment": "Malware payload (AgentTesla)", "value": "aa3d45607f05eeae0b2974efcc4362fb50352088281121e05801892b859cad0ee4c4979149e426634469d3c9bef5b8b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493071, "uuid": "b0c41aa6-d4bc-4976-bcbf-ef6e600f79c4", "value": "T1F5742220B151D687D84796774DC086CB822BBC769F56644B3580BF2D6138BCBE9C33AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493071, "uuid": "7cac4a68-e9f9-40a7-b2f8-c83b3f407db5", "value": "6144:OThun+ZP8VNM6NCLXE1/OS/HuYsxy6pjRYVkGMekmhVByTGQXBnhcbtG:OTkI8VO6NCLU1/OSvuXy6zYqrekKDyTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493071, "uuid": "a940130a-9c24-42fa-b99e-2a1880f53b41", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493071, "uuid": "d61e2208-7824-46e1-a971-e621b975a7da", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493071, "uuid": "3096fb9d-f720-4424-b044-4be8d85ab761", "value": "cotizaci\u00f3n para nuevo pedido.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6a2f9f-c73a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1707476426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707476426, "uuid": "0b17aa0c-274d-4b36-a5a6-9268937821ab", "comment": "Malware payload (DCRat)", "value": "b284af973e6fc34858863089b5f23669", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707476426, "uuid": "824d53db-aed4-4875-975b-c9fa1b822ee9", "comment": "Malware payload (DCRat)", "value": "619844164ba488869dfc0acdb6f74a8f3546583cbd1f9399dd5d64cac06c28b7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707476426, "uuid": "ca05c36b-3cdf-4299-a993-b150e6254e61", "comment": "Malware payload (DCRat)", "value": "8832b521953cd0b7da632c2200da3085f651dc95", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707476426, "uuid": "304f1046-058b-4651-bfff-fa044ced866e", "comment": "Malware payload (DCRat)", "value": "03e6d7cb3998ac0b0a0eef538aa658559a4ec1f3ba5e0428b8b480e180373e094180367ba197ac6990a9f1110f2a90da", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707476426, "uuid": "b9be2855-66cf-4764-8b65-24ba7b6d5393", "value": "T1674549017E44CA12F0191633C2EF464447B9AC512AA6E72FBEB9376E55123E37C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707476426, "uuid": "b1ee1d0a-ff21-4b24-bfa1-b2f7adb4071f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707476426, "uuid": "84693ac5-4592-49dd-8550-fd89e893c689", "value": "24576:U2G/nvxW3Ww0toHqQJ8cG7JrEKkeOkT2ehG/CLuxB:UbA30Qqi8cLKOgGHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707476426, "uuid": "bdf92a0d-cd49-4ff7-8a40-99608654f923", "value": 1164371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707476426, "uuid": "8c2d1ee7-56be-4691-81d5-f890677041bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707476426, "uuid": "556a9d2c-0366-4324-96ff-f418035a8a7e", "value": "b284af973e6fc34858863089b5f23669.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e2a3ea-c760-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Nymaim)", "timestamp": 1707492941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492941, "uuid": "dea17310-4fdc-439c-b581-c3a0484cc308", "comment": "Malware payload (Nymaim)", "value": "a7e6582aabd0d4e29d3b2fa0367d84ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492941, "uuid": "cb9153fb-3860-438f-9dae-e4a757550604", "comment": "Malware payload (Nymaim)", "value": "6291c13c12ecc41d3a910c7d485be76cc58476b0f842574c5d52e33b1c9b1823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492941, "uuid": "5b0dd948-7863-49b1-b9a0-4769f9d727b4", "comment": "Malware payload (Nymaim)", "value": "001a0424d501d55c1296c8834e9d70f7f5657d12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492941, "uuid": "835253f0-eab4-4074-950b-e29c5f31a583", "comment": "Malware payload (Nymaim)", "value": "f9d3ec596659b7ce44ea12ad04a31acdd1a2bdb0002b2324c1373bed84e51558429de8c1097d28810afb2a37dac7daa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492941, "uuid": "cf7bfef9-f6f8-494b-ab95-227c21ff7fb6", "value": "T14C54E021B6F2E832D6F75A354930DBE55EBBB8321930924F6B94267F5E713C05A22313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492941, "uuid": "f505c0f9-d1d5-40b4-8e9b-760744cefbce", "value": "41a023181e1b42ebf113f2f55f4ea949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492941, "uuid": "f52a1dc9-8b02-46db-a22b-76298bfc8b38", "value": "6144:YNNGL8vP0gHs0Die7WS+OsvZoLilHEl9:Y7GQvP1tDie6+sBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707492941, "uuid": "de01ca5f-a5e2-4ca2-94ad-ed7068174194", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707492941, "uuid": "dbac579e-eaff-4720-b489-0f42b84c7cb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492941, "uuid": "88698c6f-573c-447f-a730-e2b72d631828", "value": "a7e6582aabd0d4e29d3b2fa0367d84ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20979e5b-c705-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707453533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707453533, "uuid": "c8de42c8-8d20-4df9-acb9-42366db2a9e3", "comment": "Malware payload", "value": "b775e5b6f909e6dc2a970cfe89429080", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707453533, "uuid": "08f75952-d884-49d2-bff5-4811b0b2ef39", "comment": "Malware payload", "value": "6298c54689640ce9a35488dd44f5004519b10f8bea956a23ee4333cddc98d21e", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707453533, "uuid": "df5fbe39-8357-447d-8b1e-1d03daa14b79", "comment": "Malware payload", "value": "c6ceaed3182c5b326361d17f24cc59a7fa9bfdf4", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707453533, "uuid": "d65f659e-0390-446c-802d-de1d40235691", "comment": "Malware payload", "value": "591131c848c3a68a806b9c2c4f7798b81af85617ab43ef454ae91bb97f43ef2db373fc1e7d6cf5044c1b94b511260557", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707453533, "uuid": "5cdc3413-957b-4894-9335-372c7948c78f", "value": "T100A512F1B809BBADDD284B7099780FAA77375C1492A2531C5773F860EB978D41A40EBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707453533, "uuid": "ef9fa8e4-5789-4dfa-8d83-b7114ea57a65", "value": "49152:JNSvZqUnfZVKKd1KeRbMCxgPl38WjZBdF/RA:Y1fzK+hRbMCxu1jZBHRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707453533, "uuid": "e7bf4175-0c9a-43d4-8ab0-a192551946c1", "value": 2195179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707453533, "uuid": "5b6ce4fd-b4be-4ed1-9c49-31cf31d9e1c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707453533, "uuid": "3f427135-85ed-45cd-b601-0c9b7dd7ee04", "value": "FC-SAT2348758049132067.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46f295a-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1707488167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488167, "uuid": "eb85d874-71d1-4f55-9f20-5f7197a009f6", "comment": "Malware payload (Glupteba)", "value": "24f1a1aec533bf6f13d89763b9e39344", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488167, "uuid": "ac7d7b77-8c3f-4342-b79a-4573d4edb340", "comment": "Malware payload (Glupteba)", "value": "62c49d50a2108096e5372fdda55b6159b6dca98614f4a3338ef1221eea264370", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488167, "uuid": "115c3fef-33d0-4b68-9e8f-a4b75b3d81d6", "comment": "Malware payload (Glupteba)", "value": "a4b76e2c20409472f0002a3ff5966ca0e8b73f9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488167, "uuid": "bc8642ae-d883-42b6-87c5-80cb2c4b1d43", "comment": "Malware payload (Glupteba)", "value": "284c494361ab28f209c6758b49c9ef74d9976a066208c68f929fb7628ae43aeb46c0a26ea5c52958c6450368e47692b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488167, "uuid": "e40aa31d-25e1-4484-b28b-368d75833dfb", "value": "T1601633127AF3CA76F03B4532E824A3764B7EB8344A2AA34B674D19DC6D753E07119387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488167, "uuid": "2482cc1c-d8c2-4131-804e-db36d0d03132", "value": "6ee40427bd7762ad5f5052f54b61377c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488167, "uuid": "cf8c9a4b-d185-4b6c-9211-61f7e20e25e8", "value": "98304:b83FP49YFJbxZ8R1Y1RJ8I9o1+HCzCdwj3cCNJZi5:oN49YFJliRBIoh3cWJZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488167, "uuid": "a3805874-7bf9-4cce-ac25-5a9441bf4cf2", "value": 4309912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488167, "uuid": "a69e208f-53da-417a-a03d-4108260c76c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488167, "uuid": "ba7b6d72-0dc4-4486-ab2b-32b5d2fe695a", "value": "24f1a1aec533bf6f13d89763b9e39344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc6400b-c71c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707463406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463406, "uuid": "6f3243ee-1673-4377-84e6-a529856ee88a", "comment": "Malware payload (AgentTesla)", "value": "2b11954002fef0ba5a4f65d60683d7cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463406, "uuid": "45c5a780-45c0-45a3-8061-50d66473f629", "comment": "Malware payload (AgentTesla)", "value": "63dc6a0b3e1c7c4ac5f8ebc5e7b1c7bce6796b615e2ceba9402629224a965ec8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463406, "uuid": "a9080208-06c8-4a94-86d2-2f7fdfc7e8ac", "comment": "Malware payload (AgentTesla)", "value": "b8ee206aac5342d8fbbc89c19d0acfa7d464c379", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463406, "uuid": "b934fa31-4a6b-4570-a2dd-06a2da8fc8f9", "comment": "Malware payload (AgentTesla)", "value": "ae6b35fd01840ab6e3987401acee1b09b0dc11b596ca120e31b04d56d63c60e40137afecd10963070e9c24ebb831609c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463406, "uuid": "bff46bc4-7269-41d7-9b52-d0ff2f8ac683", "value": "T1DEE423D18AFA772BC9A303B7262950404BFCC6232418F35A4FC3A5E97677B5059D0E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463406, "uuid": "b0e0d4af-b7b9-402f-8832-57e6f255ca17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463406, "uuid": "25c41d8e-b063-462c-8a99-4d7d6d109fea", "value": "12288:kExEd6ysuFg+UkiFdtNP2KLbAedg8jGERWVFScf6TVItNKI2bkHCLt:kExcfsugkiFxP2W08i5Scf6TVuJQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707463406, "uuid": "3665b0d8-a7a3-43e6-a772-b4ee03123432", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707463406, "uuid": "20f551c6-f5ee-4b9b-9909-c68d67b3288e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463406, "uuid": "6e603e9a-cbbf-444a-a91d-4f643ff9a76a", "value": "Odeme 4805012 Projesi image 0001 png .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3c604e-c70a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707455911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455911, "uuid": "0b3bab3b-173f-40d0-80c4-db4c2431ba6e", "comment": "Malware payload", "value": "c9bdda5d132a6990808880638480ab3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455911, "uuid": "f5081d2d-c457-4e5a-9e9c-250f4ec2687e", "comment": "Malware payload", "value": "6be199b8f7fc51cd947831147afa22f3080fbac4e244be06f7276bde4aa388e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455911, "uuid": "e6d5ccbe-ffca-4126-86f8-4eb56497dc07", "comment": "Malware payload", "value": "6eb1349a80a38d95e1cde1d8730985da5dbaa266", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455911, "uuid": "8c9a76b0-bf76-4ec1-99e6-995739890489", "comment": "Malware payload", "value": "1a6313346ce75e0c74a5f577207d991d5784e53b63a2825477a6a94b40453502e9333e97221a2bd08d9de5d4104e7b43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455911, "uuid": "a245b711-125b-4a52-91d2-d7d38364c722", "value": "T1EB847C1AF76404F9E4B7D17CC9624A02E6B2BC5A0360DADF13E446561F237E0AE3E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455911, "uuid": "f6fc02c4-d7df-45ed-a904-d1e3459172cb", "value": "6fb763944f109c2865f8b3ff08f1cf00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455911, "uuid": "2558b831-61e6-4c0c-91c5-4113ede6d419", "value": "6144:tlZcN5a7Hfz2zSJJ+C75itFq3Bz9DsgXohSrcWljxfgg1ta5Hm:zZcN52z2zm4QitF6pXocJYt5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707455911, "uuid": "1dbd4551-99d1-4712-8f1f-8e86e9620628", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707455911, "uuid": "bd5f1462-b976-4d05-98dc-93b09471d8ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455911, "uuid": "7ca0de34-b13a-491e-90cc-83f77923227f", "value": "SecuriteInfo.com.FileRepMalware.13580.30909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c25f989-c71a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707462545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707462545, "uuid": "eb86fcf1-7cce-4108-9dfe-3533ebd4a79a", "comment": "Malware payload (Mirai)", "value": "31fe8b316efacdc68634dfcab98a1c8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707462545, "uuid": "abdabe90-eb46-41fb-aaea-5313ae8eca10", "comment": "Malware payload (Mirai)", "value": "6c62a1b489409cb30e93bba0ee7042d780e22268f2e7a603fb39615aa5c19fab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707462545, "uuid": "6fba0e48-f9f8-45a3-a339-cced6070d1fd", "comment": "Malware payload (Mirai)", "value": "e6e4acdf2a3cfa8c1c3b54e4a0d1f0a85ed79d58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707462545, "uuid": "1accdd55-8f06-4224-9318-8b64f3214bb5", "comment": "Malware payload (Mirai)", "value": "90656d4e3688e6ef8afefbc04d75a0fa5f6713df422df35063547dc90e9bd41cff21f73e1e954cee8f0b17815a950483", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707462545, "uuid": "bc7345ad-ceac-4294-a847-ff910798bd51", "value": "T12F0302C5A3A77A76C06F94B576DEE8C60300A10CF0484EE66D1C72772B5AB4A771C277", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707462545, "uuid": "0b2ccaea-966f-43e2-887c-155a2fd4a732", "value": "768:u4KUe7iT3shjCFgGkSilDbzEJ2UJJyq+cE6oZyIop0rGnbcuyD7U1gURS:5KB7UFg3SiBzEwyWfnZJopIGnouy81w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707462545, "uuid": "42aedaf9-e258-4451-a83f-2cb57c73a00d", "value": 39340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707462545, "uuid": "f9912e5a-fb3f-4fb0-9b8b-4b56c8e85ac7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707462545, "uuid": "04a3ec42-9286-420b-956c-596675416750", "value": "31fe8b316efacdc68634dfcab98a1c8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01294bf6-c762-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BumbleBee)", "timestamp": 1707493423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493423, "uuid": "1fdebbc5-2470-4b82-be21-9df2a794f36c", "comment": "Malware payload (BumbleBee)", "value": "d8769fd382293268706609393b92136a", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493423, "uuid": "7c8e5f54-fbef-4fa9-9ff5-e82b37846ae1", "comment": "Malware payload (BumbleBee)", "value": "6d5a53c3e6acbb2df8030baa517621cb5ac3da32a0e7d82c9e7826ad7479ccea", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493423, "uuid": "c9f16297-f484-411c-b4a9-296ec0aed798", "comment": "Malware payload (BumbleBee)", "value": "21d0f34360edb6e630c8716799f8a60e46b82dfb", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493423, "uuid": "c18e33a8-4cca-4a92-bd66-2cd6b6281d6d", "comment": "Malware payload (BumbleBee)", "value": "2d370ce26627a815d749db760773bc3895450fddc8ac1f0c66d299f436f3427880affb29fe68b83d7e5f2ede7339124e", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493423, "uuid": "a6c04630-fe76-4120-a9d3-2cdacba74f90", "value": "T1EE930274DF815062CD3F2272F0B59983A80A035EDA1F996429E6A7DD8923C448B5EDCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493423, "uuid": "25b2c115-3148-46e2-8d6e-9da6b35abeb5", "value": "1536:Sw+8+0lfu/j5Q0KWn1o6DB+ZbuRqcwoDZc4+bhwTd81tlrJVhfIGgdqVw2X8Qr3X:Sw1flo1QG1FDFpZabhwTIXvNjgEW2XxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493423, "uuid": "20906ea0-1914-4388-b022-3fff0bce6cfe", "value": 96099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493423, "uuid": "e716000e-61fd-46d7-96cb-2aa0e2fdb000", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493423, "uuid": "bfce835b-5e9a-4611-a927-630ea5781fe7", "value": "ReleaseEvans#90.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08dfb9d-c6ef-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gozi)", "timestamp": 1707444298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707444298, "uuid": "ce75a9c0-759e-4e92-93fc-2b40a4020d44", "comment": "Malware payload (Gozi)", "value": "c661c4659c4ecc91fda3c192226878bf", "object_relation": "md5", "Tag": [ { "name": "Cridex", "colour": "#4738EC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707444298, "uuid": "60b53667-9674-414b-880f-725b925635dc", "comment": "Malware payload (Gozi)", "value": "730e35f847304e4d4e5a7aec86b1b39c41aecf29d445034439484689e1abff4f", "object_relation": "sha256", "Tag": [ { "name": "Cridex", "colour": "#4738EC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707444298, "uuid": "c423f77a-7618-48fb-9d16-a7a77b675b5b", "comment": "Malware payload (Gozi)", "value": "3f120537b9bd8fa0365ae8459d7394502a5ff511", "object_relation": "sha1", "Tag": [ { "name": "Cridex", "colour": "#4738EC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707444298, "uuid": "58a38126-f0ac-4131-94bd-929c37596c45", "comment": "Malware payload (Gozi)", "value": "dbcaa809f15f52e4566777fca432fb025b35445096ab7158ede8cf13856affa8042694109b78b75f0036319d1e39a088", "object_relation": "sha3-384", "Tag": [ { "name": "Cridex", "colour": "#4738EC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707444298, "uuid": "f8c9fd98-4e21-4fa9-825d-3cac9a1c0873", "value": "T12DA48C007580C032D2AA24314928E6E51E6D7D608F749ACFB7D57E3F1FB46E2A23975B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707444298, "uuid": "ffcc222f-d768-41d5-97c8-2df3cd2d0e5d", "value": "3a94ffcdb86144f7d0b6d92dd3393d93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707444298, "uuid": "475180b9-d0c0-47c9-a355-e1ff58a77282", "value": "12288:kHlAiJHCwjXvMHk37t4Mv//IfN/YoyL8ozF0nxatQ:kHltJHCkvH/IJvUWxat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707444298, "uuid": "427b1fab-433c-4db4-af97-388437bd843b", "value": 453120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707444298, "uuid": "565db3b0-192e-415b-b5af-dfd029084a51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707444298, "uuid": "f6433e95-30f2-480c-a980-da0ca925edbf", "value": "main.php.00_0006ea00.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83362687-c747-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707482045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707482045, "uuid": "1af799c7-db25-452f-a4e0-e501fe78e5e9", "comment": "Malware payload (RiseProStealer)", "value": "128e24d5ef841397092851ed86ac08d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707482045, "uuid": "d7bb5703-bb8c-4c23-bff0-4a61f8e11a3a", "comment": "Malware payload (RiseProStealer)", "value": "7315021a14a55639cc22757933a92e14928acbf8ea37dc4140786347a7849431", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707482045, "uuid": "0afbb56b-a251-40ea-b1e0-35236fd42d41", "comment": "Malware payload (RiseProStealer)", "value": "dbbb153fda08c76d723128634578bc33a3d79eb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707482045, "uuid": "5f9ab674-dde9-4aa3-aa02-6f5823f9a16b", "comment": "Malware payload (RiseProStealer)", "value": "aaee7d70525958a89369e452acfee453f5b30392bfc5920dd21a6ff8df3c4bb1487da935e01e5137c669f324eebe855c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707482045, "uuid": "94253ccc-5bfa-4e08-a7fb-545554133cfd", "value": "T186B523CEAE404467EA807A754CD4F6B8026FED44AD9244CD6CCC7A67FE77C192C27868", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707482045, "uuid": "f4e2fa41-a73e-46b7-9a3c-4027ddb40883", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707482045, "uuid": "e3b1c8ec-d068-48ce-94ca-91c6076aa795", "value": "49152:FGYvKD9o0FURImBRWHMU/pOS7m4x1CngcMkO4sewtUR7GliQ:DS9o0FUpRWHnkS7m4zCng94Tw6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707482045, "uuid": "a6661b26-46bd-47ef-ae0b-250ff81fb9f2", "value": 2400256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707482045, "uuid": "899a8f5c-2082-437a-9224-f1af1ded202a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707482045, "uuid": "0043af48-3e58-46de-a948-dbb3abc96e29", "value": "128e24d5ef841397092851ed86ac08d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b70aba3-c72c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707470247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470247, "uuid": "790c9a60-e19b-4a6a-839a-b1a8945cb729", "comment": "Malware payload (RemcosRAT)", "value": "6c8cbdc86413e22170390a8d9c482073", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470247, "uuid": "324e5834-3255-48ec-a184-dc0e560ec438", "comment": "Malware payload (RemcosRAT)", "value": "737cedd9e82602536f0b02d2608b856c49b158928de47bb891d401bae810bdc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470247, "uuid": "251b37a9-3738-470d-a9a5-3d4ace5e2e90", "comment": "Malware payload (RemcosRAT)", "value": "18c47e58c9f19d5e5a47b661a41063bce7008ec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470247, "uuid": "4c107cf9-0335-4663-934c-bbcd1a6716ca", "comment": "Malware payload (RemcosRAT)", "value": "6ad99732b1d551240822269979fe171a0dad8becec11392d437cd1cf7cd067eac51db488c203766d780ae9a907f5baeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470247, "uuid": "f198671a-1b00-4089-8f6b-8c3f3cb5e37f", "value": "T13525E09C765075DFC80BCD7689A81CA4AA6174BB930BD203A06316EC9E0DADBCF145F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470247, "uuid": "0c556447-70d1-4537-aac9-ed4357b9ef61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470247, "uuid": "5df0da50-bde2-4604-b007-3e5429f7b8ce", "value": "24576:EGUmDDxcxFlRhhXOYtiP1mD9qL6EwthL3LQxM7OyeNBnVj/K1:EGZfx+vRhOi9qathLEm7OrvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707470247, "uuid": "3aa96865-72ff-4ccd-a44c-7dbef037a430", "value": 1037312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707470247, "uuid": "23bd6269-e8f8-4602-9ff7-951a120c53df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470247, "uuid": "7650b5cc-bb8a-4b4a-a896-36258251f9cb", "value": "SecuriteInfo.com.Win32.RATX-gen.13379.23173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8a2967-c78f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1707513016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707513016, "uuid": "b4f91dd5-9ac9-4d25-b0da-6811806b52ad", "comment": "Malware payload (njrat)", "value": "3f3186f4be8df39294c1a53f1cd22214", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707513016, "uuid": "d9e5ade1-4b1a-494f-a7b2-0ad042d6f65e", "comment": "Malware payload (njrat)", "value": "73dcc6e8f005fafcfedfb31d8465ba9f51cebe4b359f5b931765d3af5c10fa05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707513016, "uuid": "40467e50-341f-46f6-86a9-b444bfa11980", "comment": "Malware payload (njrat)", "value": "a312a3bb6eb240ade59f390e551a68f6c93ff4da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707513016, "uuid": "e1b78eb8-bca0-4cfc-8868-52e001f02c20", "comment": "Malware payload (njrat)", "value": "c525760f98e1cf38a6d8089c55c1bd80b8a0d4b639601538ef3e560021862905a7ffc98504b496fa615ffaa96d027179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707513016, "uuid": "f25e2939-0e2d-4bcf-8bab-737e0f0a3c22", "value": "T194D3294677495BC2E46C2A3610AEE6328630AC136A52E27BB4C13D6F77F5E815B037D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707513016, "uuid": "5e586d4d-f900-4b73-af89-6e10ee91489b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707513016, "uuid": "c96da187-614f-4f7c-b6c2-f810bcaf85a6", "value": "3072:jAosPoN36tCQviFC5EBnFfWl9zraF9bKYvMEwV8vI2EAOsV1/PPMCETO:j6t9zOvMVVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707513016, "uuid": "e46ecc11-7bcb-4357-827c-a3268460d0e1", "value": 134656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707513016, "uuid": "e7195ebc-f67d-4d56-9029-2ed8070018f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707513016, "uuid": "d1a2a05e-8b43-4349-87b6-c8e89150969d", "value": "3F3186F4BE8DF39294C1A53F1CD22214.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ef69f6-c760-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1707492898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492898, "uuid": "86581f39-f552-4ad8-92ee-2c7500018a8e", "comment": "Malware payload (Smoke Loader)", "value": "662bcd1f5ad0f99508002d4562f42869", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492898, "uuid": "c227ec3b-5956-4c1d-9521-ff90a65be31f", "comment": "Malware payload (Smoke Loader)", "value": "782bdfd0de0d78f62dc62dbfc64e50e0f1dbaecf04340fdd41aa2da00e0ccdbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492898, "uuid": "441fab6f-9bbb-4589-a2f2-8c293a148883", "comment": "Malware payload (Smoke Loader)", "value": "4e1d6a634ad1de7a5cbbb4f0cc02280c5b01e832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492898, "uuid": "726dd15f-0e01-4bdf-825c-3926b7f9b293", "comment": "Malware payload (Smoke Loader)", "value": "3ae2b52074a744969d967beca839ae2642565ee2e358e6d763f9d1ec7f75e03c0948f2f62db1f97d73b95d96ae05e12c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492898, "uuid": "2f91a67f-ca46-4ea1-aa1d-c28e92981373", "value": "T10934CF21BAE2C072D5EB45706871DBB06E3BB8B13771807B2356C66F8E703D0DA66752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492898, "uuid": "c0e8f2d2-b276-4ec8-9c1e-7201fd9a0eae", "value": "4696cd4eba2b1db3a82c2253e8f38d96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492898, "uuid": "8c638cc8-0daa-4c8f-b9f7-6856d315eb26", "value": "3072:RNS+H6SLytAwHtxNIN3N3QRlCR/rjbeIXMoZjnO34Gtgc9t8Xk+5YQ0o/8B:1aSLy7tML3QRlYrjVDL1c9eAQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707492898, "uuid": "0ad1cbcb-d692-4297-9dc8-3ef448daf501", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707492898, "uuid": "57af1c53-8d5e-4d6f-8a1d-90640b924016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492898, "uuid": "907b93b4-f3bb-418e-b8f4-f5d987bac8d1", "value": "662bcd1f5ad0f99508002d4562f42869.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9378a48-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707488122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488122, "uuid": "b62797b4-f44a-4182-a209-0c4ca5490dd4", "comment": "Malware payload (Mirai)", "value": "28635c8ac2bb87f930e98dc309db1cda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488122, "uuid": "6f332b87-71f4-434b-86c5-64724344bed3", "comment": "Malware payload (Mirai)", "value": "7a7d20c9be658c02524e4b069a197ae49ee575fb9aaf7065bada9cd8e9b336b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488122, "uuid": "7a4477c2-9c08-4733-96bd-9e9041848f22", "comment": "Malware payload (Mirai)", "value": "3452d5ace8c2f5ddba9e44bc96446154badecd36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488122, "uuid": "4e527cfb-9614-4061-a8dc-eeecf31bec50", "comment": "Malware payload (Mirai)", "value": "c7da9d3f3289ca0c5b04ea12d6cd98ff4d144f88066a96d8880344c7025332c8ce0270cd63c2ba88e1760744f7934a1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488122, "uuid": "ac3dcc71-9018-41b4-890e-bbef0b7e6402", "value": "T179633A92BC819A02CAD412B6FE5F518E331623D9D2EA3207AD15AF2037CBD1F0E77251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488122, "uuid": "92097657-44b5-4e06-a832-ba2cb584acbd", "value": "1536:/WloK05nJ7xkC0ztNrB28keEWwq04OVW84lx1RVvH:/WNY7635qOEfXxVWp3dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488122, "uuid": "fe3c0565-3fe5-48ca-9947-ef3708448933", "value": 72004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488122, "uuid": "95e44fd9-82db-4cd2-b132-e8c2118371a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488122, "uuid": "f6e1686e-642a-41f5-ad28-9561c54edc60", "value": "28635c8ac2bb87f930e98dc309db1cda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd231ff-c754-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707487462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487462, "uuid": "4edc66f7-cc3d-4221-913c-33d383240cd3", "comment": "Malware payload (RemcosRAT)", "value": "b5885c8a50a8a916a1b4b809e1cd4f19", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487462, "uuid": "1f0814e0-0418-47b6-964b-21fde876e206", "comment": "Malware payload (RemcosRAT)", "value": "7a8a011ca79dfcad024ec5e69d801eecde1c2f63a34859d960d9b97e23440326", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487462, "uuid": "a03f0e95-7d31-4719-af56-9b066aa4c2de", "comment": "Malware payload (RemcosRAT)", "value": "455058342040a3a3809aa1da43df84b659051ca4", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487462, "uuid": "8abb3ef3-29b2-4a05-8e0f-5e8a14caf55d", "comment": "Malware payload (RemcosRAT)", "value": "58069dbba9f0c6deb7bf71088ae1040b74144e496e45800c3f1c7bc4193457bd78a0a597c896137d48db878881cc4686", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487462, "uuid": "87dcdde3-cfbb-48b3-9574-644294ef0de5", "value": "T1AA0523EE7C681CB1DE7F50B42272732A26EFA269E0C51011EB64B744DC4C77A2764E78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487462, "uuid": "e761dcfa-e7de-4dca-97f7-40bd3cde7c1d", "value": "12288:i4YF29MGR2NAAJ+FGEr1RqoH1belXl+Kpl0V42S42JChgk+aUh+pBb2Q:i4YKbgOjwEr1wMelVPlzhh3aU0wQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707487462, "uuid": "3763ea60-a5d8-4376-b9f0-cecd4abbf1f4", "value": 826551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707487462, "uuid": "a24485ca-f975-4cca-9242-9fd6ea572538", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487462, "uuid": "6b88c5c6-2eac-4a71-bac3-6facbca6a669", "value": "ORDER SAMPLE 2024.R00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97edb36-c74b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707483908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707483908, "uuid": "fe021e6d-c2dd-4e0b-93b3-67e14b76b8b8", "comment": "Malware payload", "value": "99b517d910d9d0d8ed8d28b7373932a2", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707483908, "uuid": "977509fa-6d78-4656-b357-ab8c87aa7a01", "comment": "Malware payload", "value": "82242a1cf275f1c2f798069535e2e1dff5ad11b5a669ca7d5b133c3073223842", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707483908, "uuid": "94c61ba8-2f93-4841-ad4a-c99e8c44fdd7", "comment": "Malware payload", "value": "6afc4839d62760f0cd2d82395c5e21df1f5e46ca", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707483908, "uuid": "635adefe-7b1e-4de1-bd21-37ddd5506ebc", "comment": "Malware payload", "value": "25191cd47e1bb92b0e57b01e5c107992b3a40b35668f9d13c7d62969d2143539a5b0aad8486bbb4cd3c03906bbac42a4", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707483908, "uuid": "154f73e5-feb2-4b82-ae14-01cc0c5eb3c0", "value": "T11345F12B5DC6B995C1998933B3A955DC02F59E2FBCC5E367188C72F4CB3538A22025E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707483908, "uuid": "87985d8c-7855-4c43-b7ce-8fe66ba1191c", "value": "24576:p/s41GsJNI55p3HbCgVQu7hdmr1ObrhzE24b/xk:u41GkybCguue1yhgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707483908, "uuid": "82f93f44-e9e6-4c87-8599-1f55cd93d5c7", "value": 1195643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707483908, "uuid": "7082c2b5-523f-4853-bc76-f9f50ac9f85a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707483908, "uuid": "7f6d445a-cc36-4cac-ba2c-badce2722391", "value": "Promac S.A.220172615415415.Tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfaddb3e-c760-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707492937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492937, "uuid": "454ef34d-c8ab-422f-b892-1cef1106319a", "comment": "Malware payload (LummaStealer)", "value": "b2b42c58a4d6aff955bf0fc29078f3fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492937, "uuid": "9aba9ff4-3f5f-41e4-b0a9-2521e5184912", "comment": "Malware payload (LummaStealer)", "value": "858dc05150a542fdcdd27cd997c76e483fd0b3139f5093648e9b27c36eaf9f0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492937, "uuid": "20f03908-3f45-43f9-bef2-bf5b883303f4", "comment": "Malware payload (LummaStealer)", "value": "0a961d01fa12658e9629d967a7d0088a4d43a6d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492937, "uuid": "8b7a6800-face-434f-9202-017fb23720ae", "comment": "Malware payload (LummaStealer)", "value": "b1c88b9be9ad6afd74ceaf3e4c82c6abbeb4a50187b2d4ae9c62868ca244f947b0e7181a4f331a9efd7df3409bcaf443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492937, "uuid": "17a581c6-b16c-485f-89c2-677fc58010b8", "value": "T1C4A40112F6B2D171C1AB85B049B1EB941D3BF8B2E936C25F3365076E7D603819B2235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492937, "uuid": "904f7765-d3a5-4652-be50-27ecf9b7fdc0", "value": "41a023181e1b42ebf113f2f55f4ea949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492937, "uuid": "e849bbfb-9230-4018-ada9-b1b59487b341", "value": "6144:k+ZLgd7OItE85NLCrA+YyrOZelDpsR0TwDkayLbemyKHeZX8q8ZRQy:kCS7OMrLyrRDpsiTwiLymP+58dZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707492937, "uuid": "eb07b6a5-d5db-49f7-80b7-c3fb472d513d", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707492937, "uuid": "ffca4232-0827-4da7-a425-e6220ce13e04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492937, "uuid": "c6f0f1d3-c81d-445a-8b04-95e8ef60b80c", "value": "b2b42c58a4d6aff955bf0fc29078f3fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71a4eb8-c762-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707493782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493782, "uuid": "29aa72e2-9d43-419b-b4a1-96c74fb948e5", "comment": "Malware payload", "value": "4450d744e59a060293f0ac117d2abf18", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493782, "uuid": "9fc62239-a6a8-415b-868f-a79ef3dace32", "comment": "Malware payload", "value": "85e904af4707e459016250ccdecc29113177396da19e875d2035ce60ca357429", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493782, "uuid": "53c5f1c7-0816-4ad1-bad4-cd420819066a", "comment": "Malware payload", "value": "933a22312981a12c9a7d6b553de3d63c86d594da", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493782, "uuid": "57433243-29c1-44d2-bead-8997fce73f4e", "comment": "Malware payload", "value": "1bf2e0f368826b70589e57ec852a6e38bce22b948a5bb29ff505859e0de95765296c799ad0f51d27db16671dbe13389b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493782, "uuid": "ef42bd82-b357-4894-b2f8-0a5ac467126c", "value": "T13E431E6C98DBF4B0231E77995EEA5CF4D5AE195CC2C1088B780CBBA09359B06D8D44FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493782, "uuid": "dfbce8c6-6b4b-41fa-b387-08d27fcbc07d", "value": "768:X8jz9PlD8P+LGoUw6pdT7T7+Iwy+3J+GWQw2W2D8Z+kwNM0CC2ondJCwkz26j6ja:X8XDv8UDhsdDddURqTVxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493782, "uuid": "83efe878-44a5-4aa4-b462-302600a72090", "value": 55934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493782, "uuid": "254f4fe8-367f-4c89-926c-77f71de08caa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493782, "uuid": "a989e246-47d5-4571-bebd-943d08bdfd53", "value": "Qum.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc44006-c75a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707490220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490220, "uuid": "07d9bed9-e9cd-44f9-9199-acb2346496cf", "comment": "Malware payload (RedLineStealer)", "value": "ba90a65470771d464e5468506f0ef11f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490220, "uuid": "6394ceda-54a8-497d-9b63-6b6f6162900e", "comment": "Malware payload (RedLineStealer)", "value": "861ddbde9e32976e5a35a266c8a6eb8de0ded75940d03a99bb7d8ad5126ad972", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490220, "uuid": "eeb67141-9ae9-48b1-8f68-4e64fdb64901", "comment": "Malware payload (RedLineStealer)", "value": "2cb30138d0dabdbbaf8a9695f406bdf207262d7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490220, "uuid": "ba03fd9a-22a2-4e43-89a0-326b31ff1352", "comment": "Malware payload (RedLineStealer)", "value": "1c78a93dd63c6393aed1817b51aeaedd40717c9798bb8a219807f7a52ebacd4e87b8221dea2370495f44f49b55651e0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490220, "uuid": "819d95d8-6d66-44fb-aef8-4275220f234c", "value": "T182A35D3067AC9F19EAFD1B75B4B2012043F0E08A9091FB4A4DC154E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490220, "uuid": "5d59cb61-4c18-4066-9570-37d9001d855d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490220, "uuid": "225ce57e-2fd4-450f-9cde-baa5f4845eb8", "value": "1536:5qsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2+3tmulgS6p8l:XEwiYj+zi0ZbYe1g0ujyzd88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707490220, "uuid": "80a97374-1c49-4c9b-9d19-da7051f98983", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707490220, "uuid": "36b2ebbd-4fc9-4ad9-84d4-e3ff9a5a5e5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490220, "uuid": "48b44423-c5a5-460a-a6c2-5cef352367ec", "value": "ba90a65470771d464e5468506f0ef11f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9c0fb2-c760-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707492904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492904, "uuid": "39cda641-95d2-48ab-b67f-257b713b6527", "comment": "Malware payload (LummaStealer)", "value": "5bafee417a1fa7f8dd43ecdd3e6dc108", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492904, "uuid": "6821e998-3912-4480-b7f3-9eb5885a4361", "comment": "Malware payload (LummaStealer)", "value": "86812561eb83d96e914b8daedb39900a91d9b42b53b2ef829522803ae9f7909a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492904, "uuid": "0e0f0a7e-d94c-419c-8ccd-470d5972107f", "comment": "Malware payload (LummaStealer)", "value": "c6636760baac1dbd51bff21dac1f3f80436fda82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492904, "uuid": "9f838d64-e668-40b6-822e-b95046497c66", "comment": "Malware payload (LummaStealer)", "value": "28b5a6756f9e33ca7ef9fb1462bb1c4c965df64e5ca606aa91d8d5edf252a47a850ae67b111703c415fd56c59f427dc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492904, "uuid": "a9d7f25d-a3bf-4b78-8407-a265d10278f9", "value": "T1F4A401217AF2D071D2FB45B05F3DDAE05E7FB87256B1804F33650E6E1EA06D14A2A326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492904, "uuid": "0ac5623d-e91e-408d-a2dc-afd1ddd268f5", "value": "4696cd4eba2b1db3a82c2253e8f38d96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492904, "uuid": "dec7821b-a4fd-49ea-a0fd-badb582bc7a7", "value": "6144:63LU1WxQzGZ/jRoQ1/KkMhnlRY9mSg3EOew77rBstrTcxNSROlj3eB450V:oqWxFZFtAHhnc9mS8f/HxNHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707492904, "uuid": "3cb477c3-0438-4c5f-9eb8-10438a2d0d18", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707492904, "uuid": "d3e91f54-f642-40c1-a67f-bff5f307070f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492904, "uuid": "803c3ad3-7119-495e-9224-1fbf6324ac52", "value": "5bafee417a1fa7f8dd43ecdd3e6dc108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a941c07-c75b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707490647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490647, "uuid": "6c4f8003-7d6b-4934-927b-338e757d7a14", "comment": "Malware payload", "value": "62d02b5648da6ce427a039f0155af98e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490647, "uuid": "560a65d7-e523-4154-b168-bbb78aa63176", "comment": "Malware payload", "value": "88c88cb96ee1124683bc3518d2dccb529bd850e7cec402db8839782995a63117", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490647, "uuid": "d9610604-669a-4ea7-9a18-5999709d30d2", "comment": "Malware payload", "value": "ed0889bd0b62a37254781c7c22951c444786b872", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490647, "uuid": "0ab4bcda-b2fb-420c-ae79-4b8f15ffeb99", "comment": "Malware payload", "value": "089c2a5073225bb9435f11a7f0c2dcf099f01eccaaa713ed364bc2e7287de93b639e72344549491cdf176357026ebde8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490647, "uuid": "47b74ba6-df72-40b7-9ad9-6845e67483e5", "value": "T1DA53C79E75C3FC88139BB6B96D6A1CE0E41E0564C0D42C0AF44AA799D39CF0AD8D54FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490647, "uuid": "1f816a87-029b-43f1-a0d1-92af30f74d83", "value": "768:dB7OnHw1dRFhedf7UccqE6ibP0ad8J72l3CKtPHk3/Dra0g3Q2WQhBTQLmJToIca:dB7N+QURNNJZj/3y8+nzTVSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707490647, "uuid": "930df3f9-1014-43c6-9a1d-5299badb3cd3", "value": 66593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707490647, "uuid": "9cc2da10-53da-4a66-835e-28cb8b0ad506", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490647, "uuid": "37e6ee4b-0541-450a-a314-6cf0bb71dbc1", "value": "Notekx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c3087b-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707492995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492995, "uuid": "7bcbb17e-b8bb-4b6e-9c70-bff5f0ae0a77", "comment": "Malware payload", "value": "b7bee15549f9a66f9596d59ec90d6934", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492995, "uuid": "6a000124-3324-4557-bb8d-ba9ffed0fd63", "comment": "Malware payload", "value": "8a1f0954ef7b25ed4f3d26bb07345d98d492eb4088675bd8c754c9b04bc72993", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492995, "uuid": "a5c3fd59-9fa4-44ee-8190-ba8861ed36f0", "comment": "Malware payload", "value": "9d574b18a22601992328e3dab46c471eadaef536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492995, "uuid": "b4d802e8-a5d5-4678-8b06-34b89612d583", "comment": "Malware payload", "value": "5ce1e808444f2d86f25d0b6b5756ec6380576bf33a0b7c0a80a3db7a57271cfd77c7c57581b16d9fa0e533001202876d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492995, "uuid": "5503b791-25c0-4385-b81a-bb321cc0677c", "value": "T12226CF42FB858172E5D3917512FAA37E493D6C30A73585C3ABE0166ECC306C2B63EB95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492995, "uuid": "56e77642-3b39-428f-bd03-87a9bfbf28cf", "value": "2372a510663575e218ece860e8ec85bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492995, "uuid": "acf6c736-5bda-4758-848c-297717af8465", "value": "98304:27Mp2Rd94o1X4aPvJNhh/lSu8eP7NUSWa1Q:642Rd95eqVh9/VWai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707492995, "uuid": "32f71de1-747f-4feb-99c5-2a433dc5967d", "value": 4747504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707492995, "uuid": "f96fadd6-1718-459f-a488-e6159b3ff1f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492995, "uuid": "0760e69e-35ba-4d65-9675-f4005eb31aec", "value": "b7bee15549f9a66f9596d59ec90d6934.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365d6763-c738-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707475473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707475473, "uuid": "c207adba-3a6a-41c1-b93d-8311c2154fd6", "comment": "Malware payload (RiseProStealer)", "value": "64ef3bb8331f21ff49b01d377fc02e33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707475473, "uuid": "72da2c52-2120-406d-b72d-c917b6ebcb18", "comment": "Malware payload (RiseProStealer)", "value": "8a8091e7e810e3f36a9ff56bce7fc56eea0eb3cfcb3e3a42cf85dca137779e52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707475473, "uuid": "0e26b2a4-0a16-4085-baef-9e85e7002c82", "comment": "Malware payload (RiseProStealer)", "value": "2ce21a06a879fe291d1579f96ba56fd669ab1ef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707475473, "uuid": "2690a1a3-f77b-4078-ab1a-998faba7431d", "comment": "Malware payload (RiseProStealer)", "value": "c296b5910d057251179292b504aed7939b6ec7d29a74f0da1f203a1ed137e98b2d191f1729621cd61bec44adab890347", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707475473, "uuid": "7e3979c1-e946-402c-b84c-d1854fe33c68", "value": "T104B523CDAC01459BFB49BB7508C3FB79012FDC95BE6950CA48DE7B2737B6A168813029", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707475473, "uuid": "6fe1cb03-53d4-4773-b4c7-23e0e228c665", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707475473, "uuid": "b695590f-5339-4c70-9ffb-13c5290a477f", "value": "49152:tqSMemDhqmXJamci+TZAeIfS+p0LDX3KUEU+gXeil47u9z:t3mDhTJnGVIa40PUULXTSy9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707475473, "uuid": "12a98596-30b5-4657-81a1-5f3e31873635", "value": 2436608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707475473, "uuid": "cf09be2a-8cab-405a-a6b1-10b721e7307e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707475473, "uuid": "efc57b6c-f51f-42be-854c-447521278e9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5fb8e55-c6f7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gozi)", "timestamp": 1707447878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707447878, "uuid": "b291ba83-0963-4bc6-b594-c55786f9ba98", "comment": "Malware payload (Gozi)", "value": "7bb8b5974a947f223ae2b9517a5641d0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "UrsnifV3", "colour": "#A4F95B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707447878, "uuid": "44c58fa1-6035-417f-9a69-4752b2a914e0", "comment": "Malware payload (Gozi)", "value": "8bf69fe9bf7e1da499c6b18681b836b3dbf31c1ceb304009354217e95bf11999", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "UrsnifV3", "colour": "#A4F95B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707447878, "uuid": "35b6ea64-26dd-4d5c-82a0-ce7e14e9eb1d", "comment": "Malware payload (Gozi)", "value": "3dd551351bb7a15a9bb3b3b09611b4b9704e4e91", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "UrsnifV3", "colour": "#A4F95B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707447878, "uuid": "59a0b7f3-5726-4bbd-ac3c-66285dad5458", "comment": "Malware payload (Gozi)", "value": "33cbcec9db49a131a19ebf69fd789fd627a4cf5d2a694cd1a53f4b84acd8919dd0fb6e7e0e80d10ce6e2116d36c7681c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "UrsnifV3", "colour": "#A4F95B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707447878, "uuid": "228bbed8-36c1-46ab-841b-d5f20d1bd6ce", "value": "T18603E122BC0800F6F30F4E702996B9A8EEF3535755479CC6C50B9C695BCBA5ABC7D122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707447878, "uuid": "657ed48e-b489-4602-9d08-b795cf06bfdc", "value": "4139c221d1b6b96f238c97b827c3e63d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707447878, "uuid": "c27d6ed1-3022-40e2-82ae-855f316fd442", "value": "768:Gn9UckpReivxim+Ky3Yr4YWtaoOGIHnef+Y0cQCKScVsy:CYzFi/IrUQo8HzScz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707447878, "uuid": "55714386-bcbf-44aa-8018-2fb5dc832781", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707447878, "uuid": "04cf3ff9-4fd8-44dc-bba4-79cfe95c7681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707447878, "uuid": "7f7e49b3-d078-4679-8b25-c82a63e5c992", "value": "eb5218ce153db41158bdf7700ae8a51e415a418bb63896b3a7138ad49b520598.8cd6_9a00.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f13376-c6e1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707438355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707438355, "uuid": "04e78350-7604-4996-a521-e3b0612feecb", "comment": "Malware payload", "value": "f359a44becca01d21e21abecfadf9582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707438355, "uuid": "da44ac9d-a90b-44d3-9c4c-783c9b71d936", "comment": "Malware payload", "value": "8cb3130ea4478724d11fc1cdd480bd82bbee33888b87d27551155f449b20ba75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707438355, "uuid": "eb99e40c-d70b-4ad2-bc1c-8f0cca58a5f7", "comment": "Malware payload", "value": "e8907b7da37074e185a9f89c72c211b0e699d952", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707438355, "uuid": "31b2c606-dab2-4ad1-a1c2-a9d606c00dde", "comment": "Malware payload", "value": "494008fd75b7e9fa7a4ff2351c5c0376ae34ea1ab2953fc48ab2e4717a133eac741dbb0f92d5b78fab3745934f326382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707438355, "uuid": "2ae2b257-1d58-4440-bd13-acb989a457a8", "value": "T182A54B23B284613EC46B1E3E15679A6CBC3F6B61E5968CD74BF0194CCF351812A3E64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707438355, "uuid": "4021335c-2fec-4c2c-91a7-42463865e76d", "value": "b98923e520c238bf5e41d1144e691eb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707438355, "uuid": "bd79bf2c-7418-4a85-a4e1-02f63722e75d", "value": "24576:PTt1a2uxXAOxUi4kRtFv+xai3Cg1BuShasapy8GetCGECYJZMTQBCVunWzh:LfaDC1EShnqgAdTQBCVunW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707438355, "uuid": "8b8a4234-b236-49c5-bf6f-b49dce231a3d", "value": 2093568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707438355, "uuid": "bc985719-6c18-4088-8ac2-5512d76c0197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707438355, "uuid": "5c339694-04aa-40f6-8b9d-5e24200413a4", "value": "SecuriteInfo.com.Win32.SpywareX-gen.26600.4702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe2c948-c75a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707490200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490200, "uuid": "14066e4f-7933-4354-bafe-0d2a63cac7c7", "comment": "Malware payload", "value": "7a2723127293be21d75a56419ba9cc89", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490200, "uuid": "a4942101-6abe-4e97-8ae6-2628f612988f", "comment": "Malware payload", "value": "8e84ca61bdf321648cf32a3136959d068e3b411a47a3994700a77c5d93febf23", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490200, "uuid": "76bee87a-98c1-44cb-bd4a-d7bce4dbeb4d", "comment": "Malware payload", "value": "b53eabe0d64e21bca61346de67016b86773b4d8f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490200, "uuid": "9bae184a-0aca-4175-bf51-2730335807f1", "comment": "Malware payload", "value": "62a3445cea32a9e9c4a1b86987c0be5456d5a2ef04a50aae81c1f7aa151a480ab34800d4aaef9b9622101ecc5a084ec1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490200, "uuid": "39d5c65e-0f95-4834-b1fc-15bf10a1d8b1", "value": "T118372311BACBC632EA3E41369568EB3F21BEBFE2077144DB63D4399A4DB04C15275E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490200, "uuid": "a840ea12-b09d-44aa-8e30-0a82468bffea", "value": "393216:U4tigj2RnKYSLikaRbYmjBcjemd4SZqsSbnCM0PkK9EHo2stP+DfM16:UItj2dmika7Kemd7ZwCL84BPefMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707490200, "uuid": "c5d7b111-74ba-4f8c-ae32-42da8dae7ed4", "value": 22406144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707490200, "uuid": "d4dd6d59-1411-414c-809e-077922448db8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490200, "uuid": "6a449ef7-a68e-4ad3-9f9a-cfcc96c8effd", "value": "Df.mes-25664.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f184586-c70c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707456590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707456590, "uuid": "64a13e48-51af-4775-9bb1-ff2308310126", "comment": "Malware payload", "value": "b077d33f58db73dd013c079bb435efa3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707456590, "uuid": "ebe47bdb-1768-4871-82fa-a617e658f609", "comment": "Malware payload", "value": "9195c2f38b5942ec45f56b6a236e73f315da51ad2353e98c44fa9b6fff2f9c29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707456590, "uuid": "797751f6-a602-4179-9863-88fa5136ac57", "comment": "Malware payload", "value": "cfbb65c511510ffb8d09b4b8fbd50976012889a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707456590, "uuid": "f9ff1209-5304-4d07-adcb-c2a5f8ceaf5a", "comment": "Malware payload", "value": "1368fa1dc92aee452f184bb5c61726354b61bebece2596c27cd4fe5406313df91c4c8f4c569df753cbae0b9b4dea9068", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707456590, "uuid": "aeb4023b-539c-4b53-91cd-c3f2646db18e", "value": "T1DDE5337463B9C173E48B39798932F7A64764B524A431E90F86EB05BB1F37E91693030E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707456590, "uuid": "959958aa-0c92-4c8d-b6a9-5afc6729be79", "value": "55e8353f802707422a3462a3bab24fd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707456590, "uuid": "c2bb5a44-fe02-4059-8097-e39585fc25c6", "value": "49152:yAOwk9o0ADufC5oDFOP3dpQKrn3E7T4Yk6Vvr3SZofU1J5z67hF+mJ:y6xPuCCFOP3deKrn3E7TWIzoof+E7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707456590, "uuid": "2a26ffa5-5e4c-4be9-88b5-5498596a5fcb", "value": 3283968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707456590, "uuid": "02654497-808f-468c-920a-3a7b11abd927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707456590, "uuid": "8c8e7159-086f-4c81-8313-fe400d5da80a", "value": "b077d33f58db73dd013c079bb435efa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee05df07-c760-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Nymaim)", "timestamp": 1707492961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492961, "uuid": "bef86d4c-0f37-4a38-84ea-ed4caa6a4c78", "comment": "Malware payload (Nymaim)", "value": "96a21973731384cb66a8632eeb463685", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492961, "uuid": "57c6bb85-dfa5-4b26-8ed8-765810672ef9", "comment": "Malware payload (Nymaim)", "value": "91ce1af73ecebceb580a76af5c9567e61a8aa339f7204b56c87f1380e2e1355a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492961, "uuid": "16997250-2a86-441c-b779-fbb3247fff3e", "comment": "Malware payload (Nymaim)", "value": "4980b5b6954f72c96791ddbc2b4d25acab5fa605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492961, "uuid": "b102eacb-2fc6-4daa-9840-7fb5b1e8b8c5", "comment": "Malware payload (Nymaim)", "value": "5bb1a5f1fbc84dd5387fc8eecd55e0709eab9c6541a069ad54aceb5509e652b01ced03bdf4933106f75792d1342e503c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492961, "uuid": "b8a59d60-d46d-4b4c-8221-443a08317ee9", "value": "T19A54D021BBF2D872D2A759754930CBA45EBF7C322930824F6768277F5E247D08A26317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492961, "uuid": "89e1fbe0-95b8-493d-9627-fb977f7855bc", "value": "41a023181e1b42ebf113f2f55f4ea949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492961, "uuid": "a62deba0-1b3b-4512-a3e5-f8061d50348f", "value": "3072:IRZwxfC1isa2L8k6Dm3X7zPZS/0zHfscbEoPrQcCjdjy/NRzFGkCWi6FZWIkigMZ:IAN2LMm3LzBI0znQS8cGy/LzFGd6fLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707492961, "uuid": "d4b19249-849a-476f-8aaf-01735d5997a7", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707492961, "uuid": "a0efddfd-8d08-4e0b-94ab-946bebf874d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492961, "uuid": "c3c894a1-6472-4ddb-9fc1-674d92390d16", "value": "96a21973731384cb66a8632eeb463685.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27c1b67-c760-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Nymaim)", "timestamp": 1707492888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492888, "uuid": "86259dd2-a4a2-4ebc-98b2-8d69623680f4", "comment": "Malware payload (Nymaim)", "value": "96eed3415358ad2231c2d5460ce07ce9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492888, "uuid": "9bfbccd6-20e9-41e1-aca1-75204f80d9ce", "comment": "Malware payload (Nymaim)", "value": "93a00303cbacbe5c05da3b4dc8b77abb6bf4787034101d757c2ba85bdc3fc2f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492888, "uuid": "baf5f4fb-5d2d-4602-b032-89ca8e9018ca", "comment": "Malware payload (Nymaim)", "value": "01615a3c57fe6ea7f702c1955aede24aee9284a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492888, "uuid": "8dd709cc-d911-404b-9481-ec7be7f75b62", "comment": "Malware payload (Nymaim)", "value": "8da6ab712594d53ace87ba45864036aba622569f5b7831c37972c835a3555b0f8ad6587cae9ec2f28c38e354ac99b073", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492888, "uuid": "b1c20bce-1b44-43ad-959a-8241b2b48d2c", "value": "T10754D011BAF2D931D6E7597648308BA44BBBB8312970824B7769277F5E713D05F26303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492888, "uuid": "8dfbd8e9-871f-4acd-a1d3-d5fd4d4d9a85", "value": "4696cd4eba2b1db3a82c2253e8f38d96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492888, "uuid": "1bc1c407-4ee7-461f-8ea0-461038d5aab6", "value": "3072:hJ5UkRMLkM6WVG4buXqTyJwXyZSz9bPmiYlrTai7ENClyq/7ef9KJioaMX8+5qmV:J5MLZV/TdDz9bP8lrTlqCQeqgbDa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707492888, "uuid": "48a0d182-a0dc-4689-952f-776c30e80984", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707492888, "uuid": "a208f2c4-4db3-4e17-8440-6fa19c38b3e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492888, "uuid": "82b4610f-926a-44dd-b4e5-f40d3d2e268f", "value": "96eed3415358ad2231c2d5460ce07ce9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b516edb2-c6e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1707441326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707441326, "uuid": "ba99b463-fef3-458e-b6da-b13b6adb42ff", "comment": "Malware payload (QuasarRAT)", "value": "a86c013ae0ea0ebcf21bdac157b621f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707441326, "uuid": "a4f3a567-b66d-4a6a-8a07-4cf4213112bb", "comment": "Malware payload (QuasarRAT)", "value": "93b60d5cfd5578af14ad3073112a63d595c285e85c48532ea49d5ed6e51c95e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707441326, "uuid": "bd99bc04-25ac-48ba-9587-f551a97bd381", "comment": "Malware payload (QuasarRAT)", "value": "3313512563978541975fd2e8b73dee71de5436cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707441326, "uuid": "314a30e7-8463-4098-867e-fbf79e7d8fd0", "comment": "Malware payload (QuasarRAT)", "value": "87cb2d1846eceab4d720f41e06871925d51c4a321a2540a06b00bd74d11aee60c21fb9291031126afcf6510ff2032381", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707441326, "uuid": "5429e137-f099-430d-b530-8356bfe8a048", "value": "T12AE56B103BF85E33E1ABD6B3D5B0502267F1F82AF363EB5B1181667A1C53B5188427A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707441326, "uuid": "98a3f10e-ae15-4830-b362-a257eb9d9c52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707441326, "uuid": "61f3a4b6-df63-47b7-ab44-b01d4c6061ed", "value": "49152:Nv0L82kyaNnwxPlllSWxc9LpQXlsxWxoGdkTHHB72eh2NT:NvO82kyaNnwxPlllSWa9LpQXlsxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707441326, "uuid": "778bb7a6-c24a-4978-b1d8-25728f3a87e7", "value": 3275776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707441326, "uuid": "b7978354-81d9-40a8-ba1a-e4f66145bf4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707441326, "uuid": "823f773f-644f-4660-a3f2-14fcb31e7b56", "value": "a86c013ae0ea0ebcf21bdac157b621f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffce335-c72e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707471356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707471356, "uuid": "a586ebfa-4f27-4099-b262-73529fd3040f", "comment": "Malware payload (RiseProStealer)", "value": "2c0b5c3d1f8183b451421e1d7af49ddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707471356, "uuid": "4ab63590-6bf7-4ddd-99e9-4e8f3f90f0e3", "comment": "Malware payload (RiseProStealer)", "value": "948553c0a2bd7b770b3c35c7c1f08238ad04ef020ecd68de4f58f39630ef1cd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707471356, "uuid": "eeaca071-1564-4c67-ab2b-e94f856f39a3", "comment": "Malware payload (RiseProStealer)", "value": "9fc9ca0dba1c3d4dc1cfe49097a87c9cf1e751f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707471356, "uuid": "504b9e01-eeed-4792-891f-72b6c579d717", "comment": "Malware payload (RiseProStealer)", "value": "5a9f74123a717d90c93894b2a11f9d71ff2f5bf33353080cbc634ebe41a674bcf56dbdd27ff9804f49b9f54ec591f6d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707471356, "uuid": "65f6ceab-66df-4d0e-9fe5-434ee5694cb2", "value": "T148B53349B3E51A25DE9D8139E6E3C4354FF292436373C3643EAC81E12E123F5DE166A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707471356, "uuid": "6ae6e602-410b-4136-b9fe-a90f2b9a4cc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707471356, "uuid": "24f8a047-4dc2-44ee-80a7-b2bfa8d1ddba", "value": "49152:EdW6xCS5MQ4GIWw6tmzLoyhO7dT83HIgOaiKuYCyocVQqNvDm+7s:2WyN5MGzw6tmwyaz55UCyzVQmm+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707471356, "uuid": "098c20ec-fda2-4ec0-83eb-4c7cd059b858", "value": 2376672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707471356, "uuid": "9b9764d6-30f3-4edd-9369-ae4af296cc37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707471356, "uuid": "10651f3f-aa95-4edf-98cc-0a116474a3fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3d4282-c732-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1707472826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707472826, "uuid": "5235f452-6494-48ef-8f60-115c3b0aa18a", "comment": "Malware payload (PureLogStealer)", "value": "90b36d0bce27a726c714e8d208040fd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707472826, "uuid": "2602e79f-94bf-4801-a71b-5ccec0c343b3", "comment": "Malware payload (PureLogStealer)", "value": "98d7e80ac0ee8ffbeb51fd3273e5d5cb7236f24123af2f112bc62083d4411a74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707472826, "uuid": "2b3631cf-a4af-4813-8c59-b919dd7972d9", "comment": "Malware payload (PureLogStealer)", "value": "054834ff0d428b1719340bc7f8b1579a1b1a4be3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707472826, "uuid": "23ebccf2-82f0-459d-aa68-12d9dabbeee0", "comment": "Malware payload (PureLogStealer)", "value": "bd8aac54a603cbb1d34ed46a54dc97e86c4ff0105fb7f09cb55232eb2c5daf169f4816f4c0d49e9633dca0f037264da9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707472826, "uuid": "7eaa4c84-0c2d-4339-b49d-b6f7d100b203", "value": "T13DC30170030458D3DD7BCD79ECCB4A620C70B7D6BA5245A337A0D2085A307D4BAEAA6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707472826, "uuid": "2ff34ddb-d6d4-426c-90ef-f03dbbb156d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707472826, "uuid": "7e855094-f83a-4b46-bbcf-db2925445ae3", "value": "3072:20k6Za0ajCP6EnPRNuVaJzjHmML9M3Brsv5HWb6t+DvW:Y6Z8G3uEjHmaOOlW2QvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707472826, "uuid": "fa14f881-63a6-4544-bc5c-ed855c1fb710", "value": 118496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707472826, "uuid": "f15b665f-85ba-4aa7-8bac-90916c4629be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707472826, "uuid": "54b3dc98-baa5-4c4b-94f8-4e5fd9e1532d", "value": "swjft_3891SHYRD 27691A DO30A2L A27104Y AH38S9D DHY683D H7202848Q0 DH6413.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe30b33-c760-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1707492958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492958, "uuid": "371e5027-1656-4eb4-bea8-6359a241dd3d", "comment": "Malware payload (Smoke Loader)", "value": "8b700f852620619fb3bc409be8eea3eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492958, "uuid": "7fcf89a8-6936-4731-bdb9-4f1486a5f8a8", "comment": "Malware payload (Smoke Loader)", "value": "9966655be2002c66300f35de314f0199da38dc536e585e77ef0140b04359b8ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492958, "uuid": "acb9ef81-b108-436c-be58-e55d152f1e1c", "comment": "Malware payload (Smoke Loader)", "value": "f1ca44a2b4921292f05c9f40056d7319bce15cb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492958, "uuid": "25e16b84-d47b-4585-a84e-34def9a723ae", "comment": "Malware payload (Smoke Loader)", "value": "3955d2c266f0d8cf9f529ac58e176a7a04435bb6c1835683e4e633649a498df3e4f65b574caf4ca22b6adfb6b3aece9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492958, "uuid": "971d51d2-d4fe-46c4-a0d1-95e45d22817e", "value": "T1DC34BE217AE2D0B1D6AB0974D9B1DBA05FFBB87263B5803F3318076F4D702D05A66762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492958, "uuid": "305ed4ec-eebe-46be-a6ff-a5d8bd318293", "value": "41a023181e1b42ebf113f2f55f4ea949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492958, "uuid": "8cb8b83e-c719-4c76-8f33-2627f5662184", "value": "3072:gjy7KRLORAwGhOvXMYRnQ4Vsia0HvJEg7kM5tgK7JzP+HN1M8Xc85A1rpS8B:g0KRLOOhOP1nrVsiaqJEg75tvzP+BiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707492958, "uuid": "009e3b83-0755-4f26-a8e8-1faa42f0ec73", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707492958, "uuid": "dfe3ab7e-8c80-4812-8acd-2044989e778a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492958, "uuid": "95cf5f59-fede-4d7f-9111-fa7697d77f4d", "value": "8b700f852620619fb3bc409be8eea3eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0661367e-c725-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PythonStealer)", "timestamp": 1707467232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707467232, "uuid": "9664f058-be50-4b58-89c2-d73a6320f5e6", "comment": "Malware payload (PythonStealer)", "value": "3a41f43ea405b56e6d852c3914d76157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707467232, "uuid": "dce0412a-8aaf-41e2-9210-c9a7932976f5", "comment": "Malware payload (PythonStealer)", "value": "9b06cf592fe7b95b6b8da28c7d6a2df91742ac5b28a808d7a849bce57e16d948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707467232, "uuid": "04244473-64b3-49c9-b3c7-a6e385a3c93b", "comment": "Malware payload (PythonStealer)", "value": "afaeb20b32fe1219d6ca8f0e95bea7509a1a4306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707467232, "uuid": "7c2eb8a6-a23f-4eef-aa24-267910a22eba", "comment": "Malware payload (PythonStealer)", "value": "33c72099a2722a36e0ce1506a80aed780480e0371506f63563b51871e9809bd901efe5b421bdb29b3de89aacefd2c62d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707467232, "uuid": "4ca8a6f6-71ed-4b9e-84f3-c51f1775b87f", "value": "T1A2F63355A1C45DE0D8E2923B89A54826EA72FCB01734CADF83B4B0662E773D04D7EF85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707467232, "uuid": "6af187db-7c4f-4b02-ad05-ed745e19301c", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707467232, "uuid": "34f68d77-50f8-44ad-a95f-235bc6f45cb6", "value": "393216:tiIE7Yol+4uMYHi+2ohcyLkW+eGQRe9jocBGcFM/rtRWvz:y7rl+RMYHiRyc0kW+e5Re9M9Sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707467232, "uuid": "6723087d-0e2a-4622-b8ad-b3894662c5fa", "value": 16274014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707467232, "uuid": "fcbc7af8-cf3c-43e6-9458-66ba52a53d92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707467232, "uuid": "6d7a09c7-adef-4be2-aaa9-57dacf5b501c", "value": "SecuriteInfo.com.Trojan.GenericKD.70641791.20493.31768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b514b832-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707488141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488141, "uuid": "b4cd226f-bdb2-4951-93eb-f2e20459b92b", "comment": "Malware payload (Mirai)", "value": "98a77434b046c26093bc0d6beba2278e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488141, "uuid": "cd5d6884-e324-4990-8dae-b60a32ed83ea", "comment": "Malware payload (Mirai)", "value": "9baa74e599874ff5074bd0ce0a3cab43cbe660683b950090254178b28ab9aecd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488141, "uuid": "7df3f648-93e5-4b72-a30d-052d5b607c8b", "comment": "Malware payload (Mirai)", "value": "5f9a7fe605ddf42f4cbb2f46bb7bad1b0fca2c91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488141, "uuid": "3f9c3e2a-f8f8-4517-b850-3b7c0a1d478d", "comment": "Malware payload (Mirai)", "value": "dc3b523ba3d5a29bf93a34e401c161564399e4adadef7e72de91f6c22d9960e7b0a75c2ccb71d9acdccb166659efaafc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488141, "uuid": "57f3dd89-fe60-4348-bbb3-7aacfaed942c", "value": "T1D6233A39BA34292BC4D4A53E66FB4754B6F5134E28ECC61F7D320E4DBF20650A5272B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488141, "uuid": "1cb4a385-304f-4470-98f2-c6731c6d254f", "value": "768:t6pGKOPngfGVfSpqnByV94148vLO+3hcjWaj:tWzGgfGNSEnw4u8X9aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488141, "uuid": "2779e738-393a-45c5-83eb-b54f0166f975", "value": 48360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488141, "uuid": "0868bb66-fe77-4fc5-84e4-0cc99429c9b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488141, "uuid": "5d155ce5-de01-4d73-9358-5580651a67ec", "value": "98a77434b046c26093bc0d6beba2278e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c77b75-c701-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1707451823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707451823, "uuid": "2c37d4a7-a2b6-4787-bcf7-b64af0ae73b7", "comment": "Malware payload (DCRat)", "value": "0de14423f10cba3a118549de8ab6b270", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707451823, "uuid": "7827964e-f2c6-4ffc-8c65-feed70752d05", "comment": "Malware payload (DCRat)", "value": "9d2f1bff5b4efda5ad6bc899b6520053a2568ce6b88e3dafedbf5ab8c3dfaa85", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707451823, "uuid": "6298ea5d-97e9-4725-aca0-797944782835", "comment": "Malware payload (DCRat)", "value": "ebef3e0d928475151cf66c0fa25c0cb4714df2fc", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707451823, "uuid": "a35a29f4-279a-414b-a868-7e222860f68b", "comment": "Malware payload (DCRat)", "value": "ec4f4bb19683cdddc3fd0651192989ffa0f376e94137fa533d321bcdb987e8a6453e6257cabf6215da3c1937282a9c68", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707451823, "uuid": "16057c22-3c71-4e28-ae0d-8e6f017bed7e", "value": "T16B16F10665925E77C3602B314567043ED295DB7639B2EF4F360F20A6A9037B1CE326BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707451823, "uuid": "4fd68dcc-2ced-41ed-af58-1d92833646bb", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707451823, "uuid": "88e01e08-e2eb-427b-aaf9-3ed1dfb83278", "value": "98304:yVfAGIXd01zjUyu6yfVAAhpuGrST7G4vURfHAokSm1tn0Bj:WfAGYGporROqS+4+gSmU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707451823, "uuid": "5cdf0294-8076-4554-a486-3745b395f41b", "value": 4018956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707451823, "uuid": "6b73c906-4cc5-4caa-9864-552a9b16d312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707451823, "uuid": "f2a5897f-4034-4fee-8b60-0627af6feca5", "value": "0de14423f10cba3a118549de8ab6b270.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b535287-c6fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1707450625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707450625, "uuid": "000bd9bb-7da3-4191-a1db-3b104c9540cb", "comment": "Malware payload (DCRat)", "value": "a6026733332ee0c9d340383aa4b34f08", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707450625, "uuid": "e7f204fb-07b0-4e70-9ca0-33a5339358e4", "comment": "Malware payload (DCRat)", "value": "9ded51d8b93956f3867c6744d5a3988f4f094f0e631af5acbe67fb668cf1d918", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707450625, "uuid": "64175b75-036b-4210-ad86-6f01bfac80f3", "comment": "Malware payload (DCRat)", "value": "c68a1efc5e8a7f0ecf7814d54fc45870f524ad63", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707450625, "uuid": "ad735d53-955c-40b5-b068-26e8ab5ff0a7", "comment": "Malware payload (DCRat)", "value": "048efe325f5a220d86701bc4d17c0b338d595bd0783b7b370503bbc624c14d30111c1e1fd8356af3490077c2436722ce", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707450625, "uuid": "a7461ee3-1d04-42e7-acba-5e7df0023255", "value": "T1EAC5CF027F548A02F1181237E2EF854447B4EC516AAAE32B7DBE376E55123973D0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707450625, "uuid": "2f0d690a-ba1f-4291-a4f0-729d78565b82", "value": "069407361307fa34b23ade96ab2d8363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707450625, "uuid": "b2f275be-4261-4e20-8b1b-9f75b638eade", "value": "49152:yRQnkx0YjBKUtJqrsvivtjymTJduufIJ9LazULb:yR8sj5JqsYjyoJduufIJJAULb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707450625, "uuid": "ce45593d-cd03-40c8-aadf-053e12c36ae9", "value": 2564279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707450625, "uuid": "b4959609-65a5-4962-8062-b7c1de30f654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707450625, "uuid": "3cb6c10b-33f3-4d99-8f51-80ae690168f2", "value": "a6026733332ee0c9d340383aa4b34f08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3a7d2a-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707493336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493336, "uuid": "35e4cd1f-c2e6-4426-b062-9c84054beac6", "comment": "Malware payload (AgentTesla)", "value": "6a8021f8078119a8c7c55396b3db595b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493336, "uuid": "96e3f01c-bb47-4b43-8312-a755fdb8abd8", "comment": "Malware payload (AgentTesla)", "value": "9e19f6b4011cfb241e826abc5e52b9e2c5b99966a661ab548b90691b06cb3900", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493336, "uuid": "9a7f90e9-cfbb-476b-9d59-d10bcb1a1f76", "comment": "Malware payload (AgentTesla)", "value": "969ef2f9d7a2c9574506d549a52965f473ca1bb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493336, "uuid": "b451e6a3-1d95-42b1-bdb6-6a638622a18e", "comment": "Malware payload (AgentTesla)", "value": "fe945ca021b662fbc2348da6ac3abcc85b24cddfca2ab7fa8e9d7a33c76a1c60f37ce07317ff04616eaf9d04ff2b127c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493336, "uuid": "406fd87b-33ce-4c4b-8904-91ce256f3da9", "value": "T174F4CFA81A0E55C3D4483333EEE585E8361C1E2238245A49B577F7171EBEB7F8849E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493336, "uuid": "da0bfb05-2ccf-40f9-a7c3-55ee924b01bd", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493336, "uuid": "70f71a18-a69b-4451-a3c7-b3877e42c44b", "value": "12288:IOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiEgOkEQ0CIKDt3TQuQaBD0:Iq5TfcdHj4fmbadHIStDJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493336, "uuid": "107087d6-945c-4d67-bc57-d1ba6bc0abe0", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493336, "uuid": "d9c28955-bb80-437d-897b-c22b1c9842c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493336, "uuid": "4febcde6-7c77-44a9-82a4-963a2e30c151", "value": "Nueva Orden de Compra 45035339504.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9278730-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload (WSHRAT)", "timestamp": 1707493275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493275, "uuid": "88897494-f6fd-47f3-bf2f-872d3b6de590", "comment": "Malware payload (WSHRAT)", "value": "0ebe3edd57ff4d8f5fad8b16353d85c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493275, "uuid": "5bf8688f-9645-472b-b307-ddd65ca144a6", "comment": "Malware payload (WSHRAT)", "value": "9e2e9771b85bb6791199c3442b6099d2f96a2647f77a4e8341e935f778bbdc34", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493275, "uuid": "a475a37e-6182-439a-854d-c0a9dfcf1018", "comment": "Malware payload (WSHRAT)", "value": "d3c823fd287a31f5d6e4c76b3621ca04f8d67249", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493275, "uuid": "0fe7cb00-26b6-45a6-b152-8fa8fdb70382", "comment": "Malware payload (WSHRAT)", "value": "4270db37d08e7da859a04e0c7a1217a3f42656717f2d6f7f6f0f5b066b199518fbb5e68602db3610001a167be4b9ba9f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493275, "uuid": "73e269b1-7f23-46e5-8c84-0eee6caa66f4", "value": "T10C25E78642BD5F311FA3E4644753D5639C39E9C018E7A1EBBCC93FC6A0748844D6EA39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493275, "uuid": "02e00b7b-f83a-47ca-b15d-2cc9a780788f", "value": "6144:XQK9JgDg3ynDDKFCxCDwYjgegH0LGsJ2W1G32bi3/v0AbiBB8pt1vGWtkbIcJOyy:gwfCe9L1OR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493275, "uuid": "6a3310f2-aaa3-47f7-8ca9-b49b030fd17f", "value": 1007227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493275, "uuid": "9902ecbf-a789-4195-817f-d8c5bd2b40c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493275, "uuid": "050ec9fe-a7e0-4a91-bbcb-77675812d19e", "value": "Tax Returns Of R38,765.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c136826-c715-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707460612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707460612, "uuid": "4838fe56-369e-48a2-8fdb-0f09d27207db", "comment": "Malware payload", "value": "4d4bd40624d42c7d627221a59464955b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707460612, "uuid": "37f3bb91-efc8-414e-b3f8-a4f6308652ea", "comment": "Malware payload", "value": "a04599479ad2bebafcfdce0a22acfef84f93ca181d74a1ed10a0bb954ca1ee78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707460612, "uuid": "59ed69a2-525a-428d-bc22-bb5278a2f7d6", "comment": "Malware payload", "value": "4d3a6f2be003b8345b7c809181b788bbe3b2a471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707460612, "uuid": "c48be0d7-5ba1-45d2-b29c-6bba3dc1f693", "comment": "Malware payload", "value": "7ad130607bfd0511449f947d4f74c9f3033cecfc63b50a0bf8077f8d30015e9a856bb0703476722346faacfcae436613", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707460612, "uuid": "985f0dd1-08b6-4df7-9512-33009b16e9f3", "value": "T1129531A0B1696CB6C60C6E7164EAA47E431D7BA3D188C5971D0B773B2FB36803C4B59C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707460612, "uuid": "c2b00b64-d6dd-4b14-8ca8-1586962e8594", "value": "18fddb6bf75d47bbde1ab64ea7840970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707460612, "uuid": "fbdb05f5-0674-4a9f-855b-41ac340f6e39", "value": "24576:AgmdbMGtNqmSo+TqMMMwkrMMM8iW2wQyX6Efcw3:I1SFTqMMMRrMMMJW3QZEfcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707460612, "uuid": "9b84be9f-8177-4e6d-bb7a-d0d8477356d1", "value": 1933384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707460612, "uuid": "603feb34-64e3-4b73-888c-b6991415d29f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707460612, "uuid": "1ccce290-b286-4d63-8feb-1a6ed7883653", "value": "SecuriteInfo.com.Adware.ADWARE.Adware.Gen.4299.21788", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b9b964-c760-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707492971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492971, "uuid": "1d90af8a-b5b2-410b-a9ea-7c156175beb5", "comment": "Malware payload", "value": "62b8e7b8bbacfcf6449d64f486bb4ca8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492971, "uuid": "a7a4c2f4-cdc9-4122-8ac1-ceccb7db1530", "comment": "Malware payload", "value": "a0fdd8113e728a98dcaab2aceb6fc19178e9650bf7ae62d86ad93f5979a148c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492971, "uuid": "573cc687-dad4-4119-9f41-e5913bc567f6", "comment": "Malware payload", "value": "f42efedb2e78dff305db4c62680c070978bb229f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492971, "uuid": "293b78b0-02de-446f-811e-fe9a67ad10c2", "comment": "Malware payload", "value": "f2bfe9c8c052dff9910a881b1b1c9e69d08a77b76828d6eae2a103624e1a582a51c3b406f6c0565638282ff4145f7425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492971, "uuid": "7b5c7261-f2b6-40d9-848b-b4775c3dfacb", "value": "T19493CF686BCBC573C15378780AB8B2F6DEAE940307721ADB5B582E391F245D6963D20C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492971, "uuid": "fe4284ad-854c-4eaf-8670-d333689ec78a", "value": "1536:W36teBkGQ6dZ3ZwqYlYDwjvXHNNyJTcmuTI8Ifg3CknRj9ph0Ml5Gmp6upovcg:yLWvwQqYlYDeXHNNqMjIfMVRh3t5Gmwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707492971, "uuid": "c1afd2c7-5629-4142-a4d0-94e7dc64206e", "value": 90184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707492971, "uuid": "ddc0a2cb-4573-45b6-b3bb-331cef4a559f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492971, "uuid": "16c9faa1-11a3-477c-b2c4-3603718678ef", "value": "62b8e7b8bbacfcf6449d64f486bb4ca8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50d47bb-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Renamer)", "timestamp": 1707493349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493349, "uuid": "822d34f4-fd13-4131-8ad5-27bcf56c9294", "comment": "Malware payload (Renamer)", "value": "fb8af4e5ae8aeddf9877b85f50741fd1", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493349, "uuid": "a39fe39c-e235-4b9a-bd92-b1aee21bdc82", "comment": "Malware payload (Renamer)", "value": "a176a4968247236c5059e7bc8df8514d116954a24908ec0e87a18802d424a594", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493349, "uuid": "9d9fb15b-3853-4f86-a405-7ba0f25481df", "comment": "Malware payload (Renamer)", "value": "085e2a3fcb55bdc535430fabcd0917bd348d3a70", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493349, "uuid": "d342ff27-b76c-4a2d-a7f6-7c0976b0ed41", "comment": "Malware payload (Renamer)", "value": "9d3faa554e643b5bccd1fce8a467ccc5a45975fda37d48472983304e3474ea82b21738bfe75aa37610dad243c8ac7ac4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493349, "uuid": "6bce3539-019e-4cf6-b153-da7fdde65435", "value": "T17A055A1AB2D7143BC03616BE496752645C3B7D202A96584A5EFCFF4C0F392A33C36E96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493349, "uuid": "d0038e65-17f8-4868-a9bd-29cd2a01b10f", "value": "c00b6ba7dbbc6abee9ace3a65a49ba24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493349, "uuid": "38f33eea-d17e-4b4a-a59a-4c508de42285", "value": "12288:OwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4FhozE+888888888888W8888888J:eNzCtUpQ9WWPBSSRMTEpMNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493349, "uuid": "df23b057-c588-453c-a3b9-90ec36f657f9", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493349, "uuid": "81569a74-8035-42b3-bf54-648bb8254c25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493349, "uuid": "676511a8-677e-4882-8ffe-1f7df5209e4f", "value": "Recibo de env\u00edo de DHL_Gu\u00eda de embarque Doc_PRG2110034171560630.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2599b964-c754-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707487471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487471, "uuid": "584a532d-52dc-4e7c-af2a-eacd50b6aa34", "comment": "Malware payload (RemcosRAT)", "value": "bc66abb3921707a9fc3d9c439c7de33c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487471, "uuid": "2677a8fb-fac3-4660-aa1e-07db60fd8fe8", "comment": "Malware payload (RemcosRAT)", "value": "a1bc52dbf01c71fed09ed76a87d3820a88519b0b0520b14b6211d0d4d76c12c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487471, "uuid": "bae57cc4-e4fe-44ef-9b5f-95914b932be1", "comment": "Malware payload (RemcosRAT)", "value": "3767db2e440edee4bf494200072c94638f37a0a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487471, "uuid": "0b499ff8-e8e2-4ac5-9de3-803a9986896f", "comment": "Malware payload (RemcosRAT)", "value": "2940c57148fe79f7ab75b41b2867f1542a9d10f95b8c353117e350a9282f7c68d99c8fae4c92bd4dc246ba16b3303a03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487471, "uuid": "be1e80e6-31c1-4df6-a5a5-5de421b4b3e7", "value": "T18635D04D67214A22CBB7A771E97343120FA1D9ABD183D30B97C864BB29237EE1F61705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487471, "uuid": "e06d5d78-6bd1-4830-85aa-5a89fa929fb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487471, "uuid": "ef27a467-68dd-4eeb-912c-85c3bdd7812c", "value": "24576:x02MkMxG9WIjKZpK61mUMqz53TeIgAqM3OR:xjM490p6ZQ3TeIpjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707487471, "uuid": "90045143-2d98-4be1-b25f-b50d584a744d", "value": 1075712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707487471, "uuid": "e09b68e8-1752-4148-95c7-e4b41240b44d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487471, "uuid": "e4579a66-10ac-4907-825f-8e903ace95ab", "value": "ORDER SAMPLE 2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4d2bb7-c715-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707460610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707460610, "uuid": "1ecf25bc-1767-4648-a88e-7d244b7e5319", "comment": "Malware payload", "value": "2f068ab6f98240d11d9c1914c4b58944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707460610, "uuid": "535ebd63-dc3b-48b6-837f-b16c7007778f", "comment": "Malware payload", "value": "a4645ff9b87c215f051fd2b9d45f22ecffa630102f6e4f50f0432ded5055ab76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707460610, "uuid": "852d295e-3ec1-4d38-b17b-f8dba09bfe9b", "comment": "Malware payload", "value": "a19b26c0a7a75ed117c1aa481008c51362e6fc1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707460610, "uuid": "9a9e090b-5480-4e65-b223-5adc680174ae", "comment": "Malware payload", "value": "4e086ae0ed8f9a3360cb6fb5e2ca7404f199d31918e29868c628e1e47c26693c0ad7250376544e69024a6115d7346506", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707460610, "uuid": "312f1ea8-2ade-40a9-ba44-c5c797113700", "value": "T16D336B13BA51E033C06388B04576D1A26E7BEA511BA443D7779C06AF2F623E19F3534E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707460610, "uuid": "f5082608-022c-4ff5-9e3b-52df97c7110a", "value": "69085ab32627577de8030f42471b5a44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707460610, "uuid": "a85feac8-6207-486d-8cae-31793209b2cc", "value": "768:/1LY+jqszJ/b+LzqZyBpPHKeownuIkJf/lq+o6lFp9l0+cIILZ8r:YS/bO+Z2pPnoD/lq+XZu+MSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707460610, "uuid": "3c7f0c19-ac4a-4f86-8de6-54152620e66f", "value": 51320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707460610, "uuid": "1628a483-f5cb-4593-8ab6-5d1a4691c8ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707460610, "uuid": "820200bd-c473-442d-a18c-32278b68960a", "value": "SecuriteInfo.com.Backdoor.Win32.Cidox.31037.18082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b591f0f-c7a7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707523075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707523075, "uuid": "b74e872c-1d67-46b6-87dc-3c312e81b24f", "comment": "Malware payload", "value": "df9e2874609685e14961a8fa7a4bcaa8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707523075, "uuid": "41f4bb03-35c1-4eb5-8f95-d7ae7276e9ec", "comment": "Malware payload", "value": "a4f20673262f19190e0cdd2e3400ed63466b72117036d4610aca5d21e3e8aca8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707523075, "uuid": "f6dfc0fa-5062-4c7e-b0b1-c2cb34194338", "comment": "Malware payload", "value": "ed6fe2610dffdfd6f26c834544b4f469edcec990", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707523075, "uuid": "24fb415c-03ae-4d89-bfe5-055417ee681e", "comment": "Malware payload", "value": "25fbf6cecb67975cb5c187d563113963aae0af5a924ccae641988ff27a537987d02b5b1a9a28d420b99315c29fd11e94", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707523075, "uuid": "db65bf59-5f86-4098-97c8-6e1be7fba0be", "value": "T12F92E17D6B7EC3193986BBD022A417A852207D8817206D3A6ED4D8D7B658B610CF31DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707523075, "uuid": "7b28d459-1d00-4ebf-b5d0-ca784ba97c88", "value": "384:33qsWZ9JZ30sa9LmElzmEd9OAibg0y4T0AN18Sn8Gm22ZmvBK5p7oVc81rmTVnfl:3asenZ3070EXVcjygjX3BjJVhiz2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707523075, "uuid": "ee944b6c-d154-447f-9ebf-1827eb10aa99", "value": 20859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707523075, "uuid": "7a5fd237-af69-4463-a8b2-871dfb532370", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707523075, "uuid": "8e3dc822-f09d-40bd-a42c-78467e342ebf", "value": "DA-0986789009008.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b217d0ae-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707488136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488136, "uuid": "9e34a140-2076-4894-8cb3-18e27a5afed0", "comment": "Malware payload", "value": "ec0cd75e074eb7c3087b9fd02a18a60f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488136, "uuid": "b19b7578-86d1-4956-9db7-8d9f3eddc405", "comment": "Malware payload", "value": "a5a68b411e0a7995f4ba99173f0f20b40a371d09a797a91dfd435b59f00c8188", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488136, "uuid": "9ff1fc37-b2ee-4ead-8d08-149b1baefaf5", "comment": "Malware payload", "value": "9e64441f31a7850bca04cae2f78bb54b676f2063", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488136, "uuid": "087ec751-0467-45d2-b6fe-173322dbdda6", "comment": "Malware payload", "value": "a92f4d5a99e640b5a4a28e120225f8d6cdeb709d60967a8d354c4ae4982b67c6c2124c17f43ce9c908050d5f3f76a6e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488136, "uuid": "8eb76029-0233-44ce-ae21-4f40b7a2b798", "value": "T1FD130A186942B67CF656103CF41323B6A0B33F2C3ADCA3E2B5837539EA606C45976D69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488136, "uuid": "59db8b7e-8cd2-4c76-8fec-7d738442e2b1", "value": "768:VWYxIjVbD7E7pWyR15lu4WSn5EiIYYkXv3FjD7N:VWYcVbD+1DU+BhYmFjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488136, "uuid": "973bf213-661f-4bec-a97d-a932df628e10", "value": 42444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488136, "uuid": "77291a66-9414-428f-914e-10107d391b5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488136, "uuid": "77683e52-c0c9-44e3-8f20-3e0734705678", "value": "ec0cd75e074eb7c3087b9fd02a18a60f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86729861-c75b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707490640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490640, "uuid": "c720b65a-eb1b-411b-ac3e-bb23d7cbaebe", "comment": "Malware payload", "value": "8c7ecdd9fc696994288d9a6fa08444c2", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490640, "uuid": "883ecc52-9310-4e52-bd8d-64ff484e5d96", "comment": "Malware payload", "value": "a76ea4031064781902050026aabd55cc510577e3d31ca5908e92a35129cc2ce0", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490640, "uuid": "7d77696f-050b-4ead-99f6-62d77736b64c", "comment": "Malware payload", "value": "6f7cf611083b93714f5787b59b852ea5e7ca3ed5", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490640, "uuid": "79116a39-5e12-426c-9c2b-840740656f2c", "comment": "Malware payload", "value": "6b5a28b3915e1a01da864391aa8ad680fefeaf8480c691da055eb9a2131a7cdce04cba5c6bee66ca2ea50c2ea837c379", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490640, "uuid": "9ff60628-e149-40f3-840b-3b86c611fd3a", "value": "T13E7302FC028C3FFBEE8DAAD65FC1F6E5B72A651446CD0C0ED7AD912A244215F4D90628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490640, "uuid": "3ae32fdb-2a68-4db0-9892-c2d3ea1f9c26", "value": "1536:/XSr6/SU2RGtvFKIdN5srmpL7nh5AAlC36gEjDyMKhK6ivlh1:fqq2Q7KQN5d9FazKgEHyMhH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707490640, "uuid": "c832660e-8967-4f85-8ad4-c0555717393d", "value": 79997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707490640, "uuid": "20bf758e-4c56-4fac-9f80-beee9415449f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490640, "uuid": "3774485e-f379-4f41-9cb9-ed7719ba402f", "value": "WXMSB.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8ea4d1-c77c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707504876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707504876, "uuid": "8fbeaead-71aa-406d-b20d-775e0835ce2f", "comment": "Malware payload", "value": "d6fc4895775aafffbd52cb8e9e731824", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707504876, "uuid": "faaaa103-b727-4f9f-93d2-6d37971f0b8b", "comment": "Malware payload", "value": "a8c2d6bf4c101746a89855247e2472a8d4871b4bd75726d41948e802ebaf3e43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707504876, "uuid": "108a0a09-50ae-457d-8a76-feb7b5a08feb", "comment": "Malware payload", "value": "9762ab2f2e6bc7a3d55bc5321667ca06cf16ce00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707504876, "uuid": "b62752a5-dd51-4608-9144-9258f17ead9d", "comment": "Malware payload", "value": "df973a4f7b56f6346bf9f3b08ed41cac6731b28804dc500c1c9332aef14bac5f64201b72681bde4e18cfeb857d024b69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707504876, "uuid": "a7be012b-fa65-47d2-8f77-e6ede3a4c000", "value": "T1E645123129D58073D27B133499EC7AB0A5FEF9102772964B6F8C05892F21AE5CB1D36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707504876, "uuid": "3d7a960e-6259-4c30-8696-08f30ba4dfbe", "value": "2e838409987529c95afc2990bcd62f7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707504876, "uuid": "2c88ae4d-7676-4d35-8b34-6a4a70565687", "value": "24576:rus8z4E8k29sef3ykfjptYRawBIU3gyCta0SBuNoObZJR8wrGKB/urQD:asOqfykLp7wBIhyAOBuzlvLurY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707504876, "uuid": "4d91e3a7-2123-4994-9193-541673076d8e", "value": 1196934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707504876, "uuid": "98518ba2-6e66-4c2b-be1c-822f23f99922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707504876, "uuid": "749ac22f-db9f-4386-bd0e-f79826a22b56", "value": "d6fc4895775aafffbd52cb8e9e731824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af879b00-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707488132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488132, "uuid": "5111e3a6-59a4-4a1e-b177-0d1303c2c8a6", "comment": "Malware payload (Mirai)", "value": "a0812d1f53d13a43f47e0104bca5c671", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488132, "uuid": "5f91394c-ad36-4b4c-aad1-cf94dd0c7f0b", "comment": "Malware payload (Mirai)", "value": "aa91ee5854b12ac44319f2e7f4c26c978a77123c28fdcdbed11c80ebc3ce751e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488132, "uuid": "f8678f18-55dd-4c2b-b1de-e1d50c05c7de", "comment": "Malware payload (Mirai)", "value": "af0462a0b1aa3a50933862dbee76d15120f27c10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488132, "uuid": "1ab00566-56e1-40d9-b309-246dc58a0321", "comment": "Malware payload (Mirai)", "value": "423e8c3c183c5f2899354e7c61f93f7979f2ed34856406293b8eeb2c89331a13c15ac539db3ad3b3d15518a5e851e2e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488132, "uuid": "385421bb-f91f-4276-8e85-efe7f4957f06", "value": "T156038D9BC92A3E68D2248A74F1299F7C5B53FA05DB4B5EE644278375D003E9CF8182B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488132, "uuid": "8865f856-df00-4d89-8abb-dd5c013e4bfe", "value": "768:6UcSaMF9EDEjEzWW2aLxE3m1oiJSc7C7R:6D3l4YaW2hm6ih7C7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488132, "uuid": "268439f3-dc24-439b-96f6-7d455148c254", "value": 37880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488132, "uuid": "78b655fe-dd69-4981-a66c-717a46f7a05c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488132, "uuid": "c85e098a-ebfb-4267-8c30-a00fbecd42f4", "value": "a0812d1f53d13a43f47e0104bca5c671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2719eb43-c763-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707493916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493916, "uuid": "bbd08bc3-9922-4d84-8245-b0f9afc4333f", "comment": "Malware payload", "value": "63e149b6e000df00d543ec149b702aa2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493916, "uuid": "5fecdebe-26cb-4886-b603-9d199ecd4499", "comment": "Malware payload", "value": "ac5a76014aa8e812e1a801d37f37274c4520e6f9d69f45450c27f0bc26414844", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493916, "uuid": "f0747ff1-d672-4388-bab2-0ba375bcc45d", "comment": "Malware payload", "value": "2b801604b530555dcd9dc764d82e6be29004a2d6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493916, "uuid": "76bd6257-780a-434e-af58-40431e9a38bd", "comment": "Malware payload", "value": "6a36226e0842dce3f8e7e3212ea25c21e0b14d49a37af5855f39557100dbb7a22f416e9759901bf482b66a472e2440b5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493916, "uuid": "2a32ad10-1ba2-45a2-b7c4-0521f47e57ba", "value": "T1F0F2F169FDB70B09EF7060B91D64529654B91DE0F1A7AB92008483DFEA54CC4387FF1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493916, "uuid": "79281fa8-9424-433a-b4eb-449263661178", "value": "768:TweX/SBXj98Ndj/QtciJFYYDiFE6bdLszuPashTun:Z/SBXyzYc+FYSiFEG2zuPPKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493916, "uuid": "33353837-885d-412d-8907-590da3826f12", "value": 37182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493916, "uuid": "008d7da0-d95d-4e65-b43d-83e9bcdf2c9e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493916, "uuid": "7662f0b8-2dbb-46c2-bcc8-ed2b2d0da88e", "value": "LS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beaa8810-c754-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707487728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487728, "uuid": "94e5c90a-6076-44a1-abfe-2b357521cb72", "comment": "Malware payload (Mirai)", "value": "7d56255fdd60eef1c91b2538b5b08f2f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487728, "uuid": "5869bff4-83c2-49c5-b231-c0724bbdff31", "comment": "Malware payload (Mirai)", "value": "acea5a8eb7d2a182aece129de375653c3f5ee7d41ff29966b3c38ab03b10f51d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487728, "uuid": "90d305ad-be64-4223-9876-bde2ad8b7fd2", "comment": "Malware payload (Mirai)", "value": "75cc771fc0b94b67f6cba52f5512a5a8ff3b685c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487728, "uuid": "3630b772-a40a-4ff7-a055-c99f24a7ea46", "comment": "Malware payload (Mirai)", "value": "efe10c4a2ace17efeb865379c65930aaf9d3dab99b2edf3dd833d5b08574ef8cbfa3c0f703621c30441ae5834233fb01", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487728, "uuid": "d7c4c578-82a2-4afc-8c26-a0ac190fe1f6", "value": "T1D8333A47658080FDC4A5C2709F7FA62BDA33F07D1231B65D33E8BE266E4AE211E5E644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487728, "uuid": "02c688b8-84c4-42eb-8c14-af039635dcf7", "value": "1536:DGVnFqqlTeI/gm7okNJPBUmG02CS1KojFOa:DSFV9eI/BfNHUmS31KoZOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707487728, "uuid": "7cf30009-2fae-4b60-8c0a-aa1bd9af0173", "value": 55104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707487728, "uuid": "80bbc6ba-e50e-47c7-a9da-97666f9bef33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487728, "uuid": "411264cb-9bb4-4abe-8921-9fe70cb9dde4", "value": "7d56255fdd60eef1c91b2538b5b08f2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c71faa-c74b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707483584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707483584, "uuid": "3e7ccbe1-8bf6-4a4a-b54d-c813a4a275ab", "comment": "Malware payload", "value": "70baae8bbe854b8d7c7ba297bf1a9844", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707483584, "uuid": "4a0b69de-a993-4221-80b5-f445764ffc9a", "comment": "Malware payload", "value": "af882c91ac819a795b0955c4b416bf55c83e4f8533386411975fd80bc2ef35b9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707483584, "uuid": "93b1fc85-b7c0-4d07-8598-ee92fa6e0b73", "comment": "Malware payload", "value": "4fdadd0b2a3358f4b982aa1e6cfd722b19298aec", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707483584, "uuid": "bd6d3c29-d0c1-45a1-9b9f-2dd740286403", "comment": "Malware payload", "value": "bc10a8b73cb00ae1e37f042c32256ac7cb5afb48d9a25fb39725f8e7cc9753a17bd8a57ceed2b010df7cf3aa3d4c7fab", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707483584, "uuid": "194b199e-9925-4d90-ae43-d46fa3ecc6b4", "value": "T1B0C3E26DD34B02698F620337AB1B1E5441BDBA6EF38512B1306C437933EAD3DA1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707483584, "uuid": "c4614c3d-afcb-4aa0-986f-abea89eace9a", "value": "768:lwAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjIUJdYXAlDiVKAXh2vL9:lwAlRkwAlRkwAlRBUJOXVKKIjv24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707483584, "uuid": "b618d275-ae15-498e-a122-61300cf552ab", "value": 120727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707483584, "uuid": "598e11e1-cc6e-4bb9-b9d8-67c623242748", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707483584, "uuid": "ec6bcdc2-80de-4919-bf75-66ce13994b28", "value": "PO-45728-10876.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617ed96f-c6fa-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707448917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707448917, "uuid": "c0ce6e27-fb06-4381-99c9-20242892e90a", "comment": "Malware payload", "value": "8dc514f1d60ac30af760efd18cf1e0cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707448917, "uuid": "3b4fa1eb-c9b4-4acb-a8b6-a1c9d565d8c3", "comment": "Malware payload", "value": "b1eefd5d65bd6336c05d656f3440bcf34d0abb8769f6c5ac6b32c4927292e50b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707448917, "uuid": "e59f6c68-3a2c-4a36-80aa-f4f60150e979", "comment": "Malware payload", "value": "86ab49b0ef203ed41f901ffaf75461cda1b9a1e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707448917, "uuid": "72936ef5-1bc1-49c4-8629-c4dc544a069f", "comment": "Malware payload", "value": "b392624c3ee52263af8c94b0776f10e0dc110965200df517b3fa9db8a737a362d81e76270f2f65f8f4126f9eed4e778a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707448917, "uuid": "0ef65e2d-87b9-4f70-b5fc-50793e4e7df7", "value": "T169F3126952997C80C47272339CCB44F46E52BD723B119B6B687837EF3C3EB010EA5968", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707448917, "uuid": "8d24283b-e9d6-4902-adb5-080c873d9f62", "value": "2e8e9d7482c7c6b5198e024e4a2e9f34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707448917, "uuid": "5c97446a-2d67-464a-a703-5e45179757b3", "value": "3072:LVVQD6X62PR1B6/CGAK7pNoIO0lmzOIPIij9WC3S4PXrJufEFv4x:LsgkCG77pWIR2Vw2X11+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707448917, "uuid": "af8c759e-d3df-4c25-aeb1-c727a8068218", "value": 160796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707448917, "uuid": "fa9d4efb-5efd-494f-afd9-d9992ac2f861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707448917, "uuid": "2a2ec03f-a70f-44e7-8101-0ba1a698f8b6", "value": "SecuriteInfo.com.Trojan.Backdoor.VB.9113.20350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0869280d-c6ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (YoungLotus)", "timestamp": 1707450915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707450915, "uuid": "83e0f8c1-1c6d-468e-8551-97e5c5b874e3", "comment": "Malware payload (YoungLotus)", "value": "87455f08f37b75119d9422c735ff862c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707450915, "uuid": "b394b680-105f-43c9-ab10-5a5a37e6f14a", "comment": "Malware payload (YoungLotus)", "value": "b1f831de2136baab443c69f1a81b548d48573cfa2889ee800f026646db57eca4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707450915, "uuid": "c266a29c-991d-4ac9-ad90-cf2548d810ef", "comment": "Malware payload (YoungLotus)", "value": "b77a00e51c3b789322497792e723a8ccb0c2672c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707450915, "uuid": "b568497c-2451-456e-a279-fdbcfbd8a4d7", "comment": "Malware payload (YoungLotus)", "value": "76a64dc0b5f6f848f2979967fdcf7b7bbf2fb8a7bd72dad2db1bd651d884b4f68bc692b23537d6a4633b3f1941637983", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707450915, "uuid": "ed4ca1ab-0ef1-4529-9f7a-c3bbfb7b1b03", "value": "T1B16512D83290C387CFF26CB61A015DD26982B256CFE11F2506A9D9CAD4D439EAC1CE5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707450915, "uuid": "f4cadda9-1115-409d-b6e6-561235f6179b", "value": "8f741d7795ebb406c53fa3b806da6861", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707450915, "uuid": "fc80cf68-6470-4018-983f-91a810921d33", "value": "24576:OIvTv9g+mC5syEQmZA8cFFJdaB3xefa0ZMt2dleLW:OCZg+mcsyE3A1FIBeftCqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707450915, "uuid": "da5c37fe-fe4c-4003-9a53-e68b921b1f46", "value": 1429504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707450915, "uuid": "24bf2904-0d65-488b-8870-793f7e7ab6cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707450915, "uuid": "5e873a74-9d74-4c63-9837-56616e04eb43", "value": "87455f08f37b75119d9422c735ff862c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9b15eb-c74c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1707484049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707484049, "uuid": "1047d697-8956-471d-b6cc-dad2afff369a", "comment": "Malware payload (DarkTortilla)", "value": "f44801cfdef9afc811005e8fa67486a7", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707484049, "uuid": "510fc8d3-62d8-4a1c-bf0b-b4125d7fa2b8", "comment": "Malware payload (DarkTortilla)", "value": "b271fd4baccf44412c3a92f97f16b996248c3c1706bfd29694253ba01ab65fae", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707484049, "uuid": "14ae86fb-36e2-44f5-95ac-c9ac06adef93", "comment": "Malware payload (DarkTortilla)", "value": "e5c15cd5b46374f6e5292a83d51e017d4608e891", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707484049, "uuid": "3280537e-7f12-4d73-89ed-c824bfae31e1", "comment": "Malware payload (DarkTortilla)", "value": "dfa76b1bca439bdc2b3dddc28469659dccdfed26fda985c7e8699ba677d83025bb70c505ba4a5d69017f206eafa3386f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707484049, "uuid": "90b9b425-59b0-49f4-99d3-c1ffe336cd4c", "value": "T1F945F12B5EC6B995C1998933B3A955DC02F59E2FBCC5E367188C72F4CB3538D22025A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707484049, "uuid": "1a95b586-9973-41eb-a556-71b8d17c8f5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707484049, "uuid": "75b885f6-7448-491d-ae3c-a12c004c82d8", "value": "24576:X/o41iwtNIZ5p/TvCkV0uf5ZmH1OvrpPICwb/x:g41i0WvCkCua1Opw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707484049, "uuid": "ebbde47a-e1b3-4cac-8f6a-2e25379ed288", "value": 1195008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707484049, "uuid": "45ca2d0d-4226-4117-8d02-e2e857513561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707484049, "uuid": "045068d7-9431-4399-adc4-ee185ceab8bd", "value": "x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74ee0e6-c762-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707493809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493809, "uuid": "3cc9f991-fe6d-4bf1-a8f2-831b872d6053", "comment": "Malware payload (Formbook)", "value": "f4dc132f682d87e3e51674095c033324", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493809, "uuid": "7082d16b-0100-4808-b72d-c027eb4366da", "comment": "Malware payload (Formbook)", "value": "b55d4a15baef37956d07e013f7a797858fd6eafef0a9ede36d7ddda43ffe4097", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493809, "uuid": "420e5cf6-2741-445e-9905-83a519c94a01", "comment": "Malware payload (Formbook)", "value": "107d1fec542472c41c6946ea7655d652fec503ce", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493809, "uuid": "cd9a3d95-9b43-4646-b337-478e3a967845", "comment": "Malware payload (Formbook)", "value": "60a57731ab62df630e202afbd168513a960795e70e9b0cec5f1ef292e88c09e880f719df7fa12deec142d3dfbe21dc62", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493809, "uuid": "8b4f9450-ad24-457b-9760-810bf044fda0", "value": "T1B13410037E88EB11E1A97E3782EF2C2413B2B0C71633D60B6F49AFA514516529D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493809, "uuid": "4f1991e7-c2d7-455f-89ca-f9927d42ac5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493809, "uuid": "82774e40-9196-4e82-b8bb-7725b3cdb699", "value": "3072:jsb+OBZJxBajWttUtszUi/4QMYx95qsqKjnJA5fSsjgAM:jsRBZJxBajWgaIcqYDyKjnJXs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493809, "uuid": "cc39316f-87d8-4907-9559-294f0eac3dfb", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493809, "uuid": "bdf7827a-9cb4-4935-aafa-8c7be6e111a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493809, "uuid": "935ffdba-1ced-4034-ad46-f352e839cf20", "value": "17074938086a37925e51090cde88bb9b9cab9c2809900b2e7c2a2e6b8d9f8e8d3d3ee8799e367.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac581c1d-c70a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707455915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455915, "uuid": "0582297f-fbf3-40a5-9b6f-6188605ab8fa", "comment": "Malware payload", "value": "7c098f4df5ae8f3423242154773aa170", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455915, "uuid": "6cbeb6fc-4e88-4123-8e8d-ee68d4519028", "comment": "Malware payload", "value": "b5c232c552850a4a5594d632a3b5d0bbc3808e35fd5c8d90ce5669685494872f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455915, "uuid": "faa4a1a8-eb2e-4fd8-afc9-9bdb54b4bde8", "comment": "Malware payload", "value": "ec1ede201eccc8c872b253ffe6c48ef498471870", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455915, "uuid": "850ef027-c91d-4e7e-b0d1-2a88697cf8f4", "comment": "Malware payload", "value": "30906b393b6ea452afbea8d9d6d06d1bb855619aa6d4afd9b0430a598a05c21ef10d95e4b6a4545c08ec08e54d58a24d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455915, "uuid": "ea619ae7-d09e-4780-a098-b3bf4806126f", "value": "T104A6335862602CF5F695D23E8D52806C9662BC1543A1F39703FACA872EA73F13D7AB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455915, "uuid": "4f4d7ccb-ffba-4982-99f3-7ae3f1181e1b", "value": "bae3d3e8262d7ce7e9ee69cc1b630d3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455915, "uuid": "782dee7c-76a7-4cf9-9ad0-9599c280bf15", "value": "196608:rSglkdKID0pUzPLhQNQm8NkKemdQmRrdA6lkaycBIGpEoeHaO7f:+SpUTLfhJjdQOlp9N5O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707455915, "uuid": "2a834892-686a-460a-8f01-3af5fdbef01e", "value": 9851496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707455915, "uuid": "08bf0607-ccd9-4a6d-bd69-6c325abbb5e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455915, "uuid": "bff8de2f-1e7f-4832-a932-eb9dd8c30df9", "value": "SecuriteInfo.com.HEUR.Trojan.Win32.Generic.8542.6705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2af7c4e-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707488111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488111, "uuid": "49f8b5a5-f40d-4906-958f-0283837a3b49", "comment": "Malware payload (Mirai)", "value": "4207308842299e5c32fc704a6eba337e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488111, "uuid": "08b8026a-95c7-40f2-9794-de5a9e78e173", "comment": "Malware payload (Mirai)", "value": "b64fb3d65035cdeae4f41168a2126d9d453f05b83e7b358a4deda6c20d29b871", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488111, "uuid": "06663be2-33a5-480b-be97-721f32948076", "comment": "Malware payload (Mirai)", "value": "c74c6e8b3624d9f464e561fba523e950a46ce643", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488111, "uuid": "3841b038-7236-4228-89b6-2ca4471a77aa", "comment": "Malware payload (Mirai)", "value": "64b4660b655bbb362ebd0b101ec2399d039eb0b6e650f7b61885dbb36ac749220703d466d615e06f5b98cbcfc2cb8ecb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488111, "uuid": "ab118255-7d98-4ff8-8eb4-194160adf99d", "value": "T134C2E0E63EB76957DA29013D34ADCE325674E052D79FA613E240524821132BCBB718ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488111, "uuid": "4f4ced7f-d87b-4ce0-bb71-37761d4b1e33", "value": "384:MX1DMwk8JPyG3GDZaEXVZVBy6HInRiWLRYh4Sw4cGJYeRzOFGBzd8QUxIwNS1+NJ:qMwoDZLFbBy6HQHRYfeAxdd8n3w0Np", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488111, "uuid": "7cd06079-c316-4591-9b7d-57de5d236e27", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488111, "uuid": "626dba39-5d39-43bb-a95a-cbc32a95650d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488111, "uuid": "76262e84-62c8-4f7b-a123-6a225b869e49", "value": "4207308842299e5c32fc704a6eba337e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd4ad5c-c733-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707473634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707473634, "uuid": "bc7bf915-6bce-48ac-9ef8-77043ce6ae16", "comment": "Malware payload (AgentTesla)", "value": "393f12f18f28e9275a7d98731785f74d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707473634, "uuid": "3c6100b5-e39d-4026-966c-ffedb15b4e30", "comment": "Malware payload (AgentTesla)", "value": "bcb3f0c471ef7ff8146f911b7d5f5394699872e9140869c5531901b2170b2498", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707473634, "uuid": "b11fbfbc-b84c-4416-8ce2-6dda1298f391", "comment": "Malware payload (AgentTesla)", "value": "ebb79141a3ff6f350d6881735e9707a849d955ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707473634, "uuid": "d93b462c-92b6-46a2-8b7b-2918a42a6698", "comment": "Malware payload (AgentTesla)", "value": "9833becdfb752911a6c44e1f1433e8bf7e667913c75cb907016cfc4f840d699e04b1286b38d1b07214253a44caf03b59", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707473634, "uuid": "4d31e446-51a3-4113-a0a8-cc41c181ab9a", "value": "T168E42296E63AB327D66D83F464A4A1D507B2353F7580E7AC1CCA24DC1E5230A5B60E3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707473634, "uuid": "474e95df-593c-4a55-9dbb-9cca36e5b6b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707473634, "uuid": "5df2ab57-c123-4469-b613-b896ba2319b0", "value": "12288:6xEd6gdfA5qhTR1p62uBQwyQeQp91C4enl/stJdWdHls4WiYbmdFC:6xcTA4TpYGSDC4wetJUlWxioQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707473634, "uuid": "553c1692-e7ca-4537-bc21-228a6185e4fc", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707473634, "uuid": "3096708a-258c-47c9-aaa6-a4b5b6fbe8b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707473634, "uuid": "dd4190c7-ed33-4744-ae85-2cde9115b1d5", "value": "hesaphareketi-01.Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a29e33-c754-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707487746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487746, "uuid": "2769c017-0234-408a-bbc8-ae231aece8af", "comment": "Malware payload (Mirai)", "value": "06f6674b0158ad66a7f6953681a13da7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487746, "uuid": "4e435832-89dd-463d-b6af-ad995ac37df6", "comment": "Malware payload (Mirai)", "value": "bd1932281c86827a9ad93630f9c50280f2a4f34af7f603357dcf8f54fb47b830", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487746, "uuid": "c5221170-6959-4d4b-bc60-57de670c703a", "comment": "Malware payload (Mirai)", "value": "4a75614458d67e98bede22a81eeee41b4982d9ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487746, "uuid": "0ed8fae0-f2e1-4739-9e3c-973f51c8943d", "comment": "Malware payload (Mirai)", "value": "14b46079d94b32cedceac63204f35703786e58ce34e89451c06abef633420f44390080625e13f516f86aa18bb67d112e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487746, "uuid": "2c95b045-4638-4352-8d02-6943743532a8", "value": "T1131317E7B404FD3CFC0AE77E81174A09B431B2595A931A37A263FDB75C322D4496AE42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487746, "uuid": "902b75f6-6737-4574-bd11-d26ec5f16e16", "value": "768:CZhyxwUkezENsd7i0993LcYng/IbJQ6FsIuU8G+WHtUzVmV3GEsjMy5bTrz8:CZcivNsd7i09GYg/eJ5FsBU8G+W6mV3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707487746, "uuid": "a1c15b4a-d2ff-4e6f-a94a-bae686fc5f1f", "value": 43556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707487746, "uuid": "f126ad51-524b-458d-a08e-3482a384a84f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487746, "uuid": "09a4e7ba-c84e-4c8c-b935-58cfb26ad233", "value": "06f6674b0158ad66a7f6953681a13da7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa4db68-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707493313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493313, "uuid": "9eaf4da6-a7b7-4831-a158-48f7bb4efedd", "comment": "Malware payload (AgentTesla)", "value": "6f4edbc0a83e58417cb192fffc504611", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493313, "uuid": "a6ceb9fa-be13-4a70-9572-3de286165718", "comment": "Malware payload (AgentTesla)", "value": "c0165733062e95ec49ac20e05a6a085a2abefaa3d2a7d981ac9737781a32a5df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493313, "uuid": "68ecee6f-80bc-44af-a18e-30fd692a89bd", "comment": "Malware payload (AgentTesla)", "value": "960dca61361171e18344e576b5fd6da1f310908a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493313, "uuid": "94c5a7c8-625a-43bf-9575-aeb572e5bd6f", "comment": "Malware payload (AgentTesla)", "value": "f55fc93087fc8f458b7b0d1db01cbc33fc62f24ffdb92862cf21ac2efdad918900f37c64589b300c257bcb2a8e19f763", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493313, "uuid": "73e51f60-6749-47b9-ae01-b9a37ce16376", "value": "T113929788AE4A435565B7437C1B56591CFF98027FCA00C369B89E938C7F3492089B7EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493313, "uuid": "2c99aace-756f-4882-b6e4-997dec0fae9b", "value": "384:tCkZK4l37JYHr637JAEU37JeaRE537JRiUILq37JW6b+yO8zSnBscK4r6t:tFZ/37JYG37JA/37JekE537JYUF37JWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493313, "uuid": "a4339a28-3b4a-48f9-a15e-a6e9be1726ac", "value": 19529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493313, "uuid": "2d47a208-2d97-4ce9-93e5-145426370a3a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493313, "uuid": "5644ca4e-46a6-4bde-b075-284a54775863", "value": "\uc5d0\uc774\uce58\uc5d4\uc81c\uc774\uc0c1\uc0ac \uc288\ud37c\uc2e4\ub9ac\ucf00\uc774\ud2b8(\uc2e0\uaddc6\ub3c4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cf91c8-c776-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707502204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707502204, "uuid": "c32db367-8f6b-409d-925c-a64c23298d52", "comment": "Malware payload", "value": "64179e64675e822559cac6652298bdfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707502204, "uuid": "c7fb829b-2425-4a67-bdb7-6844d086ccd3", "comment": "Malware payload", "value": "c26db97858c427d92e393396f7cb7f9e7ed8f9ce616adcc123d0ec6b055b99c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707502204, "uuid": "343830b5-6cd1-4980-b562-ecd704205f20", "comment": "Malware payload", "value": "cceed3b2441146762512918af7bf7f89fb055583", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707502204, "uuid": "1a1a1abf-003c-4c0a-bf26-bac81b59d302", "comment": "Malware payload", "value": "02d9ad71156242cdbabbb4f9066f467a34aa2282769b605f3158acfa82fe427f7bffcd3f29dbc8c16c635200c8e8760f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707502204, "uuid": "6ad2bc2f-2e77-4b4b-8e3e-89c65a0e6c2e", "value": "T197147B037BC188B2E66703311DE4A376A7BEFD704F308727A348531E9E755C26D25A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707502204, "uuid": "e77f131b-5ad2-4fc9-b5a3-9a7a2967ba6a", "value": "c34d1a640671ce655d658abbbdd18ada", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707502204, "uuid": "67b6a046-1d74-47dc-a1fb-2b941f255039", "value": "3072:EMtKztOp6KfOQqoY3ltdNjlcwsSdplkrxf+Uyecgw:ELKfOQLY3l9jlcwnlUf+z7gw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707502204, "uuid": "218fc60d-f393-4945-8963-0de454d4c82b", "value": 207168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707502204, "uuid": "54fda3ca-946c-42d4-861e-18b6ef387b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707502204, "uuid": "9bc25c61-9d5d-4f4c-bdc2-fd40cfa5f4a7", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3b709d-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707488073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488073, "uuid": "d15d0451-58d0-47ea-8ad0-085cb2e8133a", "comment": "Malware payload (Mirai)", "value": "05a061be0f08c6ead8aaa0f666ab08e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488073, "uuid": "88fe123b-8c61-4907-b2bc-5d5a0e16126d", "comment": "Malware payload (Mirai)", "value": "c48c86f1a7df75ffc07379487eba165feb2f69e2470a44fc807258788f4c235c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488073, "uuid": "689f93b0-67cd-43b6-bd69-62628be9ad22", "comment": "Malware payload (Mirai)", "value": "1d375541f0e58c1a85edc61ec353cee991aad1fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488073, "uuid": "7ac58671-36af-47e0-bd01-148db468a639", "comment": "Malware payload (Mirai)", "value": "2989c862dd621a7c272f171b3a23953c9ce52cb886db9dabb4a17fb1ffb23100f8d38c92bffea80300e50034276d223e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488073, "uuid": "082a6db7-568f-44b7-81c2-f4f815cfe7be", "value": "T133E2F197D372A052DE382BB1F96D89CB5BBD4BACC27B70A315051618299A0435F3D8E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488073, "uuid": "ca0fcfde-0a65-4744-a53b-976f452ab528", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9Xxz9q3UEL5Ib:Porm1vpALgUJYLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488073, "uuid": "ebdf466b-c03d-45c8-bbf4-4ef111f4eeea", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488073, "uuid": "767528b4-2005-4387-82c5-6c9815808406", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488073, "uuid": "0553bcd2-7e3b-4ed2-b263-9c654f9fc2aa", "value": "05a061be0f08c6ead8aaa0f666ab08e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9cdfba9-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707493303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493303, "uuid": "73f25111-6a7f-4cab-8796-a1a931771246", "comment": "Malware payload (AgentTesla)", "value": "697ea3e198c1b7ff2406d4c4bd40ba1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493303, "uuid": "9837b78d-653e-4f40-9322-365d3a91a8e5", "comment": "Malware payload (AgentTesla)", "value": "c70d93940f00448d3a72c9a1293679ecbaf1e9fabe06cd5197e85d724f4d0f00", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493303, "uuid": "760f9197-9d5e-44c3-ad2b-5fdb7d81507d", "comment": "Malware payload (AgentTesla)", "value": "da5e2c098029cc388aa8f683fd50f727e9c66b9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493303, "uuid": "45a073a7-da2a-4604-bf12-0f8fdf08f418", "comment": "Malware payload (AgentTesla)", "value": "f16134ac6e2294674ef164d214deed9927853d99c537a30d811cd3c28aab2e34cd50823d582b1fe8259d76535698b250", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493303, "uuid": "00e235f3-b1ec-4074-aaa2-2f992e857962", "value": "T10C212C6263FA421CF6F7171C963725204B7B7E959538C61C05AC745D0EF3D0888A6BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493303, "uuid": "abcf5fde-f951-46ac-919b-07b5f8a8103b", "value": "24:QmlICkjt1L+/NitW9lFPZOdSLUrukM4NdC9s4CzRxu4CngT:TqCkBRc9iSWTMApRR49gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493303, "uuid": "5edd7ea8-80bc-4dec-824a-98a0eff9ce29", "value": 1350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493303, "uuid": "c87d2da7-842d-486a-a284-be0068cb3861", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493303, "uuid": "a7ea8653-9387-4684-b9c2-fbffbc4aa53d", "value": "Encomenda_(P.O_4203445-2024)_Multi-fluido.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac5af99-c776-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707502217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707502217, "uuid": "baca50e9-322b-4b80-9958-3f13f41fd54d", "comment": "Malware payload (RiseProStealer)", "value": "ecd75d2ce0559f6046a4eb87fe6e1368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707502217, "uuid": "1aeab8ab-4c50-440f-ad1c-983a92571a16", "comment": "Malware payload (RiseProStealer)", "value": "ca04c234825b9b12729aa3d525e80a9f800845f9a9bba6d98ffbd0d374b64e37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707502217, "uuid": "2b8bf12e-90a9-4fba-b689-594a3fc6a7d8", "comment": "Malware payload (RiseProStealer)", "value": "abc943e1dbb81f4418cf9e032ec26a633916646d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707502217, "uuid": "485e213a-6725-43dc-9be8-b533800bd2bd", "comment": "Malware payload (RiseProStealer)", "value": "edf3aab21f14722cfbe51cd51e5d9a89833123467bb6ec0b1c84ca25f03a739cc19751c07b0a1e64254f639d196be4a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707502217, "uuid": "403ad878-25f8-4388-be85-7a5862761c27", "value": "T15085230867F1327AC5FB5BB984B202975A31F8E19738C25FA6D8D0395F63EC0A035B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707502217, "uuid": "e80f4d3e-42cb-4a3c-9344-7d6b2a106e32", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707502217, "uuid": "fca62dc4-7f84-4d21-b3c3-1efda2de3b5f", "value": "49152:/O7vo9SQAjvK/xU5i4ABT5zG6i4zgr7Jq:ika+x+i4CG6litq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707502217, "uuid": "c6df2415-5936-4255-9022-ae1e8a8059a9", "value": 1767424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707502217, "uuid": "91abe820-51c5-417f-9605-fc90288988c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707502217, "uuid": "6501468b-d751-4b3a-9fd5-5d9f6d053dbd", "value": "ecd75d2ce0559f6046a4eb87fe6e1368.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ec24d1-c71b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707463264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463264, "uuid": "741eaaf7-1a25-484d-82b6-3a7f3444ebdc", "comment": "Malware payload", "value": "9edd9dcd971b488ffeb816390e55a8ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463264, "uuid": "52a8fb76-5672-4c2a-95af-ea550198fce4", "comment": "Malware payload", "value": "cb42c9169a9ed87a1be3c0d845397b79a373caf807f5abdb6a4797769b6bbc17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463264, "uuid": "430aef4a-eab1-4161-b15d-f7a9651ea73c", "comment": "Malware payload", "value": "b21e01f539f65f039b58199230fe7c64294b3876", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707463264, "uuid": "8a13ede9-bbdb-4b46-b89b-8cf137c5b775", "comment": "Malware payload", "value": "11bd23ebb929fb6832fc0e17e51349b0ed9eec26728c9e021fb91e1dd857402b4e4d619e618b8003766b5706ea84d059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463264, "uuid": "1742c280-30cc-453e-bed9-9b70aa3ac832", "value": "T139535C7067AA9A3FDDAF07B9A87261100734A2477383DB5E9FD8801E28B77C046527D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463264, "uuid": "42a5f072-6893-4005-8701-38566c4abbb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463264, "uuid": "6052cc62-b7b2-4450-9e46-606d89da227b", "value": "1536:QY+EyewUfk98L/qc69Nq5KzmWcTuV01pl7qIZo:QuDM98LreNgqmHZOIZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707463264, "uuid": "d37a4844-3686-4202-9afb-8f27f1392b67", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707463264, "uuid": "965e4161-faec-4631-bc24-6edfeca67153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707463264, "uuid": "548ce4f8-09ff-467f-b143-87517fdd995b", "value": "Purchase order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480f4d55-c75e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707491824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707491824, "uuid": "284b5e6d-4d14-4a48-95a3-48b0b937806e", "comment": "Malware payload (RedLineStealer)", "value": "cbb64419e447e9f792382ac6a2adcc4f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707491824, "uuid": "7ac8f6b4-e5c5-41cc-af98-2d2129f05468", "comment": "Malware payload (RedLineStealer)", "value": "cb67d97df5fafbfb4ce8ce8973194e1ef45b52fbc2c80fc85cf978f62d64593b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707491824, "uuid": "9ded883a-ab9e-483a-a8fd-043101f4dc1e", "comment": "Malware payload (RedLineStealer)", "value": "bd03c99a10c4c7aa88e665f5f1101cd32110199c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707491824, "uuid": "6781ce85-4eae-4f2a-9fe3-6aa1a2eff36f", "comment": "Malware payload (RedLineStealer)", "value": "f88a53db049993f6503e69d59138b0eff2e6277b5c84d477154ee97a4ad2cf09325046fda4501da459eb0b50212854aa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707491824, "uuid": "3e4aa758-6c2c-4291-a4ae-022476615e5f", "value": "T12083324A6E3279A4EC6860735DF183002DDC3E817A6B8FF564273F54F6B1E860E87592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707491824, "uuid": "9dec8cbd-fefb-4834-a458-48b9a771b062", "value": "768:10OM49JEJInaTUoefc/eiEwkkCxXaP9WwH6EZjIr9GshvSD2HkUCLzjQnm3V7/sk:1s49CnTUoekIHkZaki1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707491824, "uuid": "6ddcb08e-c3be-45a3-8fd6-a7177a6e13a8", "value": 82625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707491824, "uuid": "af58dd6d-722e-4340-9614-7495191ff5b7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707491824, "uuid": "017bce9a-aaa2-4084-9808-1d57a5665470", "value": "doxx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ed45a0-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707488116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488116, "uuid": "4971eeba-5fb4-469a-b17d-956ffd4b2f0e", "comment": "Malware payload (Mirai)", "value": "a9cb21e46036d850515a202c0bfe852f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488116, "uuid": "1230a0a0-ad7c-47cd-9d5e-8f48198c7006", "comment": "Malware payload (Mirai)", "value": "cc80e9d7a344a3befc39c509b88e5aa5d22c997395ebf0f740217837c0c3b09e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488116, "uuid": "8ef1e6d6-bf07-43f9-9b58-f811d7658aa6", "comment": "Malware payload (Mirai)", "value": "8c76113afc4b22ff253b819d42eb259f77f65afd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488116, "uuid": "4091ec6f-0d2f-473a-bcda-7dc8ce0141f3", "comment": "Malware payload (Mirai)", "value": "bbe54be5365dd4ed7f3a9bb389d8cbafb28c5711844d0e4c2906eacaf52e0cfb64503e0815f08ebe156fd4c561859e33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488116, "uuid": "7d4137b2-0bd0-4496-b5aa-dc5ae02893c2", "value": "T157D2E12CD94EBD05C5AD3EB950DF95B5398CB4C1A35DBA8E17228408F61BB8BEC071B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488116, "uuid": "31627672-1147-411c-8683-9ea0e5e1cc2d", "value": "768:C1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNeZJb8WUh:CbDs06t4BEub4sU/MbUcAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488116, "uuid": "d4852484-3c94-40dc-a45c-3767f0fecae1", "value": 30316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488116, "uuid": "bfc2548d-c585-4fbb-ad15-3de9a1f2d004", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488116, "uuid": "36403869-18bc-4933-8a98-d152222d87f6", "value": "a9cb21e46036d850515a202c0bfe852f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912c5c05-c720-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RaspberryRobin)", "timestamp": 1707465318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465318, "uuid": "ee58a7c4-62a6-4071-ae01-5f8e94e33a85", "comment": "Malware payload (RaspberryRobin)", "value": "61b14aaae219f54df081f977bab38bf0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465318, "uuid": "07cef3a5-1ffa-4f07-9584-2ccfbaa29537", "comment": "Malware payload (RaspberryRobin)", "value": "ccc0837dd0cbd08c9db38e93ebb96f34ec65e9a709c75165f86dffce1763db48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465318, "uuid": "a748826a-f97b-4b9c-ae20-7fcc22fb474b", "comment": "Malware payload (RaspberryRobin)", "value": "b7207fae0f6ebffc88c23ddb9919d9645677cac3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707465318, "uuid": "8fcc1134-36f0-46d3-9d69-c8a714fd5b9f", "comment": "Malware payload (RaspberryRobin)", "value": "15d0d6384ebb3de15882dc1ee2e97f2b69c5c53f347e6f7d00b67139195fe0f0d4612c9d3a9503365024307ac9013abe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465318, "uuid": "2b97a1fe-5873-49b2-9891-4bfb9cb09b68", "value": "T1B5952211B3C484B1E4A3253B1A3287A1963DBD209F664EDB53E03E6DDFB55C28A35363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465318, "uuid": "0d8e943d-b7ea-4ac5-80c5-fa1c2d25248e", "value": "10b73c5f7fc148e21f974da703236659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465318, "uuid": "6fc95a13-477f-4aac-9c7f-f6e171d66832", "value": "49152:anGImUliMvD0dqRi9rEmI0LQr694IQAQHgwfzdBmb3R:aGIp4cILQr696AQHgwfTmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707465318, "uuid": "a9b0aec9-da32-49e8-ad33-6f5ff0a76c88", "value": 2056281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707465318, "uuid": "70382863-26ca-451e-8b28-8b9c5a19dd52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707465318, "uuid": "f18a5eb6-c5d1-43ac-9c98-f2fe3aa3cc89", "value": "61b14aaae219f54df081f977bab38bf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bfd33bf-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707488099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488099, "uuid": "1e3d21a6-17a9-481e-ae41-aa8120815b49", "comment": "Malware payload (Mirai)", "value": "27b9665f15d1e96a1f2028e23b305bb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488099, "uuid": "cee607da-4f8b-4a73-930b-d59aeb86a62c", "comment": "Malware payload (Mirai)", "value": "cf6fecece5117977f8260be5edbde0453bee24b5aaa78d2a340661981abe16a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488099, "uuid": "aa8ce666-115e-4252-bb5c-cc459d666767", "comment": "Malware payload (Mirai)", "value": "1bde5fcba15a413d389b118d4ae23749d0b772db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488099, "uuid": "095a9251-2f3d-43e1-bdac-20e0d17f4df8", "comment": "Malware payload (Mirai)", "value": "d93f4579d65976e96365ff2ab7cf96ca999198a715d8212008b135b69123f36181cf2c4d46e89af0e79968f9d2e8f847", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488099, "uuid": "3d22755f-fa84-4c7c-95ab-8d0aad38f3db", "value": "T14C831946BD819F01D5C912B6FE2E118E33131768E3DEB2239D109B247BCB92B0E7B559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488099, "uuid": "464a1840-1cff-4989-b8bf-8f2912679d87", "value": "1536:CxnjOSuwgUtOJ8geeoJUp0gNaIAEbSMDiYyom8Kxcl5kYG:FS09yk0qaiyom8KxcliZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488099, "uuid": "64084399-c801-4260-98df-f3f1db55135f", "value": 83084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488099, "uuid": "a96f0f69-0b8b-4fb9-961a-cd06eb20e95d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488099, "uuid": "f046bcf9-e720-4e77-ae04-af664f7afe45", "value": "27b9665f15d1e96a1f2028e23b305bb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f75565f-c7a3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707521525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707521525, "uuid": "135c27f7-6d39-4f1d-8c78-341933b78cc9", "comment": "Malware payload", "value": "ed31ffec0e024a73792f99eb9e747af2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707521525, "uuid": "6c8d03fd-d339-4e09-8f9d-43eec742ebb3", "comment": "Malware payload", "value": "cfead4f7443d960c9d199a35384317522808fcce466dad7e24d85d72600a901b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707521525, "uuid": "2f98a940-7f79-45d3-9fe3-9795152b79ef", "comment": "Malware payload", "value": "6822802993e5fa070b3751e35b3e865574fd16e0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707521525, "uuid": "7c444174-2685-4f7c-b2d4-5154df685128", "comment": "Malware payload", "value": "915bbd81f927e43cc6eaa0033641a41d0c7efcd989fa4ab6fa3931b21e8e998d0fdae932ee3debcccdfc52b2a6e5b82e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707521525, "uuid": "b3ee25e8-f6f2-4ab6-b971-8e79cc4b5664", "value": "T1BD515BFB66CC8975FBF6D0FE053B2A86045914FF4622B1C40E3C294D4BC8F2A0861829", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707521525, "uuid": "fc741f94-9ce7-4940-abcb-afc2f738c4eb", "value": "48:9B5PJKmW3tfSM5kdaRoCJzjEQXjK6Jl5/C2pDpB0Su5qmp2RnHe0m6NVVz1:LKXt6FCJzHGGgOGqm50mmz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707521525, "uuid": "c94f4a55-4af2-43ec-abdd-c21ed42d7a5e", "value": 2718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707521525, "uuid": "eff45071-95ce-4e6f-a8c7-30a241dfa3df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707521525, "uuid": "bbfd4e96-0c79-4c43-97d1-becdfb851692", "value": "U\u0440dateInst\u0430ller.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c27e02-c704-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1707453326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707453326, "uuid": "e1dac04d-23cb-48af-99be-db3ca7db4eec", "comment": "Malware payload (DCRat)", "value": "a4f082b9f08a5a3e1ce6360159c8732f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707453326, "uuid": "a0b0d5b4-c81f-4560-8c95-8901468e3b6a", "comment": "Malware payload (DCRat)", "value": "d16281d36cb3139f4353ae35ebf214c42a6e19f050906961cec2fc656d295df3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707453326, "uuid": "89dbf68c-f80a-4536-bd2c-796b75e52b82", "comment": "Malware payload (DCRat)", "value": "343a2ec18799fe011c55895156bc58055a836522", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707453326, "uuid": "bb5eabfe-7a0f-4685-8c1c-e4b7ecc4d5fc", "comment": "Malware payload (DCRat)", "value": "f3d0cd6b24a53c1e22bcb6d3929d9601a3ed82bb6520b7c3e6772741e1138412c77727e9325ff4f8ef537c26a83155be", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707453326, "uuid": "58251953-9e48-4cd3-a762-f0238de3ba45", "value": "T18FB5C01679A14E36C26467318597163D4290C7263912FF0B3A1F60D3AD0BBF28EB66F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707453326, "uuid": "34048d16-b17b-4e10-90a5-1e9f2335b20d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707453326, "uuid": "0f06887f-af53-4544-bae1-2235763475d1", "value": "49152:SAK0RKiYjXfeZPP68zVIxKY92s5nfTPI3oSAv7xLqMTsMMs1a2i29obFbX:SAK0RKiYjXfe7zG2wk3QjnsEi2cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707453326, "uuid": "50729476-0d1c-49f7-9a21-579a44943c37", "value": 2349568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707453326, "uuid": "dcebf931-c806-4cd2-8e5b-5458ae140778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707453326, "uuid": "0f381da6-c2a3-4ec8-b566-1c1f27a6b1ab", "value": "a4f082b9f08a5a3e1ce6360159c8732f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2159c73-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707493317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493317, "uuid": "cc013af4-c402-4048-a4d7-32e64ee5e8c2", "comment": "Malware payload (AgentTesla)", "value": "c19d2b24fd3c4e1f4e4f39f40fce85e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493317, "uuid": "997bb438-c41e-438a-8074-7cd086b3ae36", "comment": "Malware payload (AgentTesla)", "value": "d27cc251d628f86ef7139ec1101d1225d33910bb8767bce7df7b455b13259914", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493317, "uuid": "3235bd1e-76f5-4220-ab16-0df7f8d9ba1c", "comment": "Malware payload (AgentTesla)", "value": "7257aa24d0e87a1d3277c67927dcc8c110ab0e5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493317, "uuid": "b15a9fa3-52ba-48d0-8c45-7013c06e9a41", "comment": "Malware payload (AgentTesla)", "value": "c8411f65a61ef621ac02c0a609fe1f7071ab7e3f395255c84a3b4e28f95ec6a6740187587d9a04496cda9543877c157f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493317, "uuid": "6c887531-2218-4280-ba4f-10984cfebcdb", "value": "T1E5A2B888AE4643656577437C1B46581DFF98427FCA00C369B89EA38C7F3492089B7EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493317, "uuid": "4a19e4c4-4203-4967-9c48-7b51a6423cb9", "value": "384:tCkZU4l37JYHr637JAEU37JeaRE537JRiUILq37JW6MD3nso37Jd+yO8zSnBscKF:tFZp37JYG37JA/37JekE537JYUF37JW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493317, "uuid": "04169bea-cc2d-4cce-9de2-baf429e6d313", "value": 23119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493317, "uuid": "9e8cda25-0109-421c-992a-b7109a2bc29e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493317, "uuid": "3e78dfb8-350e-4f4a-8527-e618b1ae6460", "value": "Purchase.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a94e0b-c6e5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707439953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707439953, "uuid": "b44f533b-cee4-4e4a-a7f5-ac68c066c9d9", "comment": "Malware payload (AgentTesla)", "value": "b01f9fb41d5e9fda7f0ffc5379abd798", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707439953, "uuid": "6733a185-b5b8-4486-b3d3-91e23f69217c", "comment": "Malware payload (AgentTesla)", "value": "d2bf8a19e0c65fca8348897b005eb4065f8cf89ea2ba1a5657845251d2d58737", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707439953, "uuid": "b279a028-3017-4767-b8d1-f574ad5e6cb3", "comment": "Malware payload (AgentTesla)", "value": "03f7aaf2b11cb98651c5c70718ba04c3bff66539", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707439953, "uuid": "47f89c17-d3bc-49c7-8c71-e68e291d5dac", "comment": "Malware payload (AgentTesla)", "value": "cf68c98dd5111a982045f5388661e27b47717db6c0a8aa1131e9aea5cb4ee49a00060c75f6ccda3036227df877c6edf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707439953, "uuid": "eeb2e183-d673-4b4d-a8d3-93bcca6131d8", "value": "T15BD423775A1FA503DCC0D8F4F4EF8F409A666465768ABC82D5210FAF68C0784E7C9AE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707439953, "uuid": "53e5d6ba-c3f5-41bb-8e61-a6025a72639c", "value": "12288:Ss8kPpMwBgFK/4tRxjEc1ZsGtiObxUNWItsMprAbF73ryqDt19:okm/04tTjEc1C5iBGUbFLmAt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707439953, "uuid": "ec1688a8-4347-4a5a-841d-edd688b28dda", "value": 630444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707439953, "uuid": "e439eb3f-0b05-42e3-93ee-a73963a07438", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707439953, "uuid": "ed090be9-7cc6-49ab-82fb-c2eaf5004900", "value": "PAYMENT COPY - 7Tth Feb 2024.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf68d65d-c754-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707487756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487756, "uuid": "97855a7b-79d8-4ca3-b56c-670f74b4c489", "comment": "Malware payload (Mirai)", "value": "50b17052b94e1d33beb968b2fe859ca9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487756, "uuid": "cc600b43-663f-4716-bd8a-7251810c9aa3", "comment": "Malware payload (Mirai)", "value": "d356bb22f38ea9af331bf51d3560bb5290e5d62f9f2f007ee6a010e7758a6d1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487756, "uuid": "93036a28-e7d1-4243-8d9c-ad64c519ae36", "comment": "Malware payload (Mirai)", "value": "e81628a1946ee2384528bd93cf597435322b5d79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487756, "uuid": "3c90a24c-a076-4743-ac3e-9dc5698c5b75", "comment": "Malware payload (Mirai)", "value": "f1573b85c446fbded61dc050b944864f3b9ff331f3f6922d30004a91c949b269bbe99f441e8a024824f6e83c4e168d9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487756, "uuid": "bf07d1cc-62f1-42a9-b9ce-197ff7210938", "value": "T1B3F23BC4D583DAF1EC1152F12477A7624E76EA392A3AFA56D3693531BC03710A7073AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487756, "uuid": "1e9d3906-54bf-468f-a970-4bcd8ad7be37", "value": "768:fv3GFgmh0AZoHInrFsiAD1AYw9S5+o6tW5:fvWFgmh0AbhsJD1S9Sg9tW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707487756, "uuid": "79b2c076-c6bf-4ce2-a442-f731bcdfad03", "value": 37648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707487756, "uuid": "d7825caa-530c-4e46-8ab0-d53cfe2742b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487756, "uuid": "c72d5277-af64-4361-9523-c60756388c31", "value": "50b17052b94e1d33beb968b2fe859ca9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d8c663-c735-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707474099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707474099, "uuid": "bf2f75f2-c463-4cef-9a7b-1b30e9271bd9", "comment": "Malware payload", "value": "13cd3480d6fb4f096cf3bb7ad19ac8d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707474099, "uuid": "11195108-5e53-4426-81de-160ad2c659e0", "comment": "Malware payload", "value": "d47b2d25af50a32752d011c5c754bc6765fd06169971f8ad012adba5570f95ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707474099, "uuid": "1cdc61a7-ad0a-47bb-a3d3-fb50ab2d4962", "comment": "Malware payload", "value": "ae66d496aec9410bc9ee0c092847680c9ad0ba39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707474099, "uuid": "04289cea-939d-4256-a7e3-a42becdb920e", "comment": "Malware payload", "value": "58063f67e5fd77dd97e2b4e2e5dfa1c0f434c8dedb28019eeea132dc10bade53fa8aef3d39c60d42464c4912ffab6a71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707474099, "uuid": "d7566483-177d-41b7-82e1-f5843e9c948d", "value": "T112C56B1572F0906CDFE746338A786EA04774B9368A2D8F4B12F3295D5EF8981CF20766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707474099, "uuid": "26748af2-3b20-476d-8321-5ffa69cf5ccc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707474099, "uuid": "01af7a29-7bf3-4528-aa3e-2c61afc29f51", "value": "49152:RnG5tNkxbSz5UVrIdhnW1Pc96OtleMqbo:RnutCxbSzGVr4W11eqbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707474099, "uuid": "1b2ce4a7-89a9-40e0-be0b-034f6227285d", "value": 2570448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707474099, "uuid": "219636f8-b92a-40e0-8e75-26136cd908fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707474099, "uuid": "3a76c1f5-dae8-49d1-a51f-4f52da91c908", "value": "SecuriteInfo.com.CIL.HeapOverride.Heur.25105.23117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07968597-c725-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707467235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707467235, "uuid": "955f22f7-3df5-4aec-807b-a901ef25e4bd", "comment": "Malware payload", "value": "299d2122b8c2cf334cdef60f10a906d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707467235, "uuid": "c63fbd05-a1aa-4a8d-819f-22d829b92db1", "comment": "Malware payload", "value": "d805f9bce67fc0c9d28536ffd026c7685b870c01019532c2a145362923464c28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707467235, "uuid": "066086e7-d232-4ff6-8bc5-e2ef6ce49134", "comment": "Malware payload", "value": "a33418a6a8740667e1e5030c6b650023b2876d35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707467235, "uuid": "235b23d8-f5fc-4e0b-a716-56fd60cadf7f", "comment": "Malware payload", "value": "f4e04cf974dd46959d626874d51b705e74d1c668d7245d857089f5f55d210be6abafc4f58384912abcf380e6a1d3c68a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707467235, "uuid": "73413901-174f-40b6-9499-51ec7509a817", "value": "T167763390A2D45EE4D9B3813FCA95801AE631BD610B6CCA8B83F4A9933F233C5597F754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707467235, "uuid": "45c34002-9e6f-45b4-9b12-aabe69b4aca1", "value": "bae3d3e8262d7ce7e9ee69cc1b630d3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707467235, "uuid": "9bea2838-9e1d-4073-88e8-21c69c95e8d1", "value": "196608:aeB+5A+1W903eV4Q2tpDjIIAcwD0RPsv/k9jpIL:QjW+eGQi9jo0hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707467235, "uuid": "5d565d51-c656-4e26-905c-90868fbe5c93", "value": 7356487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707467235, "uuid": "dfddb36d-bb45-4528-98dd-12fb04c28b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707467235, "uuid": "255a0b04-d0ab-4007-9443-913646a1aac5", "value": "SecuriteInfo.com.Win64.Malware-gen.27500.12976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f058d42c-c760-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1707492965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492965, "uuid": "3dfc75ec-781f-42b9-98b6-25cfc51c83d2", "comment": "Malware payload (PureLogStealer)", "value": "702208b62f9db0aca6b28f47a7b402a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492965, "uuid": "cef96de7-f746-46f4-8643-917a486bcd7b", "comment": "Malware payload (PureLogStealer)", "value": "ddd3762a1f95e1f86b86a92e54f2d52b2e9b96499a6fdc07fab98813eeaca8a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492965, "uuid": "68ea813a-76e0-4d06-bb89-9a79a45b4264", "comment": "Malware payload (PureLogStealer)", "value": "db02b42468103114c19b2757aa5ecc0f35cbbdc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492965, "uuid": "c92a6a15-275f-423d-a529-bdfb9f68f9af", "comment": "Malware payload (PureLogStealer)", "value": "8fad47adfedb6640a0b12cfb69cf83f275feb1f3b4b73952974783a11d927e3950635f1a57bec751e19f172e993e8f63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492965, "uuid": "4602c26c-9368-44bc-a2a2-e058bbc5b462", "value": "T16555014B63228922C3A4A775DAB393040B50FEA3A3A7D34777CA513A515B3BF0F61716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492965, "uuid": "ccc8933d-6dd2-4d79-bdba-20d02e427b2b", "value": "24576:quBHiaMmw4o8xlJ6NEUD8Fw7fAKj7lCoOcQCxwWHq9/Z0LeHo9hXcT/:o33Sr6NEUDUmfA+2DCxw3h0aoXcT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707492965, "uuid": "f172c79a-fea8-4eb8-a541-de404de1b618", "value": 1344512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707492965, "uuid": "11011e34-032d-4889-84b6-2d593414b526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492965, "uuid": "c0c80e92-a580-4b91-a336-4b1ee7c0f592", "value": "702208b62f9db0aca6b28f47a7b402a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89938b3e-c78d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1707512120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707512120, "uuid": "feec7969-b415-4e7d-adc9-f6eee393f285", "comment": "Malware payload (AveMariaRAT)", "value": "4df59dea2cef6c233168b355086bec84", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707512120, "uuid": "62314407-0030-417e-904f-c37a413e1a6b", "comment": "Malware payload (AveMariaRAT)", "value": "de492c6384df2afd8c36f3f8ca910d93a21a2981b3c3a80e8a858d643122d488", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707512120, "uuid": "45a0fe85-7b26-496e-8b0c-8aec58e269c2", "comment": "Malware payload (AveMariaRAT)", "value": "38ea6d2ec93f3af7b029e4e0815cfbed1a86f67b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707512120, "uuid": "f6ec3d2d-74d3-4ce9-b263-935ddd2d8ac2", "comment": "Malware payload (AveMariaRAT)", "value": "1858d50b7320115437191098d970a44cb19a0a6c2d1e17dc2123e982db08b36170b64e3e06e963e677a5a060aed453fa", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707512120, "uuid": "1538c375-33f4-4a3a-95bf-5257cb197f32", "value": "T1D3F4BE03B16DDB5FC96405B5B07015B493B5AF2BA420E2DA7CC6FDAE21F6B8E09406C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707512120, "uuid": "e3b18c50-c122-43e9-a5c0-ff36ea332cc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707512120, "uuid": "19474ede-64ba-4729-8816-99a077220591", "value": "12288:BuIjUxr/RIZBpCrAaXYykD9c3hWVefuiqzuBHofwjKUO6/My2et:BuIjUxjRIZBpGIr9cxWVquiqzuJTKUT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707512120, "uuid": "7b4907a2-9573-4b8f-b4c1-2ed3f0018556", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707512120, "uuid": "8512df17-a4fb-42c8-b8f0-20c7ac1b1aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707512120, "uuid": "bfe3c195-4566-4c1f-8bca-b66046cbb76f", "value": "4DF59DEA2CEF6C233168B355086BEC84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd30cd7-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707488156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488156, "uuid": "5620f7a5-1b4e-401e-b0f7-b1650e1870e4", "comment": "Malware payload (Mirai)", "value": "a15ce76fa6a95bdd60e12c86ffa70011", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488156, "uuid": "c781e79b-9d88-49f8-9818-7d3db6756c95", "comment": "Malware payload (Mirai)", "value": "e1a09f5deb7de29ffcc8482b004cbe185b8a3e2f671de8abb607442bd78e8034", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488156, "uuid": "73ac80a1-da0a-493b-9b80-5941a2731277", "comment": "Malware payload (Mirai)", "value": "c6e3e065710a0005eab12d7a320b9a332035333e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488156, "uuid": "ddb6e106-c9fd-4544-95a6-038471b11f60", "comment": "Malware payload (Mirai)", "value": "d9c506d5e26b89a2250420ea4234cc39a9af9486e3bacbfde766619bfc0938de2d5b5d97c4191901d4643264c8774dfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488156, "uuid": "bbacb648-74cd-4d9f-acc2-c22dd0f9795e", "value": "T11E13F884B9819A16C6D0237BFA0E83DD372A73DCE2DD7313DD156F52378A92B0A6B041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488156, "uuid": "bf8cee0f-510d-408f-88c9-9103f78d8422", "value": "768:HCCXHYzP305oYoa7osEobmotqIHZJgvaFYL924cBS/djYlUWfC:iCXwzEZxmiPgvtNQIdsmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488156, "uuid": "8fb38b44-e5b7-42e4-be43-d26702ae90d8", "value": 44196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488156, "uuid": "3c13d0e3-3c15-43aa-b078-513ee3177428", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488156, "uuid": "e01232b7-6741-45d5-b7c2-2e270be0ec45", "value": "a15ce76fa6a95bdd60e12c86ffa70011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17c758a-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707488162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488162, "uuid": "084cde67-0cd9-49be-b07f-bb059f10f935", "comment": "Malware payload (Mirai)", "value": "9d9f809963c18c95c3f76c0938fbb3de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488162, "uuid": "d3238b28-3303-4ca2-9b88-716ca91eb786", "comment": "Malware payload (Mirai)", "value": "e67600e9daca3cee1f510f78cbf52e92ccd45e37f586a0f32b7e0fe32138aa61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488162, "uuid": "ba409044-8e77-4c8d-bfc4-cfcc701931d6", "comment": "Malware payload (Mirai)", "value": "5e30e5dec2eea10366379260ba0ba26cb151b669", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488162, "uuid": "f5fbcc86-2959-4f0e-9f1e-6a1fa3950abf", "comment": "Malware payload (Mirai)", "value": "8d5321a44ec50527343a950029be92341911a9d24978564e064d49322bdcf308d01562a2610cfaceb44092712353cda7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488162, "uuid": "7d1cf2b4-5f46-4974-9019-45e827bd757e", "value": "T1E563964D3E319FACFBA8463457F39E10A35823D526E1CA85E29CDA011F7034E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488162, "uuid": "13945ca5-d353-4058-9d7b-e5849be1b6c3", "value": "768:RzZWyvL5MsRXxPx2pqV2UNz9HX8iJ3GecFgoSERFImpPxs6vvSp+ozXeyt42egHO:OKzPxkqV2U3GecFgoSWlHs6t0egwsnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488162, "uuid": "9a216303-8294-42dc-aea5-fa7e479445c1", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488162, "uuid": "3ecc984d-1c4a-4aed-8058-542e9f412f23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488162, "uuid": "3a05072f-b6c2-4a2e-bcda-5411cb188b39", "value": "9d9f809963c18c95c3f76c0938fbb3de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ccce10-c6e1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707438351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707438351, "uuid": "0d0ca7a3-5848-4996-921d-160f24c37526", "comment": "Malware payload (LummaStealer)", "value": "33289bd5de49838777b6fbe8374099e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707438351, "uuid": "8eaf0cb3-47d4-4833-b363-0ecee4a810a9", "comment": "Malware payload (LummaStealer)", "value": "e6789d5ac94a8dcba1cf33208b744cedba279310d64704172f622a2d3a908414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707438351, "uuid": "251f0c02-9935-4832-b3a1-0759f651b699", "comment": "Malware payload (LummaStealer)", "value": "350e0026e3702d7915ded3656ee6b65f88351255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707438351, "uuid": "aede7062-7d6b-4e77-88f4-cb6beea24daa", "comment": "Malware payload (LummaStealer)", "value": "c53615a3002f30749a161fad658dacc423c5eb5b5cf36a523489a2e08ae6733f25b7e40274e049c616c5b2268347e8f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707438351, "uuid": "1de1122e-9b17-4e58-8b6f-c8e1a3a5ca13", "value": "T16286226693242A94C73D22B1C116F47443F1CE869712D3BA9CC0FED67632647AE8E1DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707438351, "uuid": "75688da7-acd9-46c6-bd9b-0e793236b9e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707438351, "uuid": "338be98b-fcaa-4b44-95d2-2f2ff5c786f7", "value": "196608:fblKDgrS1Qz8YxY4Ns/80Hcm+lIMDHTJZD9a/H8:f2uz8Og8ZmODzJnaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707438351, "uuid": "974f85d2-141d-448a-aebb-4f125bdd0a94", "value": 8207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707438351, "uuid": "cf0cfbed-ad71-4c56-913c-1527fbd66545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707438351, "uuid": "5d97f160-a655-451b-9b37-be1c237d6e43", "value": "SecuriteInfo.com.Win32.RATX-gen.21236.13558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27cc215-c72c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707470528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470528, "uuid": "53279ced-f083-433e-91ff-2be7747a4575", "comment": "Malware payload (AgentTesla)", "value": "20ac315f4f69ea008dcf31c345a2d149", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470528, "uuid": "26126406-0a53-43c2-a7a3-a8af9a9a1731", "comment": "Malware payload (AgentTesla)", "value": "e7ffc4214d13d6bec7c08d1ff409516585461baf790bc99ccd1e5d58c7203d11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470528, "uuid": "b2870cf3-3a2e-4bb5-80c8-ae93c132ef35", "comment": "Malware payload (AgentTesla)", "value": "b3ce68d91bddb3c353ba612996b33b163e587ead", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470528, "uuid": "5cd7b473-acc6-4202-adda-fa1269cdf11a", "comment": "Malware payload (AgentTesla)", "value": "8000a16c35a57a0ecd04b3bb057e694d6fcffc738f28b44597d7c117bc9c7f28f79c41dbc9ccb8128fe0a0e451216c33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470528, "uuid": "512af81d-6db4-4868-ab55-061e17e61782", "value": "T11BE42330B776BE27F22253F0A4124A1507B21E5BBA51DF659E0484C2AFEB7CD4B92707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470528, "uuid": "d8adfa95-f734-475d-8b04-87ac3c43fe97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470528, "uuid": "479b32b2-13e4-4a32-ab34-9f9ee3868add", "value": "12288:AlxEd6IRBMjBHYEwXzsvHzc8p3gqOpICKEXQ/4VJc5huECHCpUkxkiVSgxblVGEj:Alxc5DiBHYXXzs/zRgpuqXe0JGAECiUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707470528, "uuid": "800d7bfb-830f-478a-a105-7f67d6b535e1", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707470528, "uuid": "29c3da79-f91a-4fb7-be63-e1fc1e573374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470528, "uuid": "9df8639e-607a-4bec-9037-1f973c672ff7", "value": "Order Kontrakt- Qatar CCC - EPC Oil&Gas Acknowledgement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce944b48-c760-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707492909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492909, "uuid": "73975aac-5fc6-40e2-aa16-1301ba6226d4", "comment": "Malware payload", "value": "8e3d4644ac719f3bf3080dcd048db188", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492909, "uuid": "b8f8c5c8-ee7c-46f8-aa56-0299575bcb4f", "comment": "Malware payload", "value": "e8d01743ce0ffa61150865297b135b597e96858b00853ec80ae47ee8771e3f0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492909, "uuid": "b0a19c9a-13ea-4c7c-b662-1f03d04e8c3b", "comment": "Malware payload", "value": "b9c794f521492d1b2ee07949ab0caf5ceade9fdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707492909, "uuid": "05dadc56-563d-440d-a8b7-0a28d873f02b", "comment": "Malware payload", "value": "65ae1a69f6087c2945e94b6f216b65f5105dc13a142cbcc923fac4d712a9f82960d6b5caab21f7c135628dcf227d15ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492909, "uuid": "1d4e2d95-32d3-4f73-86fb-1a424ce93618", "value": "T192E5337236F3A062D9824970F8308FD01FBB2C36757686A737249FB75CA2950DA67B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492909, "uuid": "a65d14e6-f375-4c5f-81db-4764e779b199", "value": "4696cd4eba2b1db3a82c2253e8f38d96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492909, "uuid": "80dfd634-847b-496b-aa4e-a9522453ea7b", "value": "98304:V3btRQKCDEKUQs1bp5QYvTOKbJ7ZHcwqsqOsG:V3btpxpbpR5XH8DOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707492909, "uuid": "acfb97cb-c644-4384-bab2-d69187e81754", "value": 3319808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707492909, "uuid": "4377803b-849a-4798-87d9-66be67280ccd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707492909, "uuid": "e3011873-f7e1-4b0e-9e51-38df64869f60", "value": "8e3d4644ac719f3bf3080dcd048db188.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038d8b94-c735-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707474100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707474100, "uuid": "56221df9-eddf-4eac-9c65-1747fcb05361", "comment": "Malware payload (AgentTesla)", "value": "1c0d858bd80e6ebf1965595bca28100b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707474100, "uuid": "12509c2b-f750-4f2d-92a4-f0c42c2903ba", "comment": "Malware payload (AgentTesla)", "value": "e975fa2f23bd0915d807f163a8cb25eaf6701e1c699bdb038b479d35601bb952", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707474100, "uuid": "506804b6-9127-49fb-b903-59e5b65f481b", "comment": "Malware payload (AgentTesla)", "value": "398243c19ca4d0295e27b99a8eb2816cfb819799", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707474100, "uuid": "1567633a-1bff-499c-b582-4e1c477521c9", "comment": "Malware payload (AgentTesla)", "value": "1a06125b14578aceacec59fd4d214d01456118057a6b9c4b58b03860ebc92cc631e2d4b484d644e2d8bd53f88db8eec9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707474100, "uuid": "7192580d-9c9f-4aeb-a3c8-3e5e4f970b5d", "value": "T112E423146278BB13D9BCDBFE7407608047BAA6AA5480DB4C1CD715EF3AA27474722E1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707474100, "uuid": "4303517f-66de-4d9b-b356-5525950e2d95", "value": "12288:XLzgOTLmNN3MuARMfkr6ftSpw48fW0BDRMOQI5FBD:XLzgOHmX3MuAu8eFSW48ftF621", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707474100, "uuid": "2c1afeb9-43e4-466b-bc2d-4a5260b4d33f", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707474100, "uuid": "130eca44-7a75-44fe-9ceb-f89f4782a583", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707474100, "uuid": "55232fb8-615c-4ac7-9f1c-bd4e3eeb48a3", "value": "SecuriteInfo.com.Win64.PWSX-gen.19868.13837", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39131843-c75e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707491799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707491799, "uuid": "2f552377-3518-4133-ac50-15c13a9a4bac", "comment": "Malware payload (RedLineStealer)", "value": "01fdb033bba5622dc77f7ccd034e492c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707491799, "uuid": "d805903d-d6c4-4179-81ab-b7541536957c", "comment": "Malware payload (RedLineStealer)", "value": "ea9bd2364b267a3849bb7c5031b207a7406d20509751b5f0e440a2c56fbc1825", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707491799, "uuid": "8d6a261e-1f57-4ce6-914b-c0479e74b1a6", "comment": "Malware payload (RedLineStealer)", "value": "91d3f0e58bcfd1cc25ac439ab3ea94249fb2f29a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707491799, "uuid": "20c350d2-0fa2-4ae2-8571-56bc45140781", "comment": "Malware payload (RedLineStealer)", "value": "73b8e195882ecc9067c3543fe6c3417c3fedb1dd1eb27d55e3e110a4294c0fa8aaa27775b6bca0c39d4706cbed98df48", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707491799, "uuid": "cab70552-fbd6-4879-9de4-2b2638aff542", "value": "T19D413A28DED90629F6B24B71CBE76213F566B841FB1DCA09019343491062251E4FBE5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707491799, "uuid": "18216c8e-b7f6-4b84-83e6-397e73de343a", "value": "12:8AXVm/3BVSXvk4RnK9hRNSmW+UcZRNSQcT+4YfuPoC1AaekiMCkpbdpYrn1IlI5L:8AY/ByKnC+/lyXYgxeeFVdd79dsrab4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707491799, "uuid": "10f180b2-5fef-4607-99b6-ee3d7ee43a4f", "value": 2078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707491799, "uuid": "7110b312-8ab9-4762-937e-28ac2af3da82", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707491799, "uuid": "4ac3e9ee-607c-457b-82f7-233dea14527b", "value": "doxx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224d6c32-c75b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707490472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490472, "uuid": "0ab4b05c-7177-4b37-a8d8-c0209f617ad6", "comment": "Malware payload", "value": "a9c5924063a253f64fb86bc924be6996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490472, "uuid": "48be6064-33e9-4246-a02d-7b2ccc0e8546", "comment": "Malware payload", "value": "eb1b278b91a8f183f9749948abd9556ec21b03ca852c53e423d824d5d7cc3de4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490472, "uuid": "44a521d2-8a9a-4717-b058-892cdc2b12de", "comment": "Malware payload", "value": "c39ba1e011318b3edf295d4bdde3d56b5de89972", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707490472, "uuid": "97a9e5c9-c53b-485a-bd8c-cfa1deedf8c1", "comment": "Malware payload", "value": "0ebf67d345d2a4306d5c9799615c8043a1bf884209738100790d406f9ed3583f8abc00e59e85e37a7e90072a9d2b1ad9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490472, "uuid": "b99ee2de-846e-4f5c-87a3-9ed5acf9a68d", "value": "T17175AE27B29600FDC06EC17987565122E971BC450B34BADF17A8A7252E32FD06F3EB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490472, "uuid": "470062ae-d5c4-4444-a778-98d7a8111897", "value": "69573714e11441683ea863c40a1c0d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490472, "uuid": "a38f1df4-e132-4a09-9eeb-9b53ae856954", "value": "49152:Do4o2O9f65YTz7jGnD3D121zsax1KWMXz/qIFI2t7:DTMwrMIWMXOIG2t7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707490472, "uuid": "14b0ae00-63e7-4c79-81e6-dd637d423d6d", "value": 1661216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707490472, "uuid": "4d5d0c74-7d6a-49b5-a46d-a26b59ba17bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707490472, "uuid": "57ea42f5-42d8-46c5-adf0-e8d6694ae48d", "value": "putty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f827ce9-c747-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707482065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707482065, "uuid": "954af604-cc74-4f01-9506-7404c5261399", "comment": "Malware payload", "value": "bf9c9cc94056bcdae6e579e724e8dbbd", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707482065, "uuid": "2aabc968-c354-4dd7-ad31-25ecbac2b777", "comment": "Malware payload", "value": "eb615c093e9b52ed409f426764857e6e42aa85e02adef59d6f1457dcbb90bb40", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707482065, "uuid": "9ad4cf20-033c-4a52-b6d8-db2c3227aca6", "comment": "Malware payload", "value": "ee340d0cc2f5f807845a87ef8ff46579a8701939", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707482065, "uuid": "0a42802d-a2fb-44b7-a85c-b531a605962a", "comment": "Malware payload", "value": "5f5fc91ac6e30650ce8b0dad3a18b43d2ef5cba0502c37ef27a0e16eca7f3398b38c1ac1e58701f5eff6fa8e735eb008", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707482065, "uuid": "c566ad8c-d744-49c5-ab0a-5c86bb80bfe9", "value": "T1DE3671E9B3B185B3F1CFA035A02875CD2D70A8573109F25B9B3776919A225FFB29D600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707482065, "uuid": "04ffdce3-9a67-4e0e-a2dd-cd5f0878bd96", "value": "e923fd2ee2558942eafbec4a9773e68a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707482065, "uuid": "fc030f41-6c5c-4aca-9158-b3b8c001407b", "value": "24576:bsjTeuEeDtPjU/PJFqgNiL7IJAL2rWcweuTK1y6hmgb5BiEfOx1dymY+Y/LnBlgP:bs91grij20YJFsGGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707482065, "uuid": "771b4640-b9be-4d97-87fe-f61ff1e91e10", "value": 5163008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707482065, "uuid": "1c80f717-eb39-4849-8a01-a608c2814ec8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707482065, "uuid": "b84aea6f-f929-4c97-9a90-10f0e7dec41b", "value": "eb615c093e9b52ed409f426764857e6e42aa85e02adef59d6f1457dcbb90bb40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2127c85-c754-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707487734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487734, "uuid": "c90da3c8-be57-4a89-98e4-d850356f20b8", "comment": "Malware payload (Mirai)", "value": "952d9566bb56b27947c42f253d8de0e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487734, "uuid": "2e1ff79e-6100-4f71-a28d-f5fe31640bd1", "comment": "Malware payload (Mirai)", "value": "eb73ade042820ac82e65a069da8163cc17af6bfef005807df091794213262bcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487734, "uuid": "f7b0260e-5505-45ef-b1d9-d34eb6e95565", "comment": "Malware payload (Mirai)", "value": "f8e44460be03c61e4407a4a62eb0c6492e720932", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707487734, "uuid": "2d2a6f85-c724-47e6-9292-a40352d7fd48", "comment": "Malware payload (Mirai)", "value": "566b4c832372bccf3d0004f0dfc949fbb22a27a25ada7ce86f31081532419d6af267da33df5b685eb1834248157220f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487734, "uuid": "1472b986-39bd-4ed6-9f71-f3fe9977f6d8", "value": "T164132981731C044BC1B22EB0357F1BD0D7ABAA9222A4E389750FEB4DD172E379946D9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487734, "uuid": "12a1993e-c3bd-420d-9d0c-f0b39b6ab843", "value": "768:8Oc1MLMGlBRfzeoeo+4/NvHCjL4x8I3tWs:8OnxM1bIiX28I9Ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707487734, "uuid": "07ddf03d-52dd-4844-9812-a1958f9aec9a", "value": 42080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707487734, "uuid": "a749b8e9-c470-4b8a-93f6-21e1387a8b6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707487734, "uuid": "9d1d8b2b-1ef1-419f-a7d2-8a273afba17d", "value": "952d9566bb56b27947c42f253d8de0e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ac1045-c762-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707493748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493748, "uuid": "f68d1802-e8cc-40ab-8da7-254dc0bd4710", "comment": "Malware payload", "value": "687f17f709a4ed900c0e15b82f7b1212", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493748, "uuid": "e71e6e68-2815-46df-a242-688302d06f0a", "comment": "Malware payload", "value": "eba0f12929d7210f2da29bf3188b9d466b25ee25fe2445b02363a2819ee71612", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493748, "uuid": "7561392d-b8fc-462f-af9f-1cd2759f9b8f", "comment": "Malware payload", "value": "119e9991a30f38247c4ba4c84c56cd9a027d471f", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493748, "uuid": "33066870-b8e8-4622-a87a-f9ecaa3a05b7", "comment": "Malware payload", "value": "367a9b364545c2c111965abe8927e2b9ffaf2e7868b47a86393aa3d3a953523450701ff4c622e88f495c277b31788398", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493748, "uuid": "d43dad72-386a-48c1-826e-ad2aa4f1fbde", "value": "T11923E69B37F98F63C1999B79905603813339D12A7E63EB076CA4013D5E633EA7C94A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493748, "uuid": "b8ddc321-9331-4f4f-ac3b-cbf5522e32eb", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493748, "uuid": "2959e34b-4ada-41bf-b1bb-56a58fada116", "value": "768:9IyeXXW1T7GHobI4XuHVPbejYqwC5u0aHLWo:93enW1/GGXoiu0arn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493748, "uuid": "a028f5ab-e163-47e1-a417-65b0b87d2296", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493748, "uuid": "8fca6e6a-fceb-4392-a29c-f1459d31cd69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493748, "uuid": "e8ece5a5-d914-4460-97e0-a800541f463d", "value": "17074937469555390bd88dbc31ce189696ea9e45cbe7cdfd02827d7b1ec96dd49f45aaf6c0761.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50907c1d-c6ea-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707442017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707442017, "uuid": "612bd8d4-123c-41b6-b96f-054bec9703c7", "comment": "Malware payload", "value": "45fdd1ea90b3f11ed19c620065870cd2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707442017, "uuid": "dc567b8e-ccb3-44d4-8dd4-c910b2009d46", "comment": "Malware payload", "value": "ec852f29cfbcffc3a33c4474a7d92b44d7fbb181f71f1bf104d0940e6e92a067", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707442017, "uuid": "85dfbbe9-bfcd-4533-9347-c808b684f4cb", "comment": "Malware payload", "value": "dc687629543dee1c3ebec056bbeb50a6b2c08470", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707442017, "uuid": "ebb47a71-a728-4bec-a427-6a548c0f44b7", "comment": "Malware payload", "value": "57743ccaf13b7a0c3b5f3e10ddf86b933313a1fc901a585593637f21159a5f5637d98c2e354f7fd87a6c43103d10702b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707442017, "uuid": "d270f7bc-0d8d-4ee8-a873-f7cd4807cbb3", "value": "T1E09533BEAFD11B2522C17AA60DB30CCAA796371F2D7E4C1662A4C257C4112F91FD49C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707442017, "uuid": "4d07cd01-f616-4ae7-9f30-ef3b90eb99f1", "value": "49152:9J8TdQbg0oeMr+lEIiGxG6FS81eQ+89e4/4jk:9OMOexlEuGMIhYe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707442017, "uuid": "14136cb8-1921-45aa-8411-20383e8ead0d", "value": 2019433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707442017, "uuid": "88047c55-c001-40de-b943-bbb42d844dce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707442017, "uuid": "83ba68b8-54bc-4f4d-b192-6781e4e2fb5c", "value": "installer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b9a1c2-c75d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707491604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707491604, "uuid": "0d8031d1-221e-4db2-b8ea-db8781ef606e", "comment": "Malware payload", "value": "62b4a3729e978ff6c0992dda7997c25a", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707491604, "uuid": "98cc4b7a-395d-4966-9d4d-a1a7657b9042", "comment": "Malware payload", "value": "ec9de19b0e54f03e057183419c80448a620db0c435fb3eff60c9c2b01662965f", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707491604, "uuid": "86f01f9d-d11d-47ec-94f8-ae2e5335506f", "comment": "Malware payload", "value": "d0532f6fba3d945c927925504e880cd7b769b6f7", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707491604, "uuid": "2e66b43f-7dca-4666-804d-22e8b0f2ea36", "comment": "Malware payload", "value": "4c50d7355f3bab52095bb89d97d43002743cb35ed6252fe4cfb0ceca62f612eeed860fb3f06ce3223392e97c20d2c9a4", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707491604, "uuid": "3d044e9b-88b2-446c-93ec-34ec1f4c5b3a", "value": "T164C08070465DC4D29167B4D517158D64941206C5D55BCD5652D50B0868C18544B891C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707491604, "uuid": "fa9efe92-50e5-46d6-8988-e2aa8210f757", "value": "3:HRAbABGQYmimic2d4EKEgSHvUo1YSo/QJ53I1Jj4I5o6Rfg0ck2RMQ5yy:HRYFVmiz/d4Ef5PISoIJ54f5oeTckc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707491604, "uuid": "cba20c2d-8576-421b-8581-924254017bcc", "value": 168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707491604, "uuid": "d8edc23f-78dd-48ef-8556-58645c6b082b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707491604, "uuid": "7302e691-1f98-4c05-b528-c9891e98c7c8", "value": "doxx.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "994511cc-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707488095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488095, "uuid": "854e4f6c-7470-49c9-99ac-f19a7f9f90dd", "comment": "Malware payload (Mirai)", "value": "94598f8d177deed59c794942cb5aa445", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488095, "uuid": "31b311da-a1f6-40a0-a484-a0f86f81f1a8", "comment": "Malware payload (Mirai)", "value": "ee9bbc8f83b7cb3828eb1b1d7e858a101708ea928ababf8d93f6113350426fe7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488095, "uuid": "00b2fb55-119f-4a56-8b2f-3122b1fc025d", "comment": "Malware payload (Mirai)", "value": "124a79c3ae40895a7390069079ed10b38f9f2f34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488095, "uuid": "0ef1036a-bb27-4c0b-9bae-cd258bb427e4", "comment": "Malware payload (Mirai)", "value": "c57333ee7812e75e9a651da01ad008884325887143153f90ee2b9e570eafe87e16dd5106b1c1687baf6378813d120e4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488095, "uuid": "f543246d-97e0-40d2-8603-22ab7b97bb76", "value": "T1CF536EC6B4119E7DF5CBE7BE84224D0EB821722150531B27BB6FFD83BD721A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488095, "uuid": "87ddbc03-5ce8-4ec7-8b66-7aeb61cfac25", "value": "1536:kPqRg0FGTbSX5xpLepSGorsF7QhOx2X/ZOqc/yA8S:p5VHV8I9cKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488095, "uuid": "d827c860-792d-40eb-9c1e-eab243c2276a", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488095, "uuid": "eec6647f-5f48-4449-8a23-b3e4bdee3ff1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488095, "uuid": "d85e0b99-ed90-44b1-9797-d848f84d9336", "value": "94598f8d177deed59c794942cb5aa445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae57cb40-c70a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707455918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455918, "uuid": "14b9319a-a2bb-40e2-9a32-ea0b7852d509", "comment": "Malware payload", "value": "5385f2d3130705c8608f9edd0431848f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455918, "uuid": "9d7d99a6-04dc-4245-9582-c77e2a47f220", "comment": "Malware payload", "value": "efa3264d8c924c5fccb9992b772138b1b043ef353b182a3c7607aad7f8b34d2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455918, "uuid": "d7229c73-b7b6-4803-b830-ea13f7d9dd4d", "comment": "Malware payload", "value": "1f80fb07e44434b3ef830cdccd3ae2daaf344ed7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707455918, "uuid": "ea5c26a2-651e-4e29-bc74-4f3ce268e965", "comment": "Malware payload", "value": "e7f656d945b84232e7c91af5cf4f187c4733c6273cf1974f3008d51435604a7130ae6870eb3966a1bd44f87dacacd7f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455918, "uuid": "6b9eae14-aa51-42fb-914a-ee3e05f08318", "value": "T1EAB1D540E7EC177AECF70F319D73936216B4FA519D268B6E24C8611BAE12B844873761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455918, "uuid": "9996a75b-5a07-4b2f-946e-ba958af347ed", "value": "96:Sy+nKD9jPv1uDFKr1jD0loCmg5UQkl/LzNt:xDlPv1uDFhwg+Qq/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707455918, "uuid": "602a8dca-e3c4-4f4c-81fb-dcdd0e97c180", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707455918, "uuid": "af3d1246-292b-4d39-8dd5-17b6bed1a37c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707455918, "uuid": "2e3e3502-fac3-4e40-adaa-472272cb6e50", "value": "SecuriteInfo.com.Win64.MalwareX-gen.11588.28337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b843be21-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707488147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488147, "uuid": "1511aa11-2aeb-4511-a496-677ca18f249f", "comment": "Malware payload (Mirai)", "value": "2d63f0d1441b4eb1f4b8b526ec1e571e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488147, "uuid": "a7e91e25-32b9-4196-84e1-adb5edc99383", "comment": "Malware payload (Mirai)", "value": "f087b4b3ea6d870b4ffc3025fde5223cdb9056cb6e8d7ccd50079adcecc894ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488147, "uuid": "2871de38-e38a-4436-b1f7-637c98cdfe22", "comment": "Malware payload (Mirai)", "value": "acb87143032811a352f0f3bf7dfb80841bbd2bbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488147, "uuid": "0b32eb17-1472-48c7-874a-7df00159e919", "comment": "Malware payload (Mirai)", "value": "59d1bff78aa813a11e4552d45bd44e4885bc54c6a510ae4ff438d1429aeaa564cb9c249f795ad129413fe21d065f1172", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488147, "uuid": "fb451799-fd92-4c70-9926-309e2db98a11", "value": "T1D9536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488147, "uuid": "7b384d58-4625-416c-9055-607eef737cd9", "value": "1536:Z7qARubgzY/bEJy9Rcpe80LDHhklv4JQC9DSW:NP+eY/bEJbuXBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488147, "uuid": "49f6544b-7cdd-4652-bb04-487f67f847e3", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488147, "uuid": "12df22b9-9d6e-4c7e-8520-d7d662579da2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488147, "uuid": "2f1eba0e-4cb1-4c7b-b922-39fb667e630a", "value": "2d63f0d1441b4eb1f4b8b526ec1e571e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7297e1-c755-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707488127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488127, "uuid": "4b7f600a-0c31-48eb-b44e-b91eb05b8e9a", "comment": "Malware payload (Mirai)", "value": "e649bffb23cc8216f0ad410471ea8e7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488127, "uuid": "ba8a530e-3b47-4dfc-824a-a6f134f7b49a", "comment": "Malware payload (Mirai)", "value": "f64a26bec96e7a42ccc450554274912751c9f82a59087ad63666df938c1af7c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488127, "uuid": "5e90de03-b600-4666-ad83-f8610cef079c", "comment": "Malware payload (Mirai)", "value": "977898071da06f21dd05c9d7185bd9def3e0c842", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707488127, "uuid": "2a77fa86-d1fe-4b8c-8e71-0294824805f5", "comment": "Malware payload (Mirai)", "value": "7f7f03637f456dd12b7d784543dee4613c28bdff5b1a14bc99d574b4f8fada56dd2e571946de4b7fff5b55ee3c47348b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488127, "uuid": "e7a132ce-ca1d-4252-ad97-86e184ed0a86", "value": "T15AA3A54DFD64AB29C3E232FEFB4902CE332B1B98B7E670258D315B5533C8B965925121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488127, "uuid": "d7e780aa-0678-4d37-a3c3-6b052d787bba", "value": "3072:KAJ9Mqv+0r78P8G1NLC1g647488y3llo0UEv:3jUgS7488y3noEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707488127, "uuid": "89c1f0b0-02f7-4d8d-af41-4d34c68c4d41", "value": 99364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707488127, "uuid": "b0c5867e-f72f-45eb-bcd1-00695d532a05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707488127, "uuid": "3be2f9d7-026a-4569-adb6-bffef847835c", "value": "e649bffb23cc8216f0ad410471ea8e7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4173eac-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707493374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493374, "uuid": "dc94f45b-5649-4040-9c1d-d65d625fe134", "comment": "Malware payload (RemcosRAT)", "value": "9cf4dc8451eabc49ed410d99688ee0c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493374, "uuid": "5b62678d-2f93-426b-88da-c30ad5a56c2d", "comment": "Malware payload (RemcosRAT)", "value": "f73e8d1f28812d763bbe7854b60a34b6b86b997944135480862304e9893830dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493374, "uuid": "cbd1db11-a7df-4348-9948-0740ba176f41", "comment": "Malware payload (RemcosRAT)", "value": "8c9b64213e2e7e50ec56cee8743b198002cda1e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493374, "uuid": "080539d7-653f-4a89-93cc-b08f6f2fd990", "comment": "Malware payload (RemcosRAT)", "value": "d7924a36c8de3a049f0553aa483f0874c2c725606ee788ca8e886d0ae75a2326af10db8b2d9b9754756d22d602299db5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493374, "uuid": "16273537-d99e-4af5-9d89-cf9930a7be83", "value": "T15B65BEB3639990F1FFA6A1736B16AD26477C7CAC10E3841E12DC197AE87406257FD223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493374, "uuid": "d679eed5-d05e-418c-94ef-a5ffb0ad5df4", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493374, "uuid": "b3401c2e-5af2-4175-bdfb-ec88b796f678", "value": "24576:9AHnh+eWsN3skA4RV1Hom2KXMmHa068T2QpZ9wqLvKmK2JRbNjX51LseJT5:ch+ZkldoPK8Ya068tnKDShwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493374, "uuid": "af33b4ab-785c-4e69-a3d6-84e73ddde233", "value": 1514496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493374, "uuid": "d5eb8bbc-975c-458f-99ae-afde6970cf3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493374, "uuid": "4aa5d577-179d-44a6-ac8f-300ba25f1e4d", "value": "HG098760000.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60cf6adf-c6fa-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707448916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707448916, "uuid": "0287402a-8d88-47c5-8fdd-0e070d83d54e", "comment": "Malware payload", "value": "a01e5cba42a62547a40881ca34568a64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707448916, "uuid": "8e6c6fba-1233-4ee2-b94e-1de9bea3b0d2", "comment": "Malware payload", "value": "f9c2cb5ab6a509d281c521042274cc1f0c832d941ffb4307717ff6c7da2b10bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707448916, "uuid": "0e8b5d7e-8db5-4d46-a493-11534addf8a9", "comment": "Malware payload", "value": "7d102c03044d0a8cbcc868995ef41d183f616b18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707448916, "uuid": "ade04d6d-64b1-4ada-a903-4b59b21cced7", "comment": "Malware payload", "value": "cdb949b535e291976299a66657779d8a682c7e9af5d9655044ca59b61e8a65de2b7a5303549ef43c16125ee2271f7f08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707448916, "uuid": "0830ac32-6c73-4819-a2d0-0aba886cace6", "value": "T1812513A2AECAD839D7B25CF499A2C58ED977FE241D754811F6BE182C833DA411F08313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707448916, "uuid": "2fc33ca2-782e-4c94-b70f-56f0dba0ba18", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707448916, "uuid": "d1409a54-f1ea-4479-bb46-e3d42a22c857", "value": "24576:HQiGy7bDdC/hWJU68BzimpS8o5kTKxwQoRHnXjT:H9HbDg4N4+WwkwYRHnXjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707448916, "uuid": "cdc354b4-64ba-4fd0-aa3b-45f50597521c", "value": 1018697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707448916, "uuid": "19fa84fe-2991-40e7-9f4d-d85fe45aa491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707448916, "uuid": "d6a6ad72-3277-4748-867a-1cc533b097a2", "value": "SecuriteInfo.com.Adware.OpenCandy.197.19.16636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae75e651-c77c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707504881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707504881, "uuid": "eda2034f-8ed5-44ad-8f49-6b8ffab9fb7c", "comment": "Malware payload", "value": "9fdff46eaca66307a8d668263bbd9174", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707504881, "uuid": "2b307766-8344-4885-8c7f-c729485f16d2", "comment": "Malware payload", "value": "fa99b97ae8564e4a6a87d79855b665a462a80a9eeabe5b2d2ccc03a5bea52d10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707504881, "uuid": "78d7ccc5-6696-4d98-8e87-0850d681ee5c", "comment": "Malware payload", "value": "c520f01e369303d5be361b4c7e413a8395878f02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707504881, "uuid": "828a4668-73d3-4926-80ce-4bf082cc2333", "comment": "Malware payload", "value": "99a7891110043f5e86e9ec34260dc194358fbaf3a1d4372c665a9a2b7d759ae51dab3c46964d34df19e58026ab74353b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707504881, "uuid": "8a3b7918-04f8-4ee6-bc94-f958ff352519", "value": "T180A4238527788207E65E17711A356ABBEA75BC113420CA2F1B305F48BC747506EAF3AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707504881, "uuid": "52c831f2-9202-4d63-8993-3c0a0ad3c80b", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707504881, "uuid": "90823ed9-ecaa-4fa8-b28f-b1384f2ea7f0", "value": "12288:lkF4+/Vfvy988q62gci61J+hgHOlnnE8iQYwr:It1488x2gjkJRHO5nE8vTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707504881, "uuid": "e3769ff8-9e27-4198-b1cb-ba80c6d4e018", "value": 470264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707504881, "uuid": "f3ba404a-9ae9-4af9-95f6-61038f8428a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707504881, "uuid": "3e27177d-bde4-4f2f-a213-e33fa7db375c", "value": "9fdff46eaca66307a8d668263bbd9174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bc325d-c761-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707493236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493236, "uuid": "f73fb5d5-8b4f-4ca2-81e6-d1f106fcb46a", "comment": "Malware payload", "value": "16b61f2ab6a1bf297ca9b482f31795c3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493236, "uuid": "0d97d934-22c2-429f-9beb-d959c0b87a32", "comment": "Malware payload", "value": "fc318408abf2e92f1984ae4c3588d130c74cbce62259b348af18d564617b69c5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493236, "uuid": "556d7224-cc9b-4b39-aa4f-80e1be38ab64", "comment": "Malware payload", "value": "955c8b2194e0cf3d6bc140e8d8498ce71ddae31b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493236, "uuid": "e0426a74-6af9-4b55-9c92-d6643d28825d", "comment": "Malware payload", "value": "2d840b424d3adfb1ea5bbf471fe6dc11a1f9a9ca7769467639e1ce632cb35fc75d8c795ba084dee32047f9d84a7576ae", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493236, "uuid": "058b9d43-c472-4143-83cb-14cc9a9da2c0", "value": "T115B2D01DF529A834CF95C2F8A1E943F6E3085142B792EC5E040F3AF8C913A3B472646E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493236, "uuid": "7e5a6a29-ea3c-47d6-bc92-c36c82ed934e", "value": "384:nTKQ6gXkyjCkoa5DbHBSIGqz8F3gg2bOlsttS193M/d+6TSvS4L7h21qkJ4BQr4w:ne2FCq58I9I3v2ql2S1ud+rSs2Ae2n65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493236, "uuid": "8a455765-39c7-497b-a458-a8fcca64d62b", "value": 25406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493236, "uuid": "347dc2c9-a08e-4897-b18e-5123d614b5ce", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493236, "uuid": "746dc20e-beee-4a70-bdde-3b8d3cbe7c6c", "value": "FedEx_Delivery_Express_Service.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3b2c1c-c762-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707493495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493495, "uuid": "f08d03a7-3628-41b8-939b-64bfb3bd0895", "comment": "Malware payload (RedLineStealer)", "value": "de838062cd23d4e6330bd8f0320102f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493495, "uuid": "d06ddbac-294f-4575-8b69-174c5fd039c5", "comment": "Malware payload (RedLineStealer)", "value": "fc8eb10bc048353393d89f1920952a1bf57b5626509410b0a7e9a1e3b586e1a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493495, "uuid": "5c1b44c9-1970-4cef-a7ac-79df7574ec81", "comment": "Malware payload (RedLineStealer)", "value": "12477af8541fa6fc795a045978328b42b96e3c89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707493495, "uuid": "95bba058-3a30-4f8e-b8e5-956f7013ec8f", "comment": "Malware payload (RedLineStealer)", "value": "2bc1b4a36aca0bed0edd77c3558d45a2acd203b16b4e081cd269c4c643deaf871de364f83fbec6d87ac4ce8d041e1395", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493495, "uuid": "8e53ab6c-a042-4bba-bd6e-94e80607bb24", "value": "T10BE41222B2D981B2D5A736758462C7B20E9F782772727DCF0FEA013A1F146928F5471D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493495, "uuid": "f797e169-6924-4934-839c-49501752d825", "value": "e6a462c35d266e63944cf9874893788d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493495, "uuid": "fa6c5211-7f81-43f7-876c-a746ee572d70", "value": "12288:YHMX6tIzJF+hffEhwjvTbbEJ7BYf8MvZdB3SlV9ASJcz:NX6azJF2fQeLbb3kMvZdB3SdAEcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707493495, "uuid": "665e21df-38bd-4f69-8da3-28fa99a81cf3", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707493495, "uuid": "147ab457-ecd8-4a4e-b42a-c8b43b68eeb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707493495, "uuid": "9c7407f9-f12b-41d8-9cb0-2d1259eb4c31", "value": "up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f71ebf-c72c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707470245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470245, "uuid": "6261fdfd-bfea-4445-8985-7ac0bf951d2b", "comment": "Malware payload", "value": "eb8e6ee35d1e5725c5b613c518e2622b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470245, "uuid": "f7a0ad16-9441-44a5-beef-92869a84e53b", "comment": "Malware payload", "value": "fd147a278f03b6047bc9aedecdd9fa7c0a710bf9446aa3b11be5284e2c0ecc75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470245, "uuid": "0893da94-ab2d-4893-9a70-38585aab426d", "comment": "Malware payload", "value": "e1545bba9432f2902818802dd2f96c33f644bcdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707470245, "uuid": "0cec23e2-972f-4fed-95b7-fe60d9d9b2d3", "comment": "Malware payload", "value": "b27a447a5d9c453b0a5cf3ad8a4d9737c5421d7ce08c891569f68f1f731f7a0a3051b3ad08f04d9412fa56e7bb12d912", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470245, "uuid": "ca5d384b-b42c-452f-be79-bc85df29f197", "value": "T10496331A2686B4F9EACC1439B17F6DDE33FE1DBD4841C429A89BB5797632F90D032481", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470245, "uuid": "caa80686-c127-4b43-9e25-ae755aea82b6", "value": "94ac5462b6b46d22165395c6e5f60232", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470245, "uuid": "cabf5224-fab2-4713-a345-8d114684ff54", "value": "196608:gMZAKWmlnejpsv7vsb5Vky8mnr+zpTR/8s6R/fCFCX7SA/ItXAxGaSSowh:jZAKWb+DsbXkynr8pVd6R/FLwXAv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707470245, "uuid": "a8cacb5d-ab6a-4782-a2b2-3f2320279c83", "value": 9189888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707470245, "uuid": "7550d2b1-4f76-4d84-b302-5f8fe1f999de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707470245, "uuid": "1cb7065f-8c20-4fa4-8976-4ec6d0e6fbed", "value": "SecuriteInfo.com.Variant.Strictor.285875.26834.9562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed7dc7a-c722-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707466039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707466039, "uuid": "9251e77c-e910-44ad-be86-f0b31dc64a73", "comment": "Malware payload (RiseProStealer)", "value": "908efd6ce55e9d2bdd971c401be04896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707466039, "uuid": "c0cb508f-8ecd-46f1-8c07-9c1faa7a95fa", "comment": "Malware payload (RiseProStealer)", "value": "feda4bad33c32eb291d00ab8fbd00d5f5c2af54ae43b88bfbeb7b9ad1435ed17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707466039, "uuid": "64e2eb2c-7928-49c9-b9fc-9e3d5988ee8b", "comment": "Malware payload (RiseProStealer)", "value": "90026eabea3e76eada4ea9f79a2f7b0f8f040054", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707466039, "uuid": "d6ff6381-84e4-4cd2-a01e-53b43b529671", "comment": "Malware payload (RiseProStealer)", "value": "b8a46ecff7d67083cd0c3c01518ad1dffbc11cbaaf1739e45980c2a7c6d58449cf5671dd1562d680617613f02a46795a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707466039, "uuid": "40bf6c6b-f224-4b96-8efc-a1cf18b7fa4f", "value": "T162B533183788A59AC80945B0C0DFE42803F375FB25B5DA8F2E6692DD4E14B94EC95FAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707466039, "uuid": "56ab0a92-8e64-499b-8d30-3948dc752c21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707466039, "uuid": "6c28b885-de8e-477b-a87c-c379cf4711c5", "value": "24576:+07itl9JgEaPEWpj1myqFMs8x8Lg2gYP1x8CBFaM2SJmHd9ItqBHRI7aVsj0tVdr:fNEfSGLzBATdQq9RVg0LTmUaeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707466039, "uuid": "f1be8490-899a-48b9-bc3f-c8f734150c28", "value": 2343392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707466039, "uuid": "dbdf039e-5d1d-4a45-9283-2a083172b68a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707466039, "uuid": "677b8faa-a5fe-4483-a084-7a6bcd65d225", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }