{ "Event": { "published": true, "date": "2023-08-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-08", "timestamp": 1691539381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3ed0688e-0829-4102-af66-8b987334746d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1059cb40-3647-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691538933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691538933, "uuid": "652cd3a6-db8a-4f16-9b94-c8f6817ce0fe", "comment": "Malware payload (DCRat)", "value": "a98ecd2d6c33bb4fced86ded2dcda89b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691538933, "uuid": "58aa03de-2dd7-442a-bea0-28bc6092eb3b", "comment": "Malware payload (DCRat)", "value": "002bec14abbd4071cdca64e6030cd91c6a6780d84139d42f53df28a219090307", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691538933, "uuid": "42830d36-82a6-42d9-a93e-4f375e12f300", "comment": "Malware payload (DCRat)", "value": "cc77cd7a282e897913bdb829fc6f838a0ef4e0f1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691538933, "uuid": "ff5f0b87-bd11-4f52-a10c-75753f070668", "comment": "Malware payload (DCRat)", "value": "0484db65853a84cdeb3cd1fad069847b74873525577cf60d0735cb628bb831703a62dbe7668a6b9877b62992151214c5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691538933, "uuid": "2c09b0f4-6a31-416f-a603-2e97267b4f78", "value": "T1854549017E56CA11F0091233C2EF494847B499516AE6E72B7DFA376E25123E7BC0E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691538933, "uuid": "bc34ae07-9849-486c-82e4-13fed1608777", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691538933, "uuid": "f49cce10-3688-4f3b-ad6b-e5a3b23dcfb3", "value": "12288:UvKqBx51wugGYU8hraHT6Qd+xSrARO66e5ZZNRZQuEvi0gcRNjM0Iv5gEL8QN9YT:Sx51wu+UAc6Qdcv5vP+t8240IvaO9yr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691538933, "uuid": "37fcd557-8424-44eb-9950-93244c8d4b3e", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691538933, "uuid": "b5a43868-e687-4449-bd22-8c87450b2556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691538933, "uuid": "04a3371c-448b-44d7-9cca-529fc2d1007c", "value": "a98ecd2d6c33bb4fced86ded2dcda89b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc867ee-35fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691507385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691507385, "uuid": "952deb61-1161-49bc-aba4-962adabe3197", "comment": "Malware payload", "value": "85fb70747cef6640124e01aff09af806", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691507385, "uuid": "4c7cae6e-c874-45c8-b5b1-0587e7510b41", "comment": "Malware payload", "value": "019c873d4b11582413a486bc3607ddeec5829617bde1d6bdff61c93b721509c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691507385, "uuid": "d970d368-b449-468e-8f1e-c50e612eafec", "comment": "Malware payload", "value": "dc52bd642a7217c2773074a5ccfb74647cef72cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691507385, "uuid": "17d9fac6-bbc4-4ec8-b60c-65330cfa5148", "comment": "Malware payload", "value": "bb4cc4b8ffb034dd7fb280cdcf50a535d856052025940becf415e1723c9ca543838e0ab61ab6ee4b8bb9203fe544e45d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691507385, "uuid": "3f51235e-beae-4219-afc4-11069292ca21", "value": "T11255232927D11092D1755B30EAF502930BB87CA7F37A56FF53D4A1A90B722C8E471FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691507385, "uuid": "4b005f9b-1be6-490a-93ed-3886aeaa2348", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691507385, "uuid": "3e313c2f-e85c-42b0-b987-0a7adeb8e76c", "value": "24576:jjhyEVvqtLcUIVjKAQSXrkvVvS8WRawcKuf+jwnGeCIcht3bvAjvT:jjUEpqlifBXAvVvSVRawcL7G26t3bvAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691507385, "uuid": "d56c39a9-eccd-48e3-8da8-db4ab642c001", "value": 1406128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691507385, "uuid": "ea7d529f-e44b-4a95-86d4-3e00fbbfde69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691507385, "uuid": "5b916384-142f-406c-9d2c-d722e01bc365", "value": "10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa09ad4b-363a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Arechclient2)", "timestamp": 1691533742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691533742, "uuid": "799b4c34-4bd8-40d7-bafa-feed9d773ec6", "comment": "Malware payload (Arechclient2)", "value": "b239bcc76219e6c73129397c12c98977", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691533742, "uuid": "add5e600-3096-4ff8-8318-523fb87a7a63", "comment": "Malware payload (Arechclient2)", "value": "033cafb9fcd3d50d858164c117ee2a1c9e7fe95b4d027315bc9d1186e655d583", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691533742, "uuid": "843605df-e269-4280-b0cd-82de3340e920", "comment": "Malware payload (Arechclient2)", "value": "91c57dc29c3e99a204cc0f07bb78731c3135935f", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691533742, "uuid": "0bab6e5e-4617-4b60-a1d1-e8df521a8ccb", "comment": "Malware payload (Arechclient2)", "value": "2681ccae859b3c27a938ba9fdfe66bc32fc89c0ea8104c7db98fea7f2dfdeee88e4e68dd55034bca3dd57c63f2cf6e7b", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691533742, "uuid": "cfdf5403-2cc7-46f3-adc9-755ec8b698f4", "value": "T142D52326B868C638D351ADF1CC75C60A552BEC8B49D25F03F7C97BADCAB13644BA1312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691533742, "uuid": "f9e0fba9-b8b2-4955-852c-ca10436d0b67", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691533742, "uuid": "fa853b35-8502-43b7-aaab-4c0f2d7d98c9", "value": "49152:N3YuSo+g6FpvlRCHL2/xX8KJ0hIBjXKrcivAq6CqbfYH4bneiSzgLBq:h/+DFpN8rGeKJ0hIlXM39+AHYeTcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691533742, "uuid": "d8424600-b796-4fd4-9bad-467dd09e2aa8", "value": 2800128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691533742, "uuid": "3b7c6e3b-2bf1-4784-999c-870ff7f713eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691533742, "uuid": "f734ac6e-87cc-4dd3-83f0-25025a2649b7", "value": "SecuriteInfo.com.Trojan.Agent.2221.7316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2b2425-363e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691535192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691535192, "uuid": "b6c225f5-3367-4bab-93a8-4ee9e9ae1d42", "comment": "Malware payload", "value": "faeb62b6240705a8af7152198449e64a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691535192, "uuid": "8ffb0d83-4134-4a52-8022-1f0296c0552e", "comment": "Malware payload", "value": "039f3a8d173f835d3e71cfc8433ead08f9975f8b6d9afd7d28bb76d54f7f38bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691535192, "uuid": "6765318f-f2f1-4706-b1fb-352730c568c1", "comment": "Malware payload", "value": "4e78f5241a94a6549b2d00305e84f03112bd15be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691535192, "uuid": "749a2fef-1f1b-4e8e-be86-44f0a120fa07", "comment": "Malware payload", "value": "2835f4cc42406fc0f5a336a75831e252f8bd511adf42a635784a6f1c3d6bac6b790e221ea09da09aa4ba53d84fa81b58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691535192, "uuid": "65a36b54-6a21-43de-a254-063bb3000bf0", "value": "T163C41244E9476CF2CD0789B28B4BEB4F0B155D524D486E01EFD8F66BECB25E29702781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691535192, "uuid": "9763e786-4ee4-411f-943d-be81f4d0afcf", "value": "28a099a911237a28521d8b7ea250f089", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691535192, "uuid": "7665f3ed-1b0a-4711-a569-1f7d1c1ada71", "value": "12288:4cp8NYTcQBQnHW52sOMbrG90Jjj5b47Jk62:4g8qQQBQHxshnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691535192, "uuid": "181b53c1-6c59-42c2-b0d7-e21bfeea14f3", "value": 584000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691535192, "uuid": "2cbc6f53-6dc6-43a9-8f1b-6b71df1d559b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691535192, "uuid": "f0d09e85-38bf-419f-8d57-0ec8184d57c4", "value": "faeb62b6240705a8af7152198449e64a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9e2beb-35d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691489773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489773, "uuid": "ab3205e2-9baf-4cc8-9741-53b85b4d6490", "comment": "Malware payload", "value": "b052a00db4441975adb31dce8067fa05", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489773, "uuid": "66b12108-964a-4883-950c-49c8f67202bf", "comment": "Malware payload", "value": "0476d4eb02fe459d3672dc246834cdf78f78b914554e7f40190421a33188a27f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489773, "uuid": "741c3c96-ac8a-4e52-9c62-9253d86a3d7b", "comment": "Malware payload", "value": "a2e8a8e4c5fb7ec24dd2af72325a74f9c04cbe3e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489773, "uuid": "0e862b04-d760-4c07-8bf2-ccc473ee4183", "comment": "Malware payload", "value": "4dd379f7d59aa099feac1c7a40c42f2f8e32e0724119abcbdd327eff69b06a1b51a9298af2606652081c45f1281470c1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489773, "uuid": "1706d7bf-3db7-457f-9cde-edf9e794edd2", "value": "T142E42345C8D30803A3F1297F428BA4E3DF6D77C842346926EDFCA16D05D76AF66489AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489773, "uuid": "d7da51e0-945a-4cdc-9f15-a47363c4b764", "value": "12288:ue1gnJpyypsi/YoonfXwzNd5tcm8mNrPbWw8rPdkB1OmWaXuw2ZHC9R1k6X8UX3:ueu3siv+fgRd5DbIBFmWe/59ReUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489773, "uuid": "2c066ec2-f6da-4bfd-801f-0d4874afe16d", "value": 681460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489773, "uuid": "4fd7370a-9dc3-42e8-bd5b-648208205bd0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489773, "uuid": "e4442dde-bc4c-4b00-bb77-b5d36bda3304", "value": "SHIPPING DOC.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa75d24a-35e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691498390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498390, "uuid": "90d919b9-fef4-4772-9e77-1520d748e0bd", "comment": "Malware payload (Formbook)", "value": "a6c9000e70a518977767a6d434258c1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498390, "uuid": "17752670-0c62-46be-81d2-fb0a5d42b234", "comment": "Malware payload (Formbook)", "value": "04ba024a8e0cefac0f874bb79bf9b256c77e36dc5cfbcb1e3ffa74432b7edd02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498390, "uuid": "58d51fc7-6679-4ed8-ad64-97974633b01b", "comment": "Malware payload (Formbook)", "value": "80dac7a531f215523463601f7f08a0bcc451d88d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498390, "uuid": "39efd428-8b5a-48f3-8593-a950b143c05e", "comment": "Malware payload (Formbook)", "value": "0bd9164487a8d8514b84fccf5b8c8ca4e8ed8124cf2a653b19c92c40dfdd562860549e59d88ab7ca02e073c1d60da285", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498390, "uuid": "a45f24b0-42db-4f4a-b345-da82989aea61", "value": "T1BF1479E0317D93CFD1A28DB10F898AB079F135AC98C4160DA0F69B2EE3D6355549C9FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498390, "uuid": "85450600-788d-4f76-b421-a72cf1244013", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498390, "uuid": "b62d646c-5e0a-4fd1-b3e2-03f25eeb51c7", "value": "1536:66MqOfg3X0WdAY1c9wqvnAv77vvvvv7vvvvvvv7vvvvv64+mhhhm+DtqOgd:6hTfg3X0WX+9wqY+mhhhmitqOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691498390, "uuid": "65d0a911-cc2a-4895-b9a5-e7c0df0046ba", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691498390, "uuid": "e90e2f75-2679-4550-8cb9-6c9cfbf67f29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498390, "uuid": "a3c26762-7c7f-4b24-b793-a8584f64ff86", "value": "04ba024a8e0cefac0f874bb79bf9b256c77e36dc5cfbcb1e3ffa74432b7edd02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a8ad58-35bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691480522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480522, "uuid": "2dfca9b9-d7fd-47b0-bf13-72881ba53c18", "comment": "Malware payload (Formbook)", "value": "cdab9633d219a135072791ba5d35b44d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480522, "uuid": "633f0afe-8e6b-41f3-9831-4334891586fc", "comment": "Malware payload (Formbook)", "value": "05189b12acbe98448200d07fb553f915a88cd57ca1115bde87fba0dc77cc5f39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480522, "uuid": "ce7170ce-fed6-49a0-a8e7-8b8bf3012e95", "comment": "Malware payload (Formbook)", "value": "15857fc6faabbc8b62da34beba25df69eacab121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480522, "uuid": "0bb088e9-382c-4339-93e2-772a1f18d46a", "comment": "Malware payload (Formbook)", "value": "2c25329d90aadb4d19c06b78aa514b2115b59838b53c0961e49b4ef0e3b74f902145284d2ce7d52369d0e2a73008fa73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480522, "uuid": "12585abe-f1c8-4d8d-96e2-e357aeba29dd", "value": "T1B6D4121264E8AFA3F5FA07FE20F910541BB3610E1962E3281EC974CE6D67B11E512F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480522, "uuid": "366c75a4-3e1d-47ed-b9ce-d5e2fc89e48f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480522, "uuid": "e15671ef-b039-4efd-a37d-0845ed9c2db5", "value": "12288:/niF9yhUBQAuuyTPDV9R2yJ0VtWauMrHj25yrfhZqq:/niKhUaAuNb12yJ0VllD2AdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691480522, "uuid": "5bf1b4ca-a1e2-4246-a150-b5ecb3eeef3d", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691480522, "uuid": "a6612c28-83e4-4a29-bc57-793100f75193", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480522, "uuid": "f863f40e-f734-48ae-99c2-0f6d9083af77", "value": "cdab9633d219a135072791ba5d35b44d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be24950-3623-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691523491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523491, "uuid": "f8baba8e-caf2-4b01-87d6-2bf417beeb95", "comment": "Malware payload (Mirai)", "value": "643bfa65c218d1e6439b146577157ee9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523491, "uuid": "d95de15a-6575-4c1c-bc4f-47fe7148eb62", "comment": "Malware payload (Mirai)", "value": "052ca9fbbb87a9d02192b33fa201058fbb2fc6437492b06a0c102b8066871a62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523491, "uuid": "779df380-863f-4392-a64c-97eb916d9be3", "comment": "Malware payload (Mirai)", "value": "d8712339ebcf92fd45b63d396ca34ecefe86bcd1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523491, "uuid": "ed16fae1-e440-427a-a1bb-d181db2e28a0", "comment": "Malware payload (Mirai)", "value": "1dc7f5a454c8e83efbf9ccd46025dec3b50c0c6c4a45d7c3b1bc4051a339189854d90bff0d37ea53db1c9be981a9f78d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523491, "uuid": "39645a6f-ceca-4138-b060-b38ca8829c6a", "value": "T105E2E1B94B3505B2D5F0AE76DAF6CD4263613B7C725A7482129423DC9AC360A32E94C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523491, "uuid": "045de3a7-13db-445c-975e-84cf28cdd040", "value": "768:kljOHlOTcLs7Z8FviuyIENCHBhroJ4qDkGZ1vPZ9q3UEL5u:kAFOqquyqBhEiQL0L0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691523491, "uuid": "964d1f6a-8775-4033-b05e-a62d4aab02e3", "value": 33036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691523491, "uuid": "57c84c02-128c-4b9b-a663-d8ae501ed0f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523491, "uuid": "59706d45-fe95-4049-b8db-f8623e26e622", "value": "643bfa65c218d1e6439b146577157ee9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d8f602-3637-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691532260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532260, "uuid": "6f1fbab3-45f0-4688-b7d7-cf5f9d072e1a", "comment": "Malware payload (Mirai)", "value": "16894bdf11d11b25cdd1e4783dd89827", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532260, "uuid": "da9a8f02-e57c-4fd7-90e7-4e29e3b50fd0", "comment": "Malware payload (Mirai)", "value": "0692b1470bbbb297024f534c369cc2faa4f28e2e5badf28bd21c31dace0d369b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532260, "uuid": "6e200bd5-026e-48f1-bde2-b795ab451c6c", "comment": "Malware payload (Mirai)", "value": "8cfc8fe5938aceae580294ad001eee8260e772dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532260, "uuid": "748f7fdf-6705-40d1-8f06-e5fb83a9f032", "comment": "Malware payload (Mirai)", "value": "418d7ea9ae6e213672d13c597bc5a7cc573da3b1e91f8b4bfcbcfc2cf1986440065052233fc4741b2b6cbc289f378707", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532260, "uuid": "a560a757-e5bd-40c6-a71a-b719a8f23f65", "value": "T188C2D061E1B62E86FB7A6E502A74C2C17BB04E9EA777CC92255DAF0804B72174705ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532260, "uuid": "03340b8f-45ef-46ea-9aff-b8dd826c2647", "value": "768:LG959yM0HWubJsWDYcGd34uVcqgw09S0p:TM0HRJswYcG94u+qgw09S0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691532260, "uuid": "8000aeeb-aaf2-4e2d-8550-66cd37323788", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691532260, "uuid": "305002de-9afb-4c72-b897-5bf7c5607386", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532260, "uuid": "a5da7133-b96c-4ce1-89be-4476370d0bed", "value": "16894bdf11d11b25cdd1e4783dd89827", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df557104-35da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691492466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492466, "uuid": "e07c1323-0b32-4111-af0b-99f7746496e7", "comment": "Malware payload (Mirai)", "value": "2797d9accc4e318cf55fbcb9920ed804", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492466, "uuid": "31e2932c-6d6f-4eb5-98b6-b3e2170c815b", "comment": "Malware payload (Mirai)", "value": "07788c4f18f97851ff473d6c1b880d9496626a4ae65902d77407d3680e828759", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492466, "uuid": "19769cd5-d21f-49ea-bf6d-25fa93b1f492", "comment": "Malware payload (Mirai)", "value": "b29042753c955f427b837dbbafa320b51c837fd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492466, "uuid": "513911ec-e36f-408d-a659-7e3b098d10af", "comment": "Malware payload (Mirai)", "value": "47ad9244074e0df9f7699c42971e09d30a065a87d9f2d6bb028cb6040fa56766283414800f79c1c17635e4ad140d2154", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492466, "uuid": "46e5c604-28ed-42a7-ac83-7f898d81dda9", "value": "T15CB2C0E04BA16702C3B0B475937C8F926E3755A4D6F6382A2A2096BCC58245673FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492466, "uuid": "efa4868c-a843-40f1-a957-48337e0987e1", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BPmLSBT98EhymdGUop5hL:4GHKQFH0rs3zWoDDRsjt7LB9U+BPT19q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691492466, "uuid": "6090cc00-c788-4fb8-9218-3f4bd1e3c086", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691492466, "uuid": "ca29d4db-55f1-42fd-96b0-0e1441595426", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492466, "uuid": "79c839de-74c8-4ea5-864a-a32912d95592", "value": "2797d9accc4e318cf55fbcb9920ed804", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d9245a-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691478820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478820, "uuid": "d542b560-6e38-4040-aa45-3ba32b335d22", "comment": "Malware payload (Mirai)", "value": "a30318d811d27be4813f90f18e91be6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478820, "uuid": "3bb4529c-3e23-49c1-91dc-1f0e52c3bef6", "comment": "Malware payload (Mirai)", "value": "07c935f53af3dc4e0cb932412ea59ce33f626d211de9bf1a42e3dadc5b687f0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478820, "uuid": "44b87fb0-8e26-43e6-9565-384eb34fb07b", "comment": "Malware payload (Mirai)", "value": "97d377e33ea67c10dfabcbca62be13529a69f303", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478820, "uuid": "4ac14870-a6c6-4cb3-a328-0cf06f7d1146", "comment": "Malware payload (Mirai)", "value": "66c95d4e0c034ff524fa8e5a38110a4b5f7b0b9a6124eca7dc3488fd301ec3648d0552a38f5152e074d9e1e94c9296a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478820, "uuid": "f41f25b1-bf69-46f0-9048-c5ba8772b508", "value": "T1D563189678C19A12C6E423BBF96E01CD332563A8D2DF321B9D212F5477CA82F0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478820, "uuid": "7c6e8d36-52c1-4b0c-b15a-b712dd640346", "value": "1536:U69UvL15Gu1C7+xIV95fqpBiypRTsf9ecahWMU334g5X9/e35+7vx:U6eBNRo9evhTNga3Qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478820, "uuid": "0e742d1d-06fd-47b3-ad51-2594c128c306", "value": 72204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478820, "uuid": "04cad374-5dc1-4139-9ee2-adae9fb5d13c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478820, "uuid": "3861d212-4c00-48d4-9d54-b4646aa1b9ae", "value": "a30318d811d27be4813f90f18e91be6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d5e4fd-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691477557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477557, "uuid": "caa88980-dba1-45d8-9ccb-537558e30306", "comment": "Malware payload (AgentTesla)", "value": "15001e69702b5cbbe9d3fc6e43b12097", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477557, "uuid": "d10c3b45-06e9-4a43-824a-1113ea81e7d4", "comment": "Malware payload (AgentTesla)", "value": "085555bf9e9abd741fd446a3112a4798dc576de3bede8ef872e87e14c270ef34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477557, "uuid": "461f30a7-777e-4dba-a0d6-a1678de3cbc1", "comment": "Malware payload (AgentTesla)", "value": "8e493f2fd24285832fae22491cd07a8c3853f015", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477557, "uuid": "c062dd5a-195d-451e-a2fa-498a95714f6f", "comment": "Malware payload (AgentTesla)", "value": "683c9f313629309f0f7d11fb5cb05d6d5d12e30ccf805daf387781fcfc9bbae64eceae0ecb3d7fede3ce2dfba9c0d21c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477557, "uuid": "debeac36-3f42-457d-9651-82ba2159d7a0", "value": "T125F433109804C07DE73BB75EC2F0ABCE823526D0A0A9367D5275C3C35E36D79955AAF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477557, "uuid": "e8e60331-82ec-4f56-b33f-72d91e1c7b8a", "value": "12288:zXnWDA93WCrvU8jbH1LA68SQEnrRxUWZpwdTeISGGryQOHPMvtaZ5LtFV69bWigw:bH93NUeRU6FZrRxUWodKISG6yQOvsYZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477557, "uuid": "caafde49-c136-4502-a8e8-56fc7ada04c0", "value": 729540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477557, "uuid": "e32aee87-d342-4a71-be6d-28415167f237", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477557, "uuid": "ce2d246d-d21d-4613-b96e-a5a7e022d01d", "value": "SHIPPING DOC.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5039f56a-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691477623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477623, "uuid": "70ebfac4-72f9-41b5-8590-784a150f6f42", "comment": "Malware payload (AveMariaRAT)", "value": "266bc7d1085f55c0291617e8b16b17a6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477623, "uuid": "db740094-efdd-4d6c-84bc-5adeba3d3466", "comment": "Malware payload (AveMariaRAT)", "value": "0903324406ab63659d98a9a4f362f889b55a8cf0794b182c844f8081707ba90e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477623, "uuid": "5c4ef3f9-db98-4a32-80cf-79c5fb5401c4", "comment": "Malware payload (AveMariaRAT)", "value": "b036b98faea50478180e33243c164d8db80b20ed", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477623, "uuid": "cb49062d-c5d7-48d2-aa34-72bb8fa4db1b", "comment": "Malware payload (AveMariaRAT)", "value": "b4e949d42ddb4ba3df9c02fda0aaefb142dfd53ff808ccca9917b190534823ed7eb32b872cf4a28e6664a78badc2c33a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477623, "uuid": "29cae106-dbff-468f-8b23-7985c296d3da", "value": "T1A2C4014251AD9F4EE2F677F8236843540BB361BD5851E2282EF138DED962702FB00E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477623, "uuid": "9c8d4467-937c-422d-83ed-b7853d465793", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477623, "uuid": "92810ffb-8702-4f53-a07e-1438cc92eeba", "value": "12288:7WniF98A3016OznK3WyZ3jc7wDcdIVod8kRiRgv5h2RnmUjLE+GNCi:7Wni0A3g7+Z3jc7waI+dfEm7VU3CN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477623, "uuid": "c7e6cee6-02c4-444d-98ae-e1b3380c3fa9", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477623, "uuid": "bf8b2b5f-ef25-45f2-ac17-bc1b380ae2e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477623, "uuid": "d02dc05f-0e4c-4746-8ca1-c84e8b23538e", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6087e62-3608-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691512234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691512234, "uuid": "d2e4c19e-3a64-4769-be74-dd703727fa30", "comment": "Malware payload (Mirai)", "value": "8bad1155b556fca8d3d9433c87a9f0e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691512234, "uuid": "8c8ad326-c0cf-4205-932f-1d685e482825", "comment": "Malware payload (Mirai)", "value": "09081df20d420754042ac549b8abd72b004227b9ff269259643524d044f41ba1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691512234, "uuid": "e877ad4b-3e06-448f-b08b-e5a2f73db6b5", "comment": "Malware payload (Mirai)", "value": "a20c79546003dc1d47190c67ff1e579ff5d20ca5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691512234, "uuid": "104354a9-d76a-4f6a-ba09-770ebf4c2d46", "comment": "Malware payload (Mirai)", "value": "f5494ceeae691375943e67468269ef0b68d0d4683279e4ef4dce79a63821820a217bdd26b1be2ffd025236d99707a80c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691512234, "uuid": "6fdefec2-8f34-4a0f-a93f-eb50112d272d", "value": "T1DCB2BF68621343C0E871817703AE1B411AB01FEAEC53AE59B795FA879E86CBD3503ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691512234, "uuid": "a0924429-a2eb-41c7-89fd-59dc430f1ba8", "value": "384:+8CiWwqONsP1gznEg78L7TZhedY5Mwbo/uTwqBTkWNDEvi+VqmfXFJgGlzDpH7uw:+riYONxD6Kx9uTt/NYvRVqeXFJgGlzDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691512234, "uuid": "11f5b4c2-3451-4f3c-b027-1e3f444fe2ae", "value": 23768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691512234, "uuid": "fd929ef6-2575-4de0-92cf-a74d55af7dee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691512234, "uuid": "94ad6a09-4051-4f8b-9db2-11a768e1db8d", "value": "SecuriteInfo.com.Linux.Siggen.9999.28296.16277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520cf337-35b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691477196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477196, "uuid": "af220897-0a96-428b-a95d-f6585e612aaa", "comment": "Malware payload (SnakeKeylogger)", "value": "c5f46378008dea922b38fe8680495020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477196, "uuid": "87912a17-1ce6-4bcd-aef8-30fba289fc23", "comment": "Malware payload (SnakeKeylogger)", "value": "090c4c45cf33e0c6ec59a1b61c2e9efb4326d6650b91e128bd741fc5881f51d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477196, "uuid": "f6823e5d-4dfd-478d-a199-55fd354c0246", "comment": "Malware payload (SnakeKeylogger)", "value": "e6f071361bd583958849f77ef61fc44163c2358c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477196, "uuid": "fb4f8e35-ece5-4c3d-8727-f6962caf1912", "comment": "Malware payload (SnakeKeylogger)", "value": "b385c7132c219ae18b596eb7a5420578f33621a95ccf75001e924a913924384e21851d98408254d4f6afaad8c9088b90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477196, "uuid": "6d3c5f77-baa9-4d25-90a9-4721dd6a262e", "value": "T1FFC4120666BDAFC2F5F617F0703811684FF362456862E61C4DE234DE5DB1B228A22F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477196, "uuid": "b8f818dc-9688-4006-8be9-3767ad101c8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477196, "uuid": "13ebb3cb-2e90-40bc-b5a1-67418aa43c24", "value": "12288:EniF9Kfc/xvUwSDnp9TFj75TO3gQuUOhhB80i+YT:Eni0wxLSrT57lpQuUENHYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477196, "uuid": "cb5d34b0-5656-449a-bbda-6a142fe3976f", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477196, "uuid": "9e4866bd-49c5-4704-9cd1-705cbdcbab09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477196, "uuid": "898debb0-1d2a-486d-9191-3146107e6bcc", "value": "Eco Ike K Oferta de A\u00e7o Rowling.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf207f7-35ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691478503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478503, "uuid": "e2f9f0ab-eae0-4959-8c3a-d1b7b575a354", "comment": "Malware payload (AgentTesla)", "value": "45a154583e75c7afcb7ca723fe7ce1c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478503, "uuid": "ea371c69-6a1c-4e96-a28d-191809debd91", "comment": "Malware payload (AgentTesla)", "value": "0924aea0baf47725fc3231386ee24a1ca0f290a8a2fad119b2348a5e3273daf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478503, "uuid": "d6f447ba-1b3a-49e6-bc33-362614325cde", "comment": "Malware payload (AgentTesla)", "value": "82ecc424928a41e98d362137f37032929ea7480e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478503, "uuid": "d62082ab-8d5c-4af4-974f-37e24a9ea8c3", "comment": "Malware payload (AgentTesla)", "value": "06f70b0e3be826959e9358156e2982fe5907df064c66666cd3e6a43d3872541e4ced455ca0a45406a405b64920fa5b6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478503, "uuid": "66be4131-0492-4373-a663-43a3a2afe747", "value": "T160E4222299BC5B8AE0F503F829BA51980FF3B4421497E19C5CD978ED7D72B215E02F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478503, "uuid": "364d17aa-b29f-43f7-8256-dc8bd172f960", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478503, "uuid": "140237c0-1004-46ea-a20d-40265f543125", "value": "12288:S4niF9HnsiFDyNYegzwHBxMcEZWa8V3cAPtaQypWRW:S4niPINYegEHBqcmCRxYpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478503, "uuid": "178a2ced-c534-46a3-bf76-9ee09b761b77", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478503, "uuid": "994046f4-c6c5-468c-a574-2404c38c6ac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478503, "uuid": "c89133cb-d834-4a18-af9f-822952b1975c", "value": "45a154583e75c7afcb7ca723fe7ce1c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d716df-35e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691498194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498194, "uuid": "de68f18b-c5cc-4583-acf8-82e5c6feffef", "comment": "Malware payload (Mirai)", "value": "929d1c9d2e91fb3e8c9bfa9cac870291", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498194, "uuid": "9cee21fa-7a0d-423c-aeee-01f2e1e5792e", "comment": "Malware payload (Mirai)", "value": "09301969ea212f3f098ff3d30e27e4e0c1e2e6b3667555a1075f730a4bef4e6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498194, "uuid": "69fecc06-4a75-4b0a-82a8-22c34c842420", "comment": "Malware payload (Mirai)", "value": "d3164f4ae4d5df7339c30cd8946ffb091ac7d055", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498194, "uuid": "3945f32b-265a-4e0a-930b-98aac22944de", "comment": "Malware payload (Mirai)", "value": "ce2083930740e7d95c7ab0ab32c5e48ab4bb6f3fdfdffaeab21b09253b3ce65637c7d036acb281d4136e3923f0d48d95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498194, "uuid": "47918ae7-eeab-4490-b804-88c084fc5f15", "value": "T111C2D1E07726FD31C420AC3DE52A4D8A3A91067C91FF393664258C399FC165B63B88E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498194, "uuid": "94d01cdf-8da9-45e6-b871-7b48dff56cfe", "value": "768:DMKyhegCCMqfizjoNpd2vJdX6vwrt9q3UELuC:oKy4qfqoeJdXWgALf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691498194, "uuid": "d0085f49-fd2d-4e41-9d47-61ba03dea27d", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691498194, "uuid": "454bef15-85a1-4a90-a9e0-73aa2d7399e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498194, "uuid": "b8ccc875-3676-4272-9a70-97d502bdca84", "value": "929d1c9d2e91fb3e8c9bfa9cac870291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790c1e05-35f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691502172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502172, "uuid": "df590e02-6f42-44cf-8dba-bd3f8035ac10", "comment": "Malware payload (Formbook)", "value": "cd37b046ee01e6abd96f98ba5595aa2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502172, "uuid": "c9683644-c126-4c09-963e-be2de8c08621", "comment": "Malware payload (Formbook)", "value": "0955b2319a4375cd070ed77ab6f9cf2c80c6635b4da9df671eeac78da1250f8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502172, "uuid": "bf734654-6897-4b40-b063-b4bdf184a5bc", "comment": "Malware payload (Formbook)", "value": "c42557cf2407a0716062de8d8dca2b260fe1c3de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502172, "uuid": "b7210cdd-77b7-4385-accc-5417f6745fb8", "comment": "Malware payload (Formbook)", "value": "84b26ce784fd834a051e914098b575e8c1c91e419ec337fc5845419321067cb585f248f8d516863d90267d6f528cfdf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502172, "uuid": "4efe63e5-93d2-48b9-84b3-5f8c9bd57935", "value": "T140441260B3E1D967F4F787712E3923637EA2D6241DA9E703A350A78C7F16980C70A716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502172, "uuid": "6b6d95a9-430b-4a6d-b511-126cba1dbbcf", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502172, "uuid": "45bb253f-cd53-4312-815f-f76fd89d4a9d", "value": "6144:vYa6jDfsEEy57bpst8KJDsjE+7aHx4VR/NDbfXZ6iP:vYRDkIpst8wDso9HC5bJbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691502172, "uuid": "25a1adfb-488a-44af-8e14-9de2f069eab7", "value": 263524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691502172, "uuid": "db229a57-8787-4abe-9106-c5ba3174a77c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502172, "uuid": "ce1b5ad6-d1a8-4e93-86da-d93bb8052732", "value": "0955b2319a4375cd070ed77ab6f9cf2c80c6635b4da9df671eeac78da1250f8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a71a8c-363d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691534887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691534887, "uuid": "7173c59c-e3e6-45b1-be8d-38a976e8330f", "comment": "Malware payload (Mirai)", "value": "e1a657a7b97759d07cd9b4988697686b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691534887, "uuid": "7d97569e-3fe6-46f3-a18d-7771c0a654ed", "comment": "Malware payload (Mirai)", "value": "09f24664e6aaf4a3da3db401015834945bb98e855c212dc33948f7f888bd88c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691534887, "uuid": "80ee38bb-d4ac-4180-a0e9-c6bfbd987c2d", "comment": "Malware payload (Mirai)", "value": "d2d73d61210ebf1ebf489b81cfc11428d4a70607", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691534887, "uuid": "85ce38c5-dcdd-4cb3-843e-6b66cd36e098", "comment": "Malware payload (Mirai)", "value": "727a2680b0312a88d08b56ad00cbea847ab35679ee98eef17569a7995a1fa653c60ed40261d293ef7e3ffeacc700c5ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691534887, "uuid": "7479349c-9fc9-47cd-b4c3-a317bcd36564", "value": "T1476301B1D5457BB2A8B50C35C83D82068F016AB841EF60DB132B5176B5E7E0D5774AF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691534887, "uuid": "b632b80d-37ae-4070-8206-830d3208658b", "value": "1536:OjR/oSeLzDPZ8AY1uItOsiejDScGIuQHGVPfJ5k4Yw:W/oFL3PeA2VDJruQmVX4xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691534887, "uuid": "e7e51c7a-972a-4f95-a745-f99da3e84c6a", "value": 69340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691534887, "uuid": "8d75558e-5d2a-466f-b1f6-db3ff97eba83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691534887, "uuid": "9abd924e-34be-472a-be59-1bc07a380847", "value": "e1a657a7b97759d07cd9b4988697686b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22cfe23c-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691478835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478835, "uuid": "1c42229f-4348-4ef4-a2d0-420158069e0b", "comment": "Malware payload (Mirai)", "value": "f679e922353d17eb1f39460eea19c0a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478835, "uuid": "adb40ea1-072c-4df4-9756-925e1e366b2c", "comment": "Malware payload (Mirai)", "value": "0a6ecc5f4b01414f40b245c7228dd0ecaaae242e8e8a1b096335aca8f0ada305", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478835, "uuid": "6a41f0c6-d543-419b-9cb9-7aec364aa40c", "comment": "Malware payload (Mirai)", "value": "2710f51f531717a5ea741cd5dbcb1f3552e89272", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478835, "uuid": "5a4741ab-bd37-4ba4-9c50-41e44f2acd22", "comment": "Malware payload (Mirai)", "value": "931ec13a0e1c12fe7c034a147f431ce909697591a0411c7c97e01c925c9c536068a7ac98b7671e8f760160ce82fd8e75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478835, "uuid": "0ae5de0f-31b3-40eb-9b7b-6cb927c82b01", "value": "T12853AEB6C85DBDD4C8008234B4229EB82B53F40996671EB58E8789D25447DFCF52F3EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478835, "uuid": "af05f0f8-ffcb-49cb-81c9-8ad4f51e5918", "value": "1536:Za89FPcEArJyfwt1gAWcGpB/NSDvXVjeXaCgs:ZX9dcEArJA3XyXZeXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478835, "uuid": "05fd7b3c-d55e-42bc-830f-89b59d3a26db", "value": 63900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478835, "uuid": "ddf9ec3e-fcfe-4fde-a3a5-44acb41cbd48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478835, "uuid": "c18a56d7-302b-4777-8b65-7453f3b2db36", "value": "f679e922353d17eb1f39460eea19c0a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164a6394-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691478814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478814, "uuid": "cb186ff2-f67a-4059-bec5-c8441cc6e67f", "comment": "Malware payload (Mirai)", "value": "2b8569d64cd321de100185b4bc9c964a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478814, "uuid": "685b4828-7be2-4986-8cf3-b5e5ff40c2f3", "comment": "Malware payload (Mirai)", "value": "0af93f5f29712c63e31cdc15b7872e545a290f7994557ab45c8197ec142be679", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478814, "uuid": "1a2f8977-5455-410c-bed1-4e589d23bd89", "comment": "Malware payload (Mirai)", "value": "6a85e682aa208f9f5b324f6d81ae7b0cb5ad924a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478814, "uuid": "63604af7-2a12-4dcb-a715-1919e033f6d0", "comment": "Malware payload (Mirai)", "value": "b8343536917680da7b63377e1f804916da712816dfe7aef2278773d73b4f460665a101f7b64956970092e6ea0595f699", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478814, "uuid": "c7939f9f-4868-4283-988e-472de0b93fca", "value": "T154634BD5E8029E3CFD4BD6BE90274B04B924635416930F2BD6AAFCD76CB306C9E52D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478814, "uuid": "ff83309a-79ae-46aa-8035-3800ca2af43f", "value": "1536:a/YL/1ftUFmXsi0tCS96FxsvZ622Eo88J9:DL/zw1dtcz427J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478814, "uuid": "2d0590cd-0191-4ec6-bcb7-738c07ca1e07", "value": 69600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478814, "uuid": "2d8c57ee-308b-45da-98e3-b01d892f60bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478814, "uuid": "32244f27-ffb9-4d4c-bb58-d26e832279df", "value": "2b8569d64cd321de100185b4bc9c964a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0ceaf4-35d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691489536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489536, "uuid": "4bb22c0e-c534-4b70-b2f5-4e9448b4f3fc", "comment": "Malware payload (Loki)", "value": "e75f67226f9f7b6d2aea80bc3caa3489", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489536, "uuid": "a762fc01-d821-465a-8917-2836adac515f", "comment": "Malware payload (Loki)", "value": "0b3086effd8f6fba603ce006970a17242a05c79e30acc38b61b50600558e27d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489536, "uuid": "ceda455d-ea2e-4a27-a07f-4d1050994a31", "comment": "Malware payload (Loki)", "value": "a9edd6a82e8f4974ace942d3a4dfce44d3e899db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489536, "uuid": "d1eb737a-f417-498d-9589-d717b365a1e5", "comment": "Malware payload (Loki)", "value": "59f8d0b7910f3ec7cfb4c6f90b571f79db632e84dbf2a5a857fbc958d4db76ec832bd72db7f486bad62343d391e73437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489536, "uuid": "6ec08cac-3d55-418a-9514-ffa1e39f3141", "value": "T148B4121564AD9F96F1FB63F4517850A80FB27285245AFA1C2EE438CE6D237628C10FE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489536, "uuid": "f014f49c-2eab-472d-9830-dbb6abe67380", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489536, "uuid": "73586e18-b8bc-4e02-9452-0cba10df8a16", "value": "12288:6mniF97xfDPvQDHx7qULW2zSVW1cRjqjqdnPS:6mniTZDP4blXCQGW1cRWUnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489536, "uuid": "9d678c1b-a0a1-4035-b79f-45f0c76782c2", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489536, "uuid": "80cf5451-8d6c-4281-9ee1-66f14d867629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489536, "uuid": "32e11682-bcc0-4752-a9f6-4ea2b0792b54", "value": "SONGHONG SOA AUG 2023_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f9ec38-35ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691473173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473173, "uuid": "bb34f916-5364-46be-aade-1d9b7e514b1b", "comment": "Malware payload (RedLineStealer)", "value": "8085a48745e7ad44f1a7276b052e1b96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473173, "uuid": "365c66c4-a218-4019-9835-dfc5344302e4", "comment": "Malware payload (RedLineStealer)", "value": "0b3a85c926bf9c26d5c2543bd15cee6616b33f296b5b428ef91c4c8e142928e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473173, "uuid": "d01ac5b0-3dd4-4288-a4e2-a48361c89fe2", "comment": "Malware payload (RedLineStealer)", "value": "7fcb40c73b704efc137a7856adf54730446a7063", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473173, "uuid": "239547cd-5823-474b-b28c-88d4294493ec", "comment": "Malware payload (RedLineStealer)", "value": "5d5293503081f7290ad734f7719a1a962d4f2a9f3a631a8d4f64b4a4189cfb5b35dbd2465fd0fd41b5be6aeba0d00519", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473173, "uuid": "073b31f6-9f7b-4e5c-a5ba-c073af24c0b6", "value": "T1B2849F13AA9C6B61E5D28A324E6DF6E45B1EFCD18F1937DB224C7E2F08711A1C176702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473173, "uuid": "34a09def-e43d-43af-bf65-3ff054b1d104", "value": "7574067d27f1e097e97a79381564790b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473173, "uuid": "95a6995d-b1be-4a53-9462-01ad7b3cbc18", "value": "6144:OPQph2CzWFBTTtGBNUUm+r15wwof/P6xB:OYP2Cz0xTsTGk1a7f/P6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691473173, "uuid": "7725d122-0da0-40f1-a1e0-ad9f1fb225ed", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691473173, "uuid": "ce7d3a29-5a2c-45cc-95d0-98c07e29df0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473173, "uuid": "ab1c3085-abf8-42f3-aa0d-b494bad50e23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33c62fe-3624-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691524201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691524201, "uuid": "0c265944-295a-42d3-a35f-8ba9c7d26477", "comment": "Malware payload", "value": "966181fbca6e40322a19277fde3e1d66", "object_relation": "md5", "Tag": [ { "name": "keygen", "colour": "#610F03", "exportable": true, "hide_tag": false }, { "name": "Troja", "colour": "#613DE5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691524201, "uuid": "308f6822-edf6-45ca-8e39-cd44b77078ae", "comment": "Malware payload", "value": "0b738e049feece1475d03a51c396d999e467dc0f36ad2b9418f2fd82e8fdf9e1", "object_relation": "sha256", "Tag": [ { "name": "keygen", "colour": "#610F03", "exportable": true, "hide_tag": false }, { "name": "Troja", "colour": "#613DE5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691524201, "uuid": "f78de78e-ead1-4ed8-837d-4d22918cb0d7", "comment": "Malware payload", "value": "172b0d3485e4647161a974e94b46b78dae46e938", "object_relation": "sha1", "Tag": [ { "name": "keygen", "colour": "#610F03", "exportable": true, "hide_tag": false }, { "name": "Troja", "colour": "#613DE5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691524201, "uuid": "a3ca9277-4be7-459b-9ad5-07e8111db097", "comment": "Malware payload", "value": "40e95ac701a726e2827c1cecc0b17cb84269b1e7ba656b12d2e446d5459abe88b85cc34b501191bb8a5bc4ef65be93d6", "object_relation": "sha3-384", "Tag": [ { "name": "keygen", "colour": "#610F03", "exportable": true, "hide_tag": false }, { "name": "Troja", "colour": "#613DE5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691524201, "uuid": "bf37077d-a808-4201-8777-f48a7e4e5643", "value": "T198052310FF9C9A20FFAAE17201926D534F02A8B405BBDDCDFC068E17A451BD6B999634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691524201, "uuid": "4c4fe69e-33b7-4fd9-8ff3-6db3c9dc702d", "value": "12288:pCf7hL5ANOYnraiigbDRyh0iXoyLejIjSnWuzWgxEI/EHfX31LOjGQFvOV5l6cDq:pCf7hyY4MgPQ6sQxF/A3dOKQGV5l6cL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691524201, "uuid": "b97a9567-d711-4844-b0da-65b544b56406", "value": 837914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691524201, "uuid": "49a10b29-e50d-47ce-b53e-170efe758e8f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691524201, "uuid": "c8c5bb7c-0fc2-4a2a-af6a-347dc8ee8794", "value": "Patch Fix.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2578a603-35e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691496019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496019, "uuid": "f7041eae-cdf2-400c-9ead-0c716dd63ca0", "comment": "Malware payload (RedLineStealer)", "value": "a3dfb0cde3a9d971b600de0be0259614", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496019, "uuid": "c3bcb92f-fbfc-4705-9324-92c2bb969f58", "comment": "Malware payload (RedLineStealer)", "value": "0c144ab019111f46d17595facd64fafc70cde0e91017ca8ced0454de9ed7df68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496019, "uuid": "880cfdb4-d980-479a-9abb-be7612943c6f", "comment": "Malware payload (RedLineStealer)", "value": "fa5c0889ef6bf8ad73107daaa8c5c55644d3150c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496019, "uuid": "2ea8a2d2-eb9f-4534-9f08-8fa23a6e6149", "comment": "Malware payload (RedLineStealer)", "value": "35ca6528d5393607a91ccc8799be063a4fc903e81430accdd6ddd4b28d1f2f51b32b2cd4e8d00a4b0dedfe07e90281bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496019, "uuid": "fddb8b3a-80de-41a9-ba51-4559bd894ca4", "value": "T13C84AF12E69C6B72E5E68A324E2DF6F4A61EFCD18F0937DB124C7A1F08711A1D671702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496019, "uuid": "8ff85cd4-2bfa-4d83-a5fb-79ada88122ec", "value": "81d6121cffaa48653088a63c1ee15a1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496019, "uuid": "11b748fd-2c5d-44b8-ab14-1f55c7e207f5", "value": "6144:4RkOPxRq2SsHPYk3We4IO50d0iFm1+8EWOh4MQ8:4+8RqgF0ILkrEvh4MQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691496019, "uuid": "dcab6a1f-969d-45f5-9c55-59f7ba7f0b1a", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691496019, "uuid": "c9208ebc-cfa3-4741-9346-e5b03c703d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496019, "uuid": "0006a0d6-4f5e-40eb-aa87-1fbbad67c16c", "value": "0c144ab019111f46d17595facd64fafc70cde0e91017c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595db4dd-35c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1691484080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484080, "uuid": "96599095-c99c-4eab-84a9-a8b46704a7c5", "comment": "Malware payload (ModiLoader)", "value": "279d23e68455c0ba104d5e78cd0129b8", "object_relation": "md5", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484080, "uuid": "ac9daf1f-6041-4abf-ac83-45f1e1de3d30", "comment": "Malware payload (ModiLoader)", "value": "0c3ef20ede53efbe5eebca50171a589731a17037147102838bdb4a41c33f94e5", "object_relation": "sha256", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484080, "uuid": "9eaf0cf2-8dc9-4693-98ef-39b98ffddd67", "comment": "Malware payload (ModiLoader)", "value": "f68cc52f19c11d07d72118e71919df20ffabe9f2", "object_relation": "sha1", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484080, "uuid": "14009259-9e8c-46e1-9034-cc1db8b33d99", "comment": "Malware payload (ModiLoader)", "value": "49a98198fd15c2daa03e4e09ee5c8dd52bef9cdf34e085db6c4baa904cdd43b19c7b15918410f3f222a4fc00dc07bf10", "object_relation": "sha3-384", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484080, "uuid": "cef993de-5275-4c54-b626-52837e810b62", "value": "T12185AE32489A6EDCF1359E08A761FE100E14B6575FC61EF8DC1CA6105A6DA30D7CABBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484080, "uuid": "496ad4d4-bc90-486a-a398-fbafbce9fa37", "value": "24576:uDi7eeqvTf9nXzTL47O/g1/9V9ISAPsn+lHOKxvlCwNSNVO:uWeRnXD4nGXzu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691484080, "uuid": "7e3a94be-e4dc-4f77-a3c4-c392b7a1268d", "value": 1866669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691484080, "uuid": "9a2fe58a-e0f8-4cb3-89a2-5577ad284899", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484080, "uuid": "0a39c615-4374-4bff-a08c-032e892537b9", "value": "0c3ef20ede53efbe5eebca50171a589731a17037147102838bdb4a41c33f94e5.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af02c08-35f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691502605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502605, "uuid": "ba24a0fa-410a-4895-8f15-048c4755f5d5", "comment": "Malware payload (Mirai)", "value": "9a394a893c012c4b020ce15309b8e8cc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502605, "uuid": "9c6f4934-b6aa-4de8-b8b0-bcbf1a8d36ae", "comment": "Malware payload (Mirai)", "value": "0c5eeae5c4dfe0a6b8a3ea6645e6639ec062af52eb04ed75a118a781b339a2e2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502605, "uuid": "dff6e376-96e4-4080-8fb5-48fe7abe4cd5", "comment": "Malware payload (Mirai)", "value": "5270eb2aeef5e0fe81e9dc31bbfb0ee354fd06c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502605, "uuid": "ac94f5a0-79c5-4b53-b3f7-39d27a530531", "comment": "Malware payload (Mirai)", "value": "0c790267197bbd6104dfba5f3533e3188d5aa6eebea1a8be1a70d5358e8a1f579a08c77af0514a55337408b874099ac6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502605, "uuid": "fa00b8ce-22d3-4b04-b4e2-c5013545df65", "value": "T11AA2E0921EE24DCBCE5218B0A5B9F68E4487E081275F4789AB46C352537F31E3891BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502605, "uuid": "4057a752-936f-4959-bd26-43346ef1fd65", "value": "384:MibrJRQ2n3t502fWExc2S5YbXtV61b6O54ZWkogv2h/j4xXPKxUAM/yhwlsgvsSe:p/n3t5hfY2SwEsO54ZWzCxCxa/yIvo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691502605, "uuid": "b15ff25e-dfc5-460c-9511-74ac8e96e524", "value": 21484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691502605, "uuid": "290f0fc8-0489-46d3-b740-46f3a12478e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502605, "uuid": "8284ea88-9a5e-477b-a2d5-60a29c422ea5", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2803871-35d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691489491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489491, "uuid": "c5277925-cb10-46a3-bcc6-456286380cee", "comment": "Malware payload (GuLoader)", "value": "33cfde927cb3f03035c418b652cd3a00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489491, "uuid": "4ab577db-4e77-4cd2-a7b2-0c9d6dcd30b3", "comment": "Malware payload (GuLoader)", "value": "0d1e98a3ae594f6f34d67fa6ae7d8195f10e24cfaf9fd8f501dbdad3bffe6bf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489491, "uuid": "6c2a8d64-d366-4293-9211-ebbbe30fe59d", "comment": "Malware payload (GuLoader)", "value": "21ba6a96a6d55e1d6a1ea9ee93b5b0b37a3dfb99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489491, "uuid": "adb3fdd4-db67-4b04-9c83-6cf2451309ec", "comment": "Malware payload (GuLoader)", "value": "136be3d441557850db3337519366e2d533480a2f56df32721a0e9d883fd128a23cd7a0641e8bf90faf55f2e4eb1a2796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489491, "uuid": "92ccefc4-2108-434d-b309-2a6c24a0a4d1", "value": "T1C2C401D1FF80D9A7C8520E70DBB2D6650275FC246D24CAC776583B6E0E32E91D829A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489491, "uuid": "e5c6fb6f-c07e-4739-b165-b68f42e9adc6", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489491, "uuid": "9a66e72d-5379-425b-a515-b29213946d58", "value": "12288:otHb13bWicvDzJ5wZTm7m1989/Ncv9Wh6u9Mka:EbNrc5Tk9elyGN6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489491, "uuid": "9a4461a8-b34c-4d03-b151-3f485e313ba7", "value": 558064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489491, "uuid": "6ab2a8dc-598b-472c-ad61-83b395ef6fd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489491, "uuid": "076d44b5-b195-4ae2-95ae-05dbb66680f2", "value": "referendarernes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f5bb69-35f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691502060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502060, "uuid": "1a03db3b-7e35-44e7-97a2-384ac89d7cc8", "comment": "Malware payload (DarkCloud)", "value": "a0c7e46f39b6b5d5fa297eb3551dae2b", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502060, "uuid": "c7dcd887-4db6-4fd0-8809-177619ab2786", "comment": "Malware payload (DarkCloud)", "value": "0e87550fdd54cc55c8ee32c72842d6fcc29e0d5dc15b197343343274dbb69478", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502060, "uuid": "a671e909-9cfa-4ef5-9fc6-2148ac8421df", "comment": "Malware payload (DarkCloud)", "value": "b3346a65da44b2b3fcb16e7207540e372535def0", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502060, "uuid": "d2dcecfe-a720-400a-8c09-1f8f81a28728", "comment": "Malware payload (DarkCloud)", "value": "e84341cec640e3a3182f63be5000461c10169c9024218ead6dd572b7d3b1ff4f47166f30a6df1083382d7a6417b53afe", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502060, "uuid": "f12f8e40-b995-48ec-b5f2-736f7bbb54b5", "value": "T1DB6423507578C2BBE8E513B14D3E4A9A87A1A95358FD504B2770DA9C3D52B42EE0E333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502060, "uuid": "c23d8208-7689-41ab-a2d3-f51bb4659abd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502060, "uuid": "5a250f6a-2841-4f68-b555-a6bcf332ba2d", "value": "6144:vYa6DUGFVIaOYjiPuDJgO/oqxVoti0X/YubirOYBYvbvDMpWN0xryZGO5NJrpqX:vY5UaRfquDeO1ot5T5yYvM+0AgOP9pk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691502060, "uuid": "a39cd418-afac-4b4f-b6d1-233d13e3e69c", "value": 333009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691502060, "uuid": "891ddae9-3e2c-435d-9a06-7eed3757b4e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502060, "uuid": "3800c9be-b09b-46c2-8e20-2f2270e74ee7", "value": "0e87550fdd54cc55c8ee32c72842d6fcc29e0d5dc15b197343343274dbb69478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12ff8c3-35cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691486778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691486778, "uuid": "fded3604-e802-4ddd-bee9-732a692f7db8", "comment": "Malware payload (RedLineStealer)", "value": "a1e9bdbabd0a6e1065ad0c87c56d1300", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691486778, "uuid": "fdaf6bc3-2133-481b-8826-86debf1cc058", "comment": "Malware payload (RedLineStealer)", "value": "0e9ebffdac31f5df08227a8cf888c9ae92429fbb2a26ff285d3ce24e231a65bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691486778, "uuid": "8e495c53-977b-46ea-a62c-4e3fd8142a73", "comment": "Malware payload (RedLineStealer)", "value": "6228d0b77e7a646f3080fffdf1e547a1cea8bfd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691486778, "uuid": "6c9c492e-62c7-4b77-92f7-4da71e1b200e", "comment": "Malware payload (RedLineStealer)", "value": "b66c3d71029b0b739c25044fdc3750ab01e1ca4b5ad3d6159e91b3718951f7cb453c71769a343e35ccbb5ef80a9f1c2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691486778, "uuid": "387d23b0-077f-4ff8-878a-16704381f0a8", "value": "T1A984AF12E6DC6B21E5E28A318E2DF6E4A71EFC91CF1937DB124C7A1F09311A1C676702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691486778, "uuid": "0188149b-5cb4-4680-bed2-1c968b850058", "value": "7574067d27f1e097e97a79381564790b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691486778, "uuid": "10d37f71-c663-4a87-b386-2a8a97160d7c", "value": "6144:mHD512cGAw1hen2wHco0NP/WUH5GXzHcZmZa:mjP2cG51hYTHf09n5GD8QA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691486778, "uuid": "8a3d12d0-f459-4781-8915-1061d324c7cc", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691486778, "uuid": "b96738fb-30c6-4c46-a25e-9e74dc811b46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691486778, "uuid": "f4d66dfd-6e40-4ac8-8f8d-d2541d682d7a", "value": "a1e9bdbabd0a6e1065ad0c87c56d1300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f540ff4-35db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691492761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492761, "uuid": "f7ce1e49-4dd5-41d3-8db2-642a5fff7560", "comment": "Malware payload (Mirai)", "value": "32bbf168b099dc5bf3521bb08176e822", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492761, "uuid": "b130341e-c4de-4502-aa89-983b6b24a0ae", "comment": "Malware payload (Mirai)", "value": "0f01d31c9b0a17e56c37a9fb78e6df18a2268f6dd859c50ccf567fa20039cbec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492761, "uuid": "d2c45e48-f5f8-4025-b14d-f96d0cee86ab", "comment": "Malware payload (Mirai)", "value": "d8313553ea8a158b75f3e5577dca91a18e17782d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492761, "uuid": "73c494ab-efd0-41a1-87d2-2b22bad7ef7d", "comment": "Malware payload (Mirai)", "value": "c774469c7b7dc43473c99b45d4df1eaa4ce5e34decd6f3208d3e9bd19e85db608dc9b11d22c5c5f5671ab727fb17b354", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492761, "uuid": "882c8a9f-6ba1-47f6-a75d-d15c14b966ea", "value": "T175E2F193D3B2A461DE7C2BF1F99981CA5BBD4B6CC27630D3160656242DAA0536F3C893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492761, "uuid": "944dcc1d-c4f6-4247-b77a-323ce8b15df2", "value": "768:noiWiO031vpAPbrVWZK3XVGxm9XYHyC49q3UEL5I9:norm1vpALgUJGvLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691492761, "uuid": "bd632ce7-fc8a-4a50-a431-a4040e4c629a", "value": 33036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691492761, "uuid": "62a84647-c241-4aff-af59-8b65149faf71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492761, "uuid": "e2db32e1-b445-4da9-b78e-3620859ecb09", "value": "32bbf168b099dc5bf3521bb08176e822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9bc019-35ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691478499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478499, "uuid": "8e13c5f1-d99d-4792-93bf-8e9fbb5dcbc6", "comment": "Malware payload (Mirai)", "value": "0fb2693a59f50dade9dff25abf3d2186", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478499, "uuid": "50acaa0a-6411-49a8-835d-73d3a82c03e7", "comment": "Malware payload (Mirai)", "value": "0f47d45b6871c5b3c2aaff8a065a2b5a138601d33bd3aec8d48c08032170ac88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478499, "uuid": "4972b8c0-658b-40dc-a064-dd09e246c9c5", "comment": "Malware payload (Mirai)", "value": "3903aacba6de1644e175eff2266908e1a3c0115b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478499, "uuid": "8fbf63dd-067f-4372-a1b7-30b76335e64c", "comment": "Malware payload (Mirai)", "value": "426926a218fbd0faad59156b7a65e6561c6fb2ad1dd4d8b473390c4ae76ffb63419dc5851f0dcfe2d57e346b365c1517", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478499, "uuid": "5d7ad4df-7776-4931-97c2-53a04fed2a02", "value": "T13D93B30ABB740FF7EC6FDD3749A92709158C550A22E97B357930D818F64B26F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478499, "uuid": "52149477-df62-4b7d-8dea-7cf4776d13d5", "value": "1536:zahaNVXMDW/JxtjzYvTIqI3LI/0B/BHcZiqRLTe:zahGVQW3t/Mh23Hcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478499, "uuid": "528ed703-f1e7-4f42-b47b-9df486d6909b", "value": 92444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478499, "uuid": "074e491b-8035-40b8-9971-5a12def0b672", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478499, "uuid": "fa4d98ca-9a0f-4e0f-ac60-582cdc6d5ef0", "value": "0fb2693a59f50dade9dff25abf3d2186", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d884f03a-35ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691500615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500615, "uuid": "7fb99977-f513-4a69-b92e-b8f43d8a498f", "comment": "Malware payload (DarkCloud)", "value": "8858017af30e7d5302c21b7d7cccdf0e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500615, "uuid": "7639868b-d4b2-429b-9cae-7c8d8f2b20b4", "comment": "Malware payload (DarkCloud)", "value": "0fdf9c1958c63c90c129bee0e80b5e955d76f6a4b6a89d9e409cc9cb8a13a8b1", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500615, "uuid": "b52d25a5-a8f4-4c73-b528-071a1906c91d", "comment": "Malware payload (DarkCloud)", "value": "ad1aa8060dbe08d28e1da9ca1260f233f26d2a0e", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500615, "uuid": "2ad3e061-98bc-4cd5-8748-84c586ccc0c7", "comment": "Malware payload (DarkCloud)", "value": "0a63930f396782e3af41fc268a7a1a6960b45c93c60aac750fad8865a228c299f40ddaf852a7849a59604c8660f9d265", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500615, "uuid": "a0ad1502-f8b1-4179-80c2-12e90ffe0e6e", "value": "T175556B25E77B6556EF29A6E85E1F847238D6DCC0F1B1C488ABE72C0385C23514E35BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500615, "uuid": "ef26cd6b-6196-4eb2-8a91-d89fc3825dd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500615, "uuid": "212ed22f-9302-45d7-ac61-c0624836179a", "value": "24576:x1I1R1I1nRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOiOgu2kq3AoBFjA:xGvGRRs6CE3jLbO9Rs6CE3jLbO6u2kyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500615, "uuid": "f11436d5-23eb-4aeb-8985-a07b4e8deed7", "value": 1300992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500615, "uuid": "453c3542-99cb-4f3c-ab94-f2f19ddc9652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500615, "uuid": "03e76365-15f7-4c42-bd14-21a80eef69ae", "value": "new order 32724.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762b9de0-35e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691495296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495296, "uuid": "f47e7743-14a6-411e-9961-9ac47d37e96e", "comment": "Malware payload (AgentTesla)", "value": "ce02243dd6d700bbc5f4823f21523c66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495296, "uuid": "6f7a3b02-b9d9-4753-8cba-ff38896685a5", "comment": "Malware payload (AgentTesla)", "value": "1043ec32556dfe5725383d7c43ec9209e8ea887072614ff669bbdb36caf2854e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495296, "uuid": "1ad49b91-6c9b-49f4-a3a4-d5ccc3908c91", "comment": "Malware payload (AgentTesla)", "value": "7a8e0379c0e56d2ae4dadcd6f5be020cf2a278b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495296, "uuid": "282f1d04-11dd-44c2-be8d-1631435973a3", "comment": "Malware payload (AgentTesla)", "value": "8865435445e8071a616ee54aa0a896033df3d3d613d3a36b75c4f1b0e047df34da4fa049a197ab041a04ee329fb6bdda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495296, "uuid": "adb0374e-0420-4b7e-aa14-080d7ff46927", "value": "T1E2052365ACEBD5D3DF4251FE78F842150ECBA0405F35BB8D30A6B01818BF3295A57AC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495296, "uuid": "96e32457-be63-4229-aff2-ae4b9fd2c86b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495296, "uuid": "3b91a03e-c63e-4bd4-b0ff-3116fbf0315c", "value": "24576:t43gLX4wuDB54HMVx4NTXbPxgorbpwRAH/bM:tcgLXG96HMmrPxgcx/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691495296, "uuid": "0a71031f-fc16-4889-a144-8e3cf70aa6d0", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691495296, "uuid": "4befbbf5-7ff6-42bd-b926-3ff3a9656343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495296, "uuid": "9031f63c-657a-42e0-8ef5-4100961a066d", "value": "1043ec32556dfe5725383d7c43ec9209e8ea887072614ff669bbdb36caf2854e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fc2342-35b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691478062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478062, "uuid": "1e44cca9-c0b9-492a-beb6-1faa915cabb8", "comment": "Malware payload (GuLoader)", "value": "3d54d1e2919ec632a59112b40e35df2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478062, "uuid": "9879e546-fb0e-4c95-b6b3-27ffd6025823", "comment": "Malware payload (GuLoader)", "value": "108e4c88da52206c4a780e2d66f6b00a7ed9e41b2f36166ff9c0fc686c1f53af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478062, "uuid": "20bb47db-c11e-4ebb-a5ed-2f49bf59fd80", "comment": "Malware payload (GuLoader)", "value": "85e1f4c6d306bd1314f325a9fe4befd8bfc80e53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478062, "uuid": "c26211fa-90ce-4ddd-aea2-beaa11597dde", "comment": "Malware payload (GuLoader)", "value": "8a6687bba50cc9e19c4fd4792e9a10a69b35af5bbdc5926237931c668e463da98052490a5e790029e8e6eb1b829c6b46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478062, "uuid": "14e8fd6c-ae88-42ef-b8d7-4515b5c14202", "value": "T1A3C4F1B216C3FB9ECC4E5570855896BA18B3AFBC45328ACEA6417D7295F01421F0FCAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478062, "uuid": "b17cc9fc-2cac-4a6d-bb0a-0d66eb126c89", "value": "bd1dc23681f44e733e87b20cf5b908b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478062, "uuid": "1e50ff51-ad16-498e-ba0c-53d0c69b98a6", "value": "12288:r81oDihe4zNyboAUJH8wLgd20iKANajZiQJeEjwJpXkSpVKjZI:4aH4zNykzcKo2wA4iWfjwJCSpQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478062, "uuid": "7858f5f6-aeb1-4ae1-bcd7-f5a622e5295f", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478062, "uuid": "3264d288-874a-4057-9118-61fa585c411b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478062, "uuid": "cf31bde4-51ec-4fc2-9b0f-04b25ae67753", "value": "Konsekvensrettelser.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee354e4b-35d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691489484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489484, "uuid": "377ecdaf-c217-42a8-867a-ac2664cd5fd9", "comment": "Malware payload (GuLoader)", "value": "4eb1b441c860c71708794b28c87b9c08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489484, "uuid": "e96b6421-d7a5-43b0-8a42-9e4086f1ffa3", "comment": "Malware payload (GuLoader)", "value": "10d2e26e7fd2141f3a41f907b3be1a6ae8778ba8e39f3b485ead152956ac0d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489484, "uuid": "dd61199f-d875-4b87-b12e-16ac6eb3e435", "comment": "Malware payload (GuLoader)", "value": "35625513075c4525445b50506fc64450be40cf5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489484, "uuid": "da51ab6d-af94-4599-9c0e-fde3ae52dd5e", "comment": "Malware payload (GuLoader)", "value": "62dd2ba34cf395402f597282f1c0a1642c889df02b71d1ac8d6315e9bb9e398b21e4a3bcd5ead6066a552923276c355f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489484, "uuid": "04a30c95-3c06-4fc7-af8f-e21c144583a2", "value": "T1045412425EA0D967DEC319B1E4B8ABBBCF373E45D2405A474340BE78783568B1B223D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489484, "uuid": "9c19c0bd-9ee1-48ae-a8f7-cc1156fe958d", "value": "076b06e6a65c9b7cca5a61be0cd82165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489484, "uuid": "ef9fa675-dd14-465a-a84c-3520304cef7b", "value": "6144:7zAJFDDsenq/rB0ecpgKGY1S33cuFy9FakHT5EzjwgB7xMiSy9K:vCjnqldKGY1A3cN9lz5EogBliX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489484, "uuid": "85ce8018-3d2a-4393-b711-b635b258e58e", "value": 293920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489484, "uuid": "14554861-4920-4f99-86a3-e10801b8f757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489484, "uuid": "69d86985-c183-4f04-954a-cb22ec6cc7df", "value": "BOQ Materials Needed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd0207b-35d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691489514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489514, "uuid": "9fa67b04-afbe-43ec-ae22-65228a176617", "comment": "Malware payload (AgentTesla)", "value": "690a4608ac4142a98de1818d06b494ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489514, "uuid": "21e4bcc4-0962-4393-9f35-f219f4dae068", "comment": "Malware payload (AgentTesla)", "value": "10ebe0fe04beae12147976c041e93e653c69cc16b5a21e43b2c5215c49c7ac83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489514, "uuid": "4f1077bf-d1e1-4983-b4aa-e2254674bb23", "comment": "Malware payload (AgentTesla)", "value": "aa1932b5a8352b12d5fff5a8cda8920e2d894c74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489514, "uuid": "5456735a-b0b3-4f47-b5fa-6ef9d0c9d625", "comment": "Malware payload (AgentTesla)", "value": "0ee708c0e6ed763f02f4317293bb90e0d0b702031e4dbac6fb48af32cb7e036233ca82f5dfe2d5237d8f087ceeec6d90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489514, "uuid": "943a6845-833e-491e-ba1a-5166f949e3e6", "value": "T15A25DF4D326A5F97C9BEA3F83422D0694FB7991E6122E2091CF232EFD561B6307509D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489514, "uuid": "70e6507e-b5ad-4200-a337-e0c06c62154c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489514, "uuid": "8c681864-15d0-4fe1-bd5c-ef5501ceb150", "value": "24576:bPya9iv8esA1FyNyZrnJI8jnLUq/iSg6lRb/MCJSuOIK:bviv8eD60JdnLp/iSg6l2KjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489514, "uuid": "0f2e718f-5fed-45a1-bda2-8744c2866ee2", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489514, "uuid": "e533362a-a77e-4f95-b4a5-8dce7b130e65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489514, "uuid": "9010ad4d-ee69-4c54-a5ca-52c39138aca5", "value": "781070479541.CI.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69cd4b4f-3638-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691532641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532641, "uuid": "9c917685-adde-437b-a7c5-d9cc5eb65c16", "comment": "Malware payload", "value": "7a4eac94ee515afa2f2af8a49c36911c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532641, "uuid": "4d416210-c82d-4a9d-b7b7-dc7ba663c004", "comment": "Malware payload", "value": "11905652014684f52c8eeed1ae671414f08801b7c60347cc9cbb065545240099", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532641, "uuid": "1a608cc9-2c01-439e-933e-8d63c6c93145", "comment": "Malware payload", "value": "fc0b7d53065f41f4d9b0746cf3cdb4609fb87158", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532641, "uuid": "d2657a12-6d97-4615-b0b6-9f313efa648b", "comment": "Malware payload", "value": "185d39ae77957f27c20c14e34d7a0c61ef587dfc50584b152eacb0220485a7267f01b3a046ea4e6c23c7a6896a2018cb", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532641, "uuid": "88c788f2-bcea-461d-b9f8-2e9cd89c6695", "value": "T1B3153367305B201CECF4CF1601F096A9679A1E071047ABB3EE5DFA9647FA2A134B814E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532641, "uuid": "251cf658-66d3-451e-bb68-935047382806", "value": "24576:hx8BuxO7sMmEc7Hji5mGsTtiFmJHvb7eejMqg/sSqQ:b/O7sMmJC5REiFmJPb75Aqg/sSqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691532641, "uuid": "179f869f-ad59-4e7e-9b65-da94513451c8", "value": 957086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691532641, "uuid": "036e5887-51ad-4f4b-a9f4-774225ef98eb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532641, "uuid": "0ee491d9-bd85-44ce-a6c8-6fbbe1c40942", "value": "Indk\u00f8bsordre 672363#pdf_1.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77563e96-35db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691492721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492721, "uuid": "87a9c369-7002-4470-9280-286a412ae861", "comment": "Malware payload (GuLoader)", "value": "f635f99f740b1bd4f2e5c5d968bf3c4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492721, "uuid": "74fe8f6f-0371-4688-abe8-e67a76dc9847", "comment": "Malware payload (GuLoader)", "value": "11a13f0291f2145e792f3f7d18a1c3747767e93b71292a9fdefed34d52dff3b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492721, "uuid": "677d1e1d-24ab-4b6a-9f35-a02e9af6e585", "comment": "Malware payload (GuLoader)", "value": "e9d73ba51502695bba19093b63370a431442d225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492721, "uuid": "cab72ffc-a380-408f-b7fc-b0ad8f425cd7", "comment": "Malware payload (GuLoader)", "value": "f74df7071a3d71db98742c78d2598ceeead9733d6ed89d7d04163c9a06e88408a076cbb532403efed81dcac9538f6d91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492721, "uuid": "558cf38c-e6bf-4f10-91f5-062a7f524339", "value": "T1F4C412C4BB80D5E7EC510A30DBB6CAA54779FD312C61C6C73A583B6E5D31EA2841A70B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492721, "uuid": "2ec0afb2-040b-4556-b9d6-6723c691363c", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492721, "uuid": "a15d8189-3a11-4cf3-baa3-10ad9bdd93b5", "value": "12288:xtHb13bWictv8DDM+1FwFj5u6R257MXXkuOaziOUeq:vbNrcx8DDY5u5VNazDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691492721, "uuid": "eb08080b-27c6-4c6a-a592-63f09723041c", "value": 574384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691492721, "uuid": "1fae721e-499b-4919-bf2a-5ad15c01d15f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492721, "uuid": "762426fc-f83d-4346-a7e7-e87cf24c507c", "value": "prueba de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4c7aa0-35fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691507842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691507842, "uuid": "5ad00363-337b-447a-adbc-910da31e54b2", "comment": "Malware payload", "value": "fd0e6cff8b9ee48b6808ae4df2d1fdc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LunaGrabber", "colour": "#F26F44", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691507842, "uuid": "2af4d34d-9997-4673-b543-6dd80c8dbfa3", "comment": "Malware payload", "value": "11de60380fb057aa2a428aed4a81cae4770be2b572ef3ce97fe383cd5ddf7f30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LunaGrabber", "colour": "#F26F44", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691507842, "uuid": "63b60437-fb56-4ca6-aaf5-05a1c036d7c5", "comment": "Malware payload", "value": "cfb8fa73ff44e1bf27a56842d88e8e08a849c558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LunaGrabber", "colour": "#F26F44", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691507842, "uuid": "553dd4f5-e641-4ee0-ac3d-0d31859ac705", "comment": "Malware payload", "value": "da16f1d3458ff68e961ebe37fdd89bb0951ab9a94860835cdf1483599353d2bf7546df14407101ce6e2879e2bbbd37d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LunaGrabber", "colour": "#F26F44", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691507842, "uuid": "722f58f9-472f-4840-b8ee-96ee88bbf10a", "value": "T1AC47330AB67109B2F5B52AB79489D6344230ECA30F30DE9AC36C56694FA75316D3FF90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691507842, "uuid": "d938f33c-64ee-4a03-a9cc-fbff6fb21848", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691507842, "uuid": "a4a8be19-07e5-49a3-9ec4-b43c4be64cd1", "value": "393216:Jh3nJWQDNcLOPhdW+7/pWCkR+E3cB1XedW3Wpsec5b:Jh3EQhuuhdW+7/pWguD5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691507842, "uuid": "8ba8792e-a390-4397-8c08-139d5fe2f584", "value": 25125993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691507842, "uuid": "24cbbd7a-fe03-4650-8c14-4eb0f338977e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691507842, "uuid": "55159c9b-4265-4afc-adfa-29219f6e39f3", "value": "DeltaMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc799df7-35e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691498420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498420, "uuid": "0ebf5c22-947c-419b-a024-51706eb00895", "comment": "Malware payload (AveMariaRAT)", "value": "fc0a948a07ac0a19be5e59fd0573715c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498420, "uuid": "a3c28c77-e377-47e1-9b24-70b30e8c044c", "comment": "Malware payload (AveMariaRAT)", "value": "125ee9ab2bb38466828777aef417c71510639ba1257ac22b2cec4471afe2aa5c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498420, "uuid": "e899a253-425a-4eaa-b4ba-e941b50fbe0d", "comment": "Malware payload (AveMariaRAT)", "value": "dc58d8ff493d24e3f3de26eccb09ce08dd300b70", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498420, "uuid": "b0c22286-0de9-4bbb-94e1-75fdc26db2ed", "comment": "Malware payload (AveMariaRAT)", "value": "59a00664e5e5a85dcd8d81fdf2268dd57b25985f3edc2991ba6b10ac771dff50fc11ad28b4fc95a1954cc580d7a46ae3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498420, "uuid": "be1a104b-379a-4fed-8fb1-c99e870bf0db", "value": "T109335B0C678C6633CABD287E84EA110513B9A2F73743E35B7DC5526C19A3BEE4501B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498420, "uuid": "a2df8802-d3f6-4428-9f0e-80895c73c404", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498420, "uuid": "dd12363e-85f4-4934-b5a0-8198c0fd07d4", "value": "1536:MZRuE286N/K9mlrigqKwYT9Fzdq32AJaX:yuE2zyt2A0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691498420, "uuid": "79c893c4-184a-4dd7-9baa-1799e85e5e2d", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691498420, "uuid": "f208f76c-ef4b-4294-97db-d150282a19f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498420, "uuid": "f21ff30f-53a7-41f2-98c8-fc4f8c3ecc41", "value": "125ee9ab2bb38466828777aef417c71510639ba1257ac22b2cec4471afe2aa5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df2af04-3637-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691532245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532245, "uuid": "1364323b-48da-458c-9b7b-084f1aeecd8f", "comment": "Malware payload (Mirai)", "value": "aa79bb68df77cfafef8e0daae8bd809d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532245, "uuid": "c3e9df9e-1a62-4eaf-ab98-4c9a180dc24e", "comment": "Malware payload (Mirai)", "value": "14dd8c16fbfc4a823a3db6ea237d9375b4841cce14620dd90dd33b76c2492a70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532245, "uuid": "5c171c17-c58c-49c7-8839-28d8e1d479fb", "comment": "Malware payload (Mirai)", "value": "4ee72d1d910afce1157251601d4dfbae60053abf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532245, "uuid": "8d305dd0-f2d0-4fa5-b32a-988edcb02f05", "comment": "Malware payload (Mirai)", "value": "8008abbca965fb7be43e9a8b8503ba0d14255592945b5118b8e4dd9b414c1e3eea6f8520450c14a83baeb3d338077272", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532245, "uuid": "0a8bc407-e522-4371-8837-cbc0ea6d0bc9", "value": "T1F272C05177655D11CA300439DE3889473B634AFAA2FC7463360C0779A1AB59F2277BCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532245, "uuid": "0fcbd48e-2c5b-44b3-8cf5-ea8990a5cd26", "value": "384:AaKUxpqvsWyydCJkaZddxvZUfMCSWNu8XhymdGUop5htGl:wls6UTZddaVXs3UozLGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691532245, "uuid": "f323aaa1-6574-42e8-bf66-029890ffc4a7", "value": 16868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691532245, "uuid": "cb91aa41-f7e7-469c-9729-6f3cb1a64ff7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532245, "uuid": "95c580f3-1d33-4df4-9223-00368382dff2", "value": "aa79bb68df77cfafef8e0daae8bd809d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b44990-35ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1691478492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478492, "uuid": "aa27400f-6387-4451-b516-46d80424ccd5", "comment": "Malware payload (AsyncRAT)", "value": "0ccc74c374d8c7ce89bce94b6134090d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478492, "uuid": "d6ff90bf-d26a-4327-8ad0-cb067c0b1a58", "comment": "Malware payload (AsyncRAT)", "value": "15ba40e3632a36e5e1c74c558e7bc4d986b3e973d79d5a42c5e55468dd848a2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478492, "uuid": "437e076f-eea2-491e-8d57-b7d2cdcf248d", "comment": "Malware payload (AsyncRAT)", "value": "bb82ea296eb5adb4f5b0fc7ccdf3949f08a04d24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478492, "uuid": "b93fd6ec-7636-416f-a4fd-77185ae407ab", "comment": "Malware payload (AsyncRAT)", "value": "784553893d674859b4dda4f280bfb0b79cbffac2c490135dcfd3cf7cbf51ce677a91184969bd5387bc02bdd7a1c02455", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478492, "uuid": "ada60e69-0bc6-485e-ad80-582ef5ec3862", "value": "T1CB35F031F581C7BED2721BF80D35E7106CE96C201E1485EA63887B6DDAF11B1AE2C676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478492, "uuid": "330c6574-78bf-4608-88f9-4be0619907ff", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478492, "uuid": "0ebeda00-5eb8-4305-9ce5-7d72505207f5", "value": "24576:SNA3R5drXP8jCWgBFgZhxSFJhEBNf0O/JCcW95:r5qiBFqhxSgf0O/JC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478492, "uuid": "b68448ea-c4bb-4411-99bf-e9a1a60727eb", "value": 1161802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478492, "uuid": "2eb2a485-8d91-479c-b885-7050c78f1003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478492, "uuid": "b156d52f-9483-47be-8d05-25255067ae8a", "value": "0ccc74c374d8c7ce89bce94b6134090d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dbb84ea-3609-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691512542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691512542, "uuid": "3b4abb51-a1e7-4fa5-9fb5-98b27a2ec036", "comment": "Malware payload", "value": "445b94057f86100678d7b382c8cca3cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691512542, "uuid": "c67418c3-6e00-41de-8f9d-a7014179c12a", "comment": "Malware payload", "value": "1695eccf307c90c8999bb6899768b316f344db4f88e5e90ac92b5e55fd903042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691512542, "uuid": "b4d94ef9-d9e1-4541-ba39-47ae3da79d64", "comment": "Malware payload", "value": "7d50d181fb5e47995704d4b82569406821d9687b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691512542, "uuid": "e675eff3-3997-4e89-969a-7a6745db0e15", "comment": "Malware payload", "value": "914f6fb7b9e40e4eddf01d0e815227151bdde5db18a77dc181ff1d1259fe04260a852c136c1bcde031990cf35efb27e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691512542, "uuid": "c88f6221-24bc-4933-b16e-b481b37027f9", "value": "T1CF85FA5031E45D76F2B31A31BE7A31904A697D845464820E20C3B9FDE5F3B106AF9FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691512542, "uuid": "85ddd682-a50a-4e5b-a148-e807e55c09c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691512542, "uuid": "b2e8290a-82cb-4ad7-a4d3-6392c8e2d08d", "value": "24576:zd0DINuNqnqQ4u99DLmls+6jAI3Ec1uisDdjMqbRjd:zd0DEuN6V99DLmls+PBxtfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691512542, "uuid": "13a1093f-3a60-4b27-ad8d-b55bd3080009", "value": 1829808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691512542, "uuid": "0ec7e8da-7712-42dd-b0ef-8df2246c1faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691512542, "uuid": "47506966-0075-4cb0-842a-8438c2898a34", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c291848-3606-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691511251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511251, "uuid": "0a87eb6a-e459-4586-8a89-328255b92b9a", "comment": "Malware payload", "value": "c7e966945db4c23e7dea5b57f77e83b2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511251, "uuid": "f3a3b646-52e1-4ab4-ad5a-7458cb767f4f", "comment": "Malware payload", "value": "16a0501b77109c3580dc437ea05caebb21efc80c83b02995afa9fae0d23d70c8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511251, "uuid": "7248add8-a330-422c-a006-20fa4c5136ab", "comment": "Malware payload", "value": "71dd34a9b37071b7adba1acb549ef484aafa9d44", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511251, "uuid": "0b671683-eeb1-41df-915e-c173ed3dd1cc", "comment": "Malware payload", "value": "a9c7c5837dc5dd45b0c021a6f11f63495d010ac1fc6b9fdb4d5f63b6c2df3049f166ed18d809a7ed54dee00d8d7376a4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511251, "uuid": "b5538595-492e-4538-9c5e-7c416c0c89cc", "value": "T15EE433448BA414466B733D7EA52CDCB6280820D781F9C4FE78FCACC5E1AD96621787F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511251, "uuid": "01f32bc6-6eb0-4f6d-b400-b26c3f220b1a", "value": "12288:bgz5GbLiP8CF6RSxzG5dasr/XHrzfWWfF1el5PETvq+Y5wCpk83kBl1Lpr1K:bgz5GboUUxGXJ/XLzfwREzK5wuG1Vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691511251, "uuid": "b506a95b-bb9d-4932-a246-a60f7f8844cf", "value": 667261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691511251, "uuid": "27f1b871-53e4-4d8e-9a1d-7280f7e52a75", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511251, "uuid": "b2a8df57-ed2f-4c87-bc2a-ff3384526994", "value": "22001625_REV001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12bcfac7-3611-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691515745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515745, "uuid": "8ea39368-567c-4cec-b9bb-5d7b1d1d3497", "comment": "Malware payload (Mirai)", "value": "7cd44efc9e27f07052fca1fba9c865c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515745, "uuid": "f8d43375-a50e-43b3-9d25-668e44ba90a9", "comment": "Malware payload (Mirai)", "value": "1766db42de528f783003e54c134c1748616d8fd8b1e134219c1ff2930ef9a9a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515745, "uuid": "dcb60703-c75b-4de4-be2d-ed3476a067a5", "comment": "Malware payload (Mirai)", "value": "12c5c77302ffb3324e972ed3984163c30630048d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515745, "uuid": "e0b8fc34-f505-4b97-a385-dfc656527ca6", "comment": "Malware payload (Mirai)", "value": "4cb8aecddb88bc12763852be0bcbf0ece5b61eefea42fc7fcce40741880fadd870e0087981887211441dce887c870540", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515745, "uuid": "0f26e3bf-5e43-4666-ad8d-f65c10fc66be", "value": "T1DF63025EF3316EE2F4270F78D6808085772CBA24727A6153E5045AE4A5EB70AF57C0F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515745, "uuid": "a1b4f665-b22f-4800-9ecb-725136d1fd98", "value": "1536:tai1gld5IuHgqDDVpPkgxseSxDrZPt/hT3cUW/QV:tcl/IubXTkgxseSdBtVMUW/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691515745, "uuid": "b55e855a-6729-4a6f-ba9d-9c62f18e587d", "value": 69316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691515745, "uuid": "614f6b52-57fa-4c9b-952a-af0b01ae722c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515745, "uuid": "ea8d8315-b761-4b1b-b862-6506659805f2", "value": "SecuriteInfo.com.Linux.Siggen.9999.384.6080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff2fe4d-35f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691503499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503499, "uuid": "59ad18ed-4a95-427f-bf04-a7d48a12175c", "comment": "Malware payload (Mirai)", "value": "864637f2bf5d4eca079deb6f481f4e71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503499, "uuid": "a8439be7-6c13-4974-b08a-38c2d9d453dc", "comment": "Malware payload (Mirai)", "value": "1774001916d4e3ca7be6d86fa029edb8f9a4d531bf140e265fab00038a2efd12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503499, "uuid": "056fa5a8-b54e-494e-aa1f-979ea8e58020", "comment": "Malware payload (Mirai)", "value": "67ae3c4b15b333a3307b1e10de627d28eb1cd5be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503499, "uuid": "343d2499-4a0b-4975-851f-5aa4b7d61360", "comment": "Malware payload (Mirai)", "value": "584a46cbf939c8eb8b8af37b9cd261fdc0a88ad77e73495df45af261325c65482abfa5e77e15b11929308799237e8c59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503499, "uuid": "ea4a195b-2458-43a3-a538-09e28782aaf3", "value": "T1C9330ADAB8029D3CF90FE6BE54164E0DBA2177C15283072757BBFD936C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503499, "uuid": "ab2d0e68-6abc-464d-98ee-11bdc9b0669f", "value": "768:RNePx133o4aRcqOCPp8oZVe+T6806MMrkzY/anXO9XuNmIGy:Sfhqx8yVeq6806MtY/anX4Xuiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691503499, "uuid": "313f2958-2cd2-4ab4-bca7-1340b9c828c1", "value": 54916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691503499, "uuid": "5886cb15-97b1-481a-8231-5788a33bfd9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503499, "uuid": "02354059-8b45-4698-b660-5f3ed3c2f55b", "value": "864637f2bf5d4eca079deb6f481f4e71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf9945e-35e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691498204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498204, "uuid": "97639956-8aa4-462f-88bd-b1f96c5a4250", "comment": "Malware payload (Mirai)", "value": "ff872b2e2d706adfa765adfe6d1e86bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498204, "uuid": "d45b3454-b701-44cb-ae5d-264397fbccb6", "comment": "Malware payload (Mirai)", "value": "17a7bcfba53890b7c0169600ea575f683eab67309ddef381f10f6f1d2a59274a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498204, "uuid": "67d88308-db80-4182-bb00-63dc9ac8f4cb", "comment": "Malware payload (Mirai)", "value": "1fa6f4d13a1c5ecb1f01c6689713205f15aaa164", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498204, "uuid": "31d3e037-8c11-42ea-bb46-1f89535fb092", "comment": "Malware payload (Mirai)", "value": "780455b2ceb30b0323dd4fd2c23b0c81ec260e7e09e7588099d04efe9c8cd374aba7cb4f4da16a9c5818c8b261530524", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498204, "uuid": "af5e40b6-25dc-4b49-a07e-ca360a5585f8", "value": "T152B2C0CC61943084CA8D7C7C278D4B664F6CA0D0BAED9B26E354CD98B7BEA4F3459078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498204, "uuid": "029b7b0c-8395-41ed-a390-f2e0fc028929", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpHgZqEWvA:/QlS07FUXqIYSXQKquH4qW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691498204, "uuid": "0b64ed68-c7d8-4fd9-a6ad-b60f01ce73ed", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691498204, "uuid": "b39d7ac7-e959-4998-b94e-eaa2c51aee59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498204, "uuid": "975abd89-e2d5-43f5-9cb6-e07fcee4a356", "value": "ff872b2e2d706adfa765adfe6d1e86bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9f2b0b-35b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691475414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475414, "uuid": "a12c3d7e-e276-4275-80ff-726160a94a58", "comment": "Malware payload (RedLineStealer)", "value": "bf80e4d37150bb48f0bd02be7d81d7d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475414, "uuid": "4a2f0da4-748e-4d87-befb-7e27f2155d9e", "comment": "Malware payload (RedLineStealer)", "value": "1800844e3125ea1918374fc679bb88c91bd99e75e78b23cf9d96bad4a11d6f10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475414, "uuid": "63690047-5dde-4b4b-aec8-f125307f3add", "comment": "Malware payload (RedLineStealer)", "value": "2682fd88624ac30cd6ef25635ae9736b15a97065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475414, "uuid": "c77304ae-7186-4a7a-a199-b5d981cc6419", "comment": "Malware payload (RedLineStealer)", "value": "1b68159f6fbccb2ee00ec2208148c90cf4335c7298b9db068ca4a4a3fe24e45f37a6c8eaaf0d70c40dad61a0d8ff9246", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475414, "uuid": "33246a29-f15b-4837-b139-7562dd46a916", "value": "T105C52C1176F94B59F9F30FB85ABAA612087AFC69DF11C2DF1251908E0D21BD09970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475414, "uuid": "803f5dc7-5ba0-4251-9827-bc7fe5fd2b6b", "value": "fbc83a4c956c82e188c68f7517f43b05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475414, "uuid": "bd496f44-feb3-49ee-afc9-6fb12e70de7d", "value": "24576:0Kjabjcj/BZ59lpCKBlltrSiT6a9Dhvh65jQlD:0pcj/BZ57I2lj6a3vWjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691475414, "uuid": "fea1a1ee-75a0-4ba4-8452-a88d18ce5924", "value": 2578944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691475414, "uuid": "1d14edb9-ba44-4854-a369-169b22812929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475414, "uuid": "e6c84fff-b091-448a-8490-47a320afd74e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23aa0714-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691478836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478836, "uuid": "d78596f3-05d7-4f9f-8be0-f5ec110d106c", "comment": "Malware payload (Formbook)", "value": "24124fbe156a5ff3e571f5fc1d79c385", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478836, "uuid": "39f71872-fb39-4c6e-8690-f290a637cdef", "comment": "Malware payload (Formbook)", "value": "185bc84b981c40e78829c220a28b4e7c431c2eefbac90d335b4a354986fa94de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478836, "uuid": "d7f41edd-7b01-4cf7-ac93-982671ba50ca", "comment": "Malware payload (Formbook)", "value": "9f3e69b3d0c31f0a2460f635c892c7c237bedcb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478836, "uuid": "2f69d17a-4fcf-4747-82fd-5631a33ade8c", "comment": "Malware payload (Formbook)", "value": "58e690342cbbb83edf68aa5ced4459588eee13a71377e48ef5358e712d1a549f6867b94c4b7247af03534fc293baa136", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478836, "uuid": "e49ea0d1-58b6-4041-858f-88faf34b5d5a", "value": "T1F80479F0317D83D3E1A18EB11FCA86B079F136ACA8D0560DA0F59B2E93D2355149D9EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478836, "uuid": "93028b0f-e919-4966-a4a3-404eadb5ed80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478836, "uuid": "0568e79f-ddac-4554-947a-071784f1a8c4", "value": "1536:3xIe9AY1c9wqvnAv77vvvvv7vvvvvvv7vvvvv64+mhhhm+DtqOgN:BB3+9wqY+mhhhmitqOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478836, "uuid": "eb4aa16f-1fb7-4d0e-ae90-e48d43e1a512", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478836, "uuid": "f4f3e003-5653-456e-87eb-08aa46642524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478836, "uuid": "cebe844d-4077-4a53-9f3d-008a29bf7ff1", "value": "24124fbe156a5ff3e571f5fc1d79c385.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7363e8e0-35ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691487131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691487131, "uuid": "6c044a85-1013-4848-93f4-5ce4337e4052", "comment": "Malware payload", "value": "ffbb262dccc775d15086ac4faf75b61b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691487131, "uuid": "4de78841-1d41-41fd-9678-14fa4579e1fc", "comment": "Malware payload", "value": "18671c68c7747e50802fa0d1294fcaab50646991fa926adb66f7ba58d7568c8d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691487131, "uuid": "25970345-3015-421a-81dd-beb90496051d", "comment": "Malware payload", "value": "9cbfaaed1f5ba269c2daa74671229cdaaecf8799", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691487131, "uuid": "10451950-a15e-4924-936f-5f4dd6f1992f", "comment": "Malware payload", "value": "a3102ee9d51ddb73668bae3da55586370a4793fb7af69d058dd350511798c7a2980021eaabcdbe808a55d8173e2da38f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691487131, "uuid": "2b55728c-b13f-4357-9df3-fe79396a7529", "value": "T17BF5F11275C2C532D17E02702A28EB7A457EBE200BB199DB63DC5F2E1E725C25632F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691487131, "uuid": "7208c56d-df65-4bd3-8de0-60c3c9cada2e", "value": "49152:YavYX5T68otYLN4bFvr/7RaKAbXGQt56YK1JeXl2aCDjKTEbpTglnOb0kSURn5dE:JYCtLAme4jKwbGOIzUy7Y3EKJZHk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691487131, "uuid": "87755557-c630-4940-bf22-e1f1d3e05e45", "value": 3438592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691487131, "uuid": "ad863a25-0aa9-47fe-adcf-f422e42ecda9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691487131, "uuid": "51e37ef9-e66f-4b58-b721-957e1c1e6c79", "value": "WCSetupv1.21.1025.30736_Upgrade.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d69946-35b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691477250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477250, "uuid": "91fd5f08-c11f-4a10-8d67-4f10c4459831", "comment": "Malware payload (Loki)", "value": "ca78af9700ece2e9b2b80709a55964fb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477250, "uuid": "290a7663-0dd6-4084-8ceb-7ca5dcca8fdb", "comment": "Malware payload (Loki)", "value": "18db78aaa111993056c55d451560bf5e7d36bf91b0acb34faa1010fe6829bd8b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477250, "uuid": "a4ebc24c-7267-45b7-9780-38b8c8fe26f0", "comment": "Malware payload (Loki)", "value": "5f11ca135a6524553bdf7880489585cad13e170e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477250, "uuid": "4524f0fa-9030-4718-804e-7dcfb95055d2", "comment": "Malware payload (Loki)", "value": "0ecd25a3efd11797c6512d7d6c327ca4a01d1e2c14eb32f542a8bfe476397f9b6114df896861b4fb2cd82aa3dee29d5e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477250, "uuid": "2ac72052-cb4f-4788-b24f-3fa77878260c", "value": "T1BA35E003E804DBC3D41D83F87E530ED91F0AAF19E99569DB04627F9B3A70A72099E52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477250, "uuid": "be64592f-cf41-494b-a000-3e652bc9dd27", "value": "24576:9RZyQw6VfZy2w6V4jKaWlEzp7aa9dlzZbtQA3Qp5EfIwMx:9bQ6VR26V4jKjOzJdHt/3XfIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477250, "uuid": "ae077294-a8ba-4779-a1b4-0d32deb5ed5d", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477250, "uuid": "51f51e3a-1564-404d-a820-f97949f9d942", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477250, "uuid": "b6ddbbf7-8138-451a-afe2-a414085ce25d", "value": "RFQ.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29516eda-35bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691480564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480564, "uuid": "d9a1c7dd-b388-4140-9e4c-20e90fb14249", "comment": "Malware payload (Formbook)", "value": "8964e3e3686d40251bb299d4b6212c0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480564, "uuid": "d77f9064-6a84-4759-97d6-22120f66fd17", "comment": "Malware payload (Formbook)", "value": "19f3d92b528afa72bfa9cd1f4b89b0cfc63b5cf0fef8d292ec957d853fe3b143", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480564, "uuid": "fa692be4-09b3-4aca-acc3-1b884a0945c9", "comment": "Malware payload (Formbook)", "value": "d41bf5e9d5c58946d865bce3bcee32cff3fedbb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480564, "uuid": "68b00f7b-825f-470f-bb33-1f02225c8118", "comment": "Malware payload (Formbook)", "value": "cd4513439e9f2d09693c63ea501c9c43657e0abfe076fa500f343916c732713f95dde85bae776f2ee18c4e8a863c19ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480564, "uuid": "38d4a123-a195-4925-9b92-5e441ec7edc5", "value": "T196D412255AFC6FA2E1F623FD25B881A40BF3F14254AAD6080EF874DE5973B224901F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480564, "uuid": "dcc6cc94-3fc6-4032-ad3a-ee7d5f1ae358", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480564, "uuid": "b6293584-909d-4c0f-b167-05bc5b2b0055", "value": "12288:6niF94hQVVsbJrOy8ZsszlyGjT3uQD7WQgZWfHifDW:6niP4bJWZvlyGjT3uQWnWyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691480564, "uuid": "52737004-353e-4e08-aa47-100fa8e4bf3c", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691480564, "uuid": "35671973-fa72-4e37-86a6-5c3e710640a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480564, "uuid": "972f7ba7-c20c-4329-92c6-7f36233ec339", "value": "8964e3e3686d40251bb299d4b6212c0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a8bc60-35c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691484230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484230, "uuid": "169fb1ad-908f-4465-8205-be85191f57b1", "comment": "Malware payload", "value": "1b524d03b27b94906c1a87b207e08179", "object_relation": "md5", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484230, "uuid": "690aa8fb-f77d-4574-b747-0e09db8305a8", "comment": "Malware payload", "value": "1af981d9c5128b3657cdb5506d61563e0d1908b957e5dd6842059d6d3cfdc622", "object_relation": "sha256", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484230, "uuid": "b21d800f-33a7-446a-b93d-6af3f21cc037", "comment": "Malware payload", "value": "8fbad6275708a69b764992b05126e053134fb9e9", "object_relation": "sha1", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484230, "uuid": "725e8c0d-9eee-4bf1-b2b3-6f6d383997b8", "comment": "Malware payload", "value": "0c12b5c1ec9801e2311fef17c7ba88910b0ee553e4d2ac8a086620efceddc22733d4f5ba4d00e55db429d3b83dc3c554", "object_relation": "sha3-384", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484230, "uuid": "56c66eb9-a914-41be-8f85-6e7efc36f2d8", "value": "T1E2F4AFC0A77BF142729AC23A21A9DC4B347C50B4B1D1ED69B3DCB05AD606473BA7D86C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484230, "uuid": "fa82254f-a3bb-4aa5-8809-2e3077b23b91", "value": "12288:pbyAIRMKMJZCL+TWHZMxdHQgCUCAH2zxMSTaiTDBCphXUgn+DRVnNsPlU0R/NexP:RgLQQgogvXUnsPlU0ZNMIpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691484230, "uuid": "381b4109-de6b-435d-8f40-52e96671331e", "value": 775656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691484230, "uuid": "30c6e97a-4613-470e-9f48-c395ee22812e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484230, "uuid": "d0305aa5-4012-46a3-9575-cfa15cd66471", "value": "UGtZgHHT.au3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aacf1a2a-359e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691466608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691466608, "uuid": "10d4a304-2209-4cea-a6b0-8104a1ad2157", "comment": "Malware payload (Mirai)", "value": "4f17a42bbde0db12b2bfbbea412048e3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691466608, "uuid": "44a34526-087d-4591-adda-05419272aa80", "comment": "Malware payload (Mirai)", "value": "1af9c13421721d0931e60abef20386d11e0aa3a391c822a84179b2b485790d41", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691466608, "uuid": "0197ac88-c497-4967-a6b3-28777cf7a88b", "comment": "Malware payload (Mirai)", "value": "0b43ed5f3d751bcbc05eb051e6dd37f4dc5b8ac1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691466608, "uuid": "81c335b4-9182-4701-bf4a-04a794f837d9", "comment": "Malware payload (Mirai)", "value": "f41baae12f925b34a835793756667d4f2149e363c49ef9d5ee0bbab22c2fda6bad566eac8ebb2f7900ffa056b5250e75", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691466608, "uuid": "ce265758-549e-4618-8d40-ea2c85745758", "value": "T17AC2D030A6AE1CB5C7100572E6B85BC9BE434F7DEAFE3890124147BA3841D553AEE9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691466608, "uuid": "b3e22f6f-4e13-40d4-9853-770f7de08b69", "value": "384:Aot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEPuGazEzUhymdGUopO:A8soTAZ3alkXLvFh8nNEYIzUs3UozM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691466608, "uuid": "28bff6a1-a6f4-4dc8-80bb-507dd86dec7f", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691466608, "uuid": "7473ad24-0e37-4ff4-8fee-78ff2e86ef7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691466608, "uuid": "42769b73-492f-4ce0-81de-b262e4f1a9f8", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d0978e-3638-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691532628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532628, "uuid": "3d83c616-514e-41d9-b95b-7f76968b3902", "comment": "Malware payload (Mirai)", "value": "e587b36650fd5bc700054f2c4f591566", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532628, "uuid": "9e63b10c-a7bd-4148-aa71-ef334062c79d", "comment": "Malware payload (Mirai)", "value": "1d689810e02f54638bf31f497fd97c4527f79767c7b2bc37f0774d9a6c727c92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532628, "uuid": "07e18b89-b6e8-4c2c-b106-d70abfe9e9d4", "comment": "Malware payload (Mirai)", "value": "d9ace7bed5d343616580b5ac9c00e854b10ef0cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532628, "uuid": "971ad152-a988-4910-8e2a-069e1ce28880", "comment": "Malware payload (Mirai)", "value": "55ea8cd77eab8d8f09ce5a7ce9909fca0fd7140cdc3627b89655ca8da7238b96cb76fc04a2c930d25da59a39a2095c23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532628, "uuid": "591464e9-3850-411c-869d-7e4e2dfdbc3e", "value": "T15E434B22B6751E06C0E4E87922F74F5872E1565F1AB4D60F7DB30E4BFE21580A6236F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532628, "uuid": "743d945e-9500-4e57-99e1-884e1ac71bae", "value": "768:sSovisSuj9R8FPZN9Y3yW/3Ledqd5TKjE+ZrO+LcZPvfQw+mm7:sSyistxqZZH2yW/3aqd9svuX5+mm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691532628, "uuid": "67c2b7e0-4264-4839-b923-cd030b8d9781", "value": 55376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691532628, "uuid": "21db96c6-a314-4d81-a91c-f71bf0bc35bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532628, "uuid": "54eaba72-4334-4e3c-93a2-d2eeaaa5bad3", "value": "e587b36650fd5bc700054f2c4f591566", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b9df12-35e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Nivdort)", "timestamp": 1691495404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495404, "uuid": "a8df3f66-4277-4764-bcc9-8bf8ccdaff74", "comment": "Malware payload (Nivdort)", "value": "82e07d2da1b1e13930210525527e3cc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nivdort", "colour": "#21A77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495404, "uuid": "729428d8-5c69-4a77-8530-db3b9298cea3", "comment": "Malware payload (Nivdort)", "value": "1db29a8cb3d862ba12080935e1edde7851839497f511af89ef36643b2052c23f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nivdort", "colour": "#21A77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495404, "uuid": "5a88878c-f914-4c27-8000-c7a48997a2cd", "comment": "Malware payload (Nivdort)", "value": "0b2b8abc2a822899f50b5ff4202d8b8631e7c0bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nivdort", "colour": "#21A77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495404, "uuid": "5e7b5981-9a53-46ec-8dd2-257e8a83f7f6", "comment": "Malware payload (Nivdort)", "value": "f6df40e2aac66d2e7ac45637ffa81812a1dd1be308ad01f6e3a29a64df351f8c2f842bc5200814c7fd97efa563da1579", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nivdort", "colour": "#21A77E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495404, "uuid": "0b71c97d-9694-4286-aabd-ad93d2104f79", "value": "T1F7846C25B490D035D0B161BA5E68EB6341BCBAE027355EE77FD80D8D0AA80C2B6F7357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495404, "uuid": "265f5b32-8499-4146-939b-45bea904a905", "value": "5b28ff30d307b0083a2cf883d68d7638", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495404, "uuid": "b959e127-ea09-4fb1-a012-dc7e7972ccb2", "value": "6144:jytHQ40ems2fjUoSnyc+Jz+Fe3jBywmDW76Ukq4Xw3RTV4RALwnhl2+hu:k1qgyB+Fe31qDu6VwBTV4RAwlJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691495404, "uuid": "cd46b0fe-2df5-4b18-9035-524252101272", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691495404, "uuid": "759c31fb-cc07-4f85-adcd-4bedd1dc40ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495404, "uuid": "6788f316-72cb-4d8e-be11-2248156aabf2", "value": "1db29a8cb3d862ba12080935e1edde7851839497f511af89ef36643b2052c23f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d308a27-35ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691500354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500354, "uuid": "95983e80-c92d-496a-8296-7a8d0ebe3d91", "comment": "Malware payload (AgentTesla)", "value": "158748c68c6020ea891efa8286390152", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500354, "uuid": "39bc30eb-97de-4f13-8fc5-89e4a40999af", "comment": "Malware payload (AgentTesla)", "value": "1e1ff24f4fb7e44eb28295debcc6a6ea5015361253d18a90daeecbb1bd2afa34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500354, "uuid": "1403344e-6f01-4387-924f-4c5dc29f33da", "comment": "Malware payload (AgentTesla)", "value": "07a4eedeccca3144728289594780ce483a6349a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500354, "uuid": "67ed6ed7-18dc-4271-85d7-4cffba14c2aa", "comment": "Malware payload (AgentTesla)", "value": "0f08924e6b96990406eec905393b8de1703e14be07ffed48b92a4f955aacdde47bf15023055719bd21a438ca99aac6d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500354, "uuid": "37ba2b3c-d818-4426-a1c5-7f70a9d241f4", "value": "T14C353A21E77B655AEF29A6E89E1F847139D5DCC0F1B1C888ABE72C0385C23514D35BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500354, "uuid": "c51c9d3c-cc69-4063-b18c-49e3ff459a33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500354, "uuid": "71d9e4e1-be89-417c-b8df-0fb661389ff6", "value": "24576:11I1R1I1nRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOLOgu0V5dGclWzD:1GvGRRs6CE3jLbO9Rs6CE3jLbORu0Pdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500354, "uuid": "b06754cc-7580-4aba-a501-071b5fed28f6", "value": 1072640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500354, "uuid": "16992bcd-932d-443a-9f63-e278b37887e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500354, "uuid": "8604f728-748c-4db5-8c9a-9640d372e142", "value": "708415278200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d1886e-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1691477573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477573, "uuid": "fc1310cd-2ae6-4927-8d57-52cc6595b87a", "comment": "Malware payload (STRRAT)", "value": "20ba74eac574b010ceb747bd2f24a28b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477573, "uuid": "c3aa66a7-70e4-4e0f-960e-957e8ff5ea48", "comment": "Malware payload (STRRAT)", "value": "1edf3cf01507803fec265ca8bae31841e556dd3ac0005f36ded69ffd8c3b0569", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477573, "uuid": "c95b7877-a81e-4e49-9f3b-8442616066b3", "comment": "Malware payload (STRRAT)", "value": "b63c59d0fb6d2c026468fa590b1d86edb03d9b30", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477573, "uuid": "b26797c1-f152-4fc7-bd3b-44b644822f25", "comment": "Malware payload (STRRAT)", "value": "8937b24379aad053c6dcfc641254676eec6d36252a80b8be5f9009beda36e95bea765eb53b7a37f845e7101bb86e85a9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477573, "uuid": "570b70c8-a9a4-4e59-bc01-8fb2067cab44", "value": "T1FFA4223E3CEB407AD407D032824896B2176FABB8A496115B75DC6D5D4F38CAD87A48CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477573, "uuid": "9be2b5bd-1b5d-40bd-a519-1fd60e9d8298", "value": "12288:WFmmDQPWrdhoV994aYHErcmzZZPSv9+o3GAoc:CcAdhK994QrlzZJSsOGAoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477573, "uuid": "b113420e-9de3-4601-ac7f-2be247ba06d3", "value": 456348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477573, "uuid": "bdb06468-29e9-4287-b3de-3b5e8d0b8c30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477573, "uuid": "8eb871d6-5a4b-4d66-b799-aa5a3f2babfe", "value": "Standard Purchase Order 20423623.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93893f19-35db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691492768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492768, "uuid": "a3ce55dd-392c-4540-9bf6-c67f3a6e4e8c", "comment": "Malware payload (Mirai)", "value": "903304616b38ecfce59d946e97e6e59f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492768, "uuid": "579b00c7-c55a-4beb-aa0d-67895fb67cd7", "comment": "Malware payload (Mirai)", "value": "1fb429325302885042b6dd51bf475c2507c3df463c5bf415dd9de0b29677af09", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492768, "uuid": "df20a2b4-8d2f-41b8-8c5b-44b12c8c0cd5", "comment": "Malware payload (Mirai)", "value": "d2c6b3059cfb33d736c514a3328d693fb625a827", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492768, "uuid": "2749d8f4-8042-4013-ac29-cf15c8eabf71", "comment": "Malware payload (Mirai)", "value": "e615d7eb2af26e17b9c9420a5a437d82c8f5cf5a7bdfbabe34a9239b25d4007009ac02abb962f157f215614257e25df9", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492768, "uuid": "05015f7d-eb48-476b-8fe4-093cb717a8bb", "value": "T1D4D2E1EBF287D0F0D5F5C4B8515C10C0F478769A5A1087BF049BA2BE4C6368E623AF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492768, "uuid": "a066d29a-c3dc-4ec0-b63c-7bb8a999a69b", "value": "768:kYSoXdJZtUjkFfNJlVrQeHvPx2csGHEQ+CSx0st:kYJdJZGjkFV35/McrItt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691492768, "uuid": "841c6ecb-3d1f-47ec-b35f-1b4b45120fe7", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691492768, "uuid": "9e2c6964-e31c-4737-9e70-6c6f74ac6a84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492768, "uuid": "13aa44c6-0cdf-4196-b40b-690f8130e411", "value": "903304616b38ecfce59d946e97e6e59f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e63bea9-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691477566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477566, "uuid": "d9f626f4-e4ef-4bdb-9e86-d63116a01005", "comment": "Malware payload", "value": "a82f3e587663e78bb7576cb6be6ad184", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477566, "uuid": "9bba2edb-28a2-472b-9fcf-2e320719f8c4", "comment": "Malware payload", "value": "20e7c3d66e4c5e0491ec13387d678f534fc014b26e45e9eefffa1b4730eab88f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477566, "uuid": "9f9b73e5-56cb-4b79-90d8-a66430a36d58", "comment": "Malware payload", "value": "a533bb3078bf9f1866d4151da14420a5956a1ab9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477566, "uuid": "84ac3e7a-e8da-4924-abd2-f01e6e5708f6", "comment": "Malware payload", "value": "c61abc3edf62fb39ae8d465c2dc8fe354709e94f755517ee03f3d5dd905c4f5b3c41fa00ae67c280b6de685871d13bba", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477566, "uuid": "91c95c78-b254-46bd-a35e-76f6d8b2f910", "value": "T15BE433F2A28AD626D030F32734A90F59E25639CB6E31747979749E0A7ED4A3BC737104", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477566, "uuid": "0b933f46-aa2f-4b21-8b5b-f803961b8af5", "value": "12288:fDRDRMoDeh0ej6BjwRZ3Fk6486u/sCkqEDgTJsKEmWLtUB2XOzxF2e+dOZn8y+pT:fNDRrDehJj6BjwRZ3FjlrPEDgTJsKEmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477566, "uuid": "55495683-2183-43b3-8ac5-f9cc35318b9e", "value": 682696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477566, "uuid": "bb59ba39-9318-4166-b68e-3f4a2b1059d1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477566, "uuid": "51353181-9dde-44d5-a4de-ce0b0e139a34", "value": "Documentos.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ee1948-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691477661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477661, "uuid": "791639ca-5215-4342-90b0-a3ec29749072", "comment": "Malware payload (GuLoader)", "value": "37668f97283702b0d161d37496787c30", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477661, "uuid": "006e3288-5a6d-44b5-bb70-4739c5d7a195", "comment": "Malware payload (GuLoader)", "value": "21bf2150085f6d6c82ae6e82b8d3d9f22ef84626dd546606fbe3c36b97554279", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477661, "uuid": "6b6b9c65-ca72-4ac5-8f32-ad3de5c49bf9", "comment": "Malware payload (GuLoader)", "value": "f6b7b66895d29ab93be799196d624e6b8a8a9520", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477661, "uuid": "3e1fcbe2-6f21-4d28-b9df-64c5ff1040ba", "comment": "Malware payload (GuLoader)", "value": "da600739ecd0904301880a159d046a4cb7456aaee5d9887dc9d9eea60a45981ceb8670ffe9c9f3995a42f5c8e72ac19a", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477661, "uuid": "8f8463dc-f542-4835-bf0d-98f976118eee", "value": "T19472B2848FCE3A3B06D717AA884934B4D5B18DFF4E1110FDE98CF5684915348AE7F1AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477661, "uuid": "c13b9fac-e6f1-45d7-aa6a-baeddfb57c26", "value": "384:eMerYmM3Sf5NoFkhRnKBCGGEsO4FiCWa3DQ:evrwi7dSfUiCWaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477661, "uuid": "3193f1b6-006d-40cf-9a85-2568e55e34b3", "value": 16282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477661, "uuid": "ee57b664-2201-4291-92e1-b9510a137b09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477661, "uuid": "da6fa5ba-4f21-42ff-bade-5d163f54f757", "value": "CR-FEDEX_TNT-SHIPMENT 930388383 NOTICE 84937739038.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e0a35b-35f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Glupteba)", "timestamp": 1691504977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691504977, "uuid": "4df93883-e1f6-4807-ae0e-43e15c955813", "comment": "Malware payload (Glupteba)", "value": "50a8d38c627fa7ad611ca987f40e865e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691504977, "uuid": "eedefcc3-14cb-415e-99cc-c61600983ca3", "comment": "Malware payload (Glupteba)", "value": "222301a390730394fdfba560a8a0070c3571aaf9541d4c96cb5ee931b26ede59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691504977, "uuid": "b9344c2b-a178-4557-9bea-cb2a75c62261", "comment": "Malware payload (Glupteba)", "value": "456d011d8d0fc5dce59b3d53d73d559af74cad1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691504977, "uuid": "01bbee7c-82dd-4e3a-8835-a3c7be288e7c", "comment": "Malware payload (Glupteba)", "value": "704efdf588a96f9097e1a4d49a5b7f56c457a609e9351e50d70f85a39f490880012e5f7a9ee4105bb7c2406554615a11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691504977, "uuid": "8c17ae69-eb1a-4e59-89aa-fd358c645791", "value": "T1EC36CC4463CE4026E8386FE17FF173EACD12BDB19EB2C75E2998139049A02DDEA74157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691504977, "uuid": "8931b8ef-87a2-4d35-856e-acf1b7efe5c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691504977, "uuid": "da287402-ded6-4426-a740-288ae6b0b705", "value": "98304:aTedAcQ2Ro3GJtYhkf6zMBiJtpOYs0FA088A1kMz:GeCl2RKatUtz91VFAD3kQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691504977, "uuid": "527caf4a-1130-4c2c-a522-b45e95fe9df8", "value": 5006336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691504977, "uuid": "4449cb9f-1fe0-4c75-95ad-b682d2985edb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691504977, "uuid": "ae39a439-2ba5-41aa-b2a3-864668484c9f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614aaaef-35c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691484094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484094, "uuid": "5d5c75d1-e5d0-438a-85a4-9b60451d0532", "comment": "Malware payload", "value": "105a21f1ce871db78300b424fd0eec5e", "object_relation": "md5", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484094, "uuid": "5d91c1d7-c06f-4a28-805c-c108d596269a", "comment": "Malware payload", "value": "2264c2f2c2d5a0d6d62c33cadb848305a8fff81cdd79c4d7560021cfb304a121", "object_relation": "sha256", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484094, "uuid": "d726b9e0-dd22-4f62-b9e3-b758cfdf3ea0", "comment": "Malware payload", "value": "dd0c2abf9636e0d3e6e0c00e2ef2d116b472b472", "object_relation": "sha1", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484094, "uuid": "665b2f7f-de46-4eb7-af7e-6567e7be9efc", "comment": "Malware payload", "value": "1497a22e2233b47258d68e50cb69c5514a8c8860ab6bf736954af88e397eb59a3ad81ed29a9f05107221a5d317503d52", "object_relation": "sha3-384", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484094, "uuid": "b45e54a8-4636-479e-8251-1a3e97dd8124", "value": "T18085C0254EF0919A2CFBEAA457BC99C0C024E0B2D615B73ED4035DB4EDC5EE3BC9A650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484094, "uuid": "05838699-f4a6-42ef-bd1c-e45f5d80a7f0", "value": "49152:VEFN7eArStqHIh3KeSG0nvd1RYQ/ewFVGkTd/:i7ZHE6eja1FewFVGu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691484094, "uuid": "386d412f-5665-4bbf-9cc7-bc556ac53b9d", "value": 1831055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691484094, "uuid": "798f0aac-df32-479b-bd28-05759ce3f2d6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484094, "uuid": "c001cf44-3e23-4d38-a8e4-2d9a0610412f", "value": "2264c2f2c2d5a0d6d62c33cadb848305a8fff81cdd79c4d7560021cfb304a121.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717fbdd8-35e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691495717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495717, "uuid": "96d35022-c2c1-4263-846b-6289a30b8db1", "comment": "Malware payload (Amadey)", "value": "7b2c6d9c85f5073ed966b38a6bf94647", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495717, "uuid": "158aadfd-ca6e-4509-afc6-491fd9fe0c7f", "comment": "Malware payload (Amadey)", "value": "24ce5948c6e53bcafe0e5cab617af84b534642b72f8f2f75ff4dabfd893b446a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495717, "uuid": "7e5ff4e2-7131-47d6-a95a-a4e12e7f5e60", "comment": "Malware payload (Amadey)", "value": "383f75d91c889bdd10d6d5e314d005ee0d0d3760", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495717, "uuid": "6ea68d1e-b33f-4bd8-9183-089e13ecf709", "comment": "Malware payload (Amadey)", "value": "4a503c7ac7cc3428523835e340814feb5141ff4eec357523581177b2a81b29c26d998cff11c423081a8dc5e8c2d1b435", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495717, "uuid": "7e2d419c-d5a4-4ba3-84c7-c97ca076e05f", "value": "T10F546D12E6DC6B32E5D28A328E2EF6E4661EFC918F1937DB125C7A2F09711E1C175702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495717, "uuid": "27b93720-6bc7-4002-804a-d76416f4cd44", "value": "81d6121cffaa48653088a63c1ee15a1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495717, "uuid": "63ccb9dd-9681-4699-b7df-42407905ee6f", "value": "3072:n8Z0b/fZNw3nqf/CBt0HzzSqonjRntCwUG9LmSSjuOc:8OXZ0q6yannjRtCALhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691495717, "uuid": "4659b192-b536-4bae-8180-82b5b21ef584", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691495717, "uuid": "d9aa564d-6d71-479a-8bf8-10095aa824b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495717, "uuid": "ecd8a47c-6038-4d24-9bd8-7175b52faae6", "value": "7b2c6d9c85f5073ed966b38a6bf94647.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df664c3-35b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691478021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478021, "uuid": "05efb774-4d01-41e9-a1f9-a9d9228eaaf4", "comment": "Malware payload (GuLoader)", "value": "78a9fbf0b6e82c535aef4c848406d77d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478021, "uuid": "9a6595d1-7ad1-4805-af32-aea68c840568", "comment": "Malware payload (GuLoader)", "value": "24f8a7c390962f0a9094dba45d9000ec7024e87adc7992740311775fcf0bd51d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478021, "uuid": "3fc3ff35-d177-4753-9a94-4366346ed558", "comment": "Malware payload (GuLoader)", "value": "b8a419f43674bcfcee6ed5d680ccc02fe1dc6f54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478021, "uuid": "4f17bba8-d034-4f14-9ec0-090fc19be57c", "comment": "Malware payload (GuLoader)", "value": "facdb76edcbddfcde5a567a14a6af01a8bc92da6b968a0f47468b8442adcb1735f8dd6046ee8cdcfea19b05699a4e2f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478021, "uuid": "b1944451-8e0c-4738-9aed-9ad222be221c", "value": "T10FC4F0F206C7FB8DCC4E44394455A67B68A79FBC8A3149CEA640BA7194F02921F0FD9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478021, "uuid": "d5983a03-b07a-4b94-a6d5-101decb5b4f8", "value": "bd1dc23681f44e733e87b20cf5b908b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478021, "uuid": "461f9a6f-1ed2-4cfe-8478-06ecfe3b57bf", "value": "12288:e81oDihelogYzTEg7eTtAjzDcut04Ma8bJhy8v2N:NaHMzDjzDcutpMaI2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478021, "uuid": "0494ecf0-27d9-46cb-ba0b-4006b98f27d0", "value": 569552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478021, "uuid": "53073b13-74af-430d-9ccb-48fe097a8aed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478021, "uuid": "c6bc24af-79d2-4bd5-a923-a0721d02fefe", "value": "Femetageshuse.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ca4402-35d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691489497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489497, "uuid": "d879f849-6fcc-4dcf-b74c-a50b9990f7e3", "comment": "Malware payload (GuLoader)", "value": "3ff6a147831784dfa8d836f0cacbb315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489497, "uuid": "05dd8b96-cde2-4c0e-8ded-94bbe895d68a", "comment": "Malware payload (GuLoader)", "value": "27339c7c14a12fea2f80d38019723ae0a490b09677fb067778e10e53e3fab574", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489497, "uuid": "5a8953d1-297a-4166-84f1-7282e278c929", "comment": "Malware payload (GuLoader)", "value": "0dfc1dbce9347f62e65c0313cde360a978333b7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489497, "uuid": "38a549c4-40cf-4815-9a16-90b3cdeac567", "comment": "Malware payload (GuLoader)", "value": "2750289968779ce1ea78283121c2b1a08d8ed0818e80b50dda4871bfdc5ce2f986dfc04cc883a8906055b625615485da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489497, "uuid": "937400a2-fffa-4f1a-9e35-7ab43af6e27f", "value": "T12CB412F49B26D186ED330E34521A9A63A1325C605CE74A43B7D0353BBF723D2612E57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489497, "uuid": "f6c2d16a-fe5f-4c6d-9da1-8a63d17b2100", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489497, "uuid": "d2c2abc1-246e-466d-8253-adff7f23ba7e", "value": "12288:f3kpU5ETsPwBcTZ6oQxVVD84gIwk1XdpHubMyrpK:/kW5ETm6oQxVVD+bMtpHubM4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489497, "uuid": "f08d2e75-9176-44e6-97aa-e183eb6eab5d", "value": 526352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489497, "uuid": "f2016389-0024-4dd7-85c2-84322e3eaacf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489497, "uuid": "785010cb-2a19-4ef7-bec2-0d7bcddff0dc", "value": "Commercial Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66adec48-361c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691520610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520610, "uuid": "eb031652-80af-4dea-8cf7-94432e2c17af", "comment": "Malware payload (Mirai)", "value": "5d0646fa05205d31e6d774cbc5a65299", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520610, "uuid": "d1bf1b3a-5a46-429c-bfa8-dbaf9f8cca95", "comment": "Malware payload (Mirai)", "value": "277ee7cb875a1d090f15b07439b214037b6fa841f13a8369bae2f78df8ba39dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520610, "uuid": "7618fa42-c2d9-4403-af29-98937e089720", "comment": "Malware payload (Mirai)", "value": "607903c5604065bc61fb2cf3199c208888b77b8a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520610, "uuid": "0a2f4531-9f14-4db0-9f36-2363de810ac5", "comment": "Malware payload (Mirai)", "value": "4739f82dee10840c06d9ed6e669d09c5246aca6ef1a402631a4f57dc0490662d4baa5ebf5c7c55aa560ee204929655ff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520610, "uuid": "82aa3b06-cf11-4a68-b2c7-84e4ddfd6d31", "value": "T19BC2E0941562FF15D4754C72CAB09A822E7B8AB573A132F13FCC17D3C66428AC9B874B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520610, "uuid": "70202cc4-9da2-47b1-9919-486dc0876fce", "value": "768:nZqbD9poewFRgjRm6O7NxKnSXQnd6s3Uozh:ns/9KgV+jDXQtzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691520610, "uuid": "bdae1e2e-9940-4dca-9518-88cecab3458c", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691520610, "uuid": "d64cea43-2d5e-40f9-90a7-cf041cef6ac9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520610, "uuid": "c9f6f810-6736-42d7-ba91-17eaf7416bb7", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568b0ae6-35b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691477204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477204, "uuid": "656c6a7a-9fc1-40e6-9640-3f491301fef0", "comment": "Malware payload (SnakeKeylogger)", "value": "8e7b234fe3dddcd937e3530eabc31182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477204, "uuid": "501606ac-47df-452e-82bd-b83707fb41bd", "comment": "Malware payload (SnakeKeylogger)", "value": "27a390665ec2af441c711cc00f0345c31317c852af895bf84f73143a4038af91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477204, "uuid": "3aa74e7b-e3e4-46f9-ab6d-05685b55cfa3", "comment": "Malware payload (SnakeKeylogger)", "value": "a05c6a6ccf3d9104c172bf6ca815fc0934662a89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477204, "uuid": "1a7c5d73-e3e4-4357-9e66-60bb614a3840", "comment": "Malware payload (SnakeKeylogger)", "value": "693f077eb868d8d71a1a834f88da3e3f6c356773936e7bed3be6641e9104311c9002a1b07dafc765f831acbc9e4d57f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477204, "uuid": "ccad59b4-45b9-4ae4-a45f-e8df2ce7a809", "value": "T10CE422645AF9AF96F1FA43F8287951540BB3A0420966FA6D0DE670CE1DA3F019B43F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477204, "uuid": "b3a57754-366b-4c5e-ad70-095cd0af991a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477204, "uuid": "f3fe8ed5-3208-4e67-b1c1-5acf50ccbde9", "value": "12288:zEHniF9se72hWjPR6BI9CFt7yf0sgqd/Sek9eYzBlfnzBZKysWL:QnipvjU6CFtg1gqhSJ9FDts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477204, "uuid": "d78c07ea-bd3d-401d-93f8-9ed0158ee65c", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477204, "uuid": "104a6b1f-6401-4774-868c-91bde3106e59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477204, "uuid": "a956f6a2-ca98-49ae-9582-627beebb974d", "value": "Cotizacion 0518.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd484df-3611-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691515869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515869, "uuid": "7efa1373-6a09-4ee0-9919-5c759ca84806", "comment": "Malware payload (Mirai)", "value": "6dc433f94ac7fdd028e4424483cc78d2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515869, "uuid": "e91866e8-ee0c-463c-bb61-09137b9ee8b8", "comment": "Malware payload (Mirai)", "value": "27bf65a57f5ba4f363530266be14d5828e406445bdf19511769e5d8d8f03be58", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515869, "uuid": "a798eec4-90a3-43bd-87e6-4dd41103fdcc", "comment": "Malware payload (Mirai)", "value": "52431730e1da348e9420af690643eeeb3b501129", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515869, "uuid": "3d656861-7d3b-419d-a848-78a5e929d7ec", "comment": "Malware payload (Mirai)", "value": "1f3ed5af535d81dff2bce88e107f0fd313dedc625ab5edcbaa113d3ab86ef954ff1655eed2f02e7399ea88dcc2309c25", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515869, "uuid": "52b7915b-ed9e-43e5-ad4b-08ea61eb855b", "value": "T1C0A2E01073532D66F3AC1C3DC9AA835BB9A71BFC80B5327679415620C94D24A3F38A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515869, "uuid": "01be628d-4cf3-41f1-b248-3911f7befc11", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjLWihymdGUop5h/:vvQn4j+ZO5fKAlxmis3Uozl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691515869, "uuid": "5a9c1a89-d30d-4164-b4d9-3c51fd374848", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691515869, "uuid": "8dbae7a3-4eb9-4824-a0c8-8d91e581df83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515869, "uuid": "b4d8cacd-0d60-4bef-9857-f70fe0786470", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b678b849-35e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691495404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495404, "uuid": "1a8555d1-902d-43ef-a61e-af4181df8d78", "comment": "Malware payload (Mirai)", "value": "62e13979c8498141e30da085ae81540b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495404, "uuid": "eb05b393-368c-436d-8c6f-f0a4cfb30ac5", "comment": "Malware payload (Mirai)", "value": "28f0f136c56edce1e78ece0a0b264ca4bcb8b6390e7e72682c1c4e0ef964ef77", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495404, "uuid": "8dd0a8dd-72ef-49f5-948d-9fd36bfff389", "comment": "Malware payload (Mirai)", "value": "f4b7b6cbc8a4e3a6dde3c9e0ae24c20f6fdd68d5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495404, "uuid": "bc9a7d07-b1ab-41f5-9fad-afc95968a827", "comment": "Malware payload (Mirai)", "value": "97a8a286a168ee81343b0dd1a3c411113845bb155436470618a1dfcc061660c241911b608eceaea1f468b52411fcd56c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495404, "uuid": "51f5da33-79ee-4765-9601-8aafb5887340", "value": "T135A2E1247F1DE98FCD37B23C86E6E5C693D07D24D6DC89865741C12FEAA36846830E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495404, "uuid": "3674ec6a-ac6b-4780-b6fa-ccea575b2b1b", "value": "384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtK7Sy3:k98o08kxofBE+ZkXaT47C2EpitC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691495404, "uuid": "d6dcf10b-9716-491e-b25c-5afad6bcfa4c", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691495404, "uuid": "d78177aa-d462-414e-9e3f-a77c403b73f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495404, "uuid": "15ce890b-1c13-42d8-97d6-3cddcfbdb5f5", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c47ff0-3611-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691515876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515876, "uuid": "b4103ddb-9111-48b9-9cd9-cdea87ecf96b", "comment": "Malware payload (Mirai)", "value": "79df3b5de50a694ff672f9582c6586d9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515876, "uuid": "e1258d63-da5c-4c72-869d-57776281c443", "comment": "Malware payload (Mirai)", "value": "28f49aa69a137713b1e5940011a4c392c7803fdee7ed4f03d888a06c6c8e019c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515876, "uuid": "7f60ca0f-ec1d-4e23-b147-3b75f3a81351", "comment": "Malware payload (Mirai)", "value": "6c26e574a0651e2b4439bf991259e01310d79e5d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515876, "uuid": "4795289c-8a33-443f-900f-0ba7d348c919", "comment": "Malware payload (Mirai)", "value": "830ea4c81e071f8b66a72a7fbf7fec6cfcc6950815ca21b0f043fea1c7849c8e02e608527403dc87d6eaad4a887b0fba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515876, "uuid": "e4d44321-427f-4f10-a9fd-1a397942a484", "value": "T183B2C0CC65543089C98D7C7C278D4A664F6CA1D0BAED9F26E360CD94B3BEA8B345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515876, "uuid": "9283383f-1d04-4689-9316-cd3af3796f79", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpkZqEWvm:/QlS07FUXqIYSXQKqucq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691515876, "uuid": "f3d40c5b-2780-4ead-9494-619d44c56970", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691515876, "uuid": "64ba7e73-0c44-4cce-8294-172585cc8558", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515876, "uuid": "1ab617ae-798b-44fd-a9c8-0565335289e1", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc3a0c0-35ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1691478367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478367, "uuid": "ef1eb0a4-cc81-4665-be96-1b720d1d6bf1", "comment": "Malware payload (Rhadamanthys)", "value": "bc8ca49fa09fa6f616708013d9211992", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478367, "uuid": "c34ce45d-b1a8-4ae5-a22b-bfb0012128c0", "comment": "Malware payload (Rhadamanthys)", "value": "29f5a8629986da0b4a353e5423fb39c505cba7c06e7aa4b5a4029c5a1669ae95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478367, "uuid": "fec248d4-3f87-47c4-ada1-0479f0cb7e82", "comment": "Malware payload (Rhadamanthys)", "value": "3f4c5725af5087b7066d53a224759b566560eb91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478367, "uuid": "8d81f89e-0717-478e-865b-3e5479ed24d8", "comment": "Malware payload (Rhadamanthys)", "value": "d90706632295762ead8723f4630ab8bfed6bdca88987e9c004045e17ead86559be5499a37b27dd218767446b535d4fee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478367, "uuid": "11c6fbfd-e3fa-412f-ab57-487eb1ca03d6", "value": "T118E5E00BBA4F8DA1D3467776C59F050C0BAEDB853227D73F798E235925037BA9A09207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478367, "uuid": "1f0f7128-b85f-4663-b8aa-3364f2736e58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478367, "uuid": "29cb3317-d145-410d-a1e2-27ddbd34f61f", "value": "49152:ZZvrmWKGDNB7G87UOZ0rFiNkSoVm+/2B72UzNyFcrOaZ+rgI0qi/8LqKX:ZZRNlUOyr1Su/RUgkYgI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478367, "uuid": "64e7bddb-221c-4efd-bbc6-0b29adad404f", "value": 3286016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478367, "uuid": "5268236d-4ec2-4713-82b2-c6383cb7d9e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478367, "uuid": "0c2a6203-1800-4120-b05e-ebd404264fdf", "value": "bc8ca49fa09fa6f616708013d9211992.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ef474d-35f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691503504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503504, "uuid": "d7ced460-d160-4ed6-9599-cce6c22d1195", "comment": "Malware payload (Mirai)", "value": "3bd962f618c2ba5afc7ee80f534d15db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503504, "uuid": "9bcb826c-01f8-464d-8d0e-755cc66a7e28", "comment": "Malware payload (Mirai)", "value": "2a302de5d3122f94b5a44efcd18e9b6f0ab800e4b006e280a7fb90aa4f85420f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503504, "uuid": "097ff5ce-6166-4984-a06f-c3973f97a438", "comment": "Malware payload (Mirai)", "value": "2db5cac302b268dc0393b4c239bdb472852d64f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503504, "uuid": "58f8f0cb-91cc-4b35-8c3f-4b69a91c3a58", "comment": "Malware payload (Mirai)", "value": "3ac766acec73316134a1e9ae9614ba150acdf4ee3d4d1b9905b01a6b8a32753130d32f10d386007c8a3c2bf5a5e619ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503504, "uuid": "63f7711e-88ce-48d1-8dd6-7a94c53e9b49", "value": "T100336B36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503504, "uuid": "1a09b1cd-0a2f-4e58-8a74-b3197e9ceee6", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbTF9+2PCZQoViOXmCozw:Oa4U7G7SvT6ftBJ2PKV7mCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691503504, "uuid": "69408163-3164-401a-a46a-62ef3007239b", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691503504, "uuid": "0007702b-b4df-464f-ae49-88607e68b28d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503504, "uuid": "fd3eb785-de04-475a-ab29-4ba00c5c8ba3", "value": "3bd962f618c2ba5afc7ee80f534d15db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5c62ce-35c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meterpreter)", "timestamp": 1691482312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691482312, "uuid": "ed7f44d6-1513-40e9-a512-a38eda706d46", "comment": "Malware payload (Meterpreter)", "value": "8f1a684e0812bf7fc387e88b979bade2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691482312, "uuid": "ebd745d8-290e-4a4f-bce8-7edd7870dcf1", "comment": "Malware payload (Meterpreter)", "value": "2cbef79f5325b188d2aa20d4dfba35dedd716f7e40c4eaed66956cf877ab14ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691482312, "uuid": "215a0cda-8e7d-42f8-bb19-c4e5cb57a663", "comment": "Malware payload (Meterpreter)", "value": "59c471ad8fa2b625570697b4a3924abb65fb1e73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691482312, "uuid": "b7280849-762c-4c6f-a3d7-585dfd0e45f5", "comment": "Malware payload (Meterpreter)", "value": "1dfc5a4124e7b798c41fbf73bfe0d1f1827b06cd642039ef041a828b9beb03da44a7567cd83bf1557f1be4fc20542402", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691482312, "uuid": "cbf4fa2e-5c75-4ce2-bc56-beedad04037d", "value": "T19BA32A93FB95BDA7CB05123ED9AA8759223DEBD407C607035D3AB2381A574C06EA7343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691482312, "uuid": "e806438d-7561-4de6-8c6f-add04829280a", "value": "8eccb79f3ff73ebe0ef15ab611edb974", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691482312, "uuid": "07540fb6-f326-4912-8086-9493d3aae06a", "value": "1536:lSWIQzsV86wKe5EeXsb0alDcFciniZLaB++p0/LLpi+s1:deGGvinid8J1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691482312, "uuid": "d9403db6-f1ae-482d-9bc3-90b56b12d4c3", "value": 105094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691482312, "uuid": "e80bb668-919c-410c-b420-80a0f7f9a55d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691482312, "uuid": "bf88436b-9b7c-4f7b-bede-31445eb8ed29", "value": "8f1a684e0812bf7fc387e88b979bade2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388a5c0a-3644-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691537712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691537712, "uuid": "e0064708-fcd6-48d4-add3-ecbab18c3c67", "comment": "Malware payload (RedLineStealer)", "value": "f0f9583d427602a55832999fa745cb69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691537712, "uuid": "f09025d3-0822-4992-957f-de9004d9a9a9", "comment": "Malware payload (RedLineStealer)", "value": "2d65d26ca3a66a722a983d62038d6c2bdd4729483ea6a23d15aee005491fc3c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691537712, "uuid": "9a2a2218-0316-4a64-aa20-64e1eba7b849", "comment": "Malware payload (RedLineStealer)", "value": "a5c6adb65037798c619ce20a60a78cf4a20b070a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691537712, "uuid": "c44b6167-0dd2-4e02-a206-cfe726773619", "comment": "Malware payload (RedLineStealer)", "value": "923abd2311c15af5a16eb4cd99c4c78cdd0325de87a5c10b0c2e088e1166b21948fe57322f57f1e857b56bff79898849", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691537712, "uuid": "2c378876-6ed9-4a3e-b5a3-f31335a497eb", "value": "T18584AED366E07861E6274B327E6AC6F86F2EFD918F1577DB13546A2F09711A2C232301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691537712, "uuid": "c4847a8c-5046-4ac5-90e2-c160719525ab", "value": "8b04667bf7005dc7bdd7ac468a9f7241", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691537712, "uuid": "dd66077b-2836-469c-ad15-ca8c176a36e1", "value": "6144:ynYpu2R2P1yXhNBWsCdV0ODszXIVkwwCL9TUFg7:yYA1y3CV0hYVkzCL9TUFg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691537712, "uuid": "0273fe4a-68db-46d6-a5d4-e01816195dae", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691537712, "uuid": "c022154f-f416-4654-b3c3-ad137514d0ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691537712, "uuid": "479277c4-0768-4a97-89b4-f7f51fa17234", "value": "f0f9583d427602a55832999fa745cb69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46086a0f-35d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691491349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491349, "uuid": "26acf36f-c283-4be7-bc08-c2d518543e60", "comment": "Malware payload (AveMariaRAT)", "value": "8d734b30b785fd45d87b33d9e3b0be55", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491349, "uuid": "1f6ff444-06ae-4e56-b7da-1c3b82abc16b", "comment": "Malware payload (AveMariaRAT)", "value": "2e1b26c1e78f2bf90aed295cd607f18317876ff2c1910f948c7967353a185fa4", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491349, "uuid": "a562468f-6cf9-4304-9e41-66b26aa6bf41", "comment": "Malware payload (AveMariaRAT)", "value": "e919bc9e153b80fef4474bd18bbea1a7595e52c7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491349, "uuid": "37e27f3e-da59-4528-b1f7-eb5654e22552", "comment": "Malware payload (AveMariaRAT)", "value": "eca3a61ba642589690b332506484535812d6c4789cadf9dee571a9502c3be16d59db924c7bda5a6b60597957805070f6", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491349, "uuid": "ed34b0b6-d3ca-42b1-b979-70f27fac66a9", "value": "T1D905DE046840C64DC9B92576E9B1B1F80FA36D25E932E20F9EED3D2F377365E4900B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491349, "uuid": "13a9bfc1-65a9-4404-b854-603edf9aa004", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491349, "uuid": "202459e6-3d34-4934-a019-433394645d34", "value": "24576:Cx3ik1YB0Y8NmgquMVd5RZO18dDcrj4mlT:Cx3ikqBpomZuc5/UWpmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691491349, "uuid": "55cd742d-0b2d-4c3e-94b0-c6b25409b325", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691491349, "uuid": "dd0d8b7e-6c5e-43cf-b82d-36ba6c068cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491349, "uuid": "d4f4146d-ae91-49ab-9247-8857cb10945c", "value": "QXsN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5651e822-35f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691503832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503832, "uuid": "c2ce47d3-abb9-4073-b5b2-a1b5b80825ae", "comment": "Malware payload (GuLoader)", "value": "f9523a569eaa47e6ce6dc10c9b07117b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503832, "uuid": "7028e3d5-3975-47cc-8b58-dca5d89de015", "comment": "Malware payload (GuLoader)", "value": "2e97f4d6bf16c0c918f48301129830bf11639ac0090c6eb937b126345fcc2185", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503832, "uuid": "680023ee-8ac7-4790-8b7a-36529e0485e3", "comment": "Malware payload (GuLoader)", "value": "01859c3360b613e1d8663b8edb702bea32ef65cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503832, "uuid": "5c14589e-3a9a-4b4d-8412-f5f09f66a44c", "comment": "Malware payload (GuLoader)", "value": "6dfdd4ea1e4dcf007061dff57e4f6d0c7af02fa5990726d180ae041467468a1ae39cd639859876cc0831284d2927f088", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503832, "uuid": "f63a3c56-7a05-439f-aa13-8bb6dece9eb7", "value": "T1D3A40207796C53DFD79E8EF1397542308A2CEF535500AA0ABAD4FE1D293274CAC1A2D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503832, "uuid": "330c6395-ced7-48c2-b69f-1fda7395daef", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503832, "uuid": "cb6068cf-663e-474b-aa6e-0f96df23d9ca", "value": "6144:AmOPUVI5v8AiOEUi4+9Ret/+qw0iTOMeH/ThI3E8pEu77jKsU4kyvzvDlMh/BlUn:n+8dOluU/+qw0XBb4vvzTks5Mh7wo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691503832, "uuid": "8f4bbf1b-4c86-4e73-a9f4-7f0fcde1839d", "value": 487880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691503832, "uuid": "9820a4d9-71e1-4f93-a904-0b898928340a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503832, "uuid": "2230c138-39ba-425b-8537-2134210c4989", "value": "f9523a569eaa47e6ce6dc10c9b07117b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab0f0a6-35f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1691503839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503839, "uuid": "b764784e-560c-4480-9312-1cfa871d51b7", "comment": "Malware payload (ModiLoader)", "value": "053052690586782a411f46ec2bf255fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503839, "uuid": "ea60bffc-81a9-4c39-9072-4ca10a3735cb", "comment": "Malware payload (ModiLoader)", "value": "2f1ca9ea9c439cddf83672896fe9810ce3d3aa2218f3718f121e90a19e3a25e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503839, "uuid": "f9db7051-6c87-49d8-aa0d-aac56d07b2eb", "comment": "Malware payload (ModiLoader)", "value": "7068fbaefcc2cbcdf51f7ffd8b77f599478fc91e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503839, "uuid": "b01f6528-879f-44ad-8713-a86ef2034a28", "comment": "Malware payload (ModiLoader)", "value": "3367484e823abb67cb4a3d2109200b896df08704d9b7662773071218c68c086daa2a40c09278f862c656305e65fcfe68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503839, "uuid": "bb86074a-5481-45ce-a9ad-288ba88c6da5", "value": "T16A458D72E6524833D2B3057C9D3B1F744C2BBE735928A5456BEC78BA2F2B240683D167", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503839, "uuid": "2eb10cff-598c-4273-a108-b1ea6e8e4ee4", "value": "a4dea6841158221e1f9d51cae1534166", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503839, "uuid": "c44b391a-a97d-4c82-bc66-5bfa24a4f884", "value": "24576:O+wrBX18XhVRGTbabra2OYSRf9PhHt8AE:OrnHXKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691503839, "uuid": "c085ebac-b0ff-49dd-8a98-d2f9d677e376", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691503839, "uuid": "307e1d17-5a9f-49ab-bef4-4cd52f9dbaa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503839, "uuid": "6560911d-7ac0-445d-9479-d828632972e4", "value": "053052690586782a411f46ec2bf255fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827a7447-3637-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691532253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532253, "uuid": "aed2638d-9456-4a11-bb96-20851e6062a6", "comment": "Malware payload (Mirai)", "value": "7cd6e0047988206974b1b22d248454b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532253, "uuid": "881ca400-6439-4b37-9022-bc85c40d5581", "comment": "Malware payload (Mirai)", "value": "2f8466111af6a69f52869740ce757d3f5525462a1705f762473927ec8be35336", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532253, "uuid": "0bb6ab8b-1b07-4d33-9930-b3b7e274ce91", "comment": "Malware payload (Mirai)", "value": "b4b49d94f53408464f061b6563574ebb1dae5fb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532253, "uuid": "c5076b69-cb9b-4762-949c-97766beb407c", "comment": "Malware payload (Mirai)", "value": "a897942fc8bde08f7f635f97431c63a614b9841ec3bd0ca0214f04c2f1db4f38c03abca176df95e119afcfd9536245a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532253, "uuid": "f0c8e428-0739-45e5-8663-b914e0cf6b21", "value": "T1D2538D75D12DEEA8C0424AB4A9598E704F13A0C046733EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532253, "uuid": "40708388-8d59-472c-8b92-92c27cbe13a8", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691532253, "uuid": "e9ba048f-6db3-4a70-b5a5-f38faeaabd41", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691532253, "uuid": "fd252a51-930f-4a5c-8070-c5b4d2af1082", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532253, "uuid": "1c20b2c8-db1e-4261-9a9e-91b67b4428dc", "value": "7cd6e0047988206974b1b22d248454b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbcc69e-3611-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691515871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515871, "uuid": "da5f308e-bbb9-4e23-91fd-d6a25baf32ea", "comment": "Malware payload (Mirai)", "value": "6f5c78aa6f00b2cfacf45298fdc3e685", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515871, "uuid": "88f76951-554e-48bb-89d5-c0ae7c257d6a", "comment": "Malware payload (Mirai)", "value": "2f91cef402551b35d5191069ed0f2363b8dad83c0a2fc49465d8d064f4053250", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515871, "uuid": "b59a37fb-ee30-44b6-bd92-551000b79ebf", "comment": "Malware payload (Mirai)", "value": "504fb4c08689cc0d7e69e47e210897fd179977e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515871, "uuid": "d58326c6-eebd-446b-bd48-8e327acc63ae", "comment": "Malware payload (Mirai)", "value": "08d7604ddfff282f66cb330a623141690287241318dcca999ac1317fb7628463c7519707353a8dcefa78271f733b1e35", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515871, "uuid": "feb4a710-dde2-43ec-a1e5-afd6e39a2444", "value": "T1CF230221880E9EB124303C36DBD5A7937AE11971C6673013DA290A3C6FB5B531E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515871, "uuid": "e2a767ae-d450-4c73-aa88-aefc175343bf", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3Kul9q3UELbUXfi6nVMQHI4vcGpv1:gECFd+A6YHAxKNLRQZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691515871, "uuid": "ef606afd-f3d5-49f5-b697-627ed359f2e0", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691515871, "uuid": "60b81cde-4b1e-4cef-b4af-e4dae82a27ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515871, "uuid": "7d38dc76-2a57-403c-97a9-5a609d794aa2", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc366f3-35ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691487014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691487014, "uuid": "172805d6-be0a-4f67-a697-427e257a0865", "comment": "Malware payload", "value": "88ff0a74239d5b0f24914911bd09b841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691487014, "uuid": "132b398f-54dc-4eb6-91a5-9b47cc245366", "comment": "Malware payload", "value": "2fb9168043738645ee0e5b5f339d83656e2bb1f4a17434e7f93caafd8cb95727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691487014, "uuid": "89fd9cb8-b99a-4768-a22c-90137e6c7e82", "comment": "Malware payload", "value": "05327f5879ffa702ec6c70eeb6bed72ba13455fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691487014, "uuid": "fc8ffcca-bbf3-42f7-8328-415e27674ad7", "comment": "Malware payload", "value": "2ecab89993d82ac69be99f353f577b2a5b80ebf0b7559804313b1e64f1861042188c9b3143ed56c079a9b5f525acb79b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691487014, "uuid": "8f1f84eb-b13e-4031-9627-78649cda241a", "value": "T1BC162386A2C26406DEA740B5E57EC127D6F03C7E0A10D3AF57A0FFAEB7051806B75399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691487014, "uuid": "c8a30571-f1da-40b9-815a-24abeb34361e", "value": "7182b1ea6f92adbf459a2c65d8d4dd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691487014, "uuid": "2ae645cd-d85c-40a7-8bd1-ed77d5860668", "value": "98304:4fN/LlSqBw+ueCWOmIalZRC18ZK1Va1hPBljwdoL5vg1:4l7Bw+1CNmIalKdnaz55vg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691487014, "uuid": "6386f1a3-294c-4bb0-a8d4-8f71368facf0", "value": 4270592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691487014, "uuid": "3def79d9-f473-4445-8d5b-ee26ed083b5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691487014, "uuid": "99b26f03-080b-41a6-b7ff-abf9375f7563", "value": "Exadel OpenVpn x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7637a7d5-35dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691493578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493578, "uuid": "cca66cef-00f3-49ca-94ca-b43fc4a76ff8", "comment": "Malware payload", "value": "75ce8a5a09c753b1b431a55ec1a49f50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493578, "uuid": "4059ba87-d574-4bc2-a961-fcd8ac737bd7", "comment": "Malware payload", "value": "31f99ac65cd31e6954cb80fee2006c94844d65d76aa6a6716ee9d11b5335b743", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493578, "uuid": "e4f4a58a-c88a-4d08-94aa-a4b636fdb267", "comment": "Malware payload", "value": "5f96df2f691aba1705063bb681da2053a734be12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493578, "uuid": "504a0c77-5183-4184-8b1d-b1ef0366ec02", "comment": "Malware payload", "value": "4213ad8b9e08ba64365aa635739f63643821a34a2fc95d452fba21db191ec4002598c7a09e243eaa0d594349fac0184e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493578, "uuid": "69f62e2a-9fe0-4a67-b5b6-43ccc612db9e", "value": "T1A1A35B4FEF66DDA7C817833048E603090737E3515AC95B173E2689396E2BA74EF592C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493578, "uuid": "b865f9f6-bc08-4209-a16b-1ba59ad25da0", "value": "5908f5a922dc78bd3f358d73ee91cd75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493578, "uuid": "606e310f-ac57-4329-bc3a-a071125170e6", "value": "1536:UUKlbwoq2b1sYyGmabXRedxeWKFwiMqtcUvMFMQiNURl5:ZKlsoq2btZe4FwiMqtktR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691493578, "uuid": "95fb3752-788e-49b4-87ef-373632230334", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691493578, "uuid": "83c884c0-9bc1-4204-b133-56d16ea631f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493578, "uuid": "150a8080-72a8-4d5d-b30b-4a9b9a797ae0", "value": "31f99ac65cd31e6954cb80fee2006c94844d65d76aa6a6716ee9d11b5335b743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82c65b6-3590-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1691460617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691460617, "uuid": "857f3b43-b418-42a2-95d2-1cf914cb40d0", "comment": "Malware payload (IcedID)", "value": "4a862a6538e1812d1969572f922c630c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691460617, "uuid": "f7c7da4a-0524-4c10-9b89-d2ba3d74927c", "comment": "Malware payload (IcedID)", "value": "3278d5d944d0773e22cda20c978ee86c6185a28f5a93facd0f3732a5ddc755d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691460617, "uuid": "f65f341d-e9e4-4e74-8292-59814b935005", "comment": "Malware payload (IcedID)", "value": "774e6ec451eb29f2b29699d8dc718fb69ff7ad0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691460617, "uuid": "fcb695ef-5c2c-46e4-8d8a-1fd65640ec1a", "comment": "Malware payload (IcedID)", "value": "392d03c4a7d7eafe802c1fae4bc7ce3cffcb381ceb401e062fb8293ec3c4145015416a02c28bb1185e696a0d8e2c3d11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691460617, "uuid": "ed1b2a3c-f457-421d-8ebd-6c2a97c4a757", "value": "T13D059D8FEAE68F87D8389475C9DE4962EC2BA3145F218E63673C4D12B503A1477E631C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691460617, "uuid": "c11dc028-5363-4c6e-9616-c63baa55282f", "value": "30c7d46c36e7ac7e0d52b4514f420d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691460617, "uuid": "b4caa17d-485c-4e9a-a091-ccca6374ba2c", "value": "12288:EFsCfLXwG5W8M5XiXRY9IszLRMyCErDc/yStGgRh6bF4h/T7Sui9k5m:EFsCjXwqU5yS9IszmK4/DawQcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691460617, "uuid": "b3992e05-ff6d-4e36-8780-5e8a54ee3ac5", "value": 803857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691460617, "uuid": "6c873a89-31b6-4034-8776-f3f87617a610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691460617, "uuid": "ddced164-c56d-40a9-8389-fe221b1e9960", "value": "4a862a6538e1812d1969572f922c630c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a4d82d-359e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691466606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691466606, "uuid": "b9025327-4059-4c40-8484-4ed4c1fa5f2b", "comment": "Malware payload (Mirai)", "value": "2eba8caf2118538ba6d8123f94d0d348", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691466606, "uuid": "e42e07ed-6e7e-4ef7-b3f9-1bfb44394c43", "comment": "Malware payload (Mirai)", "value": "329bc3e87a15ac9efbb96660ec1f0ffc7b8f8b20009e6d603a22aa0191a3c8af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691466606, "uuid": "bda52cf2-a373-4ed6-bd51-931be958069a", "comment": "Malware payload (Mirai)", "value": "38b666fda5c0f3df8f3d1060ad8efaf811a38cbe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691466606, "uuid": "5a330ec1-bb44-4568-aabe-82d4bf6c939a", "comment": "Malware payload (Mirai)", "value": "2aea7fed5a20ead7f91031fa12579a76cdf8b557c9ef079a850239114034f09b39ccfbe3b87baae6dd6912c1d5153e0e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691466606, "uuid": "79805d00-b01b-49bf-b466-34fd9f1c9f9e", "value": "T1EE33026267AE29E151B05377FC32FC1A669C17F89CA730DA2CF0561A77C58024EF6782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691466606, "uuid": "8047de6b-bb17-4282-953c-213936760099", "value": "1536:d9O/ZMAXIxNUk015LcPqF1aBexo4opKZbt:d9O/ZNKyJ5LGqFUF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691466606, "uuid": "3144ee55-585a-4cb8-9d06-e663375f4abf", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691466606, "uuid": "2e300629-fd2e-411e-bae9-f71115a6b406", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691466606, "uuid": "e00ace10-7112-4005-8520-a6ccd70d6583", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01305e7-3621-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691522934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691522934, "uuid": "04ca4fc8-9672-4c77-9499-2a267485b8ca", "comment": "Malware payload (AgentTesla)", "value": "cda037d641b51c591bcff8a826be72b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691522934, "uuid": "92f7cfb7-2164-44ac-a4e3-16bc2acda94c", "comment": "Malware payload (AgentTesla)", "value": "32aa90278a7f5ef3eda8f90d36be4c48ef411d39b07c0fe5fe1ce4f695497635", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691522934, "uuid": "f9f670c3-bfb4-423d-85cf-5afa9dd2f2a6", "comment": "Malware payload (AgentTesla)", "value": "91899fbf4beb454dd2c976f07640b5ce4e74a450", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691522934, "uuid": "1d1bf7b3-2336-43ce-b83c-ff044c944af4", "comment": "Malware payload (AgentTesla)", "value": "27b1ca3100eb386f775d3c9d814107e9df5c2089c3144153d7af6c78ae7a9a1f5e93bc58cccbdaa2868d53458e5de76a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691522934, "uuid": "9a790a19-e2a5-48e8-baa8-9cafcdac3748", "value": "T1B9D41200326E8A97C6BC5AF1A5A9054487F13A6E193AF4CE3DD510CBD2F2F01EA91F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691522934, "uuid": "99687f83-eaa4-4374-822b-a0147b451875", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691522934, "uuid": "ef5a44c5-ccf5-460d-bd9a-017537f50d7e", "value": "12288:pOSLYTyJjqquYYGgqHww5BkBQm3oULRowJg0Ra6Gr2xfymFWoz:46YTEj+DaXkj3oUtv+0Ra6Gr2xfywW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691522934, "uuid": "eb99a641-e09a-4f3b-8d33-c67b3c606d79", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691522934, "uuid": "77089386-9500-4183-b782-29bdfcd423d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691522934, "uuid": "7cdffde4-956c-40f4-9ae1-5fb660dac470", "value": "SecuriteInfo.com.Win32.TrojanX-gen.2812.365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ce3ae2-35b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691475402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475402, "uuid": "b7aff979-7fbb-4996-bf77-ef6a04f4ca96", "comment": "Malware payload (AgentTesla)", "value": "e2abbccd6c88c384f12acd1c71693221", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475402, "uuid": "9462ff29-b189-431c-b353-0ab2913c37e9", "comment": "Malware payload (AgentTesla)", "value": "32db09e8cfd829ef38b2604520f7e10b4f353c21883dec276fc4f690594e07a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475402, "uuid": "adbb9297-a0fd-4339-bcbe-421da61b9121", "comment": "Malware payload (AgentTesla)", "value": "bf792befa40e6183987e69e863f83b546b1b6cec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475402, "uuid": "f18fbea3-3429-4689-bc3c-7e4fa6825566", "comment": "Malware payload (AgentTesla)", "value": "9cc204259662fe6497e9d6f191b12bc30c28d29b3ad25b609c21cfc35faa5778d4fcd8c760cc0549fc57f2abefe15eb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475402, "uuid": "edf5db01-cb0f-4c63-8c80-8f1b2c459daf", "value": "T17B05014033ACAF73E5F597F5147A50900BF2686D295ADA580ED2B0CF2972F018E62F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475402, "uuid": "93437ff9-e044-42c2-9ac9-e2461c8e178e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475402, "uuid": "6a2b3af8-ad66-45a4-bb08-810a77025fd9", "value": "24576:7jOimmyGtLXlbl8eoDGAPqprKNHdoMjUbockzOUza+:7jOiL5tbP8XGuHJE0OMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691475402, "uuid": "abc74516-33de-40ec-84ff-50757765dd11", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691475402, "uuid": "96a88db3-8dd1-4e66-90e8-8144d8c9d6f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475402, "uuid": "dd599a2f-1f19-4af3-bfa6-8334ed52ee1a", "value": "DHL Receipt_AWB 7214303201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65453458-35c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691484100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484100, "uuid": "29b74e9f-bf1e-4aef-8a32-36ea8d8df7ad", "comment": "Malware payload", "value": "33aabffe4ece4d725e558e87d26a9b14", "object_relation": "md5", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484100, "uuid": "c48443f3-c0a0-4e90-9077-79b09f8e45c1", "comment": "Malware payload", "value": "3340013b0f00fe0c9e99411f722f8f3f0baf9ae4f40ac78796a6d4d694b46d7b", "object_relation": "sha256", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484100, "uuid": "1460e9fb-be8b-497b-b9be-fb8410c0bff8", "comment": "Malware payload", "value": "d05305a747185c93a5b47f38168664b3963e570b", "object_relation": "sha1", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484100, "uuid": "bd7aca79-a17e-4628-bb5b-b00bb3721377", "comment": "Malware payload", "value": "a90a0f731a7cffad4968258261927a5f527a82861ef470b1fe1418f45a67dacb089c813b8ac029a6a53fb12d49765709", "object_relation": "sha3-384", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484100, "uuid": "fc38c8dd-ee29-4e9d-903e-df30b4bc403d", "value": "T1D785AE32489A6DDCF1359E089761FD110E14B65B8FC61EF8DC1C96105AADA30DBCABBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484100, "uuid": "04bd9ee5-7fb3-48b0-87cf-aeb6fd343657", "value": "24576:uDi7eeqvTf9nXzTL47O/g1/9V9ISAPsn+lHOCLijGwMNBeC:uWeRnXD4nGXzuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691484100, "uuid": "432e6353-8454-4878-b862-6a091d928312", "value": 1830934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691484100, "uuid": "19a81d94-1bcd-4b0e-97b5-2efb0a1cdbf6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484100, "uuid": "8e982066-2f68-4a99-8ab9-f0e758241db4", "value": "3340013b0f00fe0c9e99411f722f8f3f0baf9ae4f40ac78796a6d4d694b46d7b.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca4b714-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691477563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477563, "uuid": "d51653aa-ef0f-438a-a1fb-3cefa9020c1c", "comment": "Malware payload", "value": "6ae27a8fe3e12014c33344f69a466d2e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477563, "uuid": "43c496c0-217a-4acb-b79e-3422308e6744", "comment": "Malware payload", "value": "33ae0803f11a85637fdfdc0441a7bb20638bc258d42414c9f60b34b6e1129981", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477563, "uuid": "f38fda5d-1969-4065-bff7-3b17ac2cdd13", "comment": "Malware payload", "value": "4c10812bbffdb6804120eba868fbe132b93aff44", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477563, "uuid": "e2adbd1a-10ea-44f8-b8a5-918696d9829e", "comment": "Malware payload", "value": "56431981a8dea287be12672f685e98c7c394a683bf4c86bf0ed488e624af73873d4d68de092d45d66d88d1228c83c776", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477563, "uuid": "74c0fb92-daa9-42e2-b4f0-1f75bb439521", "value": "T140E42399373EE8C46807D530A7872016177836978E92DD34A130B9BFEDB24466BC3EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477563, "uuid": "fc8c8683-cb22-4759-8376-e985db3efb2f", "value": "12288:glxYmjP/KkqGZcuhyWLU0uNmhCvZ5KTzYTC6Cq0LJTvtzTjwxm6Vmnsd6s:gzY2PyV4QnNJgYGrJTvtzTjommush", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477563, "uuid": "8e066375-e54b-4d72-b152-1976d0229172", "value": 675613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477563, "uuid": "0d988786-7758-46a5-b882-85b184d09833", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477563, "uuid": "9fddd5ca-552f-4c00-82c3-ab18c3454f0f", "value": "transferencia factura BC-765546.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a699beb-3611-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691515865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515865, "uuid": "e732c3fa-5016-4b41-a831-86773701de00", "comment": "Malware payload (Mirai)", "value": "d5d3e05003cc135c47705d0f1fd7b60c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515865, "uuid": "636260eb-1fde-4775-b798-cbabc191b72f", "comment": "Malware payload (Mirai)", "value": "344cbfbe3a6459067eee4273c15e4a3eefb8bdcf4c45ee64fad6065540a087ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515865, "uuid": "8a2ba082-89cf-4e86-9a89-4d6316584684", "comment": "Malware payload (Mirai)", "value": "8de080364f3f429d929ac258f4e43ce59c2bc3a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515865, "uuid": "b5b3b9df-135c-41be-a83c-b0c1ed6f2f7c", "comment": "Malware payload (Mirai)", "value": "3431542426b560f2ae569e0356f8bf5039139b64d42005e7d9e5bcfbc82e042b9deda77237509513fcb00ea8e197f5d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515865, "uuid": "46b6a023-78c1-4cb7-af2d-b4bdc1785ffb", "value": "T1DEB2D03C1B151B98DE1AC0BD839C1B503DB81B3591429D8B7206FDC7AFAA4747453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515865, "uuid": "8047cc46-2961-4dba-aff6-8e2b92e8fbcf", "value": "384:6eD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuis3md1JgGlzDpH7uNj1JAt:6eD8ZSWvZHZbs1row697qohQvg9s3i1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691515865, "uuid": "c5e41090-2766-46bb-a91b-beaf1adb265f", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691515865, "uuid": "540afc76-75fd-4ae8-917b-ca26cf846212", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515865, "uuid": "51d9a572-ae81-4d3b-8a31-bbf1686130f7", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0880efe5-3602-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691509285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509285, "uuid": "5ddf55d1-0aae-44d6-8dea-cd1e467dcbca", "comment": "Malware payload (GuLoader)", "value": "bf5ab0770f58cd092bab1c41e9fcac82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509285, "uuid": "5e351d37-e604-4345-b20b-4d1d1f16c18f", "comment": "Malware payload (GuLoader)", "value": "354bc09e2727ba9d3bce08124d88ea6600b882e5bfd729b695eb98ab16f843b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509285, "uuid": "e0381992-5d56-4928-963f-d1aed8743fbb", "comment": "Malware payload (GuLoader)", "value": "9e00b805967eecd714a66c29105b79991fae4e2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509285, "uuid": "13b5b9c3-d4c3-48c3-8f3b-fd597c34fa4a", "comment": "Malware payload (GuLoader)", "value": "44af7c29f68329d6fe88587d0b2fac14d9e9b9ae1283a6b77ce219e5b2be2580fa7b8a2b07fd5a441937e93d811f3112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509285, "uuid": "c9b23003-5bf5-4eb4-bd9f-93d5d1844cc0", "value": "T1D394BF53F712C4E7EE3C63F3B893A5EF2DF865660D84509A77A2A7E95400E224F0D528", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509285, "uuid": "ca827750-475e-4ff9-bdcc-5b5625ef42e3", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509285, "uuid": "b123dfe2-7ba6-469f-9f45-7d77e05061a4", "value": "6144:VPX0UPlrkcqMGIJjB9rVLd89+OOz/5WjhLlkaX1UTlWLTc85uK3OfvOE:zlRGIBj89+OO/5GUaX1cWLT5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691509285, "uuid": "ef16f94a-83f7-4b26-b18d-fcc99fcb4b9f", "value": 411808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691509285, "uuid": "53f96bda-4a98-40e8-94fd-bfcf2fe953f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509285, "uuid": "b530cf69-6dfb-457e-87d9-10acdd7e1418", "value": "TR9014777.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ae1692-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691478917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478917, "uuid": "e3d6ba52-c953-49cd-a4c5-faaab116d37d", "comment": "Malware payload (RedLineStealer)", "value": "ddba03daafc1c90c1303b40c288bc039", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478917, "uuid": "4fa2904b-7495-4dd2-b78f-e3751ee17304", "comment": "Malware payload (RedLineStealer)", "value": "36d5680653a8a6b5060e6b293df74f03759f60e5a1bdf996dea65463d1b9ad2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478917, "uuid": "3d500be2-6efe-473d-a967-7dbb812f9ac2", "comment": "Malware payload (RedLineStealer)", "value": "87d3fa0d26a1cf52923192f9463e3d7f1a552eb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478917, "uuid": "e9a3cd38-a55d-4b96-98bd-7baf1daf686f", "comment": "Malware payload (RedLineStealer)", "value": "012aabb15fe2853f6204546cf82b13d111519e093181bcad60b4f063fcbda5fb8233e49bb30dbe8d1aba012f73dfd302", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478917, "uuid": "6166b62b-568f-430b-91a9-34b188ea84c9", "value": "T1F0C41213EADD9573DCF51F704CFB02830A3A3DA14EB593572342699A2A73AC06931B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478917, "uuid": "ceb36e5a-2f47-4433-ad44-8a0349c15547", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478917, "uuid": "3a20d6e7-f4a2-4c13-a9f0-a268c0447bac", "value": "12288:hMr8y90Y1rsXXL6lHinM4WiwafdVyGx7pgBYClwm3lFQ+1qkUcnSh:hyL1rjirWidfdVy0yzRT7qk5nSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478917, "uuid": "46fc8ea3-44e9-4283-99fd-809a688fbe52", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478917, "uuid": "5008fbe8-d2a5-4ce9-9c0b-402cbdca2dfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478917, "uuid": "199e618c-52de-424c-8d69-fb2a512e6fcc", "value": "ddba03daafc1c90c1303b40c288bc039.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd420f73-35ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691500998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500998, "uuid": "ef8d332b-2461-4f49-809f-176f8e4f0fac", "comment": "Malware payload (Formbook)", "value": "1ce9f3ef53d1ee9a764759af6cdf421a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500998, "uuid": "8356d923-c7e4-4043-a9c5-7b8087e6eec8", "comment": "Malware payload (Formbook)", "value": "37603d12e53c4d1f27c4e6af7f44d935e0c53dc2620bd52e3e4ff2086b8a63c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500998, "uuid": "c839a6c9-6959-4711-8c10-d9a4b0615ce2", "comment": "Malware payload (Formbook)", "value": "63e7e78c749608d5944af5fe72f6300ef60cdacf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500998, "uuid": "bf24aac2-f14c-4801-97fc-7e90f6e9a08c", "comment": "Malware payload (Formbook)", "value": "5c6e4f887c12cefab60b83bbcf1e2151b79779b85e9aea969360aca3672707102b3051248a9549a42da9c9f2784f8988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500998, "uuid": "c70d7055-6d9d-420f-988d-655125b83ee9", "value": "T15B44122823D0C4B7E9630772AE7E466B9FF5B8612078138B47905B5D3A37E11EE1E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500998, "uuid": "a15090aa-f77f-4836-82f8-79e7796da6e9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500998, "uuid": "8eedf3c0-9c2f-4430-8154-aef55a9c4e32", "value": "6144:/Ya6s2Yq7sviWqxhRbR8IXRgfJ6Ko0LNenxOac5d4RnH3:/YCdviHxhRb3XRgf4KoJnxOac5d41X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500998, "uuid": "041e1a0a-fd3b-4e18-add6-ff904696d199", "value": 259089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500998, "uuid": "433ff77e-22e0-4982-a64f-c030940454e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500998, "uuid": "db2c35ca-c53e-49bb-8fbc-c5a702097372", "value": "37603d12e53c4d1f27c4e6af7f44d935e0c53dc2620bd52e3e4ff2086b8a63c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcdf35e-35b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691477350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477350, "uuid": "ffa94cc5-5fc6-48f2-9b50-9317eea7c0f5", "comment": "Malware payload", "value": "87f8f019ab0250cae5eb5b62f1665dbb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477350, "uuid": "9708a14d-7944-4af9-8b55-d43c72156143", "comment": "Malware payload", "value": "37e861a2a9ff1d219537545e830600be1ca0dc20af309611d4f7b5aa83a01491", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477350, "uuid": "4cb18782-3f60-4bff-97c4-a7092f462e65", "comment": "Malware payload", "value": "760917d89c6868a30eba3fadb2d97febf71fc28e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477350, "uuid": "dbd8c0a9-0110-4717-a710-0688fd0c6b6f", "comment": "Malware payload", "value": "2146e8e54d68352c34bb8a13eddd5db480fe1cde203f6c9deeb3b1bddc56f0e5498edf6d2d7fa0f47166f4581b9c7989", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477350, "uuid": "97ca4da8-4190-4c69-a6d5-92107f7b8ecf", "value": "T1F935E003E800DBC3D41D83F87E530ED91F0AAF19E99569DB05627F9B3A70A72099E52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477350, "uuid": "d7df3c22-fe59-4162-8a1c-be265c563795", "value": "24576:WRZyQw6VfZy9w6V4jKaWlEzp7a39dlzZbtQA3Qp5EfIwMx:WbQ6VRB6V4jKjOzedHt/3XfI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477350, "uuid": "e1fe7ae5-ecd8-4c20-ad25-a16cb7515e0f", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477350, "uuid": "5ed3aa04-1f04-4899-a3fd-aa2c30af0c85", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477350, "uuid": "a40a2141-3bc0-4257-a51a-3781b415c9fc", "value": "Fiji Islands Specification List .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659f3c1e-361c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691520608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520608, "uuid": "7ff0268a-d392-4657-8a44-3ba58f53c6c5", "comment": "Malware payload (Mirai)", "value": "9aa7f35fd9edf05650dbacf360e98141", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520608, "uuid": "1678116f-1656-400c-af26-6c911fa5186a", "comment": "Malware payload (Mirai)", "value": "3857bcb5e43498779045fbad55d0d9541b5915219d6a3d3505f7f4859afcffe1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520608, "uuid": "5b64760b-7d5b-46c9-bbf6-3dfcbf093696", "comment": "Malware payload (Mirai)", "value": "afcf2b055925695d1a6bbf073de94504e6027d37", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520608, "uuid": "757f9cca-c46f-45b6-8c0f-4ca4c4abf5ce", "comment": "Malware payload (Mirai)", "value": "1ec0978e7c7106cfb5e0c7d756ef38125f15908046a6b497602f8240a8be76e90a8f9bca3ae5ba71f891469775eb85be", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520608, "uuid": "bd38cffb-5205-43fe-b3ce-8556d19d91a8", "value": "T1E433F190812E9DB5C8B12DB5D4A45AE07AFD1B3CF98F772EA9089AC130971976FF4008", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520608, "uuid": "261ffcba-bef7-4098-89c5-08e53e394685", "value": "768:LGbPpQwNueqlA/gS8wgXFuCAIDRFLoBcoknVlA9q3UELjCHVIpH3UQJc2ZVYCYjW:6+wg7A/ww96jo6JLm1IpXVJc21+3onf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691520608, "uuid": "f42c6160-ced0-458b-ae68-849af104413a", "value": 52524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691520608, "uuid": "9469105c-c14a-4652-910b-15e8f030af22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520608, "uuid": "1272d487-6a49-4f43-9336-c4b63d74d228", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57628df9-35ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691478494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478494, "uuid": "92f6c791-0933-4c1b-a5ff-336b046f6017", "comment": "Malware payload (Amadey)", "value": "92149a8befaa17fc08898cff859019f8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478494, "uuid": "e6d6edc4-b40a-401e-970e-0b4c7aa081c6", "comment": "Malware payload (Amadey)", "value": "38ce1b37dc34f693695282fcae5df2feb392d108886ff6ed440ea620a90a11bf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478494, "uuid": "7f751513-1b3f-4156-85c2-8e1f64680357", "comment": "Malware payload (Amadey)", "value": "ee31907880a8b185e3d79e7ffd06a3c5a9bc8c87", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478494, "uuid": "18252daa-bbcf-4f00-b9b6-0d1e95731711", "comment": "Malware payload (Amadey)", "value": "d74b5ed70788a8afb85c1cd539759d55c2793717fcc2c3a535d7b52a312cf6d0fde22d16bdfb4aaa0831b1912156b506", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478494, "uuid": "10cfdfd1-55cd-4921-a0ad-1835e26202bd", "value": "T145C41207EAD84031DCB52B7068FA02930B357DA39DB8436A2789D95B4CB26D87D3537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478494, "uuid": "d34228fb-324e-4c23-9285-f1503fcbf204", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478494, "uuid": "e0dae8e6-9f51-4a43-a558-af763ee7ae41", "value": "12288:yMrsy90iBmXLPTuEx409rtvf6B4pwSgBYCqdh+XRV+wB3NMWGw6kteuf:iyPmTuEx403nDwhzah+hLB3NxskQuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478494, "uuid": "d0b31fa3-0dc8-441a-a386-5c9a8f288218", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478494, "uuid": "bd7e23c4-3fd3-48ea-bde3-86fd128efc99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478494, "uuid": "736b93f2-3124-4284-9f7f-4d20c72d0a45", "value": "92149a8befaa17fc08898cff859019f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1115d18-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691479127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479127, "uuid": "77554284-74d4-4d99-816e-4911b0419dbe", "comment": "Malware payload (Formbook)", "value": "36ad1ecd6b0f7db0870eee41a3ea5840", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479127, "uuid": "6907e8a2-21c0-49f0-b17b-cb0d5cefa303", "comment": "Malware payload (Formbook)", "value": "38fd5a643cd329cff4a7304970bbc9493e0df309bee2fdd5d11c42ceef27a7c1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479127, "uuid": "fdcddcca-3578-4642-a4cc-b5518eaf4955", "comment": "Malware payload (Formbook)", "value": "dd01a78ff1fed202da9d0477d3dca2d93d624904", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479127, "uuid": "fa294159-11a0-4142-aef5-00f73fc052f7", "comment": "Malware payload (Formbook)", "value": "24fd64825086b7282c67469e0147928fbbaf481dd32f5d45cb5a475db9fd79501335e7f0bb70814734b9a60827c9526d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479127, "uuid": "fef68115-3c32-4d90-8955-596a91f30e71", "value": "T10073146DD34F01A9CF65523B9B26094582FCBB7EF24012A530AC433533EED2DA6265BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479127, "uuid": "7e7bd9f9-b06e-4877-b63e-3e1826a0d6c6", "value": "768:TwAbZSibMX9gRWj4pSfSEL2WL1cePS3qnl8tXPyilnoTIK6EMXBxV:TwAlRDpSKpWLep3qnlM/yilnonMXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691479127, "uuid": "bb3b77cc-99f6-4cdc-836a-9fcee60d6702", "value": 76191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691479127, "uuid": "192fe03f-f30b-4845-90fc-47a351422593", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479127, "uuid": "a1d21210-e9a5-4c2b-b36e-2fc0b26e02bf", "value": "36ad1ecd6b0f7db0870eee41a3ea5840.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30a729f-35da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691492445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492445, "uuid": "f4cfb834-442e-4e06-95b2-1a5a16b575b6", "comment": "Malware payload (Formbook)", "value": "0860b9decf194469ff9004953916fad8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492445, "uuid": "b975a024-b99b-4900-af18-5e2b9ecda3a7", "comment": "Malware payload (Formbook)", "value": "39f0e93876df448f6aff1355220fc09a17c6b32e53e65683af08aaeefa40f592", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492445, "uuid": "c876f793-8164-4aee-be4a-e3bbc88a108e", "comment": "Malware payload (Formbook)", "value": "30577645b130d719ecf318b9b4d1d86d8ad5ba0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492445, "uuid": "c98e7ac9-5833-45a3-a250-739191e415f6", "comment": "Malware payload (Formbook)", "value": "65c44a2f72a974e77fa7af55dfb00f20787bb7309cd6c859bc6212d7b5b59c7b7b7739cdb6567ed22b99e9d6be8cf70b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492445, "uuid": "c2878f91-cdf3-430a-b2ce-5b1481027530", "value": "T11433122CED50DA86C815FA37C8F6B110C37535C75223872E6A679CBA259736B858B0FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492445, "uuid": "04227b3e-1012-442a-8a61-b4932a930836", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492445, "uuid": "23474148-90dd-4aa7-8937-6c25624a37a3", "value": "1536:HC23BHBjBE+PBRB02l7BXBznqUSRL9qFrb3ACFEf:H13BHBjBLPBRB02l7BXBzq/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691492445, "uuid": "4894bbd2-dc41-4a2a-8c8e-27fc1370d208", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691492445, "uuid": "f65fb316-bef7-4121-ac66-6e78e7f186a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492445, "uuid": "8b766975-dea9-4931-8188-06c4babea187", "value": "0860b9decf194469ff9004953916fad8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a96b16f-3635-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691531408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531408, "uuid": "29266192-a4f5-4a0e-847a-374197c663eb", "comment": "Malware payload", "value": "45273539c2b80efc5c3ad391c5bea065", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531408, "uuid": "0414e852-f7d6-4baa-a125-6aa91be833c3", "comment": "Malware payload", "value": "3a48dc0a8c537b8d9dc3554ac4ccc3822fae90b035b49ef8f1eeb3065d74c55a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531408, "uuid": "093f07e2-2a6e-41d0-adb4-9642f1917401", "comment": "Malware payload", "value": "e5035a7e755b2ff78659ea554ee2853a68375b70", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531408, "uuid": "f489aa2b-0a1d-4d9f-a705-35a9dec316ff", "comment": "Malware payload", "value": "c8cf23ea9b35adcf42e651f6652b68f78c74f818d21e25e28ad057f7e0730bfdd46f9581e3599c5621670ec0220a187a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531408, "uuid": "9e5e1a80-b9e3-4bc8-9890-36593570901e", "value": "T1F113E1F1C30104A295B61D79B4BCD98F934125FCF8C021396768AEB58E86546EBF2E47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531408, "uuid": "88f50526-6f9c-45df-b94a-d1fd0ee5b4b5", "value": "768:OSJBhM0LKStwBIrNklOc18nNYCYAkDHKhJPzshSaKWHQTQNozg0D3UH:ZJ7KzBoNm0SHqJRDzg02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691531408, "uuid": "3c685dac-60f9-4d98-8dc1-5c245027d9a8", "value": 43456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691531408, "uuid": "3b8f512a-1133-49f8-8bb4-440a2c13dd0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531408, "uuid": "b6e9594e-305d-452a-8195-f5b830eacd92", "value": "Vhoats.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350739ac-35c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691482731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691482731, "uuid": "2d828b4f-d3cb-4e5e-b249-b466a60d45dc", "comment": "Malware payload", "value": "6faf197b5ebb8c631abae6867a7e1d3d", "object_relation": "md5", "Tag": [ { "name": "172-93-161-245", "colour": "#BE0DF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691482731, "uuid": "211612eb-53b8-4945-82bd-1ea4e274b768", "comment": "Malware payload", "value": "3abc0fdaf327df8a3183dd53e363abde3c8adb22318ca79e55be07a37616edeb", "object_relation": "sha256", "Tag": [ { "name": "172-93-161-245", "colour": "#BE0DF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691482731, "uuid": "d7e42d84-d0e8-4f7d-9afd-90cd712b9277", "comment": "Malware payload", "value": "d9a838c62c85611930a9c9e66418cc4d31728dde", "object_relation": "sha1", "Tag": [ { "name": "172-93-161-245", "colour": "#BE0DF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691482731, "uuid": "0c611476-5b96-4ac4-a299-fa6fe252bdf5", "comment": "Malware payload", "value": "32f0079fc01b741b31906bf2348db7c469ff9d3d5f335a6e7fddb8a598346d29031fec233479a9b2c4e0b6813f495107", "object_relation": "sha3-384", "Tag": [ { "name": "172-93-161-245", "colour": "#BE0DF9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691482731, "uuid": "e14e7ad6-bf34-4110-917d-ad353fd736b6", "value": "T1E9A4234231594E53AFDFF57279C8EE42E476C1AE3D910D3E20A7999FA1828BDEDD1010", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691482731, "uuid": "f81b76a2-7550-4aa7-80b5-180c85078531", "value": "12288:WW/LNzAQoAvQc0K/Ke2A8Hj5tE3g+58pT1+uB7zhwv:W2NcIv90XeH8H1Igc8pT1r7zhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691482731, "uuid": "0e8a55bf-1a25-4381-98a1-39a4b993fd4b", "value": 493120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691482731, "uuid": "ec54d375-6ebe-4f0d-a51d-d860b3fde98d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691482731, "uuid": "2c284507-42bb-49e0-93b9-66c95d435507", "value": "bQsjTVrJ163.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296a2fb1-35bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1691480564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480564, "uuid": "bd59b03f-5f03-44e8-9175-e79536441700", "comment": "Malware payload (Smoke Loader)", "value": "f10568f2cbaa72e73fb2d07e6211cc57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480564, "uuid": "3d642137-ac5c-4eb8-8d1c-0b7189a9b7cf", "comment": "Malware payload (Smoke Loader)", "value": "3b41efeacd7ca320e40ea17d6b9b5e00b1693fed4cd5d8180c5690f386d27096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480564, "uuid": "3d66a75b-705d-4b3b-8012-c06fd7a58f6b", "comment": "Malware payload (Smoke Loader)", "value": "9f33ef5120f2a58914ded0591672319b20d57c1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480564, "uuid": "7f077a63-1efd-4de3-a51e-c78958eabb10", "comment": "Malware payload (Smoke Loader)", "value": "05df257952731a26e1ff26b0ade11775596c806b760a84484fe627faff7e3cc6901ca85b4e8e284f45793bb9e19e5f9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480564, "uuid": "061f8899-8b2b-4340-a389-7a3989a792df", "value": "T10AE41252ABEC81B3DCB61B701DF713A30B327C511968876A2346991E6DB3280D57A73F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480564, "uuid": "e905360e-6e47-4bb9-9da0-9462e073b9b6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480564, "uuid": "43f47ce6-916e-4f1e-bae5-8e2e5820d893", "value": "12288:TMrIy90HQfLqKXn2q7LUah4oz53ibN5eRNWtSP0Q/4CBmRm6nl2Fn4xhnT:fy4+nXn28ColibNAbWOAEamIrxhnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691480564, "uuid": "1830d897-84cf-4b8f-8cd4-9728d69184a2", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691480564, "uuid": "eb0c1e53-b00f-495b-af5b-2edf000ac24c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480564, "uuid": "b2e1c636-13d5-4d63-896f-0a6e0e539189", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78946c89-35ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691500024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500024, "uuid": "dd44d424-cfab-48ec-a8f9-ceaa96c4b832", "comment": "Malware payload (AgentTesla)", "value": "61db0cecc08f8972595279842c5635c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500024, "uuid": "555a3cb4-d20b-4e27-b1a7-68ad4ac2b3ff", "comment": "Malware payload (AgentTesla)", "value": "3cc80694f8b6d4f2bbb60d35edb95fc94630d2082a8969128f30c8a5e89dbe98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500024, "uuid": "55010e9f-dd6b-4e92-9b03-e453a5b3a2cf", "comment": "Malware payload (AgentTesla)", "value": "8370c2bc9109cbdd025f6fb612f731fbba90a52b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500024, "uuid": "c4818a03-6f6d-45d4-adbd-3cf2b24ba9c2", "comment": "Malware payload (AgentTesla)", "value": "a9d5193d0008efa8c8fde0850be17784b73ae893f02e3d4dcc384598027e97259b9d695fc30cad521fc85774257b234d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500024, "uuid": "e6ea08e6-1772-4f07-988f-5e894acf5a54", "value": "T191F32AEC92CA9E52D72D40B5CFB0114807B2A1474517E76D4EA1ACF63E867C3732B867", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500024, "uuid": "2798832e-cf10-440c-92cd-08fc16caaa28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500024, "uuid": "d41933ad-5845-4779-9aba-d75e64731179", "value": "3072:UWw/C4FXmo6PIUdKCCq1tgZVOJQGukOOkeTxM/:uC0/6PIUBCqoLOJQGukN1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500024, "uuid": "b219ed22-df33-4656-bb35-f19a756ac7fc", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500024, "uuid": "6ce05291-97b2-4259-8b2f-f69b95bff1a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500024, "uuid": "06523953-4991-4d93-91b2-fc5bb22218e6", "value": "3cc80694f8b6d4f2bbb60d35edb95fc94630d2082a8969128f30c8a5e89dbe98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9e8301-35e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691496006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496006, "uuid": "e23932b6-37df-45f2-b2de-d84b420e657c", "comment": "Malware payload (Mirai)", "value": "f8d58b24bec9b776d7edb744d02d061a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496006, "uuid": "4480b386-f262-4f98-bbe2-1154d80624a3", "comment": "Malware payload (Mirai)", "value": "3d8a0fb591d09f2dc4e2bf34c5ed8b1c291593bdde4540ed0d5c950f6926d67b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496006, "uuid": "65e7696b-8eeb-4abd-ad84-abc18af400ed", "comment": "Malware payload (Mirai)", "value": "ee823b33dd0d92b389817fe59b3190e9022b7879", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496006, "uuid": "20acd9fb-98ba-4c9d-bf53-b9ca77601a7c", "comment": "Malware payload (Mirai)", "value": "0c3d74139800ab12d7c92ff1eb8ce2591f0a721e8b918c90839caa3b0795206404f62e6b0866a0b9a38585f24b868e5f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496006, "uuid": "1348935d-0130-4913-9f14-17fd4954ee19", "value": "T17DE2E1CEE835598CC8B72035059D18E2E17FFD23EEE6974D12DE0542937B09E4195BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496006, "uuid": "0ea45f8a-8e05-4150-990c-9d0d293cc5d7", "value": "768:eTPITNH+Asv+ObWGYqSUnziTLN0KPU1tpdB3AiqOodo2O:0QF+RLdYq14V0zO8So2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691496006, "uuid": "d34ef083-242b-42bd-bbda-bea11f1c5f0b", "value": 31316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691496006, "uuid": "b7cac694-41c3-4f86-8d54-a8b814d9a48d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496006, "uuid": "a1117b3f-769f-4797-9c49-df147b39b5af", "value": "faecha.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0cf42f-35d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691489673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489673, "uuid": "e207f034-6ee5-4c06-b596-7336f60ffed7", "comment": "Malware payload (GuLoader)", "value": "05ca4168814c5eb85eacf408f6c2b22c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489673, "uuid": "69fdbc75-66ab-47d8-86b5-20a7835f9bf0", "comment": "Malware payload (GuLoader)", "value": "3eb5ddb1605e8343d14ea6d0ecfb77395c005d2ff448dc190e3e9f27d2c0e1ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489673, "uuid": "8731d305-3cb3-4433-9bdd-0a8a5c72576f", "comment": "Malware payload (GuLoader)", "value": "383a01981e05aeb7b76a290442c6b60908943f9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489673, "uuid": "8f9ad39c-d49e-4a46-a511-c77d8473a36b", "comment": "Malware payload (GuLoader)", "value": "e72f746e50d54f8825c898aa78d202e89ecff37ede314229d9c0389df8038d3e50b047d33c284162df274a4f0741406f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489673, "uuid": "822418b3-e074-44eb-90db-82764a9b0151", "value": "T112A48C9239CA75AFEC2F4674035FEAB62A785CD07381496E4F80320D4D3664A90EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489673, "uuid": "9189165a-32e7-468a-bf2a-c420ad687a3e", "value": "f5e6648dd4b477cc153fea2a49ce3e45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489673, "uuid": "d2fbf2ce-9d3a-49ca-94d8-d5feebf48ce7", "value": "6144:b5aSFdrqPZVheNA+ff00kFhjwxU6o8K/PrcC6MKwzDkE6CZrUxEy8diRzFmYvMAF:Xmnhe2eX+hzD3reMDIE66Uxh8AqYvZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489673, "uuid": "b5717e8b-9a1e-4567-be30-aae7d3d89212", "value": 492553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489673, "uuid": "62930164-e81b-45a0-bcd6-2030577b30a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489673, "uuid": "452d1f67-8efa-4a33-b725-4b3cd0e8f03e", "value": "Caliologist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f630ff4-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691477594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477594, "uuid": "db931ce9-c9a0-45d4-8539-54f801fb3af7", "comment": "Malware payload", "value": "a341dae0da7648a726add1df34a4ccac", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477594, "uuid": "00784a04-4dc5-4e05-802b-e0ee725e6676", "comment": "Malware payload", "value": "3f92752540e0658dc96fef662e8f96f9552383c8b8da50ea7707b35727a645de", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477594, "uuid": "52f1aed1-b5f2-4d34-8eec-95a3de74edfc", "comment": "Malware payload", "value": "7e3eeb85a2174aa2cf39c5e11f2b747f4b6f8e9c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477594, "uuid": "85ddab03-da7b-4a74-8abd-a042c733880f", "comment": "Malware payload", "value": "02c75ae86f32fbe87e3ce308cbe1dc75a9be80526e2f93866487ec68edaea67859b28e950ff48f366de8e66d399f9b3f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477594, "uuid": "7f056426-02db-45c1-a402-71710139a433", "value": "T11634A81056DF6489F1B33E520BED69E88F1BBBD15B3AA05D2048530BCBABD40CE95772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477594, "uuid": "715586b3-27dc-4818-962e-2dc2f23560bd", "value": "6144:pOSgylSD7K3qdnX1ASODZkYHvn+AyHxR4VxMh:pOvAyRR4VxMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477594, "uuid": "d049fece-aa8d-4fd8-9331-823127e8ad92", "value": 238968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477594, "uuid": "f92ae5e7-5c6d-4a5a-943b-8bc71421b6e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477594, "uuid": "f40c494d-00f2-493f-a407-0cb7450c9590", "value": "Reserva.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cad54ca-35e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1691497427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497427, "uuid": "6117f2fd-24d3-416b-8f20-3a7f6659d426", "comment": "Malware payload (Smoke Loader)", "value": "4787612302a398f125f19125161d020e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497427, "uuid": "20df26f9-c002-4773-9bdf-beaf9c4f0ec9", "comment": "Malware payload (Smoke Loader)", "value": "3ffd178ba8339510fd8024a94be5bdaf719af859435220cf6fc556829d915c63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497427, "uuid": "d118fc94-226b-418a-8a1d-1791a3c19abb", "comment": "Malware payload (Smoke Loader)", "value": "07b312b82278a6701d7b2e53bb1a72b8c9101cb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497427, "uuid": "ba7688f4-390a-43f5-95c7-edf4b75403d7", "comment": "Malware payload (Smoke Loader)", "value": "e647ff628e4d5d6425f54cd5ab46b5c18cebad5d7448c133b3d3c283c0fc77c3e38e8813a67ca91188af15a8f4d1c0b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497427, "uuid": "cab01735-63d5-4de4-83d3-61877761f841", "value": "T128644B13A2A0BC65ED264B328E3EC6E4371DFD518F5977A62218AE2F44B11F1C273725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497427, "uuid": "3acd710c-2820-4caa-b420-24656769bae5", "value": "40f5175c04a7e34207ea3837a6e797ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497427, "uuid": "189fdc89-0445-47c1-9495-e4add86bb762", "value": "3072:ksAdmVBmdgDuzRJPvr72PSjsvApKRdaO/kG5SMyaoXpz6B:0A7AgDARlvOSIvApKbrb5SMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691497427, "uuid": "96bb1a83-fc31-48ec-a7f3-0e0ee71f7251", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691497427, "uuid": "411a00f5-86fa-4056-9486-7551b0d20107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497427, "uuid": "4f910bad-84b3-459f-a51b-c1328ccead48", "value": "3ffd178ba8339510fd8024a94be5bdaf719af859435220cf6fc556829d915c63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d90413a-35f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691503817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503817, "uuid": "3ba29f2e-21b5-4664-a31e-89340b6ddbaf", "comment": "Malware payload (Mirai)", "value": "1290df7f6a99f66473aafebe2c1744e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503817, "uuid": "2fc390f5-76b1-4af8-886b-34dd8c134a8a", "comment": "Malware payload (Mirai)", "value": "4259aaa94dfb66e4f69f97b8dadf230c6d2abb9d64126579da8fdf7142c7ad98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503817, "uuid": "3babd7c6-e06a-4935-a33c-cdfb3e6bd957", "comment": "Malware payload (Mirai)", "value": "4dce9862fd93969a27bb408f00c5949ea4653d5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503817, "uuid": "20159214-436a-4af5-809c-0bcd5c6bfe83", "comment": "Malware payload (Mirai)", "value": "75f4cbb94ffceecc771a2334e12210240e9b4a42e2cb315022b2bce8664bb17eb960dedc945f4242809b150b554beda0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503817, "uuid": "0573af02-4d01-493c-bc86-734091c85d32", "value": "T1C5B2D05EAA68B5CBCD9D3DF49BDE05B89A8820C33E9BD75967210DE0343D149FC080B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503817, "uuid": "4ae0c814-2c92-40d1-8d47-7425842adf20", "value": "384:xTWfByn9ho6j7f+XJPFWkJ1qKjlovAMK3aOwbF+jQtrh2tleRWGVCz0NvaUS:xCI9hofXhFWkXq8lovA5qjbltd2zaWaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691503817, "uuid": "c0a7e9c2-b8bc-496a-a111-30f3bd37ea01", "value": 24888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691503817, "uuid": "7c843458-1492-408e-9994-1aa5e000fee2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503817, "uuid": "a22aaaf9-2387-4b05-901d-02f829ac94be", "value": "1290df7f6a99f66473aafebe2c1744e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943c74ef-35d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691489763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489763, "uuid": "cc77be93-4e4d-441b-9ec7-33d9fe745721", "comment": "Malware payload (AgentTesla)", "value": "5fc52428ef2c6aab6ed40d1410ef6203", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489763, "uuid": "68c033ac-6a08-4e52-98fd-d3796322e2da", "comment": "Malware payload (AgentTesla)", "value": "42f8cd40a497fc10b8be5ce4e4888b943a34ec854b72fe960c35cdea9b51a50a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489763, "uuid": "b3c83558-2809-4431-9bcf-8bba70515183", "comment": "Malware payload (AgentTesla)", "value": "862370e9936fded7484924f7a916c38da4cbf81b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489763, "uuid": "a0377795-8400-40b5-853e-40fa05e9b140", "comment": "Malware payload (AgentTesla)", "value": "6fa033d100420af975fdc31816ac1131756bbc089c6259cc414c2b0bccc6583ea3d07af2567691f01c6a3d69e0253df8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489763, "uuid": "1c163c2d-d693-4cab-8712-6150b6a4e6b0", "value": "T1F2D42304666CD705DEF803F53B2854BA17F9B24B6928D35D1EE52CDA6823F9E0A61F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489763, "uuid": "56982915-e506-45f1-b1a9-a8f1dc117183", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489763, "uuid": "5bdf2ff5-87be-4289-aba5-5baca1a385e5", "value": "12288:V9TBtNTDCzXVFDJjW5FXB9KYSwTl+p24VekT6vMIyVLplKe:DT3tDCzFFlq5RBfB+LekaSLpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489763, "uuid": "12bb7329-e2eb-4cc3-8e6d-0e3ad098a16b", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489763, "uuid": "39aee807-9655-41fb-99ff-3fb1b868b299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489763, "uuid": "f3147107-6506-42ce-b047-eeef16b6b738", "value": "copy 48592.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487d6305-35b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691478039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478039, "uuid": "eb59bc37-34e2-4e4f-9a8a-7c579530c761", "comment": "Malware payload (AgentTesla)", "value": "f091401243c9854eb3e738c580eb3948", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478039, "uuid": "44b396c5-3006-4b66-8e70-0edc59bb918d", "comment": "Malware payload (AgentTesla)", "value": "4312881bfbd20a397dedaf19a9bf8633c3fc8e087cd508ca278d862b90fa4b61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478039, "uuid": "6606a94f-133f-4053-b0cb-027d65982b1c", "comment": "Malware payload (AgentTesla)", "value": "af08f2c5a08c7b16b9dc09743e9b935bfdcf9a1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478039, "uuid": "0ab2076b-f01c-4f74-84cf-1b3ae1d8d26d", "comment": "Malware payload (AgentTesla)", "value": "edc9744c0d587aa88e7700e0f3126e03fdbc979c2caa8499971e7929ef8493e7bd893c66232a9f84d8434fbaca4b522d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478039, "uuid": "01b102a9-c5af-4f77-9672-d64da6522289", "value": "T1A6C41250E56CDAE1F86E07F96C74443003B2BD2DA531E6299E6A34FA1973F5B0822D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478039, "uuid": "84db68a2-9f1c-4f58-b961-e090a5ff78f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478039, "uuid": "edb65763-f88d-499f-9d78-961062178041", "value": "12288:G5Aj7usiWQpG6PfBIkh3/TlFaBVykjMKI3ej/:cAj7usnQA6PfBBh5+Ugq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478039, "uuid": "dd855c6c-2961-4ab7-a6f0-010d75bf3720", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478039, "uuid": "84c94576-5ed6-4048-89df-591a01cff89a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478039, "uuid": "39ce7ba6-4a23-4ad1-9c51-03cf6a8e1358", "value": "Invoices-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba235fe-35e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691495600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495600, "uuid": "5ba765b1-38d5-4627-a697-1bae3bcd2a2c", "comment": "Malware payload (GuLoader)", "value": "ed203e9a95bb5aed220c02e3e41840aa", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495600, "uuid": "0a35c94d-0898-4d5d-b441-de16512ec553", "comment": "Malware payload (GuLoader)", "value": "4338ea7febcb6a73ff3a463dc3ff90d8330bfd2cd6d5f760dfe5516c74bdba69", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495600, "uuid": "3fcf1be1-5f5f-43d4-bc3c-f169174931c1", "comment": "Malware payload (GuLoader)", "value": "5b90a10971c35a3f45e58e122c0e25e4049cbb98", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495600, "uuid": "9f343a9b-bab0-4366-a4b4-7b68888799d0", "comment": "Malware payload (GuLoader)", "value": "2f95ecda229ca69f61f7e1498df8d0a6a525a042e478faa3672408cb5d0cb6a3c5af8b68714e49088bf3f0faea1eb901", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495600, "uuid": "abfee892-950c-4dab-a8b0-882e064fa838", "value": "T1A8327D3F9DE851BCC30B20B55860B095EFA87EA79294460FDE70FA68C16279E4781355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495600, "uuid": "1def7be8-56d4-4b0d-8094-ef681f4e9ffd", "value": "192:mya0NnReBWk4N5eNA2A+EnVs+mg1SoBOJYaO36PvdrK16LvnY93cWeszUyDjB:myXnReBWku5+A2bkBdBOJYaOqPg6Lw9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691495600, "uuid": "b247bd16-a4e5-4ba1-b894-eaccccce7364", "value": 11496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691495600, "uuid": "f73b3b86-2331-4e7a-88cd-6a86beae8cfa", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495600, "uuid": "2e989a01-a5dc-4938-a188-719ecd5f33b3", "value": "new-order PI-No202307110.XLS.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145aeef3-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691477522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477522, "uuid": "0eadb012-3354-4f5a-9f2a-5850c33e19b4", "comment": "Malware payload (RemcosRAT)", "value": "7fbef0e70374a3d060f988dfc3a33ee2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477522, "uuid": "48a2286b-4906-425a-804f-47f03144ffbe", "comment": "Malware payload (RemcosRAT)", "value": "43941890cfd819b895745b34b67a20841053b581c8accb91d5fa2bc5769c22f7", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477522, "uuid": "f77bf7e0-43d6-4edd-bfd6-017deaf0d4c4", "comment": "Malware payload (RemcosRAT)", "value": "0283553cf1aed054774279e93730e3039dda27a2", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477522, "uuid": "d5bd9ba6-3765-4205-959e-dfab47eca5a8", "comment": "Malware payload (RemcosRAT)", "value": "e22f4127c6979619885e334b097c6ce822fa2788be479ad619c8e16b0c9a54a648b847c54e34423377bb238544631933", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477522, "uuid": "bf15b30b-e5e4-4755-a6ec-380b455e4ea5", "value": "T1455171041BF90721F3B79D7355B7522188777801D9749B1D008D42CC1B67A21A869F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477522, "uuid": "92235580-efde-492d-865d-71bdfb4e364c", "value": "12:8AXW0m/VnEXzZUllG2efhhi4k5n+knh44HyN+P6EbdpYrn1IlI5u9bOVn1IlBiNg:8AGJtnyUlVefniFnRhpzdd79ds5/f3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477522, "uuid": "d3e4da88-3fd2-42a0-9289-43bd38e7a62f", "value": 2684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477522, "uuid": "528ef18f-0659-4f73-bc8a-9d0c57593848", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477522, "uuid": "2ad75080-2f96-4177-8d43-e5fc6326695c", "value": "Proof of Payment.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7905b3ac-35a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691470819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691470819, "uuid": "b689f544-104f-4b8c-bcb4-b78f133b0f49", "comment": "Malware payload (RedLineStealer)", "value": "2b1465c74e6b08d91fdcd3e6ba325d8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691470819, "uuid": "5b078504-ac9c-4612-9673-95aed2fb16ca", "comment": "Malware payload (RedLineStealer)", "value": "4401ff9bde7c8fa01c34a3b90959ae1e41eba1ca2e0fc6ce57ecce3a34dd25ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691470819, "uuid": "83d6052e-cd6e-46ea-9a83-49ddc5cd7e30", "comment": "Malware payload (RedLineStealer)", "value": "fa36e0328dbc51e2a33f4d20dc1d1620bc873c86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691470819, "uuid": "f877da18-dffd-4ac6-8004-d49d7af67e14", "comment": "Malware payload (RedLineStealer)", "value": "84bcff72afd00648925304a867c91557caff0a7b0fac4b6a530549d1bf70833e7a70a4d86d00320a05effc7e60713d40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691470819, "uuid": "7857c38a-ad88-4c11-a30a-268ab0dfac65", "value": "T1F854F1423AE1CC32C19B85359921CBF06F7F743255B1C94B77840BBE9E32392AE66356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691470819, "uuid": "82e99822-0fe4-42d4-ba61-0af5ba307e54", "value": "2de346935dc4b8f552af9d851541677a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691470819, "uuid": "418acf06-4bee-452e-9fe8-bb7afd99a3b1", "value": "6144:eS00L5rVKRwk5AnG0Daf/oSeJh2QE5slq5PwWW:80tZKRwk5TXo5JxE5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691470819, "uuid": "c2f1a068-2377-450b-b261-a98fb00cdbf7", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691470819, "uuid": "f0e38163-b425-414f-9a47-23d694cccf52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691470819, "uuid": "acc2f0db-87b3-4d6f-be77-cfa64c9ef007", "value": "2b1465c74e6b08d91fdcd3e6ba325d8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1c51fc-35b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691474420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474420, "uuid": "f663c6fd-7709-4ebb-b349-78aa5309d5d7", "comment": "Malware payload (RedLineStealer)", "value": "f88f6f7518fb3c6878c682189e627610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474420, "uuid": "ffbb08ad-d5ec-4675-8296-cefb4c99a12d", "comment": "Malware payload (RedLineStealer)", "value": "445313b315d4804177b96cd884ac97b6f2ab5f71642f53c82ee22b3b4f63637a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474420, "uuid": "8b95e859-a857-4f3b-97e3-0e235f45e925", "comment": "Malware payload (RedLineStealer)", "value": "bb45fe6a290b484af7443a6e0e48465801021b9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474420, "uuid": "9d7aa284-d426-43f3-a556-cde98ddc8bfc", "comment": "Malware payload (RedLineStealer)", "value": "124dbed2f451ea0ea44538a0d7366cb195d3ad1d37e834fb93a7b6dc1b47a47d0fec102b37676e7ee85baae008431543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474420, "uuid": "123e23b0-551b-424a-a2a9-39a6070ba389", "value": "T1DC24D0217AA1C072C177B5304927CAB4BA7FB836E7B5CA4B3B54067E5E312D14E7A306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474420, "uuid": "c30dd5e7-2dc8-46ec-a146-f3073fe53605", "value": "2de346935dc4b8f552af9d851541677a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474420, "uuid": "987ec0ee-f31f-47cb-b39c-9c8e402e84ff", "value": "3072:KE9VaOvn4L52opGGU6dzXZAQY2xF+Q/uoemlfJi6oOihEUVx5ktEdzXo2o53fWSp:huO/4L52opHXOV2OWSv21t4AX8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691474420, "uuid": "061d9cec-927c-41e7-bcf1-57894464f557", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691474420, "uuid": "6046e008-305d-4c98-82b2-4907c95ab0e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474420, "uuid": "3fd7cd2c-476d-4a50-a7f0-485841389d94", "value": "f88f6f7518fb3c6878c682189e627610.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1660160c-35ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691499859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499859, "uuid": "d633604e-cb5e-425c-843f-b6b429834b16", "comment": "Malware payload", "value": "58958c11b5e7f9edebb92f67114ec569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499859, "uuid": "39e0f3e0-1d88-4491-bac1-b61bb7b5e20a", "comment": "Malware payload", "value": "4509974056194a7fc3da788629700ff110e47e374cf26f9899d611e01508ae41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499859, "uuid": "d39fa5b1-56b4-4057-b01c-a78dab692df8", "comment": "Malware payload", "value": "d4c3ef2f0d93dfffc69cb33e50a931da3ddeb5ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499859, "uuid": "23eb10cf-af30-4f34-88c8-cd4296520ae0", "comment": "Malware payload", "value": "255077dd324f2318809a6bdf32446d07d7ee24be93ac8dfdf77289dd2a08107b6a7894a1ca74b342825c8a721f8a68ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499859, "uuid": "49a4cd9d-d92b-4141-be11-1ce7889d7a4c", "value": "T180B22C10ABE8C237CAAD937165A2132007F5F2CB7815E7979D8074DB2E127173D06EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499859, "uuid": "c66343a1-48ff-4266-8035-3a6e865150dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499859, "uuid": "4e732f4b-77a0-40d8-aef4-8972fa2dce1e", "value": "384:SipNYJFYxuZKfcoet5K4fLZKPeXW/gMlHL5RU/NBHk0xMyss:SipNYvYmKEoq5KEJOyNpk0xR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691499859, "uuid": "7164dca4-4861-4de6-9032-1121f6432283", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691499859, "uuid": "35f719cc-be46-48af-9054-084d29fb6c37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499859, "uuid": "1ba444c2-99fa-428a-83e0-4a1ee9c20cf4", "value": "4509974056194a7fc3da788629700ff110e47e374cf26f9899d611e01508ae41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a4e222-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691477633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477633, "uuid": "eb12a267-7012-4e3f-8fb1-8560c6527b58", "comment": "Malware payload (GuLoader)", "value": "62690a5e6470d28421f4ac578296a3cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477633, "uuid": "8c3d2886-52e9-4d8f-b230-1ad8f58aa84a", "comment": "Malware payload (GuLoader)", "value": "4516d53edc70377fd3e646e4b68991c7b5728be43131dbf379a47b16c108664f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477633, "uuid": "a72ac44e-1b40-4929-b66f-312c70910998", "comment": "Malware payload (GuLoader)", "value": "7a4938ff7c6f2561fe3159aa1c3fe18a96905c15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477633, "uuid": "da8bc668-6806-4bd3-831f-f34b8854b5e1", "comment": "Malware payload (GuLoader)", "value": "cb38b81347a2219ab406f1d3a55bbdce1bbca0a1d04dcdc19029462a490401af41fe551dad522a0a6cf96a9f7660822f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477633, "uuid": "b9bf9f2e-fa49-4bf9-849e-e0a8f67dbc21", "value": "T13C94BF53FB26C5E7EE3D63F3B493A5EF2DE865664E84409A7BD2E7D51000A224F0D428", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477633, "uuid": "18e504f8-0bfa-4050-a0f5-605ac698a489", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477633, "uuid": "8f4bbbda-c5f2-493a-a53f-29f91501c698", "value": "6144:qPX0UPlrkcqMGIJjB9rVLd0e7OSomJYQCGAZq04f08/Kv3ZXzVkTcP:8lRGIBj0g/omJYTGAn4c843NBkTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477633, "uuid": "63482bb1-a6d7-4ee0-996f-c47b5ca2a4ff", "value": 418528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477633, "uuid": "bd5a4972-9520-4074-ad5f-f916aaca5288", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477633, "uuid": "8fa9d7f7-12a3-49f1-9663-89e75d64ff79", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779cfb99-35d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691489715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489715, "uuid": "50083616-8344-4fe4-be30-05667784fa74", "comment": "Malware payload (GuLoader)", "value": "05cfcf1b8dcf4964c222206f1afc5494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489715, "uuid": "e64c53a5-9e1d-478d-9b56-00779dda79dc", "comment": "Malware payload (GuLoader)", "value": "470d1893565b609a60c2a9d64a15fbd5593dc65a95a1cb98f0ad9249fc5c9188", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489715, "uuid": "1835e972-27bc-4a08-827e-b5f36598f925", "comment": "Malware payload (GuLoader)", "value": "9ace84f52a93b11c99a1fda7952ae10a7d380d7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489715, "uuid": "fdb52ae3-d335-4db5-bbb5-576f0c1c541a", "comment": "Malware payload (GuLoader)", "value": "f514fa1f4dcf12a625bb30e58971ef2da0870f95afa1aff9b3da8f4a1a3fbff71abcd35d5f1a8057f5778171754e8bdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489715, "uuid": "5dd46550-ed2a-43de-8240-375faffd2de7", "value": "T163B402B46B24C2C7FD320E7405156B62557A9C299CE3CB4BB3E1342BBA723C3941D97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489715, "uuid": "01d45bf2-1765-479e-8ca3-2326c681b422", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489715, "uuid": "cdcbefce-26a5-4bef-9809-17b2ee3423b9", "value": "12288:D3kpU5ETsPwBcTZ6oVDxMdZiYNaWKUQYyIqpgVAhXptE:bkW5ETm6oVDqAYsW5QJqAh5tE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489715, "uuid": "56eaa013-6359-4b03-92d5-2a28422e5ec3", "value": 531152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489715, "uuid": "29206e41-a941-4db4-8cf3-248edfdd3612", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489715, "uuid": "2ddf0b4d-a86c-4c20-affd-3789c5171917", "value": "4500673011 xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487a339e-3596-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691463007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691463007, "uuid": "77e73c55-2f54-4b11-aff9-21461997ff55", "comment": "Malware payload (Mirai)", "value": "32e70b607dbee939fb2243e0e117b0b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691463007, "uuid": "bf8a3251-e57c-4062-84ae-c0fb6923ef5d", "comment": "Malware payload (Mirai)", "value": "4852c4d94033869a7ec2e5f8d378ed1965d243ceac6d805f87628d1eedfeb6d5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691463007, "uuid": "508bf3f5-0046-4e0c-8b5d-297a98f5f2a2", "comment": "Malware payload (Mirai)", "value": "d626c50a3ff2a7ba0c5f3034125010b174bcb76a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691463007, "uuid": "caf84b69-0994-4500-9290-0e885f4eb634", "comment": "Malware payload (Mirai)", "value": "801f0ebd92712c1ba1aefbb75a0324376aefb64b6e6df5086e62bf387dd6ef9161ee99ac9eac0abbd2ac980d43b27614", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691463007, "uuid": "bb6d8cbd-d384-4166-9a8f-b33ecec04bb1", "value": "T1FF434A95F8828A13C1D1127BFA2E968D3B2563E8D2DF73039D301F61369B82B0D6BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691463007, "uuid": "14c90820-2efc-4968-8aef-8cdd13c06fa4", "value": "1536:L5wmKQGZbpWaRWKC51It5XcmZuAb+10mM:L5wrJgKGabXcmYAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691463007, "uuid": "422bf485-0303-4b37-8ea1-1373f8d56d2e", "value": 55688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691463007, "uuid": "c0e4194a-0087-4e2b-9abd-f4b8dd462733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691463007, "uuid": "e783ee02-bba9-41dd-a32b-012dd1cc363b", "value": "botx.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6f250d-35ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691500546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500546, "uuid": "7487d570-7d4d-4ce4-855a-51956c340f87", "comment": "Malware payload", "value": "5b65ed856431309b6c2c69cedc43901a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500546, "uuid": "0e0e6263-8d3d-476f-957d-2f54ec45eabd", "comment": "Malware payload", "value": "486e4959d116b7e5c3f14800e3b55bba2cb725b381539466ddc761bd6f8ad929", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500546, "uuid": "1c32f750-01f7-493e-bc3b-6c5d71a83f02", "comment": "Malware payload", "value": "69ea17e4031e0a1d23709f2b4c383c3f1deb6ea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500546, "uuid": "d3d20c83-9269-42e7-9dc3-5b4d14235c6a", "comment": "Malware payload", "value": "0c446c6be0c463fa4d2b46aacf3032a6ab9b2e8e3ba3e2e3880e27040d3601da975510d5d5b12806e16d0326872e24a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500546, "uuid": "99d0e4e6-784b-4823-a16b-3568e6c4251f", "value": "T114534B566D91540AC9D4BBF825F091572A32BDE10120C1CBA8FDFF299EB2353EDC51AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500546, "uuid": "72b0d505-b496-4284-bb37-50aefe75874a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500546, "uuid": "3501a042-c490-475d-ac96-29a1b30b21f9", "value": "1536:cyNGdS8Ai0KLEN+Mr630VDFN7TPxdF8o75F943hh:cyNGdS8Ai0oEN+LEVDFNfxvXX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500546, "uuid": "8643fbe8-ca9b-46b2-983d-7f6c089819d2", "value": 63560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500546, "uuid": "b5df8568-d439-4735-99f3-975dc16ca192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500546, "uuid": "b1aaadf2-8ea8-4002-b382-f681abe4b34b", "value": "486e4959d116b7e5c3f14800e3b55bba2cb725b381539466ddc761bd6f8ad929", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bae168e-35ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691499036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499036, "uuid": "b48d25fe-5e4c-43f9-973c-bcf90942fed1", "comment": "Malware payload (RedLineStealer)", "value": "a6d70cf0c7fa28e70a01ed72bcc02d73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499036, "uuid": "3a37f1cf-835b-49fc-b4bd-b80f6cbc426c", "comment": "Malware payload (RedLineStealer)", "value": "48ce6d3980118b53846390616ee0aad6528b90fda1bd6d1b82e7a095a5f85bd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499036, "uuid": "a16c9337-a289-43bd-a63f-4ce96609f29e", "comment": "Malware payload (RedLineStealer)", "value": "0fb8e21597c5baa97ea07b83857d846b86562e0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499036, "uuid": "a542da27-441b-49f8-85bb-0bb7a89b1877", "comment": "Malware payload (RedLineStealer)", "value": "8cdac11dec28dcc39c2ec4d33e2eb03c5f3fad041c8e30ff739f9d34e3d2395c0e5c6a6018db44431bce854ba97b468d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499036, "uuid": "844d03dc-292e-4535-81f1-31c6438fbfdc", "value": "T1E0935D1AA3DD8924E67F0E707871111D43F1E8436412E78F4DC9B0EA2F66F88576A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499036, "uuid": "ef8a2667-0ba2-4eaf-94d8-4bc72dfcd7af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499036, "uuid": "9e333079-b444-4dac-b90d-3c8fec522290", "value": "1536:GoTx9HNwDE1lDTN1QFzxMgwCrB/atqgdbibEB/l2kdoSGe:GoTxFPDTN1QBqgRJatvqEhf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691499036, "uuid": "a742588c-7c1b-49e2-baa6-1ecfd808fc3f", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691499036, "uuid": "55e10aeb-0f38-42ef-bb6d-45c368023f14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499036, "uuid": "84598354-4af5-40de-baa4-604c0f50bf14", "value": "a6d70cf0c7fa28e70a01ed72bcc02d73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce606758-3632-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691530233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691530233, "uuid": "01f1a254-6344-4b5e-a117-0fca0abefd14", "comment": "Malware payload (njrat)", "value": "a92c04a27c09720c1732d8e415b70c58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691530233, "uuid": "9dc287c3-2959-45c3-accf-0d5c9041b9ec", "comment": "Malware payload (njrat)", "value": "49a566cb2d4743882065069c82ba0b7875134928fcf6fdde35dd8873426839bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691530233, "uuid": "d758d264-e04e-4afd-9a24-d7a09df1291d", "comment": "Malware payload (njrat)", "value": "7021a1e850a1ea47e09dd0d516e47ff8cc429575", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691530233, "uuid": "a8f1a4c7-319f-460c-ab44-028e87a25c7f", "comment": "Malware payload (njrat)", "value": "897ab901f0489f93728ddee037df98818197f5a6ffd112cdbf24ac3a3ee366d77e2cb8dd5b93c51cc0d2ca105a08d8c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691530233, "uuid": "3437f77a-5b61-4a68-ace9-3e24db5fb2a9", "value": "T1D8D3CF852AE48305D4AC0536659EB9F082EEFE4E0811CDDF1AF0F38A997339FDA07558", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691530233, "uuid": "7d326103-96e4-4cc3-83b3-1ca76be7ee30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691530233, "uuid": "f18291a1-28e7-440a-9d96-6e2eb275e9b9", "value": "768:yKm+71d5bRpcnu3zb4KkQZFpmnfR6x0iKK0zp4p3ZtL:hm+RjbRWujbiQnufwx0zbapph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691530233, "uuid": "15cf7aaf-037e-4751-87e6-91cf2dbfead7", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691530233, "uuid": "c1dfaaa6-7c1e-481e-a9bb-ffd6daa9b1ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691530233, "uuid": "ce89a0d9-50cb-429f-8fa4-a5000e8d6653", "value": "a92c04a27c09720c1732d8e415b70c58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6b10bb-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691478829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478829, "uuid": "8ac32dc7-0ad2-40f5-92bd-d58425ae6270", "comment": "Malware payload (RedLineStealer)", "value": "ca4bfce8a365bfb03c75124dd9cb6d1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478829, "uuid": "d3df5de5-99c1-4ea7-906e-5e166a87c731", "comment": "Malware payload (RedLineStealer)", "value": "49f7946475a14333766672334d78118ae982e4071b716f4efcfb919a67d972eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478829, "uuid": "261d6113-2627-4edf-9f32-1d301d333919", "comment": "Malware payload (RedLineStealer)", "value": "452fde2747cc80fbe07a8ebbae9f0d04a76e9d1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478829, "uuid": "be922535-0a9d-48ca-a548-8d3bbfa17dde", "comment": "Malware payload (RedLineStealer)", "value": "568f062006d94c4612f270a7a273f789f6624cb108f21b04730d8c03a1ecb2d8200623114c289a4d65e022420b12e944", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478829, "uuid": "578b0b96-b313-4f35-b366-44a9532fdcbf", "value": "T1DCC41212B7E59032E9B45BB058F203530F39BC9149B9572B2B87A99F1C732D0A53277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478829, "uuid": "f64dc180-ccad-4941-a808-5de47117a75f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478829, "uuid": "a239646a-587b-4c9e-8c47-e438fbfdc089", "value": "12288:9Mr2y90TVUFkxkis+mDyWverS7gBYCiehFFk2CR4s:7yGUGdsj+oCLza2I4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478829, "uuid": "bfd137d1-1ddb-4ed7-a571-352d2836604e", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478829, "uuid": "7b50b6c1-41ba-43e2-bec3-81c678a2c2fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478829, "uuid": "9a79dd1d-15a4-48ef-959b-7ac2adc62710", "value": "ca4bfce8a365bfb03c75124dd9cb6d1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f9119b-35ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691500909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500909, "uuid": "195be5e3-c69b-480c-9d8f-e9b55a27ddef", "comment": "Malware payload (RedLineStealer)", "value": "c7f0983f3900138bbec9aced9806a70a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500909, "uuid": "0953d1a2-c6da-4879-9c40-bde05b2015e0", "comment": "Malware payload (RedLineStealer)", "value": "4a0e14dc39091597b1baa72d1e107876e13cb2806fbecb37f329bb3ee079de46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500909, "uuid": "00a2259f-fef8-4418-a1ee-247918989d89", "comment": "Malware payload (RedLineStealer)", "value": "ceef9eb820283665f5b9c27ac1b4348b4d8a939e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500909, "uuid": "0cb6f760-d313-4840-9111-f2cc7f9f94d3", "comment": "Malware payload (RedLineStealer)", "value": "c169098711badcf2f22352e88e96dfb4501a9c833cd958cbe3af48c5b169aabc313931f37d5489e8a2a7cf841784ce7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500909, "uuid": "82b9e15f-e312-44f4-aad9-85b6b795dfac", "value": "T10C1512207490C1B2D6B2267584E7CA7D47B931B0477B96CBB74D27BA1F122E193362CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500909, "uuid": "ebbcf48f-476f-4a49-a711-b041b1b66eec", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500909, "uuid": "ce006e82-aa6f-4d7e-b3bd-9bdb145af83c", "value": "24576:Ek70TrchSLDy3XfRMqjU9SIFblnV0KUYnKeR6JNVoooNm:EkQTAhSfy35hnA6Kn0H6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500909, "uuid": "8cb69635-6aa8-4943-99a6-e835e570c9f7", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500909, "uuid": "5d2f4bcb-1d44-449a-84a5-4f2968581661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500909, "uuid": "a4efda5f-9c5f-42ee-823f-2ca63d73cb7b", "value": "4a0e14dc39091597b1baa72d1e107876e13cb2806fbecb37f329bb3ee079de46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0caf20e1-35ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691500702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500702, "uuid": "8793ad7a-888a-44da-8306-89e0acf0ed61", "comment": "Malware payload (AveMariaRAT)", "value": "a2fe6a19174c433e304629876ae3e83e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500702, "uuid": "95144d29-b107-46ac-a53a-3097462dca33", "comment": "Malware payload (AveMariaRAT)", "value": "4aed7e79799b99831a8e43da5e4ead88792f7852560cfe80aab8fc3663aa0c14", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500702, "uuid": "149a9dec-3218-494d-90c7-3322bf199835", "comment": "Malware payload (AveMariaRAT)", "value": "7fdfd511b37459a131acba5fd4cfaeac2596bb00", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500702, "uuid": "6759a05e-0478-4dd5-a40c-9c8137aaf00f", "comment": "Malware payload (AveMariaRAT)", "value": "c85d5804e597029edfb610a7b86618aa2f48cec4d85d5856fcfa03e4859565f1a359e82911e5459faa1438e847b8f21b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500702, "uuid": "9f213d93-7364-4d5c-841f-9dca9ecb0db9", "value": "T110E470626526294EE92A3171D052F36D86058FFC4D37DA4CFC09F21ED272B831CB9A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500702, "uuid": "cfc2d1eb-41a0-4ad6-9081-d0e3c34fddd1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500702, "uuid": "96cbb475-10be-490f-b531-8125b90183cf", "value": "6144:WYa6wA+J7XPJnad1zbOJY5uW8lhpx0o36:WYyAQ7fJnynOhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500702, "uuid": "bfa6230e-8c46-4e39-b196-d31956060adc", "value": 694337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500702, "uuid": "a2af1b94-bf58-48b6-b084-5b84de5d0f06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500702, "uuid": "1eeffe28-81b7-4854-b446-6218795d7eb6", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc4958c-35e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691495120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495120, "uuid": "935aa9dc-7f03-4061-ad28-f0f82f3ac397", "comment": "Malware payload (AgentTesla)", "value": "bf0539d873b2f9edb57140089b3a9299", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495120, "uuid": "450cd922-e168-4a0b-84fc-6d087ef1f715", "comment": "Malware payload (AgentTesla)", "value": "4c07e47aee6d362fb55a3bdda00c91ee39f65100a3e740b52930de37bdb674ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495120, "uuid": "c66ceab4-5a0d-4b42-82c5-875fad180772", "comment": "Malware payload (AgentTesla)", "value": "ed75238c6769575a42d75a62dcc02e6eb3060c09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495120, "uuid": "acd83c75-1572-48d5-97b7-3d0cd1ed0a0f", "comment": "Malware payload (AgentTesla)", "value": "e6f9aacca589f58486f755f0c6b7f547146cd7063ac89541ee936d6e96d381c2853e857da37da4ab63806ed66c86c899", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495120, "uuid": "c2768a05-b83e-464e-981c-6a1f3fac4dbc", "value": "T167052358FC805E26F87EA776313F69201527ED47B3B1A6081CBD32117B7B391AC1AA47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495120, "uuid": "da1423e5-2ac4-4397-9ca6-87173b155d2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495120, "uuid": "7c6e62a2-29db-4b90-9cc5-bc2e1b8faf2f", "value": "24576:hYdZT37nQU03TElSNHofvliEorqe7BksQneb:hA0U03AloHoXQ7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691495120, "uuid": "590a222a-5606-48f1-9259-03eb47b601b2", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691495120, "uuid": "a106836f-ae6c-4188-87ee-db488e77257b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495120, "uuid": "1737a712-ed5b-47b2-982e-cd9e04866f43", "value": "4c07e47aee6d362fb55a3bdda00c91ee39f65100a3e740b52930de37bdb674ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2b7cef-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691478802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478802, "uuid": "ac40c117-d677-4a01-b97a-2ca037683e63", "comment": "Malware payload (Mirai)", "value": "a03e319091ad90f893ebd1f8404b798d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478802, "uuid": "8b241aa5-5a3c-40c3-a3b4-57dcbde25b68", "comment": "Malware payload (Mirai)", "value": "4cfaae35d401b2d32aa038beda11cd27443d01be4cdea8d1c9dcb7ddc50b01da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478802, "uuid": "aa59fb03-a29e-4d11-ac1f-096c2ddcb82e", "comment": "Malware payload (Mirai)", "value": "f724030069468b3fef596135526613c15bcb12c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478802, "uuid": "d6dbfe0a-60a0-4aed-8a92-cc1b47e08d23", "comment": "Malware payload (Mirai)", "value": "2ed75f0e4a0d1e175612185700813ad0c9cb73d440dbe30dca31ef59f01f0bd610de49e9c9e3616e83db9596188e334c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478802, "uuid": "599c9281-eb3d-48d5-98d0-84cf9e14af32", "value": "T13093B71E3E258FBCF79D823547B78E229658338A26E1C545E15CEA011EB034E741FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478802, "uuid": "21f5a6c7-e08c-4713-807c-e09cee316a80", "value": "1536:bK/QR35eT0Ata648QFjyAOVDZZYHWmdXmaYkhoh9x:ke3sTPiBeAOVNZrmdXmaXhab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478802, "uuid": "8e0e2e8e-51a4-4c56-8085-068df6bb1439", "value": 89628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478802, "uuid": "f30bd202-a0e4-488b-81ef-62f5c33b1295", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478802, "uuid": "8b76c164-9bfd-4954-983b-ebf5ba26e153", "value": "a03e319091ad90f893ebd1f8404b798d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5bd493e-3604-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691510408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691510408, "uuid": "0aa90d3a-38a4-4f51-914e-86b4518ac574", "comment": "Malware payload (RedLineStealer)", "value": "f5747266389c82de80847a13920351bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691510408, "uuid": "ab9b8211-26cc-42a0-9269-811ad45d2bf1", "comment": "Malware payload (RedLineStealer)", "value": "4d29ca0407ae73309a233d185d456fa687209d5db8b0e0c79faf02113134b569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691510408, "uuid": "389523ff-d7e0-4cf2-93b0-26099c5a31bf", "comment": "Malware payload (RedLineStealer)", "value": "172a789969d293505b7a345be244b153beb588ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691510408, "uuid": "b7c3e191-6b56-4366-9f0c-e29e2015ab46", "comment": "Malware payload (RedLineStealer)", "value": "969336c4b796f7c4a41f912f9e15b1a9ac14b5ad6a0ce5c1dce91d3e042979e32ab737ca35e4c71b6abe6336e5f35398", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691510408, "uuid": "37b234a0-6269-46a4-bf3a-f10f9ae2515e", "value": "T13EA4C0D266907865E6670B327E2ACAF46F2EFC918F0577DB22487E2F09711E1C631712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691510408, "uuid": "d6f16589-f27c-453a-8fb5-ce27121885ff", "value": "52d0e35c520458543d7ae579063fd12a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691510408, "uuid": "661bb64c-409b-4233-9ea1-87cb338b2c92", "value": "6144:wMKezNXZ94I8jjP9m8LBVeW60MsfsVlF9oVlmg2Ddw4zVA7:wJehXZ94vkCVn4Us/FWnIdwWA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691510408, "uuid": "e8731e55-b045-43ed-9f15-685e78a9fcc1", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691510408, "uuid": "c062f67c-7e15-4471-8511-dfd6b31ea8e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691510408, "uuid": "586fab7c-2c5c-473b-a509-ad7e4ec8fbcf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63bdada-35dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1691493766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493766, "uuid": "3b4be1d8-9757-4d62-ac1d-36ab1ecbec29", "comment": "Malware payload (Tofsee)", "value": "a5d65f69175e4f319b24f72d672277cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493766, "uuid": "04462f7c-ba83-49c0-b7c5-c8a34a0bad2c", "comment": "Malware payload (Tofsee)", "value": "4da7209376cdd1a659f1755fd7e1b016b7b67e22bf42cd9cdcf7dd1691ef3d0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493766, "uuid": "b6c62d69-2ed5-468e-bce8-728ca6447f40", "comment": "Malware payload (Tofsee)", "value": "1b67910d4f5db92936070cd5e78381ea86b9fab3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493766, "uuid": "66ec8703-aeaf-4eb4-a4db-ecfd5fe91892", "comment": "Malware payload (Tofsee)", "value": "80e983f31b255dc5ad91ff70b5eed00f4a0c8aba28ee68b2a14d21e5717a2e190a41d17246cd4ea3c244bef0a9bf0e89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493766, "uuid": "0e9dd5dd-1fbf-4fc4-8440-e4a6a5df6dae", "value": "T17F546D03E69C6B62E5D28A324E2EF6E4A71EFC91CF0937DB124C7A2F09711A1D575702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493766, "uuid": "6328dbb0-1c8d-41de-b889-8a4b1bc9af18", "value": "81d6121cffaa48653088a63c1ee15a1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493766, "uuid": "ddb5cfbe-829e-46a3-b83d-be3d67b8dd22", "value": "3072:h8WAbcAddvkpT+9LqS0HUANJYDiK0QQ7q2P/3c/h5rGQx6ad/c:yhNdET+EFUjiK0le2P0KA6q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691493766, "uuid": "4813b9ed-3bca-4b13-9f57-7d0263b14123", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691493766, "uuid": "39375091-6d1f-4025-ab7f-e48bdbcb9124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493766, "uuid": "b8023cdb-33c7-4417-894d-161c723d2a73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5f28ff-35f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691503812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503812, "uuid": "8fcbf4d9-295c-4399-ba17-6188e4ceca1e", "comment": "Malware payload (Mirai)", "value": "23958a75a4e54bf29c96718ee81e70a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503812, "uuid": "3cdb8de3-a9b5-4975-ba8b-db7f4bd8dbed", "comment": "Malware payload (Mirai)", "value": "4dbb8dd7481e84a3b153e4e35b93bbef1c595449c42c921300dfc2cc20eec2ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503812, "uuid": "eef5df98-008a-46b6-8c6d-285470032ccd", "comment": "Malware payload (Mirai)", "value": "6e512bc1d5b48826dfa59d29cbb5cebc843e9ab9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503812, "uuid": "82cae603-cd44-4a17-a904-7dbee2b03acf", "comment": "Malware payload (Mirai)", "value": "67ce75d97c5a340e53ad1fa310fcd1b15e8c3248231d3f0dceb62923771a6eb5010ea71fec11478a1e80a1750bbbf5c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503812, "uuid": "6d24225a-d81e-4254-8663-1e960680726a", "value": "T129A2D025C2D04C6BEAEEFC705884C6C077E09E996BE9CBD337E4DB0265590269604DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503812, "uuid": "818f85f6-15e3-4984-8e5d-64a77f8a0915", "value": "384://rJg92ZdhXmy/Avh6SQJl5Y/m2isEshgtqgvtGe7RoFn4Ye1M4uVcqgw05VxJJo:/TRZdhWkAvISol5ihSfaq04uVcqgw094", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691503812, "uuid": "9f75eaa7-98b0-4956-8e07-879ad47bf522", "value": 21868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691503812, "uuid": "eabed1f7-6a8e-4bc3-8c1f-30f91444d157", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503812, "uuid": "f1a81020-9652-464f-a697-cbfcc62f1005", "value": "23958a75a4e54bf29c96718ee81e70a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3528d40-35e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691497573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497573, "uuid": "0f1b2501-8974-4e6f-ae1d-ba233d05940d", "comment": "Malware payload (Formbook)", "value": "aab9b51ca1f05e2085708dfc2f8d0d58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497573, "uuid": "92cc10f5-2425-4f7d-b2f9-1a8f679225d9", "comment": "Malware payload (Formbook)", "value": "4de7dc6c64cdd1b536973e84afd2b05e3781c7b1059dc05b8a7623d05ec1388b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497573, "uuid": "2077b78f-dd00-4deb-8181-3ae767db6bb5", "comment": "Malware payload (Formbook)", "value": "9ac0bb21fb05832cc8121feb6406ca0091f99c76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497573, "uuid": "7846fa11-1765-4bf1-aa8a-a85d98ba159c", "comment": "Malware payload (Formbook)", "value": "4326eef8e5053a1451d01ddae74d7ca3142725a75d7923c70421d1ff70d4676dcf58e8546a662b1957e989ed85f09ec0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497573, "uuid": "80810dd0-5cae-4680-97e8-596db38aa9ce", "value": "T1B9F4F05651154203E6071FB8D538BF344EEAAFD76832DA8ECE29B5D33A72B8E0461C53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497573, "uuid": "093a7625-7d16-47e3-ba51-2aa8f5b16983", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497573, "uuid": "9d85198f-ef23-4b2a-86dc-15d56d34575c", "value": "12288:s5LbzIu9+r9rYEqOlsNFEVhgFfRVESrALC8ekClzoRDrbEyhUUjlrLXPofdtN:s5LA9EEqOqwILG5LBXCl2nQUtXet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691497573, "uuid": "311dec5e-e76d-4806-ba13-dd02c5008d39", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691497573, "uuid": "083c5573-45bd-451c-be27-01f87dc58e12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497573, "uuid": "58461952-5c20-4402-9561-d63bf70bc9b1", "value": "4de7dc6c64cdd1b536973e84afd2b05e3781c7b1059dc05b8a7623d05ec1388b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4899b5fa-35b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691475462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475462, "uuid": "598e985b-25ed-4fd4-999e-1bfa1bdaca8a", "comment": "Malware payload (AgentTesla)", "value": "c290bcfc39aa5061937f8a7caf5ea4fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475462, "uuid": "554e1f55-2ba8-4f0d-ab05-755ef25a0082", "comment": "Malware payload (AgentTesla)", "value": "4f04a42a32afc88988279c6bd13c58623b9d8989d11119be3f1e3a35fe4d7fa0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475462, "uuid": "c38a358d-9ba4-46b2-9f32-57bfdc79e2c1", "comment": "Malware payload (AgentTesla)", "value": "857bd1614f537f6d9b0adb99f2fb7e733c19f6d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475462, "uuid": "f840b53b-4fdf-460b-96dc-ebb379e4aa9b", "comment": "Malware payload (AgentTesla)", "value": "ca8c397e95c672d7af3a1922448e3ac49143a2e5eecde03f9043724eac42d095e3f74f64c9a94d9f12dfb05c04621bc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475462, "uuid": "d466e68e-c609-4b7d-90ca-c79e9b68f1db", "value": "T105050201377D9F36E4F593F9253920601BB1346E29ABE6680DE2B0CF1976F109A11F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475462, "uuid": "d5ff745f-be6a-4e9e-94f7-128c7464b44e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475462, "uuid": "5ded5e89-b291-4adc-a886-6c3f137a6166", "value": "24576:6cHiBfXOMv9lCWcVtnkta+shKqNl7iQ1:6cHiBxlFcV6a+sXl7iq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691475462, "uuid": "8067b2b7-e11f-442d-bbe0-ca08b4cd29ff", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691475462, "uuid": "cdf78fad-d4e0-40f8-9699-bc729750a1a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475462, "uuid": "dd14020b-33b5-412b-9bb9-d735d1fee58e", "value": "FedEx_AWB#5035329204643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d254291a-35b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691474405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474405, "uuid": "b8da3e30-eb2c-45e7-bc8c-fd51805ce16d", "comment": "Malware payload", "value": "d716451eb9ed0c4a929ce39f44841a1a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474405, "uuid": "5287bee7-56cf-4b9a-9d0d-5b15dd08c3c2", "comment": "Malware payload", "value": "4fbded3b418a80de910f5d05b2019eae114b8351b176a83c6a0a322d9130b8f6", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474405, "uuid": "e69b4585-5a41-418e-b9f2-98e1e8ebd42e", "comment": "Malware payload", "value": "2a140bdfa24f5bc5195f5c2efaaf11e476adc8ed", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474405, "uuid": "832dcf8b-9cd0-4c12-a757-697417bc2367", "comment": "Malware payload", "value": "ede16c6114774cd685fcd973e6d3bd93061bdc6a9d3df16b419af2161ab7dc06448f7ea7ecb9b499fbb36c275bb2ab88", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474405, "uuid": "7f7dacc6-ee47-4641-abd0-646aa6124ce2", "value": "T19773184AB951AB02D4D321BAFB8F414933536FACE3F972019D24AF6023C799B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474405, "uuid": "e5672653-b067-4f40-9b26-b4ecd8a99f5e", "value": "1536:TBnhnk1HRuCx29DlpLe7wNZ2Yk6b4NJP3XelGy757iQUKaS9PzY7+5l7:zgFEZlpUkZ2Yk6b4NJG3UKaS9Pzh5l7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691474405, "uuid": "e4418599-a2e1-473d-84d9-c639b456b93c", "value": 77728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691474405, "uuid": "025e1781-2226-430e-94e6-2d92c9e20ffe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474405, "uuid": "9b8add90-e754-4b92-848e-f562969151e1", "value": "loki.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0f569b-35bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691480540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480540, "uuid": "f36c296d-619b-477d-bcd0-180cc05c036a", "comment": "Malware payload (Formbook)", "value": "45eac982af79d0b7f7ae032514c67deb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480540, "uuid": "a8501b52-9cd4-4dfc-9d3c-f02b9f479aff", "comment": "Malware payload (Formbook)", "value": "50d4047ceee0880eaafa9f27bf63914481f101c5e47fb8fe819a36362de036c9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480540, "uuid": "38da0347-73c7-4738-81f1-8218f4af110a", "comment": "Malware payload (Formbook)", "value": "7ea5ece4917f90289e5bc52312843d2c4eee1ddd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480540, "uuid": "6a69f67f-5705-47a0-a29e-8014a1fe920b", "comment": "Malware payload (Formbook)", "value": "ecd498be6ce4ba3769262a5e93cc713e9420c81d0edf913891b10897a6a34fcbf350c2b29b25ef822abef8dbd8ff3db9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480540, "uuid": "48d6d9f0-7723-40fe-9f58-4caac673aed8", "value": "T16D630268C34F01A9CFA662379B675A4545FCBB3AF24052A1306C437933EEC3D922667D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480540, "uuid": "8063a688-d6ea-43b9-8739-839b30dc7b42", "value": "768:swAbZSibMX9gRWjqg3VVeMvHR3mCsclD6:swAlRw3SMvHRflm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691480540, "uuid": "5bd2ecc8-8cc9-49d7-85a4-0aa32779a9c9", "value": 66823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691480540, "uuid": "c81d3ab6-1c4a-48b9-b16b-0c08f22b1e4a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480540, "uuid": "9f1466c7-5781-45dd-bbe0-63487788404f", "value": "45eac982af79d0b7f7ae032514c67deb.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8466b6d1-35e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1691496608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496608, "uuid": "c5af7765-d1cc-4b9c-a2dd-d0f1030f63f0", "comment": "Malware payload (YellowCockatoo)", "value": "233ef31fafedb871160f3e3ea53b01b8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496608, "uuid": "581f6481-a5ef-49ea-87c2-acd839d95ece", "comment": "Malware payload (YellowCockatoo)", "value": "511637bf26adb8ac42cec6f38da7cc25ceee118e4a5f09e61bfc39defbc97809", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496608, "uuid": "4b0024f7-d6e4-43b5-975b-e469fa921620", "comment": "Malware payload (YellowCockatoo)", "value": "995b912f42cb2965988b2d8d1d6d54c025e40583", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496608, "uuid": "9aa55e6b-39cb-422a-a388-e0d7ee8b225f", "comment": "Malware payload (YellowCockatoo)", "value": "e41f975adbbadb66bc727ce00ff03f2c9819cc587cfeb1ad762ff575e67c92e835e7fb32cc08060dca3d44ba3f3379ba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496608, "uuid": "672197cc-d412-4ca1-b3c2-d2bd5ddbd0a8", "value": "T1B8E4DE103BA4DD508B2C56E868DB97079B2762A7EEEFFF0346A29174191B86347503CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496608, "uuid": "9e84dcae-76f1-46cd-b3b5-d301217b0e2a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496608, "uuid": "125e19ea-ccb3-4b6c-92b1-352e0f78e048", "value": "12288:3zbuRd8O4cSMwiLLWS3NPPQGGtwi/zoqN3WB7FiK:v2y/ctw4vIyi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691496608, "uuid": "186818e3-c4df-4a44-b85e-6f2780e2cf36", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691496608, "uuid": "bb284c5d-51e4-4e7f-999d-61603f1513b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496608, "uuid": "315ec178-e385-4905-a567-c7ce6a100876", "value": "PABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZFSP9NEtuBPTLI7uJGKY4GRQVcR_TCMPNRCVLDOgBGKXzSQCREyS_B403SKXFN4NWENI.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fed0b6d-3611-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691515874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515874, "uuid": "93461562-dcf6-4e42-be8d-3a94bfbd20c7", "comment": "Malware payload (Mirai)", "value": "e2336acccc2d793a889344c8cf007071", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515874, "uuid": "d9ca557c-586e-434e-9ca1-270f6e336b3a", "comment": "Malware payload (Mirai)", "value": "518d8fbdb9ee151a0798305e5ef530c15cdd91fbb9a52545e35afa96e61f7417", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515874, "uuid": "2f8d7425-9599-44d4-9853-843c6c377afc", "comment": "Malware payload (Mirai)", "value": "dde30b2af4adec38a977b3f47d8394ec485812a2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515874, "uuid": "982f0e73-ed7c-4e5b-ba7f-ca8d5ca8f5ab", "comment": "Malware payload (Mirai)", "value": "b9e302c0891703f8ea5e249a4af0d36f11dd59ef2e1d43d5d304cd5cdc69de532410b808c6a2e81652f5a3b8e950375b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515874, "uuid": "ca59a931-9e6b-4f88-be96-ac7125183cbb", "value": "T1E882CF30619B75E4DBE10435FAEE8EC6A71A0BF8D1FC36D217587B788A4500611F92DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515874, "uuid": "1a67494a-a786-4b71-8533-a733eb20daa4", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaEXhymdGUop5h5lY:6GV0P6+kom0tVAoNvm+to1EXs3UoznlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691515874, "uuid": "5d1e526f-a7ef-45fd-8ce5-6098ae3e2cd6", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691515874, "uuid": "e8230c53-d0f3-4d1e-8eea-bb4e32679dd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515874, "uuid": "4af581b2-2c43-4034-8904-b9c2151d007b", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce543f98-35e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691496732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496732, "uuid": "27691b40-7dfc-4ba9-a1a1-7a60b9b91108", "comment": "Malware payload", "value": "96f18afc0b7c8d90da85fa2d37cf3b0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496732, "uuid": "a202b45f-3cb1-41b9-b229-a71837351ebd", "comment": "Malware payload", "value": "5226f056143959145b5f9a744ba2832b6f76089c258830271002b1e9f54e0489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496732, "uuid": "164527e8-6414-4533-9b6c-17549e946f52", "comment": "Malware payload", "value": "39bf29b4928cf7e1e9ea9c21e3e064fe04b925a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496732, "uuid": "b302cc2a-ecfd-4b07-a0db-782a23e766e4", "comment": "Malware payload", "value": "304658a3bc8dce62c2de5ae3565643c80e891bd473b379947a824c8d170a54927dc3c809251fcbb7d835508e5e523e76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496732, "uuid": "5e7ce027-e787-4f95-95bb-78c2df35f26a", "value": "T1D07633303FE298BDDC16DD70A012C0E963A62FBA343711262A0FA8DC2577E52959F5D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496732, "uuid": "19ed6854-f571-4a5d-8a55-109e6ac7786c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496732, "uuid": "a9a1c664-d29e-4a7d-88b2-23e44b33c5f1", "value": "98304:LlXJQ3gjPfCjOEQy8BiGulN0D5Elq1JD5x5BLTl3KteCgihJ+PDviGr9sXnQtFw1:duVgBi1BUnD759l3KM/k+bvikEQ7w1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691496732, "uuid": "257e92f3-e850-4e96-be8b-ee56f62949a7", "value": 7150036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691496732, "uuid": "7656544f-9afc-4fc1-8021-858df329cb6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496732, "uuid": "9b2c811b-453e-4e8d-9b15-91b10d0cab26", "value": "5226f056143959145b5f9a744ba2832b6f76089c258830271002b1e9f54e0489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7925ae84-35af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691473826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473826, "uuid": "d835f841-d4f6-4e22-bd17-167fc7bec8d4", "comment": "Malware payload (AveMariaRAT)", "value": "7de550c69675d95ccf9a3583948a729d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473826, "uuid": "0d59c9c2-55ec-4b8e-8941-12269b08d3e1", "comment": "Malware payload (AveMariaRAT)", "value": "5273803733ac0c5735a3ce3bdca070069a39705748ca95eac2b161c8054fbb62", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473826, "uuid": "34bc8eef-4e2a-403c-b6f8-c79fe9752cc7", "comment": "Malware payload (AveMariaRAT)", "value": "8ca8df3686b769e3624d0a505c9f614103549a33", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473826, "uuid": "62a1f479-8945-422e-850e-99c9888db6c4", "comment": "Malware payload (AveMariaRAT)", "value": "9a9d281c8f241664b469187780bffd8421d0ff9696a57821e8f029270ee511ace3f0957f04a3b853b6b06a04b95e091d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473826, "uuid": "daf16d5f-4366-4b90-b503-5f1ee51ff806", "value": "T1BA052413263CDAE2F4AC7EF4152913500BB02C5A257AE55BC89F7CDAE877B13C901AD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473826, "uuid": "e583a55c-4a93-4de1-b4bc-cd426ef91e04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473826, "uuid": "f0668b7a-af26-4bae-8f78-6502635ff913", "value": "12288:Ys3IiF9FsEs4Uwsx1cl5mkBJb+lAJ2H/mnun6WChjCHi7Le:F3IitsEQNcDmXAJ2H/Yu6LA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691473826, "uuid": "a3b3c6d2-e7c2-48fb-8b22-33325ff1e85a", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691473826, "uuid": "e010252f-177a-435b-99e9-bb6033f914f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473826, "uuid": "084cb47d-aaf8-49b3-8f27-12a2d47ba572", "value": "Attached Picture And Details Of Our Specifica.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce06df2-3599-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691464517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691464517, "uuid": "b6eb683f-e2e8-4572-b2d6-b5d8e89b2ce1", "comment": "Malware payload (RedLineStealer)", "value": "4864e1921b46bc11d2358c1985d35cf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691464517, "uuid": "89ae5251-f27b-4c8b-ad44-4758e333998a", "comment": "Malware payload (RedLineStealer)", "value": "5303b4aea2db43e76bad4f1e0a4dfed6a1d7e1b0698d6b20366deee89253a180", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691464517, "uuid": "dfb3ef7a-1178-41e6-9c5a-7531e1ce3be0", "comment": "Malware payload (RedLineStealer)", "value": "a4733168416deba2249b5f8625479858f27b7fe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691464517, "uuid": "e57c9de8-39db-4972-9f8f-df4de7cfd434", "comment": "Malware payload (RedLineStealer)", "value": "845315a60edb9c1949670115a2e2bc96133f68565d377773e1cb08286ab28eb2092ac66b632c9f0191491b29d476e78d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691464517, "uuid": "a249c4c4-0ed1-4ec1-9abc-c9ce63aba703", "value": "T14D54F16239A1C432D05748788D21C7A1BE7FB87257B1C56B73180BBF9E223C19B7A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691464517, "uuid": "f2d85659-2140-4b99-b626-757e079a2d46", "value": "2de346935dc4b8f552af9d851541677a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691464517, "uuid": "99698792-6405-49a8-8dea-fc73966c848f", "value": "6144:AzrjLerWERoJs+I/lx59cHMjfqt55W1SEiZ65jQUx:YjiKERo++mjJT1liZ657", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691464517, "uuid": "e472f0ea-80b0-42ac-b92c-88cba07b0a78", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691464517, "uuid": "4a05111c-8e82-4366-af2d-7a8c4d8f387b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691464517, "uuid": "f4312b97-8f6d-465b-a31f-11ed52d10675", "value": "4864e1921b46bc11d2358c1985d35cf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327c413b-35e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1691497759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497759, "uuid": "61859926-9f80-4b01-8992-7cb84eefb614", "comment": "Malware payload (ModiLoader)", "value": "7fc9d601f5ce30d276c8a68aa30e5f35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497759, "uuid": "276d79d8-9d4a-47a0-a551-ede90c697042", "comment": "Malware payload (ModiLoader)", "value": "531cba7a93bf9fb54f40b723848a5ca025f48afddb2d2550c5bfb410d22e45e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497759, "uuid": "9be3d78f-1a22-4640-be28-b768ab601338", "comment": "Malware payload (ModiLoader)", "value": "4b56c1cd6cbf686acf46cdd89c6eaea442e92fc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497759, "uuid": "2c49993f-085f-4973-b011-9925202c528e", "comment": "Malware payload (ModiLoader)", "value": "ad7221b9b32a3baeb0c5a28ddd1990239ef2ec4564da4a315915004a28a0982e316b9147e46eedd5ff086faf9f80bd53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497759, "uuid": "e15142b2-e807-4043-a277-7042e679e440", "value": "T15F059F31A2748472E01A69399946A75864357D213D38F86ADAFE3CCCAE7F5C3FC251C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497759, "uuid": "b2ee7f87-c295-4d3f-911a-15575f4a4824", "value": "c1bc1b4428880431ffbb0e7b82ce2dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497759, "uuid": "af6e1c84-ae8a-4c95-8a6a-e9e6ffe918d5", "value": "12288:h3H75pQe3LJf1jpBVudoJrLsqkbBjXjBhGHxWgyFaB3Z6:hL33tfd8dgLTklP9aB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691497759, "uuid": "05dd9b7a-3760-40d2-885f-17a5cde5d3da", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691497759, "uuid": "5ad3f8c2-7bcb-4880-af27-12ebcdccd75d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497759, "uuid": "242aa5de-73ac-41a8-9d63-c1186f414ea2", "value": "531cba7a93bf9fb54f40b723848a5ca025f48afddb2d2550c5bfb410d22e45e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666cdbb7-3638-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691532635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532635, "uuid": "08483b2f-bdcb-4159-858f-adeca66c51a5", "comment": "Malware payload (Mirai)", "value": "1d8c33eee1934dbfa0e581c0051db9db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532635, "uuid": "d3ac734b-ba0c-4597-a8a5-0941c679083e", "comment": "Malware payload (Mirai)", "value": "5360fe0dbb8fafaea203eed5b6a8a7192049de0fd49192dcf42c0fefd4d55dcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532635, "uuid": "e642f2b6-eb9e-40b7-bd2d-f9ef431e1fca", "comment": "Malware payload (Mirai)", "value": "4a7e146637923413ebc8777c235c02ac03190f91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532635, "uuid": "705808c8-b400-4666-8b57-9cb50292895d", "comment": "Malware payload (Mirai)", "value": "4b6f14e9b30316a8cc8e9cae1111a9a0bb1a043872b3ce94e3ff05b88bd37486466b5c289df79ef4e19c124ceea1ed87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532635, "uuid": "956b0e93-6e9c-43ba-bdda-d9f115e4ec1b", "value": "T134732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532635, "uuid": "6d6efb82-02b9-4bc2-b853-317bad8240b1", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WP:927jqCt8v3GI/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691532635, "uuid": "e98fd5df-f745-4db6-93b0-71f809070a8b", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691532635, "uuid": "51a2707d-3c07-4b57-95a6-d46ec461ec6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532635, "uuid": "b6544374-b18e-446a-a58b-4bef4f365d6b", "value": "1d8c33eee1934dbfa0e581c0051db9db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d2af53-3625-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691524707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691524707, "uuid": "0c872f7c-db8f-4f7d-a4bf-a586f8c7b389", "comment": "Malware payload", "value": "8f9de3ce238e237cc649d2db9fe890af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691524707, "uuid": "5df73b04-0f83-4ddd-bf60-0240a1cae83e", "comment": "Malware payload", "value": "54ccee6fa601b22fc17e00f7bf48c9d33f103ea1d3ba6cc86986bfe19a624b4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691524707, "uuid": "5a5f1631-62d4-40a3-a7f9-137714ab6c3c", "comment": "Malware payload", "value": "b3fb0379b4e2679c0c1fa350b7962c2f54dd068b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691524707, "uuid": "d2b46394-a181-457d-9c4f-9d896fbf6577", "comment": "Malware payload", "value": "e9f018dc745084ed7d9906b16dd3def5927a61abd9ae0f70cea2de6b4b4f1ff3e12e6810fb6afcabf2224b4e1e1e3ed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691524707, "uuid": "205f837b-42f3-4162-9868-0ab1d26c5278", "value": "T159847D3DB685CB32C9DDA7754AB3190D90F02256F962760F3D9CDCC16EC22CA064EB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691524707, "uuid": "bebb34cc-bd03-4820-b720-2e8c438c6a3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691524707, "uuid": "1fa5d3e7-bde7-4570-a1ff-273051a392cc", "value": "6144:Wb7DLKaDVEjtEv1nOMIrPFEd/q+648/KfNdDyk2QRNIl0:ADLK2m+1nNAEh1zgk2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691524707, "uuid": "2ccf99d6-d7df-4693-a298-8b7bf3c2f0da", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691524707, "uuid": "7591e108-991b-4297-8ed0-be19493b880d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691524707, "uuid": "f2ede0bd-9468-4c35-9119-f3443b95eb83", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2a2bfb-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691478856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478856, "uuid": "7c2c332f-c8be-4f5e-8b6e-80ced930fc5e", "comment": "Malware payload (Formbook)", "value": "5a8637cc62a5884edc586b690d0bac10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478856, "uuid": "b4f418f7-6e1a-40b5-89c9-272c8fc9b8fd", "comment": "Malware payload (Formbook)", "value": "54d08c079e162698607d24a232cc8b51ea0cecf8df1d6fefa27726041e2cd366", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478856, "uuid": "b60bec9e-b6b0-42f8-bf69-3178d501e560", "comment": "Malware payload (Formbook)", "value": "33ff0da34d35ef8051d5c88641502ee7bf2f0333", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478856, "uuid": "92525418-cf9c-46f4-ab2d-19d90807e717", "comment": "Malware payload (Formbook)", "value": "2dacb135a3f181b94fe70988265604cebd2ff4364a16af8fbb651841c2f36bd1aebe8036a60bbbae850a923742532476", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478856, "uuid": "a3b8b017-cdbd-4e16-a750-e9646b78dd0c", "value": "T18DD4122225BC4F52E1B617FA64B720A40FF3A1822C27E65D0DE57CCE9CA3F128452E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478856, "uuid": "15644506-11e7-4a69-b5eb-49b2c9471146", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478856, "uuid": "1b0f5cdb-b39e-4d99-be06-47fad9ea2ce9", "value": "12288:BsniF9L2hCugpGy1Md/VmA01Z0/ROPRfxzIZp+kD/etaJedzY+GG:BsniKhjo1K/V01ZKRWPEX+K/jJed0+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478856, "uuid": "84923cda-c871-4e19-affb-9d9c6a4265a6", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478856, "uuid": "eea187ae-221c-4de1-81d7-fd9e6e812820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478856, "uuid": "54dd409b-33a7-49ea-bea8-560d67052ac2", "value": "5a8637cc62a5884edc586b690d0bac10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b812353-35bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691480755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480755, "uuid": "c748a17b-6f25-4b68-a0bd-41bbc780301d", "comment": "Malware payload (RedLineStealer)", "value": "662a5d4a94a2c4bb33ea35756afce582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480755, "uuid": "6d9edce6-7a70-4392-9414-cbae37decd41", "comment": "Malware payload (RedLineStealer)", "value": "554b75cb65327d24a3b341c72a0a0acb8d17eb974f5d34b5abb44ce170142489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480755, "uuid": "f1dc2c39-5d77-4eb5-b1ea-655adb129273", "comment": "Malware payload (RedLineStealer)", "value": "b2ab57bbc8f187b4c0c20a378cde19e0eda0f2fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480755, "uuid": "bca0b01c-7198-46a1-b383-6a058bb1b724", "comment": "Malware payload (RedLineStealer)", "value": "d5f0c498986553bf2e948b3503f2da3fb1a9867d7920f995a2d10a8539285f58e2c1a1a620482ae81ee815afb8d046b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480755, "uuid": "7b90f224-ee66-4ba8-a7b6-68f240abb498", "value": "T11764E102A7E8EF73D0EA46318F1EFAF4766EB460CD959B5732409A5F0D30282DE66351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480755, "uuid": "40f7950f-d877-4855-bec6-33d871639f62", "value": "df057e6e694564b280d5d580fc2bc648", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480755, "uuid": "4ac2b1ea-22cb-4bb8-82b2-89489f779c34", "value": "6144:Pz4LmQpCTnNznxvNPKaD6mF/OowjjjWVRWqR:MBpCV/PKBmnwjjW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691480755, "uuid": "83748b3c-4690-4a05-a8f6-8658378f37c4", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691480755, "uuid": "5ffc2d5d-c61a-4b57-aafd-3baa88c9701b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480755, "uuid": "b1ecc0e3-82cb-4773-8187-f19b9a2a8d65", "value": "662a5d4a94a2c4bb33ea35756afce582.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b41534d-3611-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691515866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515866, "uuid": "8ee6b4ba-daf8-4925-be3a-b7d900cd7dfe", "comment": "Malware payload (Mirai)", "value": "52f289dc7e55af0be94e00e480c613b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515866, "uuid": "047fd94c-eafb-46b6-b5fb-a575c081898c", "comment": "Malware payload (Mirai)", "value": "556a2c1c506bad9fc66de35916624c6658a24d9835576f185723c267b439653a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515866, "uuid": "ecb0d4e4-a223-4b54-a9a6-1f658235dd25", "comment": "Malware payload (Mirai)", "value": "fd31d56d97932d7cfa314a7393ce2b264dedea82", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515866, "uuid": "6dde3951-de17-4cc3-8a4d-e231ab89f958", "comment": "Malware payload (Mirai)", "value": "c84cea4724d907fb2f3450b388e1a02f8221cfe1f22404f7774b8bcc1a760adbee19d1ee8d6b59c16e6037196fc0c826", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515866, "uuid": "a1768c7d-ffac-4f62-9efb-c4192168e571", "value": "T144A2E019BF1C828BC832293955E9E9D22357FC61F2DDCD492940D16FF0A33A95874F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515866, "uuid": "cfa2bf26-a435-4386-a6b7-33c1518617de", "value": "384:M0hLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oT5:T98o08kxofBE+ZkXaITbp2F2TWul0c5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691515866, "uuid": "8a3eb66f-cdba-4b84-a87d-d85a9a450b71", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691515866, "uuid": "7950b95c-180a-4885-8e55-f0384f62741a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515866, "uuid": "0b610046-e347-4af7-a611-74337cca00a8", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d471f5b-35ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691478450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478450, "uuid": "bcab9079-4d1a-4e4f-95a2-137ac5757ebd", "comment": "Malware payload (RedLineStealer)", "value": "f92dd9fab0fa9f6fc637ffa9606cefdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478450, "uuid": "c9f05022-98d3-4c15-913b-a76359651672", "comment": "Malware payload (RedLineStealer)", "value": "556b00e70c30e24cbe9af599383b88c062d46e72edf7266f5eea6e10330704bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478450, "uuid": "e25a8241-0b1d-469b-9f4e-f49b3cbd9e4a", "comment": "Malware payload (RedLineStealer)", "value": "cd64a8efce818091a8b2f037092793961bd7ddff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478450, "uuid": "6d32273b-1ed6-4c1f-be17-5d91af373e2a", "comment": "Malware payload (RedLineStealer)", "value": "456a641541918515d4cdddc132606a51bd8ce035b5f29657726a69fbbd7da579db54c8cd0327b7ca62099da098dcb319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478450, "uuid": "aaa167f7-5cc8-4c02-8d50-01496d8a89ff", "value": "T139E41207BEF59123DDA85770A4F60B830B373C92697853172B66A94A0EB37C0B47176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478450, "uuid": "51fd29b8-0957-4836-95f0-c4cfaac069f6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478450, "uuid": "975a6d6d-8899-4258-87be-b9dba39e68f5", "value": "12288:UMray906o7UDftizarRKu4Zdx4H4xt4nx01GHj/KEWTe1tpQNfxzcPK:2y6of8iKu8sz77KEWT4pQNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478450, "uuid": "fef987e6-0e03-4627-ab60-377a901bce95", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478450, "uuid": "ca8a86fe-2653-4de0-b006-1e0e989366b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478450, "uuid": "2aa216f4-4eb1-4ad9-889d-f83ca69f2478", "value": "f92dd9fab0fa9f6fc637ffa9606cefdb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff31708-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691477515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477515, "uuid": "0e6ba2ef-0f78-4aa6-b3c3-f69a1a58d5f2", "comment": "Malware payload (Formbook)", "value": "84783a2493baf6e8db916c57e81f90bc", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477515, "uuid": "270a1f03-ab5e-4281-b177-de5431ba4b9b", "comment": "Malware payload (Formbook)", "value": "556c89d97bff251e5a6e5db0b9e7dc69f11752758538ecbba759c9347ae4b2a9", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477515, "uuid": "d8871b0c-6cfc-4eb5-ab25-4c977b7c5eff", "comment": "Malware payload (Formbook)", "value": "bb4360a60ae5d25d1d90790ee993de7a1a0f5ed2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477515, "uuid": "5875577d-c43d-418f-b883-4f8fb1c430e4", "comment": "Malware payload (Formbook)", "value": "ae64a93e6bdacec82ef8942d246efe1f7ddef62a8d6eb2616b63c77d046a020403b9d946dccb3d71305d4045402bf9cf", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477515, "uuid": "bd18c7e9-7f85-4ea5-8d96-197f43144cf3", "value": "T12AD41224A1BC8F81F1F647F93A7F206417F36204596AF64C1EE538CE4D227328A91E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477515, "uuid": "b23d93d4-920f-4486-b299-0fcd1954eb4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477515, "uuid": "8ea3656d-53a5-46fd-bfe9-bc36eca93114", "value": "12288:MgniF9czTFlkDiVgWMLudJ9eJP2+LbxowdZWUMMytEAiV5:MgniUPFkiPXgJTbew3WUfyN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477515, "uuid": "4b35921c-fa43-456e-a3db-f418d903b3a2", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477515, "uuid": "e1b22057-a4ec-4f14-9973-7fb60593219c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477515, "uuid": "464eebc1-9256-4fd6-9f89-51dc051ce61e", "value": "DHL_AWB_907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf42108-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691477644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477644, "uuid": "f2c13ee4-f397-453d-85cc-765bc0c3c6d8", "comment": "Malware payload (GuLoader)", "value": "e06d8bb56e5189394a8531612e74e48a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477644, "uuid": "74e41eb5-da6e-41ac-a6eb-479f55053811", "comment": "Malware payload (GuLoader)", "value": "568a48bb06d720a385151fe56f192889acdc3d96802d0f6ec8645812720b0386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477644, "uuid": "2dcd60f2-a928-45b0-a06f-059749999e33", "comment": "Malware payload (GuLoader)", "value": "3e2939af238a32f24c4b31facec916f6c76d4287", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477644, "uuid": "1c1a419d-101b-4abd-bded-6c1eb3243cb1", "comment": "Malware payload (GuLoader)", "value": "6053f1b463187b231a2888e6c76a7d6095d0143e40ca71af631c4f357b7416d1a2d4cc7618edae2d4fd24fedd01d7e5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477644, "uuid": "396db31e-6098-420b-96b1-9fcf989d1eb7", "value": "T18684BF53F726C5E7EF3C23F3F893A9DF2DE865664E84409E7AD297E550009224B0E528", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477644, "uuid": "980cbe52-9a97-4a7a-86dd-9200cdceab77", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477644, "uuid": "f3a6361f-cc51-4881-bcd3-68309642ca06", "value": "6144:xPX0UPlrkcqMGIJjB9rVLdLy6jKKja4nwcdmxB9FptS7K8hCWuWiI:PlRGIBjLxjKiJnw/Zw2LWuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477644, "uuid": "34980115-ad78-4691-9565-7dd3ad57ce23", "value": 407984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477644, "uuid": "5dcf45d4-f11e-4747-b483-fbd0e190004f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477644, "uuid": "5bb89792-a6b1-4466-bdc1-940ee14ca029", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d35c79-360c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691513951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691513951, "uuid": "bc3cbb68-dd16-49a5-b0f5-e3d329ceed2b", "comment": "Malware payload", "value": "99d01719d392924e6e358e3d595c78e5", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691513951, "uuid": "400d6d77-bc62-4378-9b97-782eb3713de4", "comment": "Malware payload", "value": "56c9290b9dedb67fb989f68e6bb57113a9361b2486e6509a4bce887c86b7124a", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691513951, "uuid": "ced2a145-6c1e-4de7-b5ba-31e808ce462f", "comment": "Malware payload", "value": "e4c6ff0426f27197a2eb027677e4a83ef153e7c9", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691513951, "uuid": "6eb77990-1fca-4b31-9bdb-fad676ea71d7", "comment": "Malware payload", "value": "e4593e96e26ac78ddacf4b5deb171671f359c893a8a49228e1fd1f8f5459987032d292e0c363a497c69aaa312d275fd1", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691513951, "uuid": "5403cbef-d38e-49ab-a9dd-e2b2cc0a09df", "value": "T177C08C94812EDC35C02B8E188D09CD7DEC0211C1A16ADCB1829016CCBC434A78ECE0C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691513951, "uuid": "ddb4afdc-71cf-4aa8-b156-3f06d30dd0b0", "value": "3:HRAbABGQYmimiLXIhzKEgMXTkuGxctVB+o1YSo/QJ6Tb0GQvyYesbBSn:HRYFVmizLXczfKxctVB2SoIJ2QvyYesc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691513951, "uuid": "6603da74-88db-4b11-b94c-748e0dc127c9", "value": 158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691513951, "uuid": "8e9a2626-48d5-4bc4-b287-40821f47b91b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691513951, "uuid": "4e0d287f-8952-4c65-a57d-e26b82ea4eac", "value": "win(en)-localupd-download.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ff31f8-360f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691515101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515101, "uuid": "67bfbe5e-ce10-40c0-8d49-c626e889820a", "comment": "Malware payload (Mirai)", "value": "5f3bed095a0f6e0f1735b6215f3dbf10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515101, "uuid": "5dcaa467-9ec6-4079-adb2-97fb1ad83d95", "comment": "Malware payload (Mirai)", "value": "56cf3a1438cb37281e5ae957ac213c0fd312f6ad8e09885199c9ee49dcdd9c20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515101, "uuid": "c72b8c5f-2184-452b-ba32-1061d3cc6162", "comment": "Malware payload (Mirai)", "value": "4c6c67633db086c6220344df66b07b895580d96b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515101, "uuid": "ca97f0f5-fe9d-4174-a2a9-37488df117d7", "comment": "Malware payload (Mirai)", "value": "75f75cc4e012804545dfe34ad8684810151c2773ea6d1c9f980fb2d93095fa17a22e28991a2bd1c706e7981aae21e3f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515101, "uuid": "dfa8b766-3a15-4d90-b24f-a7ee0f90d563", "value": "T15E13E162924A103096F546B5D40383CAF6BE4D61F4E1F3A17E5D434CAECD4E2C7B9E62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515101, "uuid": "cb657c59-58dd-427b-9d8a-a29684f5e468", "value": "768:b3+oTGBn3bV3mlCLyW4GlwKHJjD0I7Fob7+VqB+qNJXcmgN3UA:btCHeW4xKHdAWifg+LU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691515101, "uuid": "4b2f4cee-5c27-41a8-a5d4-8053fedcfa5b", "value": 43424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691515101, "uuid": "b123ff01-2248-42e7-814c-4d0150464bea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515101, "uuid": "48c9215c-3a78-4c25-9746-9ed84e618daf", "value": "5f3bed095a0f6e0f1735b6215f3dbf10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e0963e-35ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691478488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478488, "uuid": "9430b30b-353b-4aac-85e2-d2c4db39f6a1", "comment": "Malware payload (Loki)", "value": "3cf88d419652e5fc43ec8983fa501618", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478488, "uuid": "b9e65b2e-7b49-4f52-9da2-f5368a06477b", "comment": "Malware payload (Loki)", "value": "5781e8b9faa7f9d6016bce962bbc5677a40b018eb2e3245588287c032dc2960b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478488, "uuid": "e4473742-1b1f-4c3a-9c4c-cea071dff761", "comment": "Malware payload (Loki)", "value": "7fe3bf32ca0a03db6e038354ff133e2204e7076e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478488, "uuid": "be816764-f163-4f90-8d22-90ccbed4dc7b", "comment": "Malware payload (Loki)", "value": "596a6ed926c9e23674177b1caa6edfc1132f6814fb400de4daa7114d650071540a856b061f76582ccb996fdbe5afffdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478488, "uuid": "16afead0-5406-4567-923f-5de3dba394b6", "value": "T1C324D0213AE1C032C06794345835D6A1A77FB8366BF4CA9B7B540B7E1E323D29F66316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478488, "uuid": "804b91aa-3287-4ff2-a837-4b940f13428e", "value": "2de346935dc4b8f552af9d851541677a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478488, "uuid": "07c83850-be72-4bf1-a362-90da22a41c3b", "value": "3072:KzEFr+Oa9/LA2hSGG+KRhF8Is5AdQw3ycjn8cW3H53fhiqYwv:KQwOG/LA2hSH+KRhF8+3FtW3NcqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478488, "uuid": "06128681-7a37-414e-9df5-dd490a14532a", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478488, "uuid": "9894ecac-ad16-499b-a27d-96aaa455dfe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478488, "uuid": "35479d1b-63f8-45d5-9432-de5756c24731", "value": "3cf88d419652e5fc43ec8983fa501618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cc3a8f-35b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691478283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478283, "uuid": "447f3e30-3cb4-47da-a59d-26dfe7c303b3", "comment": "Malware payload (RedLineStealer)", "value": "d7323e58b63d1bbe9f9e0b64edcea7b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478283, "uuid": "c550a001-3cb0-45aa-a94a-df23bade98b2", "comment": "Malware payload (RedLineStealer)", "value": "57cd94dc2fedd608d52612b8928a7eed54ef70d93474f65a5893bb6a7fdeada2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478283, "uuid": "d3712e0a-43e7-4008-847c-e32bae55e06e", "comment": "Malware payload (RedLineStealer)", "value": "a00feb0a63b87ff55fc6345627874f6475533534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478283, "uuid": "d481dd91-8118-441f-8af1-c8a4836d4844", "comment": "Malware payload (RedLineStealer)", "value": "b38777a14a4ab2c488a173dfff8c6c8964adc1a521e867555acf6a9d62a17b0c9679a65a23eb0a7f9e3bb9cab59ff82a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478283, "uuid": "c2c023d5-ac50-434c-b6f1-c52bc77f3394", "value": "T106546D03A69C6B61E5E28A324E2EF6E8671EFCD18F0937DB124C7E2F09711A1C675701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478283, "uuid": "480d1022-ac59-42cd-874e-faf5bfbd9c0a", "value": "7574067d27f1e097e97a79381564790b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478283, "uuid": "3b058698-b1f5-44ce-ba39-9a4906c1a802", "value": "3072:Q28g3MTEyIuoXkRs7gSc7yoOqnPpEPdccC22sGR12W4PbnDqw:X/uEEo0m1c7yXmP+Pc22sm47nN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478283, "uuid": "d965282d-6436-4bba-a2c7-9768ded1b2a6", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478283, "uuid": "c92aebab-202d-47f1-a5c6-0c1195b384c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478283, "uuid": "4ca8188c-d507-46d8-b1f4-bc7beedbe481", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad69c35d-35e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691497536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497536, "uuid": "72d1dcfc-cb14-4d1b-92cd-432e2ac226d0", "comment": "Malware payload (SnakeKeylogger)", "value": "792168d3e129682602200d0ef330aa5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497536, "uuid": "12ebf163-9068-49d3-8f75-b8f17407f721", "comment": "Malware payload (SnakeKeylogger)", "value": "5997a10b7ec5669650d2e310bc3b65a33017c1352d91548a496f97735d5bd486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497536, "uuid": "5f329ec0-df5b-48db-80d0-312087cfaded", "comment": "Malware payload (SnakeKeylogger)", "value": "d8b6bdfb8d1866a13dfe249db09b081e5b3958cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497536, "uuid": "083d50da-3f0b-4049-91cc-2e25f734b93b", "comment": "Malware payload (SnakeKeylogger)", "value": "443a8ce54ce1fc3ee312131c8477385078cb252cef550aac0e34b83f94de4d94f9b49ef634761b4a98083be865045d71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497536, "uuid": "58b5db34-5d4d-4fa5-b42b-9dac6c2574bf", "value": "T158D422BA6713CB07D05B13744E28A430437ABED67816E363ECC37BCE96A1FA61854953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497536, "uuid": "dc12e788-319b-488a-a731-88008ac5d2c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497536, "uuid": "62969e51-b5d8-4707-8cb8-7e99c69b3b22", "value": "12288:s5LbzIu9+r9IaLDm3SoeehMV9zx3J3AoWX6HqrqbB:s5LA9NLq34zx3BQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691497536, "uuid": "f7e087c6-523b-4b99-9cc1-1964690c0fd5", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691497536, "uuid": "346713a5-dc27-4341-b631-1b170d1e58c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497536, "uuid": "56031ee0-5b09-4630-9185-8200d62a14b7", "value": "5997a10b7ec5669650d2e310bc3b65a33017c1352d91548a496f97735d5bd486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acc37d6-3635-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691531408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531408, "uuid": "89abc2d7-1318-4fb4-a5b6-854ffd930a30", "comment": "Malware payload (Mirai)", "value": "f356c2d6c801045dd5adf7778ee3efe3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531408, "uuid": "2f70c890-cb38-4730-8c62-d7d0fcf507d8", "comment": "Malware payload (Mirai)", "value": "59af2ecc479877462576001899a509c08a50d919c62b65682e66827e064e5923", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531408, "uuid": "a1b2a7ea-76fb-4804-8b47-69d3cde17c8e", "comment": "Malware payload (Mirai)", "value": "8ee72d79b88d38573efb90f1b9e0633d3c749ee5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531408, "uuid": "392f5ecf-6b84-466f-8f0a-5d13f43aead2", "comment": "Malware payload (Mirai)", "value": "f12165e4f5d42814224cdf1db394b94c00c3cc8653a2510d274f18753d04af8725beba8e651537bfefc6a6ad91b08974", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531408, "uuid": "178c626f-2945-4674-b554-7812f13b00e1", "value": "T13CC2E0685228C472B0B45836FDAF4503A736CFF8DAAF362622144734E097D2696B4B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531408, "uuid": "e7f89099-c2b5-4079-bbea-64db07ff6c32", "value": "384:XH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plNR+XhymdGUQ:myNUQUfhQllxlaH0MFjlOnGsj2s3UozD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691531408, "uuid": "722d38cf-0d13-4346-bf32-4b0bdf1fb1e1", "value": 27352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691531408, "uuid": "d28820b4-31e5-4153-a023-917665960d60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531408, "uuid": "81efe1fc-14a2-4df9-a1fa-04c51fe5f609", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30be5ac-35b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691475265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475265, "uuid": "ee2c5dfd-8b4e-4cde-b267-3bd30c0843c7", "comment": "Malware payload (AgentTesla)", "value": "18c8f13e3e801c696d16fe8e00b1eee5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475265, "uuid": "7a64a5be-0023-48ac-b226-acb717986f01", "comment": "Malware payload (AgentTesla)", "value": "5aa663f88bbd1d58ab129a4ded631a1d93ce4e13a5bfe7e0d933ddd1453d55a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475265, "uuid": "7fb20069-92ab-4cb8-b913-028e5a891124", "comment": "Malware payload (AgentTesla)", "value": "ef6327a7fa1515b1d10094bbd0b4a18e08644e78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475265, "uuid": "59451b1f-1a44-458f-9c42-b82f9702b50e", "comment": "Malware payload (AgentTesla)", "value": "917ae22963bb9300e011f6fa0b731e094e665db6db185ebd0db3401e48fa632f7c16648bfb52628950c09b0eadfb9b5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475265, "uuid": "dad21f98-1a3d-44e3-b5e2-d7b0daa5a8ce", "value": "T1C1F4E01031395F26D9FEA3FA102155861FFA591E2232FB085DD631FF2A69F418A41F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475265, "uuid": "88008ebb-c305-486f-9909-c999a02f251c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475265, "uuid": "431b3a10-9e5f-4eaf-a515-93d172fb0292", "value": "12288:QiDa9iF9mygC/LGGHW3BdaAwpYrGm+PEFJS91hmvTy:QiDa9ieQyR3qpYafEW91hmvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691475265, "uuid": "49fb4125-a55e-42fd-90b5-731aace9641c", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691475265, "uuid": "154f9645-57a9-450c-8ad6-76d9ac0c4443", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475265, "uuid": "edc38965-c416-4dbc-a3cd-b0679c1bdf7a", "value": "Scanned #0046108082023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e8fea7-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModernLoader)", "timestamp": 1691478872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478872, "uuid": "e9873840-eeed-4247-bdeb-b8ceed0d4e1d", "comment": "Malware payload (ModernLoader)", "value": "13dd53ceadf73a9acf8c2a4be896b60e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModernLoader", "colour": "#2CE23B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478872, "uuid": "2be7d87c-8442-44b2-94aa-716b54f2aab9", "comment": "Malware payload (ModernLoader)", "value": "5af45ed8f06ff703176130b10b4a7c35d72b4fb2de4987330fb6acc57f938e2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModernLoader", "colour": "#2CE23B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478872, "uuid": "73739868-c4a9-46f1-b55f-60a8c777d68a", "comment": "Malware payload (ModernLoader)", "value": "db3ef778852372dea08eba9e4f05e87fa466dc69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModernLoader", "colour": "#2CE23B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478872, "uuid": "234c2064-69f5-46bf-854c-0b18651b5bbd", "comment": "Malware payload (ModernLoader)", "value": "fe4a75c0b5fb2dfc71a96c85f0a690fab93638076eb65ede41650b4018b7a7ebbfafb3d023740db76ba3a40e5c6a581e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModernLoader", "colour": "#2CE23B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478872, "uuid": "6b16dfb1-ba84-412e-9f73-f67767304ca2", "value": "T113758C8BBCD454B5D5A993318CB592D17731B8480B3237D32F01B6BA2E36BD41E363A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478872, "uuid": "002191ec-ec8b-43ad-896a-3960948f1762", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478872, "uuid": "d7d4a145-1432-47ed-96f8-d55e9bd358de", "value": "49152:VX6h1rQzbDIFg0YRNK1o73LR7Fjyx7mlR:VhbDIS7TLR7Fja7mlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478872, "uuid": "49ccf197-97ed-42c9-9eee-dc6db8708a8a", "value": 1592320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478872, "uuid": "b3272556-106e-4f3a-b152-d84c4259c72c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478872, "uuid": "9f31d8ea-831e-47dd-8b7c-02dd7dc9455a", "value": "13dd53ceadf73a9acf8c2a4be896b60e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62163c73-35ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StormKitty)", "timestamp": 1691499986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499986, "uuid": "e91b28b0-ff3f-47ec-9b8b-040a5c8155cd", "comment": "Malware payload (StormKitty)", "value": "31503bd1455f4dc0288263ecbc7af2d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499986, "uuid": "01fbb7ee-ac14-453c-be08-944e49e30e8b", "comment": "Malware payload (StormKitty)", "value": "5afb4e6a861525cd433a70e5249c5a85573b4282f1b292e175f4737ba13eff56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499986, "uuid": "37fca736-02ae-490e-9ec1-3091c58a17e6", "comment": "Malware payload (StormKitty)", "value": "ac35a7aa76f1b8c9be148f2a835adb12295125ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499986, "uuid": "f40da12a-3e91-436f-8f33-2f5757337c77", "comment": "Malware payload (StormKitty)", "value": "a94a98daee55a3dfb151b7f89fe3e338cfecf4ff22033eacd42763fa95a890a1d400cc62c15d461692a32f8c22686b9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499986, "uuid": "b72dc795-cf15-4746-b8ba-e8975773ad0a", "value": "T19524D006B7DB5512D9485971D0E30A2453F2E78B23B3D68A3E8D42590F433E66F8E78E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499986, "uuid": "1aa35855-478b-4497-9574-345de5400794", "value": "3072:ayEdA7fMpvQVOl3uutPT8ahmHwbQ6rLr4UEW4FP1y86vLabNCdRQav3Iyc2Ab8Fs:a23UTLhmQs6rlEWApqLaUdRrPAbin4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691499986, "uuid": "e9e88e59-a768-4fa8-b6aa-9a0a88b2526a", "value": 209992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691499986, "uuid": "fb8fed81-2eb4-4913-8cd8-62f15e6da2e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499986, "uuid": "f8a1de12-66a3-4092-a833-4fe86ba6d094", "value": "5afb4e6a861525cd433a70e5249c5a85573b4282f1b292e175f4737ba13eff56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc18b75f-35db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691492943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492943, "uuid": "b46f4224-db94-4703-984b-634a9fcd8654", "comment": "Malware payload (Formbook)", "value": "740e2966f0bb96982a15acf39b361819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492943, "uuid": "56b5b3e2-5676-4796-9b4f-86c79b7d369d", "comment": "Malware payload (Formbook)", "value": "5aff1db8f4c749933cd8869e1e80f000e4c27de7c0c7a7d1aa59c4f324522210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492943, "uuid": "43bc0824-b138-4086-b6a1-4bcedba2fa25", "comment": "Malware payload (Formbook)", "value": "d89ead114739085e2c99fdb584e207f4398531fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492943, "uuid": "965ddb85-e216-4c9e-ab9c-69d092e7bbaf", "comment": "Malware payload (Formbook)", "value": "a9659a7bf11d95635188f21819e65ddfe66b5c5ac6aca479edb2a6d0c8074f5ec9570201f188f778a28ad2e84f13fe76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492943, "uuid": "7b1b45da-7f76-42e4-b460-572cec5e23cb", "value": "T1FAD4126731AC5F18DAB793F468B4584507F1F90FA1B5C3252DCA22EE5B22B101AE1F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492943, "uuid": "0d798f72-d733-4ee3-bf30-c9176227b197", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492943, "uuid": "a27423a3-3cf0-46a1-b6cc-df19572c71e3", "value": "12288:df2iN2GULU3/zZ409voNtgsP/qhtpk26vlqw2+XNsiGCBS:df1xULU3/zbU/4pR6sw2+X2iXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691492943, "uuid": "834612e0-5a70-4216-99ff-bbe643d6a190", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691492943, "uuid": "e9be32bb-d724-4db6-93c1-5174befe491b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492943, "uuid": "3ac81750-cf9e-48c7-a68c-6fa94cf47679", "value": "5aff1db8f4c749933cd8869e1e80f000e4c27de7c0c7a7d1aa59c4f324522210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c3e5b8-35d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691488752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488752, "uuid": "3ef2269a-585b-47fb-aa7c-3e8e9f7273fc", "comment": "Malware payload (Formbook)", "value": "00263b4aad42e011a7779e85f07b4bc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488752, "uuid": "0fdb1cf4-ffe6-4186-9035-a9c40394059e", "comment": "Malware payload (Formbook)", "value": "5b820d4d3e8e5662246712592782dbb01dc54b474f08aedaa14373e168c6b9d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488752, "uuid": "1bcc0c5a-c57c-4b07-b333-04655a2df347", "comment": "Malware payload (Formbook)", "value": "86b3dca578b90adc7ba823fe48b97ba87d1da3be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488752, "uuid": "b5e30f11-7d06-4711-9ff8-e39c18ec2ed1", "comment": "Malware payload (Formbook)", "value": "2709f40604bd261ef252e8a85cb6ce974a3cca1886b8b3ba81902e167fe9414d4d6a4adbb2c3e9ee9698b6595959705f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488752, "uuid": "3320b898-e1ed-4316-8523-87f1b1fc5e2b", "value": "T126E4F160B1BC5F5AD477E3FB1611A11417F6A9AEA26DF3195EC570CF22A1F400A00FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488752, "uuid": "dd7eab8b-006b-45c0-8868-e12e0ffd9b1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488752, "uuid": "80d2bd47-a1b9-45cb-bdfd-af7001cbef3e", "value": "12288:IWwQr2S2iNtOR4zt2sJmPq2cD+cn++YIvu2Mi4XrpDXpxLbymd0/J9g9PJGwWq8:1wQr2S1Zt2XPqlCcSMu2MVXrxXL+g9PD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691488752, "uuid": "f25d7172-3bbb-4001-879a-06dae9bf0098", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691488752, "uuid": "72f7dc06-a87e-4fa4-8c52-1714c650608e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488752, "uuid": "6ea9c534-983e-4fb4-a34a-1cfd9933fcdb", "value": "5b820d4d3e8e5662246712592782dbb01dc54b474f08aedaa14373e168c6b9d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3133f525-35e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691495180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495180, "uuid": "fbe23b31-6580-4856-b19e-9f456c5426ff", "comment": "Malware payload (AgentTesla)", "value": "b7f78ca0260d9d5702c05055f2317fa5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495180, "uuid": "3caf7115-3793-4fa7-8cff-3f5c794a0fc2", "comment": "Malware payload (AgentTesla)", "value": "5cf1b3cf7987c16061df1f12f5be01702df47d4d003f4fc7844d36583b0df168", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495180, "uuid": "8682e994-1250-4e92-9b7b-494c3449102f", "comment": "Malware payload (AgentTesla)", "value": "34fc4931a1216fe594211943a50b5051b47f309e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495180, "uuid": "3a984e9b-2a1a-4bfb-90ea-f3fcc24012b9", "comment": "Malware payload (AgentTesla)", "value": "fda04e6878044e961991243b9837fdeca55623bb0470d0a69b179c597327c4c3922752a4e273cc649b028906feaed29a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495180, "uuid": "e1c32df7-b3fa-43e8-bf7d-2b6137d6fe11", "value": "T1F7E4CFE0B344C665D86797F9843796A76673A64E8C28C60D2DC2FF8B7D327060063D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495180, "uuid": "0a96c1c2-ad23-4fff-9159-20592e3d8cd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495180, "uuid": "d3727c79-b1e7-48b5-a8ba-4aceb9f59a3c", "value": "12288:eJmefaynh6z0QM3zmpcSmiy5Znab4ID+DfUcdAA:HeCQ6z0VycRiYtUEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691495180, "uuid": "7baa3a84-dd4f-4c77-ae3d-a879c8b63a6b", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691495180, "uuid": "493225ed-7758-4b3a-b995-18e7996f0392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495180, "uuid": "08abef43-fc9f-4126-8875-eb9e7a8296dc", "value": "5cf1b3cf7987c16061df1f12f5be01702df47d4d003f4fc7844d36583b0df168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea940d07-35b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691474446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474446, "uuid": "1fd1e0bf-0587-4678-8213-99f2cdc909b9", "comment": "Malware payload (RedLineStealer)", "value": "8f54c58551f1c29d6cc645498c1457f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474446, "uuid": "07d6fba2-b527-43a9-b2a1-4b6cec68c8d6", "comment": "Malware payload (RedLineStealer)", "value": "5dacd585b978969d845f1550448187b4d2702da0e63fc3676674404cf87b6bc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474446, "uuid": "70d2d8c3-899b-4955-a0f9-8d84a4819591", "comment": "Malware payload (RedLineStealer)", "value": "bf70f19f36baad30eb05348b1dee5789d38dafeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474446, "uuid": "6ec24dcb-fa25-41b3-8f76-2cb96a74c01c", "comment": "Malware payload (RedLineStealer)", "value": "3a2dbbd1f95f5552cf49bc1b3de63021760be93a22f641b882654a2ab23c3c66039c90b3d3e51db0a362a04dd2e688e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474446, "uuid": "e6f1022b-b49f-4bb4-b3e6-f406711f9f43", "value": "T1A5A4C002A6EC6B61E5D28A324D2DF6F86B1EFC91CF1937DB124C7A2F09311A1C675742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474446, "uuid": "b9f2c3bb-ab89-42f4-b1d8-aea6f048f4e3", "value": "7574067d27f1e097e97a79381564790b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474446, "uuid": "1ac8006b-5f0f-4a96-ae96-76007bb9a8af", "value": "6144:fLVZ+inFeLUulCVxy+W6J+PVkAz8Saih7LT1iwYiQGGeUxthxzo9WrwYV:fRYinAay+1yks70wYxDxtr00rwYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691474446, "uuid": "50704ea1-5e22-471b-a34b-8f9d8a58bec7", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691474446, "uuid": "5d52bd9f-2587-4ad4-ac99-b24bb0ba5f28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474446, "uuid": "b21a4f15-311e-4a79-b6dd-932d9d1d9b7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253286a8-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691478839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478839, "uuid": "3619c8ed-99f6-4f2d-bec5-fe352037dd1c", "comment": "Malware payload (AgentTesla)", "value": "57c8002e35b846998d5543c6d45b0422", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478839, "uuid": "0e87eca2-618e-4e24-8cca-75b8c30484c6", "comment": "Malware payload (AgentTesla)", "value": "5dc08b146c732bffc74f956abda53f6fb87aa34d34f3c4230a5696458dec4c5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478839, "uuid": "73f99fa1-506b-4229-9504-1a4a58ca0369", "comment": "Malware payload (AgentTesla)", "value": "8fc7dca205bbd11f9e67f6253be1b303381e1cb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478839, "uuid": "26c89324-c594-4b36-82f0-1885efebb4f6", "comment": "Malware payload (AgentTesla)", "value": "e94f1c5340a5f2948d815014f7f8ce9c0bc9a1e143f9cd1f3d2f910add2dee5a75e235536d260224b60daf445b59241b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478839, "uuid": "6f91e8f9-ff78-430c-bb45-9b13666ac3d2", "value": "T117252921E77B655AEF29A6E85E1F847239D5DCC0F1B1C888ABE72C0385C23514D35BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478839, "uuid": "6e0a9bde-458a-4d5d-903d-ae1c6c3283f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478839, "uuid": "5486534f-af76-47a1-a068-882dc8201e2d", "value": "24576:E1I1R1I1nRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUO8OguXm0L2zaLTn:EGvGRRs6CE3jLbO9Rs6CE3jLbOsuXB0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478839, "uuid": "594a3e27-35c2-4bff-ae92-dfdc175eeb44", "value": 1022976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478839, "uuid": "34550476-f55f-4803-8139-7cb8864c18a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478839, "uuid": "015673ed-3d6a-4ebc-910d-a05b99180964", "value": "57c8002e35b846998d5543c6d45b0422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfb6637-35b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691478075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478075, "uuid": "d1fb0cc2-155f-4d55-a055-4edc194491be", "comment": "Malware payload", "value": "23392df21171bb10fd956a3f3ecbd4a8", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478075, "uuid": "a04a3a29-9ff1-4716-8357-9ec89483f277", "comment": "Malware payload", "value": "5fbc1a481ff9d1eec3d9ca4a1aa251bcd6a1ff42dedb4ec7e9a1e5a175461cef", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478075, "uuid": "0338136d-ab22-4017-bbc5-30ba6622571d", "comment": "Malware payload", "value": "8086bcb37ea2ecb1c4cbce37d8b14b9099610c49", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478075, "uuid": "4f30028e-2a06-44e9-96f7-a526207e7d18", "comment": "Malware payload", "value": "dc8c990fdb0dc221aba90a25db9c6424507a8235abf0acaf07d47d0592d2dfc79fee9c97d73e48df23970b5ad0acf2e5", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478075, "uuid": "f752637a-9816-4c04-b564-4ec287a53e02", "value": "T132840252877AF5099C57FE3BF9E49BE704EE0C2D66C386ADC98E21DC5988D34225840F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478075, "uuid": "42251b45-f2f5-4a59-b51b-a37eb4e60ef7", "value": "6144:ijKwGZs0eWcXz+ln0pYdiRZrmYxZM9LTgYUcZbsGBmWpadxEZzPvGs5/Pop9V+bA:WK/mWcCl0siRZyYxZwLhhbsGBKgzPvXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478075, "uuid": "f5f6d46b-fc12-4dff-918e-63d2f965705b", "value": 377940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478075, "uuid": "9477d6ce-dd0d-4e2c-a057-c3f734b04cbe", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478075, "uuid": "3f88cc1b-ccd5-41ec-8eca-a411aa58ce83", "value": "RFQ Orders Sample.docx.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b4e0b6-35c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691480925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480925, "uuid": "c2bf77f5-fce2-4c48-b017-4cd3ad8c4471", "comment": "Malware payload (AgentTesla)", "value": "fcb4a32e656f4aa3d890f85d902835b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480925, "uuid": "6667a40d-0a70-4e9c-acd3-e1935f701450", "comment": "Malware payload (AgentTesla)", "value": "604ee098f44bf5571e6f360dcd1995d4c96e45ee2c2aacf8fa349b62f520ee1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480925, "uuid": "27e92d00-853b-4c77-843f-f81042f58447", "comment": "Malware payload (AgentTesla)", "value": "aa36c16cf999baa6f604772dfdd732b12b6b1e26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480925, "uuid": "d3d81fc9-40a9-42f3-bc8e-e2163737a717", "comment": "Malware payload (AgentTesla)", "value": "472a603a55f3bbb447ce8aafbe563cbf69caed94dc49783f3dff1aa1a814f3d86224881e56f060129babc69476568e1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480925, "uuid": "d48cee9d-75da-43c0-a378-0bfb03298867", "value": "T108051202377C6F26E5F6A7F8143A20804BF2656E3A9ED61D4DD170CE1E26F109A51F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480925, "uuid": "8a903f4e-0652-40a8-b7db-71eaf1cd8186", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480925, "uuid": "6bc19897-47a7-4625-8090-de66f4a080b0", "value": "12288:8s1HiF9FGd3/zwN+oP2ailUr7Q3rbmsvrDdiGvB1wvale2K5lShUYMwzB:Z1Hi2mV08nGvBivX5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691480925, "uuid": "cf9aa669-4faa-4214-8f83-90b61c8fcbbc", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691480925, "uuid": "70924452-b660-4554-93c3-416a8bf319d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480925, "uuid": "c1d90f85-5ea9-418c-ae4e-2f1902545655", "value": "fcb4a32e656f4aa3d890f85d902835b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4256f85-35da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691492474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492474, "uuid": "e99c70dc-d4f6-4296-9858-be784795820a", "comment": "Malware payload (Mirai)", "value": "c426cb3e91d71096927aee065c461a4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492474, "uuid": "2ea0d1b2-4da2-4219-ba1d-d331e4ad2db8", "comment": "Malware payload (Mirai)", "value": "6066de03dec8686929f880bdf5d1b57f0179472f6bd0c77372fcba03d0335abb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492474, "uuid": "6ad32d71-e252-4d47-9b8d-38f9a0d41f9a", "comment": "Malware payload (Mirai)", "value": "4cdb08c6e796f7f19738d7dca717b8b372f38947", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492474, "uuid": "9c69e1cb-0a58-40cc-8c25-e50b42774248", "comment": "Malware payload (Mirai)", "value": "cf16828f508b89f50defcc70171c1af29606f6185449eee139ea012a9c2b0baea92832506f8352a2a9644d6962ef182b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492474, "uuid": "31258901-63ee-48bb-9640-c790b298c4fa", "value": "T10BD2E18D76D362F7CCD9D6BEB20F5036709E74A9B2B19367B306D4434366140EA82D8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492474, "uuid": "34dfe691-7a3b-4058-8fcb-d3ed3ec62c07", "value": "384:MPd/PxEDLd2TwM4zb6lowYcEaqsU9lcC450LQixBfE4jdlz0lewZ9WitT3T2Ny6:0lxKd294CxEnsU96IHE4RlY99Wi9376", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691492474, "uuid": "95692e77-a351-4352-ab76-b46a701820e6", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691492474, "uuid": "30bc20d8-5007-4510-a959-768dbe2cc3da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492474, "uuid": "b1fb55dd-4aef-48dd-942a-b2b4c7067449", "value": "c426cb3e91d71096927aee065c461a4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3bfe2d-35db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691492731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492731, "uuid": "a0f87689-fa04-4e0c-aa3e-922d6a72c9c2", "comment": "Malware payload (DCRat)", "value": "a45686ebfc9a5792a88c2383e0d69405", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492731, "uuid": "74709a76-d800-4018-89c4-8ca60f8f11ac", "comment": "Malware payload (DCRat)", "value": "60a5a17d3b353ab823508af1a2dc5a88a82de03cecef8271d465d7a65a4b5057", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492731, "uuid": "72903704-9af4-4be0-99f0-64c0e8018a3e", "comment": "Malware payload (DCRat)", "value": "9c060031be57dd37111e1aaaafc785fe8eb7ad47", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492731, "uuid": "2cd60e79-20ef-42cc-a754-5da3faf9a17c", "comment": "Malware payload (DCRat)", "value": "526453da3402b411c7cf05e537c3e1b4f5b05f29090d120fc69389a9e514618e2e246f09fe3e80dba2e1c91d1e17cff6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492731, "uuid": "f98b1f19-f520-4dbd-9e99-55e8e38d00a0", "value": "T1D1557C01BE44CE01F0885A33D3EF46484BB0AD516AA6E3277DBA376D16123A77D1D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492731, "uuid": "95ccbc44-fd92-4401-b624-8d37b8526929", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492731, "uuid": "1d63ac77-0100-4fc1-9b07-455158500dae", "value": "24576:fzEc4GoR0xRVb7HS1CY35I6xK6CKrQJltSNg7WyZiM5MuO:rb1oR0xLbTSB3eQ1KJI8W0iMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691492731, "uuid": "b9601535-0347-43a9-9648-2db49ae83cce", "value": 1345536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691492731, "uuid": "2866fe1f-fa41-4323-b347-184e541e362a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492731, "uuid": "6c635ded-48b6-4738-b3fd-ccb96e9a7803", "value": "a45686ebfc9a5792a88c2383e0d69405.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc640f6-35e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691498154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498154, "uuid": "0086e5c5-90fa-4379-855e-fdeaf5862d86", "comment": "Malware payload", "value": "dbc4d10414eb41bf8020c4a36326288b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498154, "uuid": "c03768c2-3eec-403c-8db8-d1c98adfb479", "comment": "Malware payload", "value": "60b7371baf1af315fdf5a09b71d9a24b5301b5e28d01f9c061750bf39968b5cd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498154, "uuid": "5b7daf07-e195-4829-ae7b-cfd2151d68d8", "comment": "Malware payload", "value": "6b910b8627b7048011ec710e636b9c7b8a1cb5a3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498154, "uuid": "e674116f-730d-4c62-b077-266542b26948", "comment": "Malware payload", "value": "57b1f0242b8f3ecd77a73ba31e4b9fb8b8e8cb471680e52ffc1a6776e9fe638a4350b2842ef6cc260575fa091b031c14", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498154, "uuid": "4f58c5dc-abd1-41cb-a3db-f53fc8fc7e73", "value": "T14635E003E804DBC3D41D83F87E530ED91F0AAF19E99569DB04627F9B3A70A72099E52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498154, "uuid": "3b326449-9447-4463-a8c7-6670b32fbcaf", "value": "24576:lRZyQw6VfZyqw6VYjKaWlEzp7aYqdllZbSQA3Qp5EOIwrx:lbQ6VRK6VYjKjOz8dBS/3XOI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691498154, "uuid": "2a27341a-b089-4d3a-b603-f0207e9761f8", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691498154, "uuid": "dcb8ee85-e63d-4a06-bf98-cbfe9d6d3904", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498154, "uuid": "51988039-d27e-4ca2-8732-9e4908f51d44", "value": "RFQ-G-9840270XRev01.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad70676-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691478956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478956, "uuid": "76298255-c2c5-4b10-876b-e226736e895f", "comment": "Malware payload", "value": "13876e0c6728fb1cbefe79fcc7315e70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478956, "uuid": "92d7e217-c16e-4c06-a3b2-e97e18e93ab4", "comment": "Malware payload", "value": "623e57f2138f869c8a093760721a1116489ff00099237d3942d9bf8ebe91f55c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478956, "uuid": "ac88018f-d22f-47ea-9d5d-592d086a45a8", "comment": "Malware payload", "value": "f1a2c0c8efb434d78898d90f15eaad74fe78f98d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478956, "uuid": "d357220b-50ca-45f5-b8c6-703611451e96", "comment": "Malware payload", "value": "7f0a6fd8b4572417cae3a5d5be02db4bbec4d43f481fccbd36f993ce7f2b472cbd0ea4771ad871c88d6c44c00a42331d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478956, "uuid": "65e7cbec-2a96-440c-a054-f78ff58edb7b", "value": "T178954A016BD89A61EABF5B34A87111448777F462D67AEB0F338C80A41F7BB409C92777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478956, "uuid": "90ba47b0-cd21-4c26-8c85-84f6ca1b650a", "value": "24576:rW/3Fv18zjT+CrH6ta1Dk418HQMssrivPUYxF2:rW/3Oatb4G/ivPUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478956, "uuid": "584c2fe7-ce65-452b-8161-6dffd2617e06", "value": 1893376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478956, "uuid": "fd4adbf7-d0b4-4549-b62a-aaa2bcb9d2c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478956, "uuid": "c0e0ed41-553b-494b-9cd1-b08a385da06c", "value": "13876e0c6728fb1cbefe79fcc7315e70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df099d5e-35da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691492465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492465, "uuid": "9fe97ef8-927d-41ee-8ec1-4b418537cec0", "comment": "Malware payload (RedLineStealer)", "value": "822ed586290950d65f626de92d12843b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492465, "uuid": "d4c536a2-4f05-4015-9ac0-032fe41b7084", "comment": "Malware payload (RedLineStealer)", "value": "6360e3e724063c4aa184a9482cc96bf795a3f64ee54a3e48c635b7f44e62753c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492465, "uuid": "fdf319c0-0984-4a3b-841c-a9879a398425", "comment": "Malware payload (RedLineStealer)", "value": "31fc2177e2be505aa3f7a6c716147f1c725bf858", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492465, "uuid": "a856a098-e1db-4093-bad6-0628017c555e", "comment": "Malware payload (RedLineStealer)", "value": "d4c3d635d87a1dfa8ca336ce6e9975616d0d6ceeb64d3f9ed604334ad2971b462932ee7b89e2edc071cf328e423e7ac8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492465, "uuid": "da0171a7-5d68-46c6-af40-2333daf4ed9e", "value": "T1D684BF12E6DC6B22E5E28A328E2DF5E8A71EFC91CF1937DB121C7A1F09711A1D176701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492465, "uuid": "f439327a-1382-4c00-9d8b-5ef1eb5f8b41", "value": "46c207d29e8eaa8317918259507bb42f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492465, "uuid": "139512c0-51db-4cfa-823a-96dd5c27f80d", "value": "6144:eGR95MEqbb1kq+sZAQo30FbAfku6Q6a9TN3:eYvMEq3nar0FcfkuPlN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691492465, "uuid": "36439888-b4de-4003-9a99-ed8e39d11154", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691492465, "uuid": "b0799c56-878d-4799-abc8-9c0def87b953", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492465, "uuid": "2df00c9e-89f8-4f3a-96fe-5f50e1ccb834", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e900e5-35bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691480587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480587, "uuid": "a06fbcb7-d22f-45d7-9c4a-34634adb670e", "comment": "Malware payload (Formbook)", "value": "86dcafc23259a1d914ee71c9dd41ab9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480587, "uuid": "5951c18d-71e1-4f36-9f7a-7cd603251795", "comment": "Malware payload (Formbook)", "value": "63b0410652da12f415ba3be83cda769bd268b83000c425f666fbefb4fddbf3be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480587, "uuid": "bb8747f1-09e1-4025-8568-131cd127d160", "comment": "Malware payload (Formbook)", "value": "8cb05f1ab927a32b9b12520844365df1108690e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480587, "uuid": "f609361d-d77f-4ae2-a051-ba84696b0bba", "comment": "Malware payload (Formbook)", "value": "59cae8bf0ceb88ad7e5ef3390bf1271ee6294cc0198492887e506326b5397d450d189295295334130937fd6ea87f4f97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480587, "uuid": "73be2e38-a9af-48ad-9ee2-d077af7d089f", "value": "T1B0E4F101337CAF76E4F2A3F9147560540BB5755E25AAEB6C0DD270DA2CB2F108A12F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480587, "uuid": "b33ea5d5-a8f4-4e82-a0b1-9289ff17798e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480587, "uuid": "8bc6dfab-543d-4d33-80e4-340114ad325a", "value": "12288:OOp2iF99pG9Jan8tajaYG295i+3Id7GQlWJfF5c7X0SyFtfF2WZhIEQ:9p2iFpmMnSZ29tY8QlWlcT0PF9FzDI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691480587, "uuid": "abfaed03-2e2c-43d5-8a76-cb6db0a0509c", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691480587, "uuid": "d180c576-ab76-4864-ad1c-7854e9c399ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480587, "uuid": "28c175dc-b02b-4962-8308-4c34f8e7c922", "value": "86dcafc23259a1d914ee71c9dd41ab9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9c7cd6-35d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691489505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489505, "uuid": "db9cadca-370e-41c2-86ff-27915663e813", "comment": "Malware payload (GuLoader)", "value": "6ea128aad981db51fb37a219cb6b266e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489505, "uuid": "7e1f41c6-6227-4e94-a1a1-07adf8c46e14", "comment": "Malware payload (GuLoader)", "value": "63c7c7144d487bb38e9473ed1a7b420440b131981c5e83901614212f7d9bd8d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489505, "uuid": "dc98b6f0-3981-43b0-a7cb-5b94d44ccf72", "comment": "Malware payload (GuLoader)", "value": "37bdacba8fe247ff5ead7524a0ffc17b7dfbfdbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489505, "uuid": "32d20c42-b1a0-4043-b230-bc0c3b93efb4", "comment": "Malware payload (GuLoader)", "value": "5a0a4ef74755ecccdcce0953fee987dfb39e6b12d393f7efdac3dfd12fbf7a7def66734d7387b07471d442233ac36f8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489505, "uuid": "9e6aa293-f543-4669-af89-8874b003df8a", "value": "T127541204A7D2C06BCBE7497090BAAFFECB766F42C280C45757607E743935A929F09B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489505, "uuid": "a019a3cd-00b0-4c28-93a6-e3ced9940be6", "value": "076b06e6a65c9b7cca5a61be0cd82165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489505, "uuid": "f9b0a987-f743-44fd-b447-a3cfca97d96e", "value": "6144:YzAJFXG1/PZthjld/77Pm3pHT5EzjDu7w5x:CCar377ypz5ELu7w5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489505, "uuid": "904f08ca-ab04-4472-9184-1e7b95dcf2b1", "value": 280544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489505, "uuid": "5eaabde0-a5e7-4842-b34b-9d6c5dbbf558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489505, "uuid": "e190f525-35d7-408f-b41a-b6a0e887dc74", "value": "DRAWING-MATERIALS NEEDED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed41f00c-35dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1691493348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493348, "uuid": "e30d09cc-ceea-4158-8a85-97c5316e12c6", "comment": "Malware payload (Stop)", "value": "fa7caacfef44e34ab2c4de91172418e7", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493348, "uuid": "352e8ec4-81c6-4e2d-94fd-c3a7ada36800", "comment": "Malware payload (Stop)", "value": "64d1144293e91b56860209f6f72b4b24ddfe5c32d4366f67684bc572350b30ea", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493348, "uuid": "0bd467d7-2ed6-405f-8e70-e8453a1768d1", "comment": "Malware payload (Stop)", "value": "71ac6913783e5e49e6f137d7c5bac5fda5cc3fde", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493348, "uuid": "0ef329f9-43ad-4074-bbfd-36de7258e371", "comment": "Malware payload (Stop)", "value": "c8b1295a112d330e1f16df39526606f2e7bc3b11e47a47dee17c34bbcd53c0d683f806dc1be670d3967c3e188de81551", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493348, "uuid": "41968942-75c8-4adc-821d-dbf489fa52ca", "value": "T1BB45AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493348, "uuid": "c423b5bb-6b06-425a-a226-df0b2a81f344", "value": "24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/RRPOO8YYGUq7:F0dwAYZt6C31WeTJRPOhYdUq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691493348, "uuid": "fbaef994-fbe6-46bd-9a5d-45da65ddda56", "value": 1273856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691493348, "uuid": "418894bf-ab17-4b0b-8007-58b03f7b25d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493348, "uuid": "bf5863c9-e3c9-4312-ae1b-b06ff81595f7", "value": "2023-08-06_fa7caacfef44e34ab2c4de91172418e7_stop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c698309-35ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691500353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500353, "uuid": "6dffc78d-2c5a-467b-b88a-88b0f76d047f", "comment": "Malware payload (RedLineStealer)", "value": "2b77bacb2ac69963039eb41199eee479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500353, "uuid": "0b4ec495-c906-4f1e-83a1-72602d826e37", "comment": "Malware payload (RedLineStealer)", "value": "65d18df23c60d9f0d917880da59d3ddb81483462d1253283c8c526874c8839d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500353, "uuid": "789d52ad-5176-4136-a4b2-9b08a6cfe32b", "comment": "Malware payload (RedLineStealer)", "value": "5af531f1fd5f1da98d881a63b478bb274287f381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500353, "uuid": "0199cb06-f1f1-4fb9-9ff8-b47ff3c5a824", "comment": "Malware payload (RedLineStealer)", "value": "2dacb02eaf572fa60ac97b3ed534e4cbcb95f695116bf3ab31467d45e54f83827328ecdab74dcafc909948da957ecb8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500353, "uuid": "ad4b7c05-790f-4ced-9a6c-8c65f86f695d", "value": "T1A5C4D00272F07831E5325A324E2BD6F56A5EFCA24F95B7DB2354EA1F09B11E1C572702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500353, "uuid": "6a256c64-84dc-4ebc-b010-ee35c345887b", "value": "4103fcf9abd72f2334f54a55e8d7a696", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500353, "uuid": "ec75c7aa-5657-4f5a-9c65-8dfefc376b35", "value": "12288:tLDfczWW/AgKv/wrpnGk6lfSPMn2nOwZDfPFb/Xj:tffiKSMXlq0wtBDXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500353, "uuid": "370ad03b-f45a-44a3-9c7f-becfd1392911", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500353, "uuid": "55696c5e-658f-43a3-90ce-383b6cc60aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500353, "uuid": "1fa42460-3ab5-4585-b625-39e81faaf294", "value": "65d18df23c60d9f0d917880da59d3ddb81483462d1253283c8c526874c8839d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a0e9f6-35da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691492451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492451, "uuid": "bd6dd5c4-1d94-41ee-9dec-0ff9ea226ca9", "comment": "Malware payload (Mirai)", "value": "dd0008b41c6bf013f1f9a0604a4e1617", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492451, "uuid": "c45cefeb-5445-4ec7-88f2-6dae3b749a91", "comment": "Malware payload (Mirai)", "value": "660088018d771c825f7c84375b02faadd7d754bcf9feaacd79b5a8351281d294", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492451, "uuid": "4bd8857d-5e57-4868-a978-c5e085c2134c", "comment": "Malware payload (Mirai)", "value": "ff3318d9142dea43d4197c18f604f28f75f20157", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492451, "uuid": "dd860432-d536-4b3e-b38f-ece8cce6d6c1", "comment": "Malware payload (Mirai)", "value": "81e0b0e976aa185260bf7634bde25a80b88f0a56d8a799ea4cd10a605051af1734b57424ab0e4850ed6151b180a99da6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492451, "uuid": "ef477cff-9afa-4a5e-a456-e889ababcd7b", "value": "T18FD2E12CDA5D7E44C69E3D7D50CE96F9298CB0C0635DA58E17268858BA27E8BFC070B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492451, "uuid": "b6a4687b-89a5-488a-90bd-ee988e231f53", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNXZzcJbUWUl:kbDs06t4BEub4sU/MbUXFcYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691492451, "uuid": "390766d5-efc8-420b-ae40-5923f9aef4a3", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691492451, "uuid": "99843790-b874-422b-8a76-fde41125b1f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492451, "uuid": "a090588f-4590-4719-9364-a08670449d7a", "value": "dd0008b41c6bf013f1f9a0604a4e1617", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0729eb3-3606-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691511365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511365, "uuid": "a591d516-70eb-4474-bf5c-08c7e3b1033b", "comment": "Malware payload", "value": "a06d11c9d5341dd2b9851b9eef0e1705", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511365, "uuid": "c79d0207-3d0c-4596-8174-40d2c58bf714", "comment": "Malware payload", "value": "669d6aa22582ece6305d4347a31cd25bb2f01075749de0fa7438a04725f02cd1", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511365, "uuid": "38654449-7745-4b0e-8976-6c5d3163a828", "comment": "Malware payload", "value": "0ecdef54da6974af668f479d605cae5fb57a761b", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511365, "uuid": "8bd4bac3-6389-436d-9b79-7bc59bcd5fcb", "comment": "Malware payload", "value": "ae9902d6c61261e1714d6421cdbe1a4ee0f48fd8fcc7d8cbeb1d619d8f637663ce6ec821c792d58c92d2f6cca56ab684", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511365, "uuid": "69269d0b-9c8d-432b-888a-efe0608851c9", "value": "T1DB0412AD77808C486E83C75177E05003C987D797E86296BF386E49D58F42E1325A3BAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511365, "uuid": "7023e937-6381-4f0f-a12d-965d0768538c", "value": "3072:yyB3BLugdu8ZwqUn51FncNhZ1XLRL33TlholE2zg/eB4FfDZjRDzkjnfLLRN:yURLfU8ZwBn50hZ17RnlUBc/9Ff1RDzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691511365, "uuid": "b19fd0d4-06f6-49ca-84f1-738a4030e2ad", "value": 180751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691511365, "uuid": "09c36de8-5e2d-413b-9572-03e8de28a63b", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511365, "uuid": "3b9ee37e-c16f-4311-a9c0-cc2028c6adaf", "value": "DetailsReceipt912900878.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c755bd1-35d0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691487817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691487817, "uuid": "6b75dcef-a073-4861-b743-d1c46c3c919b", "comment": "Malware payload (Formbook)", "value": "c893fddffd614ff6c7eb186a786a8f70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691487817, "uuid": "f5cbe785-1c8f-42f3-ad44-7a7753499f9f", "comment": "Malware payload (Formbook)", "value": "66a8c10fb58f0271630054370f503377ee88d52849c75bbb3b57201369405f26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691487817, "uuid": "5fb81b57-d77d-4a10-a0b2-3dcb64ac9bbc", "comment": "Malware payload (Formbook)", "value": "b0283bbdc5ad781f05e5acc2924c4951cf0d573b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691487817, "uuid": "d7fa1ad9-469c-42a2-84a2-078ead8a85ba", "comment": "Malware payload (Formbook)", "value": "862e887c52a22d8d25efa39b0b30fe5b2821d0f5715537da0f33167e77b951aaf3008a65e400548c8d8da623f4006beb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691487817, "uuid": "2f3da237-5be9-4e88-b3e5-edd797839471", "value": "T1F5441248C6E5C5B7E8611F31097A27A65AF556122DF80B8F03203F6CBD3A6439E1F366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691487817, "uuid": "e55c9b55-63c0-43b3-b78c-0edf8c7d2a63", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691487817, "uuid": "5bfacefc-a9cf-43aa-b06e-e981eba66826", "value": "6144:PYa6QgmRn4IAoyoqeO34lGJ9W0nNmc+8qTy9nflR0JXzpFaqOE:PYmgm14V3pgGJ9Wqj+7UlCvFa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691487817, "uuid": "09e2a3e0-debc-47f6-b21f-2424f3a751cc", "value": 269941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691487817, "uuid": "7287ed6e-197f-422b-b04d-5926a8d8f5fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691487817, "uuid": "20d5d26b-3e02-46c0-824c-01cc6ef6f6d6", "value": "ARESPHE -20230808-01 requisition.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ba40ac-361c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691520632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520632, "uuid": "552d80b4-f169-43d4-b9f6-0fb00127d7bf", "comment": "Malware payload (DCRat)", "value": "a89375051c78e7e567cf4ef2d349d8d3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520632, "uuid": "47f3b8e3-e5d5-49c1-86a3-7f478798e3dd", "comment": "Malware payload (DCRat)", "value": "679bf1ece5d0a3592e49f135d5bedcc5748565a1c4d05b785017f0c53e2d0eca", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520632, "uuid": "f37d50ca-1aa7-46e9-814a-fb704af96300", "comment": "Malware payload (DCRat)", "value": "b83f1fda831481344fae26a7ce92740d38b38e54", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520632, "uuid": "c7c8482a-dbec-4a98-9ff2-dae44a631e55", "comment": "Malware payload (DCRat)", "value": "ee965762b9363e241b7800107010069416b7b3900c3f93332c353f749a44424ef0d9779a3b284c24cfeda821a1fb896e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520632, "uuid": "1bd38c6f-e752-4abf-aace-6263ed63f905", "value": "T12E4590243DFA901AF173EFB59BD4B596DA6FB2733707945E109103860B13A81ED8293E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520632, "uuid": "1e1aabae-fa90-42b1-b28f-4c8a8bc82e18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520632, "uuid": "0377ed3c-1c05-4c88-bc45-1e6394efd90d", "value": "24576:qADdteLS1VO6wLVqq0aJSw69voIN7y7Di0:sE86MVX/SwHmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691520632, "uuid": "5cfa6dc5-b577-496e-b486-4ec11e60eaa8", "value": 1205248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691520632, "uuid": "68164708-ee81-425f-b2e9-e28b6901ce5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520632, "uuid": "6dc41ad9-abf7-4dd5-834c-c194e8ab1178", "value": "a89375051c78e7e567cf4ef2d349d8d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2aa6b46-35e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691495021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495021, "uuid": "d9fe0118-31fc-4537-a622-a0d85abf8de7", "comment": "Malware payload (RemcosRAT)", "value": "2b6079d76ec19f9ac5281bf5160acbdc", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495021, "uuid": "c36fe050-fcb3-4cdb-af90-99ffe6d3d919", "comment": "Malware payload (RemcosRAT)", "value": "6bb4bc099c4b6b193358631ba4a2bfc728c565297e395ab72274a226174cb7f7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495021, "uuid": "0f1e23d1-d7bc-44a3-87ad-86ff038930b7", "comment": "Malware payload (RemcosRAT)", "value": "8995ebd67c97bdbd37c1d1424c41d0a5b103626e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495021, "uuid": "37330d9b-b2d4-44b1-9a9c-e893ce4dae3c", "comment": "Malware payload (RemcosRAT)", "value": "8d34302269a901dd480306cced92645ea7875570775e51f8c251f01d36c7abd737c2dccbb7ab986915da348a643acaf1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495021, "uuid": "57dd7c1b-c12a-40a8-9d15-4cfa9f88b11f", "value": "T147A4122AE34E0919DF55A7BB834B9E4909FCB33DF38540B1799C973037AD82E4662478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495021, "uuid": "2eccc624-4294-41e6-aff6-745e07fab348", "value": "3072:8NH0SuL97CHnwEIv3RNVnlJKCIpaPQimmxkjaYEWUIM2NQ:oH0l92QEIv3RXnPy2QimuozEWUIM2NQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691495021, "uuid": "091fe623-c61a-48d6-ac2b-1a24f6734821", "value": 483541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691495021, "uuid": "6c2cf3d9-1a6e-4413-adf2-fcd9b4ddd7d4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495021, "uuid": "b2945504-8a7e-4b98-bf0b-2512707bbc58", "value": "SecuriteInfo.com.Exploit.ShellCode.69.12800.7371", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0bfa112-35ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691500628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500628, "uuid": "fd9310fc-8355-4726-adcd-20bb13a19b23", "comment": "Malware payload (Loki)", "value": "d07ae0584cb210de4ab93d1cb0c7c71d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500628, "uuid": "14c5121c-c4e4-42d1-8cae-21d068aab493", "comment": "Malware payload (Loki)", "value": "6c09fd67d2c7eb94431138da2180c52e3e868d8ddf026f03fd86b0548fb0a3ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500628, "uuid": "6e6e5fb4-f5e9-4921-97a6-e69e298ff47f", "comment": "Malware payload (Loki)", "value": "a244c6a06dcc3022b7152631f4701f6b28389cbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500628, "uuid": "32450843-b9ee-4605-98af-d794f8284e24", "comment": "Malware payload (Loki)", "value": "c922409746aac223fa5dbc8f2302f1f9cfa0da10f3c4d41681695fc338c03deb14bdc0c94ab965e578737c4a4fcf9a0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500628, "uuid": "4b74f518-e289-4782-bac5-5a1e86106f0b", "value": "T103D4F11962BA2B1EC83B3FFD0E10617087F9195A3076D35A0F92B8DF8C65F440A91E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500628, "uuid": "745ae101-69fe-4dfc-af11-3f254fb9c7cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500628, "uuid": "e6275a47-c2a2-4d16-be34-4192ab5094fe", "value": "12288:NpEP/SJa0Q4KsQvUn2pylLz8Ph/qdsQIyJ9hREE9:u/4/Q4KtFiL0KJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500628, "uuid": "489b8322-2e21-401c-9463-1e2df106fb45", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500628, "uuid": "bb201494-dd15-4ead-8f67-78ab29dbf067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500628, "uuid": "9aa5ff1b-5d6c-497f-937a-19277c9e91e1", "value": "6c09fd67d2c7eb94431138da2180c52e3e868d8ddf026f03fd86b0548fb0a3ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f2adb4-3609-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691512445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691512445, "uuid": "a59d3015-881a-4ebf-ac9f-a74fcb63dcc7", "comment": "Malware payload", "value": "f30f21a408eddaabd33525c158109a06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691512445, "uuid": "f019d77c-4583-4b65-9aa3-ba81c56fa4d3", "comment": "Malware payload", "value": "6c3f24ff26c5d2f16ae6aa8842e97d402c2e203d0aa2798a40f4dc000554dbca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691512445, "uuid": "eb8e4223-6ac5-4ae8-8037-ae2a6217746c", "comment": "Malware payload", "value": "c4786dd01744a7af7377e823e3973e38d4b3865b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691512445, "uuid": "870b8b21-7642-4108-b04b-1c9bc7d30394", "comment": "Malware payload", "value": "9e9f7e64e653e0973026c41ed5daee68691afae97cbdecfe03d5ad7bcedd9c8625756837199bdf1c675aecdc1fe911f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691512445, "uuid": "44f7785a-91d2-462a-813e-7e60d94cf1ea", "value": "T1B7F6233BF258203EC59A0B7284735650987BAEE2655B8C1E13FCB85DCF764A04D3E687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691512445, "uuid": "09277121-08ba-4580-8c29-942d1fc5de83", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691512445, "uuid": "5b5e8c99-6ed3-41ab-9a9f-bb1b94fdd0eb", "value": "393216:9lzsKH0MR7lbsKH0MR7lrsKH0MR7ldo9+:9lzslMFlbslMFlrslMFlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691512445, "uuid": "c4765ca9-d834-4190-8c36-289cbb27b4cd", "value": 15663916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691512445, "uuid": "1f98a1c2-03ba-45c5-ad1a-29a12c00fa6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691512445, "uuid": "ce76ddc8-fafb-4b0e-9c45-ba0d0ce47ea2", "value": "Zortam Mp4 Media Studio Pro 26.13 + Keygen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470787b0-3596-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691463004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691463004, "uuid": "ad8d7d20-c387-4690-a7db-20c79bf90cb2", "comment": "Malware payload (Mirai)", "value": "83ec7db07d15829b11b321032e5efc69", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691463004, "uuid": "26825201-271f-439e-bb22-fd044c97ecf0", "comment": "Malware payload (Mirai)", "value": "6d90204a61664400748f7eacc74b6e98ceee8211ca563989e0ec1e889885ce13", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691463004, "uuid": "6e03bf3d-ba15-4760-a267-52e9bc720ea1", "comment": "Malware payload (Mirai)", "value": "929e564986e2bb2304d6bc786b6f980f60d1fad3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691463004, "uuid": "a79badbb-af52-4d46-9ff8-f5897d9603eb", "comment": "Malware payload (Mirai)", "value": "f98174110dc17900e6e287811c965e7e05a9ee3047e4fa4593bf85a51164f81431b1023a8ab008dc5a644c0ea605d727", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691463004, "uuid": "5716e673-5dd8-4140-a0af-2967e740dfc1", "value": "T1D7D34B46FB818F13C0D6177ABA9F42053723D79593DB330659286FB43F867AA0E63906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691463004, "uuid": "4b7871dc-358c-4e16-95f3-4f19fc6a5669", "value": "3072:FMHPp2YH4jMB2CSHfFBR5KVbweCS9j6RM/918mywPoIlq:FMHPp2ZjxCSHfFBzK+XS98M/9OmywPo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691463004, "uuid": "5b9f1257-51fb-4cd2-991f-8291961ba530", "value": 131723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691463004, "uuid": "2fac73b8-e801-4e70-93fa-242e8abe38ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691463004, "uuid": "e385f64e-d6fd-41f2-912d-b222acab7b78", "value": "botx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7fd4b7-3637-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691532298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532298, "uuid": "bff38242-848e-4cd4-bda3-12070be08aca", "comment": "Malware payload (Mirai)", "value": "1b000343824fcce641cb60606d6a498e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532298, "uuid": "c2dc2b16-0e73-49a6-96eb-7bc4212f83cc", "comment": "Malware payload (Mirai)", "value": "6d9d690ed332764715edc6f21f34b318e15d82635c4736c97604a3b4e9bc930e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532298, "uuid": "a7fc21a7-9b28-46c6-b025-586e069d7c44", "comment": "Malware payload (Mirai)", "value": "2c18a1dac465e5aa36ff3b6c2b240895600148e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532298, "uuid": "861c3026-4bee-4208-85ec-c657d12fbb36", "comment": "Malware payload (Mirai)", "value": "a8cb4ee960f773afd7dd43864c6ccc435dfab72241b942baebd4f0bdc8cbf562cff6a9d8645e8e4dd618273ac4e88d00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532298, "uuid": "005ae654-8149-44ea-b6a9-0df0335562a5", "value": "T1A6234B3AC87ACE94F4094730D8719D791B52F01C92723DBA198AC0A1605BE78FD5A7FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532298, "uuid": "45fb7623-23f7-49be-912b-ad1ac456a0a6", "value": "768:iavR0mdmgShmumBmdmtm8wBO3l1lhXTVVd/04XClMoHmLB9aw:iavR0oBYPEIgsOV1ldXR04X+LHW9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691532298, "uuid": "427c65bc-638b-4dd6-8361-b99d94b33167", "value": 46184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691532298, "uuid": "82626c46-db82-43bb-a284-31457662c7e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532298, "uuid": "5b24cc0d-cbac-429c-98e8-1e8c9e91a28f", "value": "1b000343824fcce641cb60606d6a498e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d8fd08-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691478817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478817, "uuid": "cc297268-9971-4df6-9a0f-5d00fbba7608", "comment": "Malware payload", "value": "eea67fdced50fd50688f7226f3f52aab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478817, "uuid": "a108c006-a9ee-4aa0-b190-fdc972d31502", "comment": "Malware payload", "value": "6e3479e956384037fe7c31e12dc058116abe32986fcaee3eb9caae719b4b4391", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478817, "uuid": "a592240e-6eb3-4620-b54f-b3e11dc9ce06", "comment": "Malware payload", "value": "b22a366bad01b4052783976f28a710bff412af7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478817, "uuid": "658d310a-4eb3-49ce-a3cc-867faf82949d", "comment": "Malware payload", "value": "4cad52810874d08ebd5a45fee583065e0f1b7dab152ba88059e2882bec56e6b77646fef053fd0ae4e4eda832599b6cba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478817, "uuid": "d600c426-0707-474e-845e-c38951bb34b5", "value": "T103E312FCDCC6D12ADDA813384EEAD9E771757AA9320518F9FE3C431988D9C2DD486098", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478817, "uuid": "3e7331e5-9c8c-40a8-992f-18230a8e33ab", "value": "3072:nnb9T2rzF40YSM5dCsX4pG8ntGUkqG9ZsmPr211D1:ndkzF43SM5dCsenQjq2Zs4ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478817, "uuid": "330b9a9a-0bc5-4f52-b869-d10a92e2208e", "value": 143237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478817, "uuid": "4b942c27-21a9-4281-a174-75f034d743e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478817, "uuid": "cba6900b-9291-4fc4-95f9-951e902f81f5", "value": "eea67fdced50fd50688f7226f3f52aab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7128860f-35b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691475101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475101, "uuid": "795c3787-d50a-4c7f-8284-23321cbbe903", "comment": "Malware payload (RedLineStealer)", "value": "2cdc3fcd4241373002239a9f75ed33ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475101, "uuid": "7d6f3943-8074-40eb-a4d5-72b9925e86b1", "comment": "Malware payload (RedLineStealer)", "value": "6f025089262da4afa315d370d09906306734783c219cdb878507fab53ee62253", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475101, "uuid": "58a9dc8c-6154-4833-97fc-3ddc6af39746", "comment": "Malware payload (RedLineStealer)", "value": "ebc68d6f4bae1975b79f3530e345ad55dd1e9643", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475101, "uuid": "a43cb1bc-fd68-484e-977b-49c5d10ddf89", "comment": "Malware payload (RedLineStealer)", "value": "be5593d765de41845f4cc45a42ad56b3974b69b6e7497289494f0e9de266010d3107c894a4109f4cb52c99917d7a6350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475101, "uuid": "4a01e1dd-0415-4f13-ab39-2af0d758cd26", "value": "T166256C6079A06132DDE350790BDCB4274F6DA0AC0FA746F316C49EEDAB206E11F79687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475101, "uuid": "989cd783-a3e0-4d3b-8438-4594739a5465", "value": "b1baadc7cd565683e6ca39782aebf267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475101, "uuid": "de7ddf2d-3553-4aa7-9591-1d7e5dfb321c", "value": "24576:E+RxqVK7nwPhMbByrTopqazNzx0rg+kdX8:fnwPhMWNac8+kds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691475101, "uuid": "3a8359bc-8757-47ed-a6c2-d74983cc2303", "value": 1013856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691475101, "uuid": "7d1aa352-e55e-4b42-87c3-46cfff40cafe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475101, "uuid": "890f2478-316d-4dca-b3a6-b5fe55bc8c66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6477ba86-361c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691520606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520606, "uuid": "311aaabd-b037-491b-8fe6-919f10dad925", "comment": "Malware payload (Mirai)", "value": "af2ee0a70e5b7694b6ef7dfc5c14895f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520606, "uuid": "308507bd-3003-412e-b06b-818a16e41fa5", "comment": "Malware payload (Mirai)", "value": "6fa3968224c3b54c49b1f73f2a614c6b2819455bedbfbc8e65a25f5b8286d9f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520606, "uuid": "c02b3209-2b2e-40a7-8da7-815e1d2d5962", "comment": "Malware payload (Mirai)", "value": "6dc36dca845a3d11c042f8aba679ca7c5c861ea2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520606, "uuid": "b98c93d7-2020-4a8d-bf7a-b26a53231002", "comment": "Malware payload (Mirai)", "value": "f52e5a5e453b7387ecdf90715924375859a50d2ae5348be105c7dbdb030e2a51234d12f28cd5ef33b2a2b1cb009a7c6c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520606, "uuid": "38be4df0-680b-4a1d-a9d2-408307d0af6b", "value": "T1D8C2E1FDBDB71E8BDD03113BA56DA833C2B4E0A4F35C72472684511264072F9963AED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520606, "uuid": "29f4276c-9e94-48f0-91c1-e9f6b1073d8e", "value": "768:qMwaDZqFbBy6g4021ZTTq1l5eTxSaL0Nh:qekX/T/uv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691520606, "uuid": "66b4a2b2-03a4-40e4-9e37-df0faadf22fe", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691520606, "uuid": "f5e4aee1-7ff9-437a-877f-21a2f59000dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520606, "uuid": "0e9a03c5-60bd-40ea-81f4-671c14e2cb17", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f20bed-35d0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691488200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488200, "uuid": "8007cb28-58e3-466d-845c-0632ba5e582e", "comment": "Malware payload", "value": "25d13a27c279c8685c49ede394d86701", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488200, "uuid": "1178b23c-59e9-4c9b-b784-3be0c9bec3e0", "comment": "Malware payload", "value": "6fb7069f3be038937a4d4b114589ae0de5b5bd8282f4a7bedfeec4f2944c03ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488200, "uuid": "b6010218-6326-4206-b47a-c9b44162ec8b", "comment": "Malware payload", "value": "53eb0e0c144f4b2fae2658affbd611c316fd8f42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488200, "uuid": "3534940a-6efb-41d0-bac2-229bc4c039cc", "comment": "Malware payload", "value": "291cc963d54738664cc7e08e1f1e28be6bfd994b6e6e4422c53ee571a888c7b55f179e6b7b6cb2a1a45e1cc27ba4af4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488200, "uuid": "d676cc15-e15d-4010-825b-5a37dec18187", "value": "T174C412887AD05472D4537439F86CCDF29A2DF8B15F20DFEB232807721EB46957AB9821", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488200, "uuid": "21737112-bafc-4089-9c0c-ad31e1f69a3c", "value": "5826e2bea2981d413e896f41d08c994e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488200, "uuid": "d54a137c-3e6f-42a8-b0ed-1acff29ed218", "value": "12288:2YmG6/7iICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:2YY7BbVTb34k30/8dRi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691488200, "uuid": "0154ff4c-320a-4c02-b07d-25e8527d2b06", "value": 581953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691488200, "uuid": "ae4e5eaf-4f70-4063-a3c8-2c040b5f78ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488200, "uuid": "e5433f67-6e55-4f6d-801a-a65df567dc58", "value": "6fb7069f3be038937a4d4b114589ae0de5b5bd8282f4a7bedfeec4f2944c03ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb5cd51-35b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691477271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477271, "uuid": "b68605e4-013d-4e66-96cb-28f7f3faaf1f", "comment": "Malware payload (Loki)", "value": "40cc0aea55817ab049d8512321ee1172", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477271, "uuid": "85b1b4fe-87dc-42da-89b0-0b6016bd29bf", "comment": "Malware payload (Loki)", "value": "6fd093d83ebed704ab1d714cadad817d195ea0acb6fa6d00c672cfc94f05aecf", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477271, "uuid": "3377b580-4bee-43d4-bebb-eb25ab1fc933", "comment": "Malware payload (Loki)", "value": "289e7edb147a4a01070eda68f949d3bbe8bb80ec", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477271, "uuid": "58d1a61d-758c-47de-b01e-5df9a955067c", "comment": "Malware payload (Loki)", "value": "75dd140186912870941619189c91c9a85113a86188028c3527ebe3b0f144e8ff39fc82c492b1e87f015d33ab0e44d909", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477271, "uuid": "b3d12e81-b9b5-470a-88b9-46c21d62b102", "value": "T1B035E003E800DBC3D41D83F87E530ED91F0AAF19E99569DB05627F9B3A70A72099E52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477271, "uuid": "961d1662-6514-440b-82bb-b137961909e6", "value": "24576:rRZyQw6VfZyhw6V4jKaWlEzp7aI9dlzZbtQA3Qp5EfIwMx:rbQ6VRt6V4jKjOzrdHt/3XfIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477271, "uuid": "29830113-1816-425e-a4b2-bb40504308da", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477271, "uuid": "701ffe8d-2e0f-4816-9340-b229e9fe4be2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477271, "uuid": "7ba03bef-c964-421a-bd58-89ef5a4771a8", "value": "Shipping Advice for PO#313(B)&366.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8999bfc-360c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691513956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691513956, "uuid": "6465e9d7-71a3-4da7-9ba2-fe47353cf62c", "comment": "Malware payload", "value": "fcb2d3dd8a18bceffb6302a3181fa3d4", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691513956, "uuid": "8d80723c-b68d-4794-9755-66f80f6a7462", "comment": "Malware payload", "value": "7016a3809d13f367ba927b4e486713b175b0acb794ccb971e4bfb1a503c459b7", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691513956, "uuid": "75f523ca-a7ac-441f-922e-c169d9a58e39", "comment": "Malware payload", "value": "e6764a95edd1d9a38c8769302f5fdeed8173de94", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691513956, "uuid": "d05d75bd-1a75-4ac0-ad8a-ee5dbd5e59a7", "comment": "Malware payload", "value": "e5a1c5c9425467d893c7222091499dad02bbfaf01e3e10742abf48e7fa9ad737f2b5001c01eb678347dcef2d26ca6693", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691513956, "uuid": "d6b02dda-0295-4c3d-849c-5188fb9d5d78", "value": "T1DE319E3722B4070CC2B6CA3B68B1BA13973AB40DE90B4F8932515E78181859CF825F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691513956, "uuid": "9546e8e3-b014-44f1-8e80-1e2be750a248", "value": "24:8NmZsxqMtBzRN7oKcaghW8YxA+W+j+/CWIyaLMcap8l7pEQeyTppTpZab/2XT:8uMnFjk022Mcam7iQ9ab2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691513956, "uuid": "cf675cd6-041c-447d-b1ab-ee83161a90d6", "value": 1569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691513956, "uuid": "aa69dd14-74c9-440b-9043-58f53b27e04f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691513956, "uuid": "0207580c-869a-4f39-b4b5-cbcc415bf657", "value": "72.2612.2-sanctuary-upd.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa725522-35db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1691492806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492806, "uuid": "fd7e85ef-a37a-4b25-b15f-3c9cfe51c0e7", "comment": "Malware payload (Smoke Loader)", "value": "eee16136921428cde38ce7f0cb5a4e6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492806, "uuid": "3ac11ca8-74e5-4f2f-a9cd-d45551cf81c2", "comment": "Malware payload (Smoke Loader)", "value": "701d706530d4e793d3140bba8574399d52e023f3db523210312cf64c5a81e058", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492806, "uuid": "61e13d81-e2b3-4049-9fc1-cf036ff52e0e", "comment": "Malware payload (Smoke Loader)", "value": "c4654069bb3060efe4d51a04c71a43ce08a7ace5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492806, "uuid": "230f57ee-a8b7-43fa-ad8b-cc98b0404fb5", "comment": "Malware payload (Smoke Loader)", "value": "b114af88da8c50f7349d5e4ca9cf5eed3ff386af1e15f256470545a550c7b0df3a4ae1b867bc09fc90f8a544689585fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492806, "uuid": "ff2a4bae-eac0-4f1b-be26-e5a0cb58cb8f", "value": "T152546E12A69C6B71E5E28A324E2EF6F4A71EFC918F1537DB224C7E2F08711A1C576701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492806, "uuid": "f500c4f1-8a07-4c8c-a16a-6d8b14e0ec90", "value": "46c207d29e8eaa8317918259507bb42f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492806, "uuid": "cda8bc00-8d90-4c3a-9c80-f171bec43b6a", "value": "3072:R2IQILjh6BLAnbHg+0iyfv6nfCDaB4LQRYkgGRoYc:sgV6injgsy6nfeQngGRoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691492806, "uuid": "52c645e3-73b7-4182-9894-d26329cea2c4", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691492806, "uuid": "63f1bdfa-f088-44a8-a3f4-fe90ecaeb13a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492806, "uuid": "39ca538e-53f3-4d1d-9d67-c25bba71d3e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e873aca-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1691478935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478935, "uuid": "585618ed-a037-4388-8edc-a27f31280fc8", "comment": "Malware payload (Smoke Loader)", "value": "37a3782172b8db598c8a259cffb593c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478935, "uuid": "44f26036-5cb1-45e6-9406-7f00668adc9d", "comment": "Malware payload (Smoke Loader)", "value": "7116b3f38d2eda400a423d91932a4a5f2f5e792b1b071fe94fa75e54bb01ffc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478935, "uuid": "0b30b113-8d1c-45cf-a207-5ddb62cbba3c", "comment": "Malware payload (Smoke Loader)", "value": "a8ebd1f116cd4a21ff8f2c9c5e8c5ed6f0466995", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478935, "uuid": "b67b718a-093c-4bc5-a8bd-779b44609811", "comment": "Malware payload (Smoke Loader)", "value": "5d305b02a92856006e0363525c7d58fafd1daf35b704e47c7ea83adfdd672ac603ed527c00b6217e236d1a6d7cabaf7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478935, "uuid": "76e9cb0e-3b57-405d-8ea8-6f0b7316fa2f", "value": "T13EE42316F7C99477C4A21B7028F706870B36BE629D70A35727868AED1CB36C4A53473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478935, "uuid": "16b2922d-8eac-4448-8968-2aadeabe8f1b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478935, "uuid": "5fa5aa7a-0801-49b5-9cc9-e8fcd4c77369", "value": "12288:cMrzy90IllUOnytcxrFqWBRqUPgw5jkxuhgGMnAGaR9/Ym5RzWxisoW:nyrlX9ZPvYxogGQAx7BR60sT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478935, "uuid": "849215b9-fd9f-40b7-999b-040697dffed6", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478935, "uuid": "a67dc3ac-5ba0-4fea-aba2-f2d4e2303ed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478935, "uuid": "76a955ea-6246-438c-a02d-df42a648238c", "value": "37a3782172b8db598c8a259cffb593c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1826d54f-35ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691499003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499003, "uuid": "a4a69e79-e303-4d9f-889a-5b2cb8c2c17f", "comment": "Malware payload", "value": "37474eb50b7f2b884cf74ad4f9789a7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499003, "uuid": "391f88d0-6a4d-41f7-b265-00afdf92cf41", "comment": "Malware payload", "value": "711da4b8d8a8deb964c31a96dac1b85418e44a2a40417d5099c26118a30e67f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499003, "uuid": "5651345d-94c6-44fd-bd99-c2e62dd22cf5", "comment": "Malware payload", "value": "0599a90eb6cc47b2d70e048cf1a3582ab246617b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499003, "uuid": "b646126d-1ec6-48ca-b790-01aca9d88f21", "comment": "Malware payload", "value": "e784e4bfb68a5d7185a5507a8ae0a9fe170806a0f5072974c168677fac54b891ee156e6b7f5f193010462f46e3eeefe8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499003, "uuid": "ac2aa4dd-5fa7-4788-976f-b01557b30d6b", "value": "T137B1A511A3E88375E8BA0732E8B367014779F741C8A7CB6D28D5428F7D36A444913B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499003, "uuid": "ae6278e8-e0c2-48c7-8f11-ce85ff7f7709", "value": "48:6LLNzGyt/kKl1RfhIBo7htNMEyXGvI6B9bBTUPI9sjlbv/54tdFkklor0DpakFFX:unsKH7TyXGP7ag98likkmYD0k4zNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691499003, "uuid": "6b833303-e671-43d8-99f8-438e8421a799", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691499003, "uuid": "d68bae0b-38a2-4bc0-84e3-5eef746f10ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499003, "uuid": "bdeeac4c-e9ea-4cc3-b9c2-d1b883955d8e", "value": "711da4b8d8a8deb964c31a96dac1b85418e44a2a40417d5099c26118a30e67f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa01081-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691477560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477560, "uuid": "f7e5c678-753c-4e72-8680-4a721d9b425e", "comment": "Malware payload (AgentTesla)", "value": "9ea5f3681953b5fbd3a2b22d930b7179", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477560, "uuid": "d31791c2-649c-4b4c-b768-92e31693036a", "comment": "Malware payload (AgentTesla)", "value": "7297b3b888aec7dc413d75f9e3c828f1ef590adea759e6da18976c9b1a9f6977", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477560, "uuid": "2e7d59b4-7136-48f6-a8d8-c65fce012bd0", "comment": "Malware payload (AgentTesla)", "value": "d57d0de8079066c694e4714faa889869f5271b91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477560, "uuid": "8d9d1bc5-78f6-43ad-9e53-47a14e326619", "comment": "Malware payload (AgentTesla)", "value": "cd07291f6b8075a350bffb44a45db4c5b3e9ebb52414e4e655afc9c5cfe8c87b70980bc1aa7ce74c75586fe8638fbe89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477560, "uuid": "43b87a85-1f8c-4ffc-aed3-2e40ab5b51f2", "value": "T1AED433A7DABCE41F5F4CFE7A0F0439C6AB1DB3B9E3894970748155F2A4081E85B86780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477560, "uuid": "01a7df35-9948-4136-8761-6ef1dbd62101", "value": "12288:evRuoCEvRucXLVmJHVLPghx6B3XKVzVcEmtaIiMl8eZdUzk2DqhVFF5a:eMoCED7GVghk5XMcEmgItdUpga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477560, "uuid": "94fea769-d8f9-469d-9bcb-676b2fbb1f2e", "value": 644973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477560, "uuid": "c6139138-65ec-4bae-ac0d-f84032a2bf0f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477560, "uuid": "69919255-6ae8-4e86-b571-c0d6e3e05d21", "value": "PO-REF67340982.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da4288b-35bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691479444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479444, "uuid": "e4fde23f-cf97-43a9-9065-49698fb7b43f", "comment": "Malware payload (Amadey)", "value": "178f2dd364caa2b666fe5c6f38c58798", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479444, "uuid": "b868950c-22a3-4f0c-b78f-c55522d1305a", "comment": "Malware payload (Amadey)", "value": "72d5cb5140d5d9dbb48d9307c4c5ff64d9154be7d987660c829ecd428fd71959", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479444, "uuid": "d61c960e-3ebf-4457-9e49-7f4964ea68a8", "comment": "Malware payload (Amadey)", "value": "9beb49d086dd962a8698072b37d49acef3c56997", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479444, "uuid": "147817da-32fc-486a-a905-e1b4c6625170", "comment": "Malware payload (Amadey)", "value": "53596cc0d7a8dd47ce4a4996b251c2c8cf756915f7ae7749be7926c522b8e4d6659e6a97597c1d0436ff11b41e88c780", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479444, "uuid": "3afb2feb-d17d-40d5-85e8-15acd1c187ed", "value": "T182E41207ABE84172E8B52B715CF603870B79BC705AB8932B2785A94D0D732D4E43976F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479444, "uuid": "2dc7f54f-63cc-499e-9bb6-0628138c9f31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479444, "uuid": "bc4c0080-3177-4bb7-bcb4-b6a556a29e06", "value": "12288:TMrGy904Zq6L8g7FgZqXE9//g10GlnQUnmKW0KSjVld1uFHNNHlKZLh5muwtdCP:RyhFecG//xGlQUnmKFTEPHVuwCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691479444, "uuid": "a18890b6-a283-4776-971d-1519b0875073", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691479444, "uuid": "af7714e2-06a3-4c31-ae47-84b0f6d34fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479444, "uuid": "8e95a05d-7df8-4d2f-89b9-8136fd506975", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7795eee7-35e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691497446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497446, "uuid": "e155de08-fd84-425e-bae9-02e4eb44de7c", "comment": "Malware payload (RemcosRAT)", "value": "c31f87fdf4a631180ed1bf137b6a2704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497446, "uuid": "93e5975b-86e7-46a3-a4f9-64deb8752df7", "comment": "Malware payload (RemcosRAT)", "value": "74d84e5119a3952c4f641f884ff3d5a1db3a0c2a97dde6a87d11ae11cc107285", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497446, "uuid": "42b82f6c-f35b-461d-ac81-a5f24bad09ee", "comment": "Malware payload (RemcosRAT)", "value": "c62e81d0cfe0f78d615dcf20c0ba254fa67b94ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497446, "uuid": "48ecb606-099b-439e-95ba-6b9a4ac198ce", "comment": "Malware payload (RemcosRAT)", "value": "0905ef717c25de84a52be3c4905753a3edff4713ac93e6b9e1737837599f700d5a3876719065ed492f3d8c5473231449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497446, "uuid": "baab5f6b-cc36-4fcb-a506-52bcccbdec13", "value": "T197C42288F582C99EC5D57AF815BA526A16B7AC912124C08F97B4BF50B972103FCCB32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497446, "uuid": "493e7384-4b35-45dd-a0b9-10ac64774e46", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497446, "uuid": "62425b71-c999-4d40-824b-1ca53d578349", "value": "12288:AYfvTG8TIOeDHBXZoVeBryC+AtAQeuWE8e0IRjdBo:AYfvTG0oDHBXZoVeJ8KBzmdCbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691497446, "uuid": "158d414f-f0b1-492e-a47b-0df543f417ee", "value": 550725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691497446, "uuid": "404c2425-3cc5-4733-837e-b2e6175852a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497446, "uuid": "dc0c7c94-bbe3-42ae-9bba-7b894229de5d", "value": "74d84e5119a3952c4f641f884ff3d5a1db3a0c2a97dde6a87d11ae11cc107285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5930ca-35ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691500406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500406, "uuid": "30929dad-6d5c-4ee7-baa0-2d042d83698e", "comment": "Malware payload (AgentTesla)", "value": "152afd34355dc62e5355b5372ff42f63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500406, "uuid": "673d45e5-e305-4a85-8207-75f1bb84a2a2", "comment": "Malware payload (AgentTesla)", "value": "74e540ce47d401714b7455ba5ab1227693764f070ec1db8f9cffba0aa4732992", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500406, "uuid": "a07406dc-475e-4484-b07d-0ed7596f2af4", "comment": "Malware payload (AgentTesla)", "value": "7803968641cb8a43b0bcbc13690f2ebfbe93fb81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500406, "uuid": "f3546556-0ed2-444d-9ec6-6a181d704db5", "comment": "Malware payload (AgentTesla)", "value": "a0f46a713d1a4b7838d11b418932c817d0d1485099c489609b02b013f27896b573c592bd55f6bac8a6a493d5bd4066ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500406, "uuid": "dc39b159-3096-46fd-ba15-438928e48b50", "value": "T1D1D4E1B4A0AB49E1E24B8A70597CBDA21E7570E3EDD605380B3D5544DFBBB043F84A4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500406, "uuid": "7cd26908-89ac-4ab6-aa09-42f48a05f4d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500406, "uuid": "3f160a5c-d6ab-4170-8294-e4e5f1dc9d8f", "value": "12288:AGJCi6XoL/1ZqXx5m88OVeAdjHrbqMGI1knOIlJJZrFreOrbNj5Ay/5Ur:AsiXoLefm88OVeAnKvLsOX3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500406, "uuid": "5950b72d-8962-490e-9e1c-2e4d307c0416", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500406, "uuid": "a8100044-397c-4dbc-a69a-f4ddf20b8a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500406, "uuid": "fa303ee5-cb33-4e32-9d23-bcfd0732a789", "value": "74e540ce47d401714b7455ba5ab1227693764f070ec1db8f9cffba0aa4732992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169bc388-35bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691480532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480532, "uuid": "fc0030a4-83cd-4ddf-91a5-8cd7d51be808", "comment": "Malware payload (AgentTesla)", "value": "dd9783da2e8fbb9ab0383e0c1641a14e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480532, "uuid": "e18c496b-b101-4223-9efc-a6ea3c5b389f", "comment": "Malware payload (AgentTesla)", "value": "757e76e77538b5076603e3dd7f45cc9931ffcecae25b02364f60f6295bc5d1b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480532, "uuid": "7d0d83fd-b024-40d3-aac9-4dbcf6018bf1", "comment": "Malware payload (AgentTesla)", "value": "43af05c60ec595b3dd6b39e2eee3b686fca7ed0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480532, "uuid": "9671bb39-58be-4b2c-a310-5cf3aa71d85b", "comment": "Malware payload (AgentTesla)", "value": "b829f9605189a691c3446ea935ec2969ac4aaa92769ea66370321b11a3f134e3d8589af43b31893a753baea556c62f0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480532, "uuid": "d94f3914-6f6a-482a-9d6f-b23ca2d9460c", "value": "T1E953476D934F02A9CF525237AB1A1E8441FDBB7EB74051B0346C533933EE92DA1262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480532, "uuid": "fb7fa11c-05dc-4886-a1dc-64d06c4c6ac7", "value": "768:twAbZSibMX9gRWjS0GUsq4H/wWgmMsToLzeX7WzW/S9AmgzzuE/j:twAlRiGA4H/Czg7eAxzzf/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691480532, "uuid": "2375f13e-7ed5-4f3b-a954-6b1b9e765294", "value": 65982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691480532, "uuid": "10228577-44ca-4d90-b042-47fd3aa379c6", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480532, "uuid": "2fca8f12-694d-4c05-8d3f-87d170b289d5", "value": "dd9783da2e8fbb9ab0383e0c1641a14e.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec922d9b-360c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691513963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691513963, "uuid": "2b08aa06-ad48-4b6e-a02d-a9f2fbf66e25", "comment": "Malware payload", "value": "bcc20867e47432be4fe4f951428170d3", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691513963, "uuid": "2320dc93-c5f4-4bff-bef5-95585a681e10", "comment": "Malware payload", "value": "772635072d42d4e41b2a91b533563b624bc9289641f7157391a4568168680b25", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691513963, "uuid": "ea756a12-bbc5-4494-b368-2f668f5185ca", "comment": "Malware payload", "value": "1251deb420db327f93ef0a0e55eb1b333fb0ca88", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691513963, "uuid": "bf01f0e8-c51e-4556-844c-71c452269aad", "comment": "Malware payload", "value": "bdecf06f2c9b719a2467ebc4f2063eb4ee1db54dce623b14f447e8729cdeccfe8e353eae43da314bbee559f4bd7e06a5", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691513963, "uuid": "ac6dc107-4cf5-4c5e-8b64-f42e8d2e3201", "value": "T16345CA34397A7C2443EBDA1334F14B961CE9564FD1703A3B199AD8239A346C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691513963, "uuid": "0a67ecb1-0743-4b46-865c-d72dd214fc71", "value": "3072:+Uqm9YQ0yH1i9i4Z6JDfOBQ5cfLjHxrQ0vtQsOh:+y9YLyVF4k5N5OLhfQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691513963, "uuid": "c9b7e4af-ba5b-4b48-859b-c59bba895384", "value": 1262590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691513963, "uuid": "08362229-54c6-48a1-8317-af54b949ebc7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691513963, "uuid": "ea218bed-4f61-4609-a6cd-502f0e09ae29", "value": "follow.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f17a6fc-3611-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691515873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515873, "uuid": "ff1726e0-c26c-45b6-b5f7-3919d69e988f", "comment": "Malware payload (Mirai)", "value": "e8f65c35ed3db32097d3f920d2c07755", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515873, "uuid": "5f10d6f7-4f9e-4b28-b827-699f3fdeb940", "comment": "Malware payload (Mirai)", "value": "785a800540f0a071a876ffa033d6b9f9e112ed24c587602c324c1bd026a1171c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515873, "uuid": "22609549-6906-4262-bd21-55b76d5cc247", "comment": "Malware payload (Mirai)", "value": "44a95294c44d09571bdc2a6c5709e6c72b547268", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515873, "uuid": "72af42c3-9990-4316-a01b-4167b73c8d73", "comment": "Malware payload (Mirai)", "value": "2bbc49961f73c359096cae6a47aaf56b14f8d10cd72edbfb8fec2dd84a8bc8b3c74fd78ac5a3d6257ef77df7951315ff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515873, "uuid": "dace31e2-3257-43f8-a9c8-1803b227e657", "value": "T13EC2D0A1B726FA31C4206C3EE52B4C8A3A51067CD1FF353654258D358FC169B67E88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515873, "uuid": "9da28929-8d67-41a2-9092-f902dd607ee8", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrM9q3UELuQ:NKy4qfqoeJdXWgVLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691515873, "uuid": "2b9ab9d7-3144-46b2-8f13-007bdfc18ca5", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691515873, "uuid": "dbdaf5c4-b2aa-4ca7-9b36-83cf97185e2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515873, "uuid": "988c49aa-cadf-4a0f-b9ee-0f2481938bfe", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45920ee-35b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1691474784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474784, "uuid": "3bd375d4-7c3d-4b3e-9ca7-9f48b73b9c55", "comment": "Malware payload (Tofsee)", "value": "5c00ce09a4e183802027bb3315473c8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474784, "uuid": "d638e5ff-e559-4d98-922c-a7a74d85d64a", "comment": "Malware payload (Tofsee)", "value": "787cc52fcb94334b237932627fa7a1a843c5a9f79b3827b1bc899773601e1d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474784, "uuid": "72f3e0a4-491c-4c91-a2ed-b9065e1aaab0", "comment": "Malware payload (Tofsee)", "value": "d2cd5774fdfa0b40a26e35e74364f8b54336aefe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474784, "uuid": "be9c3134-62f9-4f50-9dde-ebfd57c6b60f", "comment": "Malware payload (Tofsee)", "value": "9fcc893dc2ce4504fbcd4a43677751d8fea2cfca8d4f8c02d7d5c07aa3d8ced9be0c230e43f9b210d7938cb432877aff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474784, "uuid": "cf0cb01d-9b28-4b7f-a8eb-0d1acceeeeff", "value": "T160546D13E6DC6B61E5E28A324E2EF6E4661EFCD18F1937DB124C7A2F09711A1C576302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474784, "uuid": "e3258475-8c1f-4ae3-86dd-9b8229fbc5e6", "value": "7574067d27f1e097e97a79381564790b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474784, "uuid": "6c58dfe8-2aa2-4b5c-9d0c-62d24c0dda52", "value": "3072:M27w3MOJE+8lAgf2dgSDuZ+rowNVTdF+7fIdR3ew:zMDJql1ejQyowNVTdFqiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691474784, "uuid": "fda2876d-7730-4be4-9532-50be29586a02", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691474784, "uuid": "11addc94-5dc1-477f-b815-9ab4820e2a9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474784, "uuid": "33965f7e-61fe-46ed-8be6-25b760461e7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ae46c1-35c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1691481329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691481329, "uuid": "643b81c0-6d35-43c6-b477-59ee652eda0b", "comment": "Malware payload (NanoCore)", "value": "a07062b3e0739fa7acc8205b07e41d7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691481329, "uuid": "91088ac9-06c1-4f5c-befd-84c9bca6539a", "comment": "Malware payload (NanoCore)", "value": "795eb474d51e7d53bb274661aaabd4bfc8fb6c80f73ffd72982a082a4e8e5658", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691481329, "uuid": "fb2edcf4-dbaa-432e-a2d7-9b525b8c8866", "comment": "Malware payload (NanoCore)", "value": "e45c8e8934e2f2329d887b574890bf835c93e9d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691481329, "uuid": "bc07227a-b405-42cf-abe1-8e08cf4fe8e2", "comment": "Malware payload (NanoCore)", "value": "8bf5250efa71ae4d41e31e2874b2c4ef15fc295a24033c621883f31bccaf3c0f6a85a58c850b9cd815ab8a99aa4c2d51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691481329, "uuid": "bc9bdfe0-32d5-49a9-926f-29344e8f0516", "value": "T1B505D526413AA0B79F097ABC5E13D87A35C96B40B1B6E188B72F38C3D5C61161D3A7F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691481329, "uuid": "5b04b1f8-796c-4929-a9b1-a00d931d70f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691481329, "uuid": "eaa4f5b2-63e8-4aac-9de6-8bf2d3204bf5", "value": "24576:7Angf86FOjrlnf4pppNpppppoOQpppNpppppoO:72umlbO7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691481329, "uuid": "aa1e468c-5245-45a7-a13a-82ed7a71a311", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691481329, "uuid": "d064997e-bb00-4fa3-b149-f75f85c1ca18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691481329, "uuid": "651d557b-fa03-4ca5-ba9d-04e95132273a", "value": "a07062b3e0739fa7acc8205b07e41d7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92add40f-3643-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691537434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691537434, "uuid": "09a28b48-015f-4bc4-a8ca-30f06b9071b9", "comment": "Malware payload (njrat)", "value": "a99198757eb9c7f3d031a1224cbc9255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691537434, "uuid": "73ea0ca9-1668-4291-b083-04a717fa9b1c", "comment": "Malware payload (njrat)", "value": "79870d97f8b51763d001c7935c895589c6f29573b45a0c98da4c430c7f676937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691537434, "uuid": "3890ea17-e00c-421c-9a2f-b9f4246cdd08", "comment": "Malware payload (njrat)", "value": "f08373c82fb240e8ffc00d60f759f8731809c970", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691537434, "uuid": "54adc263-4b59-48de-a83a-84eeb042f59b", "comment": "Malware payload (njrat)", "value": "c46e32503de6cd8367c16500162f6b88b1f4d7acb6533cd565627c5d3f10e0ae50b2807531c5788fd41367fa7a36904f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691537434, "uuid": "16d8ef9b-a1e2-496b-8f82-ee30244d82c8", "value": "T110033B4D7FE18168C4FD067B05B2D41207BAE04B6D23DA1E9EF564AA37636C18F50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691537434, "uuid": "1bf919e2-58e8-443f-a932-b5c0a897f828", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691537434, "uuid": "deab2e37-33a0-477c-b1ef-13e11c3b6839", "value": "384:QAqs2giHF1RJvubMcKyMTYe31kTf6bs8rAF+rMRTyN/0L+EcoinblneHQM3epzXA:zq3TTJc5MTYeGb6w8rM+rMRa8NuTat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691537434, "uuid": "c23181b7-4398-4630-8543-d3df4aa81c7c", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691537434, "uuid": "9382e3f3-1945-4ae2-9e4c-5d2d74efb044", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691537434, "uuid": "8d9915e3-49e4-4003-9d59-ba28e12371b4", "value": "a99198757eb9c7f3d031a1224cbc9255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0473b7b5-35ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691500688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500688, "uuid": "d20825c8-a2bb-4af2-a421-19387207f94d", "comment": "Malware payload (AgentTesla)", "value": "abf9e9e3afbc3f406ba20694b591e7ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500688, "uuid": "68360432-52a4-4584-84c5-55c2101c592e", "comment": "Malware payload (AgentTesla)", "value": "7a387a6fb27c5d9740242f3c240240aa0e762e0d4fb7c4d0f4866c0d9451fd56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500688, "uuid": "a25a6f4d-ee8a-413b-903a-8493e7fd1c77", "comment": "Malware payload (AgentTesla)", "value": "b556e26c5d29c45e3a27c6115fe0bdec86935c56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500688, "uuid": "13454ea7-e130-4f26-af28-67118c9b3b6f", "comment": "Malware payload (AgentTesla)", "value": "085eda07d722393a5dcbcfc5aadce19a0289baf953732dbcb4fa84cc45f3c2dd531ed576616b7ad64414b6fc61603d94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500688, "uuid": "d1812aee-fc4b-41b2-b09e-a91b7d7c89a4", "value": "T1BEF32A2CA2C98E65C32D40B5C7B0115817B2E1664617E76D1EB1DCF63E867C3732B8AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500688, "uuid": "f97f9611-e16c-442d-9586-9422f2bdf2e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500688, "uuid": "321ba7e9-f951-45f9-919b-80206ae550ab", "value": "3072:0uBe5QVSPR+JK/psYedc24kCPJawaWrJkx3bGub:kQVWEK/p5kCPJawDJkBau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500688, "uuid": "433c161e-6680-4c96-bd82-41ff92f65f6d", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500688, "uuid": "b81bf6b8-4829-4648-b5d3-12379da953fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500688, "uuid": "b65aa6a1-c65b-409a-830c-562d81986b56", "value": "7a387a6fb27c5d9740242f3c240240aa0e762e0d4fb7c4d0f4866c0d9451fd56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eeaf401-3603-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691509806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509806, "uuid": "aed329a5-3317-459a-97f3-35ea50945529", "comment": "Malware payload (Mirai)", "value": "9e40e44ecf24fe35c789945a4196ae89", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509806, "uuid": "f108eb80-051c-4ce9-82b2-0814fb2dfede", "comment": "Malware payload (Mirai)", "value": "7b3d44fb3c17b612d1d9d0e0427c1f44ae58159862ab6e089a7107dce529a837", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509806, "uuid": "11b528c6-4023-496a-9a7e-0174c2b962e0", "comment": "Malware payload (Mirai)", "value": "4da58ae986728987e9ae50e0a8096469d4603007", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509806, "uuid": "d6557d66-f30e-4e40-821e-4f5f9cae1ae1", "comment": "Malware payload (Mirai)", "value": "1a3cd898a6bd8830fbb0f6334705f2687afac21996c8f96e194711ec1e145fcf7a57e27501984c932f9f402b14e49059", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509806, "uuid": "d183bd6c-1b34-4ad0-9d1f-38347d5b4557", "value": "T15D63020881279F616DD60E31D0B8C593F61846B0C2975ADB134A07D4B7EE28AF279DBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509806, "uuid": "53d6efc1-f0ea-484f-9946-4936adbd12bb", "value": "768:x4vDxcGvYufnXpWHpCZID0hVT6W9r+iWzNG5XCBfAE3edK3Vdq3UIzt1d06nNVur:Kavuf4p0rhVWzNG2P3e8qzt/0sNVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691509806, "uuid": "532627aa-6750-432c-906c-93910a9799fa", "value": 69380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691509806, "uuid": "8a9d08a8-a58b-4933-8cad-e4e24875f23f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509806, "uuid": "4fc389f6-62a9-4993-823f-59635ab52ce8", "value": "VRarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c528c3e2-359f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691467081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691467081, "uuid": "20934423-a5f7-469b-b9bb-663af12dc741", "comment": "Malware payload (AgentTesla)", "value": "3823b7a10c3bbe3661e9513439ae092b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691467081, "uuid": "5efd5cfa-9ffd-4337-b138-04c5c1bf73e5", "comment": "Malware payload (AgentTesla)", "value": "7b894d774bf391f6a133e0f8901e0807ef75996cea19e865efee1f804bc300e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691467081, "uuid": "26b9585d-b661-4dd5-aaf2-f999fa95ff12", "comment": "Malware payload (AgentTesla)", "value": "7405b1b66561d98f76937552a7b5043803233505", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691467081, "uuid": "b2ad08d7-d98e-4b06-b649-d8317bab78b2", "comment": "Malware payload (AgentTesla)", "value": "49447c518afaa1f437ca2013f8706d70f51a5983636be049004aec196c8fbc96551db25f002ca214fd513dee8c1d079b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691467081, "uuid": "14e96986-6f93-497e-92e4-26bdbda652ba", "value": "T1E3B218012BCE69F2C398F2735269C44945FDFB3339122AE9789CA19237AD11D5BBC170", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691467081, "uuid": "debae167-d68a-4c6d-b03c-c517339b5ce6", "value": "384:CAg+VwCg7Ke8zo1BAD2f0q40Xz+q/7xZH/DOSXQKgS7Y7Rmn:CAg+CKp+a2fvCSz7OSxzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691467081, "uuid": "e15e470f-3fd6-403c-9b89-1cd796180130", "value": 24638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691467081, "uuid": "d661dc77-95dc-4093-916c-d4067ea98cba", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691467081, "uuid": "58e5a1f5-c1db-4a10-9eed-4a72dfe10dd3", "value": "3823b7a10c3bbe3661e9513439ae092b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590226aa-3638-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691532613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532613, "uuid": "6beb2d8b-682b-4e8a-8dc7-a50c1853fc61", "comment": "Malware payload (RedLineStealer)", "value": "4b8d73f800bf68319891f724c427178e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532613, "uuid": "9c03e422-69be-4ea7-a06d-01dd0a03b18a", "comment": "Malware payload (RedLineStealer)", "value": "7bf3f2e7b01a6def023479988f460ecf9bae1d94379be2e3a3bfc58a0e0644c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532613, "uuid": "3532dac9-a1b3-42a3-9a1a-7ac0f438d5cf", "comment": "Malware payload (RedLineStealer)", "value": "d428f27cc08ce1b83f6c0af65d5c3c70b9d71bee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532613, "uuid": "c951a340-b936-4aa8-8f8d-51b32da627fe", "comment": "Malware payload (RedLineStealer)", "value": "d40040aaf64f223fdda3c0e0f87e6fd7747eddb0d852827fc727fa0c3cf091eb19b26aed94c8e2fd539a4f261c3f9150", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532613, "uuid": "6f52a9f4-06a1-4115-958f-a4932bd98b8a", "value": "T16B84AFD266A07871E6274B327E6ECAE46F2EFC918F1437DB22587E2F09711A1C172711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532613, "uuid": "005d0daa-d208-4878-8c4b-540e842b2c40", "value": "52d0e35c520458543d7ae579063fd12a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532613, "uuid": "efe643a0-a353-4a6f-9dcc-e622547ea1fa", "value": "6144:3Mx8bDejDBgHjvdpq+0+wO2KXK0Mwe+8TwcZ7:3OkDeBgHje+0+wgzMwe+tcZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691532613, "uuid": "5aed20dd-b50a-4520-8849-a7dffe2d96ac", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691532613, "uuid": "6d6af0b3-931d-41d9-abf6-7f6c74852a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532613, "uuid": "380a8314-3d47-4dd5-b184-85281001cfdf", "value": "4b8d73f800bf68319891f724c427178e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd26e2c-35f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1691502100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502100, "uuid": "b45e6dc3-bf16-4128-80f9-41fd0c8effd6", "comment": "Malware payload (AZORult)", "value": "0416fc8d4ce867484df2c609f0b77b55", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502100, "uuid": "8f38765a-28f4-452f-b053-611bffeae629", "comment": "Malware payload (AZORult)", "value": "7ccbbb770d396d32ffa75df046707624fe6a6a53e4425225ccb76e113ef5d971", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502100, "uuid": "431284ed-b0cf-404c-8ed7-c414b0ae8815", "comment": "Malware payload (AZORult)", "value": "63293483033ff85a425d491a89cd3bbf7444c7ea", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502100, "uuid": "8fdce77e-6ec3-4332-8ab9-e5a4ec0d695d", "comment": "Malware payload (AZORult)", "value": "27810d9998fa9f7136e5a03fed6963e0404a0c08b52d22a2158af0bddd880cd6594c87c1dc1cd6cb50198fd1724aa920", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502100, "uuid": "5c8393eb-4acc-4b94-aeea-09b6c173bbb5", "value": "T12EF30131BA50C4F7C72247B00ABA9657EFFBA51901417B1B6BC48F6A3E5B182590F2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502100, "uuid": "1de5f7dd-60b0-469f-8fad-22df49ef8b91", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502100, "uuid": "7609b752-8735-4ac0-9cb2-cacdd20c20b3", "value": "3072:+NzPHk9MpcQbF5zgi5q5Ab7nApiN3HMj8qCIXNrGzvLO9DnmmP945OE1N9jr8WBO:+hRFFi8q5Afd3sPXlG/OVfP9ybXlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691502100, "uuid": "c91a8568-6fac-47ba-ba38-3bb2069e96cd", "value": 160577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691502100, "uuid": "0b7d3a48-78dd-4aca-aaa1-add9d76fdd55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502100, "uuid": "5f40f8ca-2f33-49dd-81e8-2ffbb4aa6daa", "value": "7ccbbb770d396d32ffa75df046707624fe6a6a53e4425225ccb76e113ef5d971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17838347-35ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691499861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499861, "uuid": "bf974d0e-ad23-4f49-915e-1fcef0f6955a", "comment": "Malware payload (Loki)", "value": "59894e1fcbacb121a56273e8f387cf57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499861, "uuid": "b083d7df-5763-4653-8592-776a927e672a", "comment": "Malware payload (Loki)", "value": "7d6ab0bfa49a0dd92c4b9edb62de20fe450694bf9b2fdb5cbeec92c6ca137095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499861, "uuid": "14885544-b2d9-46ec-90f4-ee54a75837e5", "comment": "Malware payload (Loki)", "value": "68adc8eb3881785e35d24a08ae8b1c3b6108e06c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499861, "uuid": "1b0eabd9-6d85-46e0-ab77-b75224b44293", "comment": "Malware payload (Loki)", "value": "cc7ebacfea49201ba6888beafb3fa122506c49cab0e2abe10ad2f354a1ea911c935299e873b14f4cd12decb3e7cf1474", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499861, "uuid": "d8405ea5-6e5b-4d17-b6af-2fdbe1a2fc0f", "value": "T10EE40111373CAF22E5FAD3F9257520600BF1645E25AAEA5C4DE270CE29B6F004E41F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499861, "uuid": "f4cb3364-400c-4187-afad-75ea884a3524", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499861, "uuid": "8055155f-9e9a-4ea8-bbd6-34f7e7224f57", "value": "12288:ks5IJiF9QS4aRRKLqMS+kOowhIdPiwsPhIle0hcHRE0uHhHjELOV:RWJioSNRFjOowh4PuOle0KyVhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691499861, "uuid": "2afade53-eba7-445e-9a51-f38b94791882", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691499861, "uuid": "ea0778bf-d000-45eb-bb85-3ef67274e03f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499861, "uuid": "b75f880d-790d-4e8e-b6ac-c893790a9eae", "value": "checkzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509490a5-3583-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691454860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691454860, "uuid": "f9b9894e-e3eb-48b3-9951-7d69c8095a8a", "comment": "Malware payload", "value": "1fbc313a8a218772370f94a8b6d3665e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691454860, "uuid": "724b0c71-ce2a-4c21-a579-5b5a31377dd8", "comment": "Malware payload", "value": "7d703330401a1872c0d7c74199afdaff6d11bf7aa65d49e53732ed66220c18ba", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691454860, "uuid": "55678bb6-45e6-49c9-b7d7-1796716f6594", "comment": "Malware payload", "value": "2dae86eda391fab6fdfa452c16399844649ea1a0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691454860, "uuid": "c4011b8a-a0e4-429a-8118-f522df7896f7", "comment": "Malware payload", "value": "6fcfcb59876ba7a8059412344a51942d8296de74bdef021d81c280c0230839831b1d49117ec2e4f8401bb97db557f93c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691454860, "uuid": "580c3129-3dfa-427b-865b-d4f2bc75be76", "value": "T135648D22B680C072C1AE0934659BD6B919FD757089F4D487FBD8DB6F1F71682B22438B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691454860, "uuid": "c25687f0-3dc5-42c1-aaa2-7b71c37e83c4", "value": "ccf5c5cddaa36f4d958dcf6f161f061f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691454860, "uuid": "bdc1a9c1-9d94-4b73-b647-74f3ea067baf", "value": "6144:RdGQ75x3D0LyDWK/Pn3ejQye8NaNv9vrTBM+7vxA4/1:RHD0WDWK/Gkye8NaNv9vrThh/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691454860, "uuid": "8cd7e2d5-1e0a-47bb-a249-fa47e863653f", "value": 307968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691454860, "uuid": "a43deeb1-743e-489f-bf99-01e7e184aa04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691454860, "uuid": "54d1511a-b8dd-4296-bd25-febe9a5a7f90", "value": "7d703330401a1872c0d7c74199afdaff6d11bf7aa65d49e53732ed66220c18ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1139cff-362f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691528922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691528922, "uuid": "f5ea9bb3-c1c1-4b1f-86b9-b83ce5d12b9f", "comment": "Malware payload", "value": "c906f5482d2a7d1f0ff3e6f3a945e27c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691528922, "uuid": "22c91a1b-9b1d-40e1-b590-106bf0d91450", "comment": "Malware payload", "value": "7d746e96a8c98fa35f66b7033350d5c800b7b9e0982409995bbdefa93c1a1cb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691528922, "uuid": "d72c9ac3-f488-44b3-92ab-914affa2d94e", "comment": "Malware payload", "value": "23f3894f3d3ef6bca88def2ff3320471b309d940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691528922, "uuid": "dc14076d-8052-4d79-bc9b-5656bf1b9a91", "comment": "Malware payload", "value": "548b4bfa68f3bb0182628f14e533ff47af20706c4ce1ee69143651df8011f06316b8998239f39403c9892a0e5ffcb4f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691528922, "uuid": "27f2cfd7-d0b1-4458-bf32-2ac580c7180e", "value": "T12E854B731109A41BDCB4C7752253FEB5A871EDE9BA1EC2A21BD1BF6B783514C096B203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691528922, "uuid": "8404f534-5a7b-4bf5-b555-852ed5dc354e", "value": "c4d010441c17e8245adced7fdcad59f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691528922, "uuid": "da462486-09d9-43fc-8df2-5485d2b435cb", "value": "12288:ANVV/rGvaRlb2nZS1dUpSp3fHwS6K68ZaAouhdKiIXZam:MVQPnZSXUpShfQxKy9urDgam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691528922, "uuid": "00dff215-489e-4796-94ae-22012fe6c38f", "value": 1806848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691528922, "uuid": "426a9f1a-1e17-4f18-9d49-011dd19e2b21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691528922, "uuid": "c58fac70-2e2e-4686-97a0-31e32f44be16", "value": "authorize.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccdd389-35ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691500810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500810, "uuid": "10104a9a-4dc8-445d-9fd2-826535d7fda0", "comment": "Malware payload (AgentTesla)", "value": "f5fb55d15004d4b374888ff295ca0631", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500810, "uuid": "1b1cdf5f-762c-4bbc-86eb-2b675541b4cf", "comment": "Malware payload (AgentTesla)", "value": "7e38d8f8a3433cbbb08248807ac6ceae67206bf6aabd7dc0f51f146779adf51b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500810, "uuid": "33d0810b-d8d6-42ad-9912-abedeae04926", "comment": "Malware payload (AgentTesla)", "value": "8f25f4da10f779d0698601c86c4c1a3e99f95aed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500810, "uuid": "2b1647af-9c42-4192-97ba-ad64ae9acd52", "comment": "Malware payload (AgentTesla)", "value": "2c49cd67b4b430fa2eca07a6ae381dc239bfc563972953b80529a585570e1b7d44c9bd47c15d70f1f252ca983c794b70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500810, "uuid": "8aa17b5b-bc6c-4897-948e-16d38e70034e", "value": "T15DF412109AD3862BD0264B7844A0E374A27D5DDA7762C7CB8DCFBDC7BA267C80635606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500810, "uuid": "8ac95414-be20-4a46-8ae9-b272d18f7c92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500810, "uuid": "0e2e14c1-5ec6-4c44-81fb-b6499b687991", "value": "12288:Xb903Y8auPM7q6bpw4dcZda/igJrV49lCoBGmWvCc5OMu2+8NS26i24D0lMp9:Xb903Y9zu4CZdO1YRT6CgOM5Vn24Dp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500810, "uuid": "635900b8-e460-4eec-a85e-ee6cae66d653", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500810, "uuid": "b92134f5-62c1-4dda-9e6e-2fa4185de294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500810, "uuid": "8e0ad94f-9868-4bfb-9b43-99c8598a90f4", "value": "7e38d8f8a3433cbbb08248807ac6ceae67206bf6aabd7dc0f51f146779adf51b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ab89a3-35ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1691499155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499155, "uuid": "c9f857ba-2adc-4d37-bc8a-8adb11601bc9", "comment": "Malware payload (ModiLoader)", "value": "8e598335699f5fc57ea991eb12165b8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499155, "uuid": "6eafabaf-31f6-4437-89cc-8c12930a10ec", "comment": "Malware payload (ModiLoader)", "value": "7e7845ee07e9f3fb07b6529f5186eeec85495d699026c8dedfd9429cb97da1bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499155, "uuid": "0414ad0d-8a39-4d6f-9641-857d9ec7af10", "comment": "Malware payload (ModiLoader)", "value": "1934045b85fe455de3fa1ee67e1653a998baf70d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499155, "uuid": "cefb97ee-199a-4271-b9ca-d6f68a357090", "comment": "Malware payload (ModiLoader)", "value": "2aafb44d58a21ed10ce30e2ffbe72aa93f00a00d3ef81b2f792250b068fd44f19d06b03c40a7805e1fb3d09ff9a21463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499155, "uuid": "5d213cb9-61d1-4a92-a188-efbebd06a196", "value": "T18F15AF25E3B18832F1735A3CDCD7A278692DBE612928AC0B6BD81D0C6F39751791E05F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499155, "uuid": "55070b1c-e6d2-4ad4-9fbb-66705b5ec461", "value": "ec87643344a2a7d84f861e977219ea27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499155, "uuid": "1aa724e8-ab94-4802-b79d-5274696e2259", "value": "12288:n5d5MBTDUs7yo0s8+ltmqwNHqojVhrfNKKJyF+vOmhptWV5hI96m7f7kmbRAwvVF:jOPGoTVmqA/tKws+2utwhlm4QeMVskf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691499155, "uuid": "46d7be31-5829-484d-ac56-44f8e9744cc3", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691499155, "uuid": "18716cf0-78cb-432e-83cc-32b36bf78abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499155, "uuid": "ac35631a-8984-4121-b421-b4b9792c8edc", "value": "7e7845ee07e9f3fb07b6529f5186eeec85495d699026c8dedfd9429cb97da1bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5651635e-35d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691491806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491806, "uuid": "ce375a72-dc7e-428d-b5d9-04a305485f4d", "comment": "Malware payload (Mirai)", "value": "1f9bbc56b79dee12d17794b98c5ddbbf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491806, "uuid": "52e0674e-1ac2-450e-93ec-fca099722c3a", "comment": "Malware payload (Mirai)", "value": "7e9f7be0f12b61762968ac7af49677a22f1cd6e550f3d4212286b53c8b99d28e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491806, "uuid": "b183008c-f505-435d-8855-8ce0490dee98", "comment": "Malware payload (Mirai)", "value": "7ffe32377817656cf9b65aded1e0abe4db2b975e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491806, "uuid": "32c87737-0fe1-4ffc-8554-be9596f40c47", "comment": "Malware payload (Mirai)", "value": "7019dc162a4ebaf133ee12c8d6efcc9363c3f5e72698dd0cb6dc2014c0a8eb54b0e375d8b442bff12238dd6e5a1aaa2e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491806, "uuid": "5f37b5ee-fee9-49c1-b3db-78342e1bc720", "value": "T19A3302A227AE69E291B05777FC33BC1A669C16B95C6730DA2CF0961977C08024FF75C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491806, "uuid": "6d451a29-29d5-4bd5-a0e8-5f4c00d5ccfc", "value": "1536:99O/ZMAXIxNUk0fLcPqF1aBexo4opKZbEKt:99O/ZNKyDLGqFUFct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691491806, "uuid": "7d57e2a3-5a5d-47cd-a206-51c3a322cc11", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691491806, "uuid": "3f687550-7773-4d98-864b-2319cc3239d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491806, "uuid": "08dbe088-4ecf-4818-aecc-ea9194982b94", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb4262a-3637-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691532275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532275, "uuid": "e8379af0-5ebb-4bb9-99ca-863153fbf559", "comment": "Malware payload (Mirai)", "value": "f0af04881403bbaf9fdf378d2659cc96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532275, "uuid": "49085f68-d665-4a0e-9165-3367f83d0e2f", "comment": "Malware payload (Mirai)", "value": "7eb789697b9e8bb29a3f5d551c43294d98bb94e3d0785f6b4796f9919d50aa92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532275, "uuid": "108c2ecf-6c06-4364-b2f6-84140e4f06f3", "comment": "Malware payload (Mirai)", "value": "10274b7b4f1a403d03a031ad1ba85e649ace7567", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532275, "uuid": "0614306d-eb6a-423a-af6e-ea42503ef486", "comment": "Malware payload (Mirai)", "value": "c4f6274a1d9eba260a9a2a1465d18060ff45687bbaabbd52b8a5837a471ca37202f99775d0257f219d4d6a6d81b231a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532275, "uuid": "edf6085e-fa04-4776-b3c2-8b898b2ad3fc", "value": "T171D2DFAEE4B542C6FD8D5C3E808C3FA00E59E581221BDB9167118C4D5B36C5BF17E4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532275, "uuid": "ca7afab9-3a57-434d-92be-7d9e3e9bf3a4", "value": "384:Q8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjGj1RWGVCz0Nvv:FMYHb62x4ahQ3CfdwLjBWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691532275, "uuid": "ed0f74c1-60ae-4f94-aa38-c7f37ec53a77", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691532275, "uuid": "56c8de6c-902c-42df-b952-46cede37d133", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532275, "uuid": "a2db56cd-1f9c-43c6-ac1a-d53c40200e0d", "value": "f0af04881403bbaf9fdf378d2659cc96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9436748-358a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1691458096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691458096, "uuid": "f8ad3300-2753-4a5b-85f9-55fa72afdfd6", "comment": "Malware payload (QuasarRAT)", "value": "7a837441ef73435830b9f5e7bf858f67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691458096, "uuid": "92ed28f6-0edf-42a8-807b-a44a8dd5536d", "comment": "Malware payload (QuasarRAT)", "value": "7f3ce13c39b8aa0202357579138c56a684a5c0aad61b8b5c1f3fd20f12afa916", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691458096, "uuid": "ea3c5913-caf6-4e5a-a96f-7fd8a41de119", "comment": "Malware payload (QuasarRAT)", "value": "423a46a4497c406ab925b9d442c9ac3d680c48cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691458096, "uuid": "a6e8809b-ac76-4c68-bc01-3b4d2f904255", "comment": "Malware payload (QuasarRAT)", "value": "2a10c1c16312d5a8b2a02e8d69786b6b506e7ffdb4c85fa452592a67cc0672697ec239b5d1809620ba4fb33019c17452", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691458096, "uuid": "2c65bd06-61b2-4dbf-8f96-41032fa045eb", "value": "T1D0E54A0537F80E27E1AFE372D6B0441667F0F82AB3A3EB0B659166791C93B5188417B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691458096, "uuid": "76e2ed1c-adf3-419f-a6d5-fbc65fc3a575", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691458096, "uuid": "09375ccc-d6a8-4463-b88a-b14aa6999fe1", "value": "49152:Q+EVUWCmlNuqBfHFRrOr+kR4CPcr9cdWoG9AfTHHB72eh2NT:Q+MYRqBfHFRrOpR4CPcZc0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691458096, "uuid": "94b4c9ca-c189-4d73-b3af-d0966d98e634", "value": 3264512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691458096, "uuid": "403fc51d-7a1d-44cf-8c75-1d93b9f4398d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691458096, "uuid": "fd15b8e6-403f-44be-9309-ac3010bd8b59", "value": "7a837441ef73435830b9f5e7bf858f67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1392c9-35f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691501698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501698, "uuid": "951d70ff-fb34-4e23-83be-d232510e6950", "comment": "Malware payload (AgentTesla)", "value": "0dc53fcac707d27400179382f3067c8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501698, "uuid": "52df3021-57f8-4fcc-bfac-ea7e91918606", "comment": "Malware payload (AgentTesla)", "value": "80ce21fcc805697cd3d617fb8599d9e20a300a7e1428c0b160db85f166db5be3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501698, "uuid": "be0fb1e8-2945-4b89-9e89-d9ef27c639a4", "comment": "Malware payload (AgentTesla)", "value": "26d10a7733551f5ad2149ab6fc5f6cec9e076425", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501698, "uuid": "b72a61ce-3954-47ca-bb03-245511ad22bc", "comment": "Malware payload (AgentTesla)", "value": "be44693d1b7c47bd523ec5925e005afa1e1241526769b221cdf8caf4834730b73b6fe25e56c6dab713ae4833aafa6df0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501698, "uuid": "a4553dce-240e-4e34-9362-51e0a586224f", "value": "T19BD4CF22D31AEE86C1961DBC502154F127756D24A25AFA36BCCCBB7F02B67C833D6583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501698, "uuid": "66d8ed11-672b-4ee0-b5f2-1a3351adc30b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501698, "uuid": "3dbfc446-4965-41df-a5c1-9e0057f09c3d", "value": "12288:W6P1AjFEKOQFQKwuBS+vXhrbdvR43Gl3hq/0:H8FjOQmK7rxvRlr60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691501698, "uuid": "18baa2eb-0c5e-4777-8fc3-f2918a8fbc1a", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691501698, "uuid": "b4c2a50f-c714-49c7-85e0-804fe35c6297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501698, "uuid": "978b3fd0-4d41-493f-954d-61a063546904", "value": "80ce21fcc805697cd3d617fb8599d9e20a300a7e1428c0b160db85f166db5be3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33eef91b-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1691478864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478864, "uuid": "1b9868b1-8620-47c5-a439-8e6dbd3432d9", "comment": "Malware payload (DarkTortilla)", "value": "3a51ad516ad839a98b795711b4aadb15", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478864, "uuid": "4f69fcbe-2a8d-497e-b1f8-a41e9364f307", "comment": "Malware payload (DarkTortilla)", "value": "80e2f3ab9f85cfd764db0792a05b2a77889457522bb3f6d9b5edfac8321843f8", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478864, "uuid": "c47bdf04-9ae1-4a7e-b138-3f600b139d39", "comment": "Malware payload (DarkTortilla)", "value": "2fe34e8a1fbeb84da4fd26fbdff1436711b3cb17", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478864, "uuid": "139c6711-2415-45f5-8576-145915a870fa", "comment": "Malware payload (DarkTortilla)", "value": "bd8b6c95cae4a95d7db11de7aea14b592b77b50d09a7da4f79367ad1749647f2236d764f6e17a7de497533e7163832d3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478864, "uuid": "c69854ab-adb2-4a74-84fd-e75c0cde37e2", "value": "T1C965E04EFC022F55C331D87B0A8E9A203CAA12BF5F529F1772656987DF805C6B03566B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478864, "uuid": "51f145b2-f16e-4e71-9b95-2f18526feae8", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478864, "uuid": "b97e3560-5be2-4e4c-85e6-78f8889b5dd2", "value": "24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478864, "uuid": "c16019fb-dc20-4e29-83bd-7821a050363b", "value": 1441646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478864, "uuid": "f238962e-6c18-4eb3-b33f-d10e485bec57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478864, "uuid": "2da7eb0c-b81b-410b-bc5e-028e07807880", "value": "3a51ad516ad839a98b795711b4aadb15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea5a453-35ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691500652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500652, "uuid": "a00e3d9c-d5b3-4f85-b374-9af6b8aba487", "comment": "Malware payload (AgentTesla)", "value": "831345bdf8e6bfebfee189f4d145d738", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500652, "uuid": "e124dc16-ef00-4c06-815e-7bd0ea7cc641", "comment": "Malware payload (AgentTesla)", "value": "815156bad70a59b55681690c8b2e48ff3be7703d45131bca0a486a5247dff35c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500652, "uuid": "2e184c74-4360-484b-be1c-c6fa7ac3a8e9", "comment": "Malware payload (AgentTesla)", "value": "59ab2df774ca170c6813e31fb712a2a2379a651e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500652, "uuid": "ffe6ef4f-6590-45c9-86a9-50ba7d2e42a4", "comment": "Malware payload (AgentTesla)", "value": "70d0ff5ffbcd5ed2d50e1cf451759b51f0877597f11cecd319262d54fa901ef82812f1d0eab29c17b6039d466d00fe11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500652, "uuid": "4a1a4f68-048a-4be3-a7a3-6c03731713ee", "value": "T1CCE4015822FA6B2FD87ABBFC1E10113087F914497027D3564F936CEA9D76F440A82E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500652, "uuid": "f06cab0a-4e86-41b8-a5bf-8f343c5b6fb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500652, "uuid": "35648604-bcad-45ab-9ad8-067cbea8fdf9", "value": "12288:9jEP/SJaf3vI7Q5a43DTQcAneBZT8ddyqP89o2CShe:s/4e3vIInVvgdb6oDShe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500652, "uuid": "0830daf5-edc6-4469-a880-69e2d56aaf3a", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500652, "uuid": "39c1177b-1dee-4a75-8fcd-baf395e3faf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500652, "uuid": "7b318fbe-7675-409e-a39d-96377333a688", "value": "815156bad70a59b55681690c8b2e48ff3be7703d45131bca0a486a5247dff35c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3338e2-35f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691505318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691505318, "uuid": "fa2e23f5-b404-42d7-845d-a9ba99ee7c21", "comment": "Malware payload", "value": "ecd80a100b4eed048fff1016370d12ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691505318, "uuid": "bfb51251-651d-48ed-baa8-23113a0e7f90", "comment": "Malware payload", "value": "815c8192d3805ba9f8ea79df232bed3a856165da479a4fea1dcae67a7d109f2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691505318, "uuid": "5f74fd1c-668f-4561-96d2-db286a631687", "comment": "Malware payload", "value": "60585f0d72bd34bc1a8c74a2d3eaf8a5ac2b610c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691505318, "uuid": "b3acf56d-7d5f-4f54-bc1c-9aa5cf704948", "comment": "Malware payload", "value": "1574b6d88eff10ec796c09e0c1c0293118bdcbe07b999cf5e21f644cc39e6e89680eff36f8a4db638db722ee76242450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691505318, "uuid": "ba322f30-9e46-4ba8-8766-a86a1a240eb5", "value": "T19656D074CBCB4935D9130FB8DC7AAA9AA3F13F3D2935E72A093539339554A38160E523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691505318, "uuid": "0cfc1836-7804-4bba-b6b2-145e63c97390", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691505318, "uuid": "9b1a09c2-f135-45f9-a920-9126a678c9c7", "value": "98304:SM1gX705LxZaXnssMaQ95UBqDlOkyHkjZeQB6yBuQG33siEEl7gxG1b2f:SyE2wNs95UhatAWQRf4G1qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691505318, "uuid": "0073ff72-614c-4670-93d5-774b197aceb3", "value": 6129464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691505318, "uuid": "81470cd1-3415-4c6a-abbf-c0f8d4acf8ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691505318, "uuid": "06f85ca0-85a0-4b7c-aa0a-fddcbc6b6a5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b01163-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691477759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477759, "uuid": "7506b6f0-5858-43f4-8648-cf8c4f9f09f1", "comment": "Malware payload", "value": "5c08f81b7c0798d18adb487ca38e40b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477759, "uuid": "38b66f58-f5a0-4919-a96e-5a8347652d6a", "comment": "Malware payload", "value": "81c326d1046b12e0d6484d94fd6c6d71e9fea0ffd3c17da8dc362b362a6de5f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477759, "uuid": "6f9a4db7-8c39-4d9e-8490-5bb39a0b3f29", "comment": "Malware payload", "value": "06d795be9f1ea313ac0f729109a666c2b64342af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477759, "uuid": "263b4ef0-4dff-4622-b02c-ea531fe07be3", "comment": "Malware payload", "value": "c2cd51ffae9e3c7996f2bf56f451810afedf28305825f6d71a0dc54ad01909e7a47541a573c08efa051cfcd80ee9b95d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477759, "uuid": "1b82e401-18f6-4dd2-a4cc-aac55248ae99", "value": "T1D1F2F919EB8C8573C6BAC2FDA8F233130274DAC53452EFCB599453A52D03B257941EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477759, "uuid": "827eafb2-68df-4c52-b18c-789c3437775f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477759, "uuid": "eceded31-e8aa-4de5-91f5-9bea2225f5a8", "value": "384:PKItuTHfIznJak3Sne0Eq7oT4xiHa23cjXfV8cbv/CnxLzBNsYqBAWXoKev44ZDG:P0wAe3abyxwl6WZQ4sDRWWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477759, "uuid": "3b5067cf-6695-4a34-b123-ae3262644dae", "value": 35840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477759, "uuid": "2994ff7d-d09e-4621-84a9-1eeee0e0a49d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477759, "uuid": "7668c37a-01ac-48a9-bdac-2cfc47e4c178", "value": "Scan_Document_202308078900000000458.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76418a89-35d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Arechclient2)", "timestamp": 1691489712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489712, "uuid": "d8900a42-1941-41be-9466-970670e656c4", "comment": "Malware payload (Arechclient2)", "value": "608638750dcc078dbd10555303bcce9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489712, "uuid": "12f6f6b3-21a6-489d-9565-0f786ddacbf2", "comment": "Malware payload (Arechclient2)", "value": "81f4e0d6a70f14c3e07241196bd7f5318e302c28c64ca4bb876f4e25fbc3e5d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489712, "uuid": "5ee88322-4adf-4a46-8220-7dca076efbfb", "comment": "Malware payload (Arechclient2)", "value": "29cf6801805f4b3b643aefda8e3f0a71d041f37e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489712, "uuid": "8b744e09-14ec-46cb-b2f4-31cf38aaac20", "comment": "Malware payload (Arechclient2)", "value": "1706a2a1f5ea10158ed689af79eaf942518a9087a62f170fb8dde792a1e2b8f3ad7ae7ef207ad70aafa2a0ed09a50157", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489712, "uuid": "40d8fc7d-c600-48b1-a41f-1f127bcc77d3", "value": "T1FFE5335AB9409488E83CE1B2D313D8906E601EFE85440DD7F8CD776609EB0D6FE2BD69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489712, "uuid": "dba47f53-7042-40fd-aa53-625ccb666a6f", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489712, "uuid": "3db599a1-9a64-4c91-b4a6-c6745b367736", "value": "49152:f8Owzrpem9UT6eAW6weX5Ktxyr/FJp8dQsJYMYMqu/oYwpXgsFOeRsbBhEg+BHyx:TwzrACbfW695Sg/FgdQsJYMY9u/o/pXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489712, "uuid": "4ca42b58-e4dd-4b55-b89f-1789d9801b1e", "value": 3118080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489712, "uuid": "28a57d66-adbb-4c78-9b0b-d7d10bdf36e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489712, "uuid": "36d158c9-ad66-4692-afb1-b7c579d0c04f", "value": "608638750dcc078dbd10555303bcce9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4abad65-35e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1691495937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495937, "uuid": "20377ee4-9a98-4fc0-b037-1fd1baf29e6c", "comment": "Malware payload (YellowCockatoo)", "value": "47aec4ceb60331ea13c0d5e4330a571f", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495937, "uuid": "6c7dc87d-f35e-45f6-9e72-cfeaca684fb2", "comment": "Malware payload (YellowCockatoo)", "value": "82600121c6678c2fc313d8e94031b65ac5ff0e0c1b5e0fac00410f222ca747ac", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495937, "uuid": "8b6f3d99-a000-4ef3-8b20-6af15ce2f52c", "comment": "Malware payload (YellowCockatoo)", "value": "ea79294f42b06fedae001cd375b6a9e48082b0b0", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495937, "uuid": "ced03c25-ae47-4bb6-a7a0-e41916aaf736", "comment": "Malware payload (YellowCockatoo)", "value": "bd1b39336a76ab9e58eaa0d21c5dd4d7fe06f853beb1780c90dd10572e76a5837cc4b533b1cd2905a2681c3914212f87", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495937, "uuid": "903b77d2-3f39-4d2a-bd99-1f688d748d01", "value": "T1FCF5B0D4CB9E7367E682694973C3466886B98F7D6134082BF1BBD9D491C360A9F203CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495937, "uuid": "1ba8fe59-e94e-4a8b-9bd3-af775c8d917e", "value": "24576:8fVNBboOYqSCj9aMHPUNjxOdaRJCLz6et8/4cfFbfgKlt:8fVPsOKMvUNtMpLz6eilfFbfjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691495937, "uuid": "8763ec22-df43-4d9f-89ad-a85e09f9a120", "value": 3422386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691495937, "uuid": "4abd0ee4-20e1-4a4f-954d-c3d2883d41c4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495937, "uuid": "a5c442d5-627a-45f8-b0ba-cf475c4a3488", "value": "installer-tool.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07002aaf-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691478788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478788, "uuid": "8652c76a-4f14-4b77-bdb3-90c740566dc2", "comment": "Malware payload (Mirai)", "value": "1918707368f0aa8aeb7ed011350f0de4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478788, "uuid": "7b98f476-1794-43f9-9278-16d0c4fc5c41", "comment": "Malware payload (Mirai)", "value": "82637161b729c7e689580bb2d774f9fd150a43b71c546fcc474888051bd20017", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478788, "uuid": "90840db5-5348-4bf6-9f28-2454ef19dbea", "comment": "Malware payload (Mirai)", "value": "16dc01f59b6ecfeb3fd3b3c9348ef68c9349926a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478788, "uuid": "6da40a72-6933-42a0-9fa0-d90ec3b80bff", "comment": "Malware payload (Mirai)", "value": "f9873f452c8a419282261dd4b64ea8665832dd27c3abfb18774f4ae6ad98f039ba79708b4e846cad445d0f73ac9facbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478788, "uuid": "d74a3cb3-7634-49a8-aa9b-f750493b479d", "value": "T1FB83E895B8C18E11C5D413BBF92E118D332267A8E2DFB2139D206F147BCA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478788, "uuid": "e4575a74-47b8-4ef6-87c4-e95fe8fad05d", "value": "1536:ORnabgUZLKq/zB8dAm5UhNTzeRGq1SM2b/cc7JT8i6N1nGKQw5e5a995nZ4cuIcW:1gYLp/t815YNPeUqoMS/ckJ4pNlNz021", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478788, "uuid": "4f3bdfab-16d9-4b17-835e-9a011825a04b", "value": 83244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478788, "uuid": "67f8e4ce-c146-4017-b360-07bbc9516865", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478788, "uuid": "e8474f96-f7e4-47b3-b019-4a4525ae2f82", "value": "1918707368f0aa8aeb7ed011350f0de4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c89228d-357e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691452840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691452840, "uuid": "d40fc2f2-fc72-434a-8063-c400070a548f", "comment": "Malware payload (RedLineStealer)", "value": "cc4d8fc3c02d1706c374f38b4f8074e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691452840, "uuid": "fb59be23-f88e-4190-8e2a-33d7e8cb5015", "comment": "Malware payload (RedLineStealer)", "value": "829c8a42d65b1587d2067127d22ed243d75c50e3b0830344dd5d64ac6ce390de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691452840, "uuid": "5b8503b7-225d-4a76-93d0-b18a0f31949e", "comment": "Malware payload (RedLineStealer)", "value": "17a49f94f7da6242d7917ce07c5546f76d2a8847", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691452840, "uuid": "4f48fa11-ccf1-4b89-91f3-f7fafff974c1", "comment": "Malware payload (RedLineStealer)", "value": "f206408fd61154311879c5c079332b8fc8e737d654ba72237a8e7ad9e1951af773670d504a6edfbdc5d4084f77c3a24e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691452840, "uuid": "fa389289-ce3b-483d-b6c0-b8862b4e2d9e", "value": "T16C64E012A6E0EC71D55A86318D2BFBE4765EF4618E9ADB5A72340F7F0C312A3C663311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691452840, "uuid": "01b5d19b-02f0-4c29-a53e-c7d9e3c57136", "value": "fa3af5d27b7217d6ce74cd1f3da0fe05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691452840, "uuid": "acae3f00-10c9-4359-afaa-a574ead5a904", "value": "6144:fyILtw3FlTZU4UYiPBSyVXmRDr8sLJ2OywWnm+UaR:tK3FlThUbBSy2DrLdyI+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691452840, "uuid": "22089187-f606-4f29-8f08-de4ead2c4050", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691452840, "uuid": "91ae4f96-5813-449d-a98f-ae25894a470b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691452840, "uuid": "16aa13ec-f1e3-4973-9275-880685805880", "value": "cc4d8fc3c02d1706c374f38b4f8074e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de18bf1-35e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691497886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497886, "uuid": "6fa1f8ab-d2cc-44b0-921c-6c3a76e45bbe", "comment": "Malware payload (Mirai)", "value": "d554ebcc11e8d1d1022edb5c09d182e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497886, "uuid": "22b6ec72-c5a5-4536-9a05-5d4a7e954997", "comment": "Malware payload (Mirai)", "value": "82ab4f4420e0148809020c38fc63cf15eebd75b28fba962719d82b491eefdd1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497886, "uuid": "6ef68424-05c6-4098-9951-502f6cd7ebea", "comment": "Malware payload (Mirai)", "value": "f1bf9a9cdb519b5bb6b6449cd1c0610d16a4e594", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497886, "uuid": "423feaa2-3c9d-4f63-a6c3-3e86c45b86f6", "comment": "Malware payload (Mirai)", "value": "8a5efd8f44f79f2e115878f4e909d3bd820cfef54c4276dbc3837312731db746eeedc81dde555e2b394de48ef1cccdfb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497886, "uuid": "00f15f9a-36d4-4b56-967e-8c72fed217a1", "value": "T15333FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497886, "uuid": "7a3e49e7-5369-4674-b311-ea2bb4c8f5c7", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oGA:r/hqaJMeteqK806MHdkfQX6HuCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691497886, "uuid": "33111a6c-b625-4187-b15a-ea2c9bfe4406", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691497886, "uuid": "33c11126-9acb-4da0-9b98-46bc6fcdfab1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497886, "uuid": "5b41bce0-474e-4a15-b9f5-2e9adf2a398b", "value": "d554ebcc11e8d1d1022edb5c09d182e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6041dcf8-35dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Conti)", "timestamp": 1691493111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493111, "uuid": "c5454512-7032-4f81-a81f-67efdca9a594", "comment": "Malware payload (Conti)", "value": "3c7db7d387c900cc26000af2feba7e9a", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493111, "uuid": "e5ac34db-f982-4db7-8f05-cbad56add962", "comment": "Malware payload (Conti)", "value": "837c0f1e9749121e4f8204c2b5546964c10d4e3d85a514458c35cbc021762d5c", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493111, "uuid": "fa77107f-b7a6-4a32-ab0f-d7bd3d005893", "comment": "Malware payload (Conti)", "value": "bbafa2f1af8ca8c692f9bb70cbd36d6ec7bb7b49", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493111, "uuid": "3cab7428-541a-43fd-a2af-71e3e01867c2", "comment": "Malware payload (Conti)", "value": "d0227484c8214d1f63008368799e8146acdf941a9843215a49db37c8198e086b1c7acec41eabfb704712844194e6658b", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493111, "uuid": "ca8b8fc3-b686-437a-8730-407f665a3c35", "value": "T123144A15B64E4634F25A98701AFC6DB354A89A38336FCCF7B3C946792A25AC27430F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493111, "uuid": "52a0ab5d-2fd0-4ff1-a87d-b4d1fc7b9abc", "value": "264caf1303410c12995f63c5eb060208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493111, "uuid": "1e0ec3d6-5b6d-4106-b18c-9909defe2f68", "value": "3072:RLJGBP1t82ETTwPAobQ3tOqmb14Gul22QZkN7S44EXZN0Rx6kFn:tJEPCTwPp03YqyNulakLu6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691493111, "uuid": "79f00f33-69c7-4e89-b2b9-488cbd9e773d", "value": 206012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691493111, "uuid": "5f766bf5-1788-4f97-a2b3-0c4f754f20af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493111, "uuid": "b96c04ca-a286-44fd-9437-95a20e812fda", "value": "2023-08-07_3c7db7d387c900cc26000af2feba7e9a_conti", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f231f6f7-35b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691478324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478324, "uuid": "ff0fb4fc-eadf-407a-98a5-2895d20b04b3", "comment": "Malware payload (Loki)", "value": "0945e91513b403d503ec58b7e52f9451", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478324, "uuid": "624f9c73-a9a7-4a1c-bb8a-942dce789496", "comment": "Malware payload (Loki)", "value": "83eb06c7916703b3c45aebfc9606d4e2926d9f14220b3f970b0b4159abefcbdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478324, "uuid": "1c6e843c-5004-4f11-9091-3c326168c9c4", "comment": "Malware payload (Loki)", "value": "240cd71ef7f5b15fa1771e04639fb9c439d23e20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478324, "uuid": "1fdb6321-c0fa-4c46-9ea8-0bd89efbda02", "comment": "Malware payload (Loki)", "value": "1227ee9087b5421ec4b78e225d6798d523958b437adb9343e0c56c1949cb4a543422540aac0b77a1c58bfb5dba81371c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478324, "uuid": "46a2ca8c-0b2b-4b35-869b-c5fcbc4e9ea9", "value": "T1EED4F1013778AF66D1F5E3F9283650940BB2745A35AADAA80CE1B0CF1DB6F104E62F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478324, "uuid": "5434f292-721f-45d4-8290-5c3920013b58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478324, "uuid": "23db220b-04be-4aa1-92b1-d4e0c2ae79ff", "value": "12288:CshRuiF90YHKzrCFAj8msB/RX8HqxGtwuoVARlDVUqIOj:vbuiwWVmsjXAqgg4VUhOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478324, "uuid": "66e91a47-be6b-4d9e-99d4-8991361e8249", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478324, "uuid": "272a734d-c2fb-400a-ad67-4b7d771e4b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478324, "uuid": "876cb700-019d-42f1-b174-55a4cb8d734a", "value": "0945e91513b403d503ec58b7e52f9451.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93dc151-3636-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691531942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531942, "uuid": "650ea9e0-0b13-43db-a3bf-3a95889ecdb0", "comment": "Malware payload (Mirai)", "value": "58d00fd032bb25b01a1daec4561fe599", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531942, "uuid": "d2ed4515-c1c3-4e7a-9c37-d0ba35fde1e3", "comment": "Malware payload (Mirai)", "value": "84cd00bd4368112f7823b1b5b8ecc7c4b471f7e45336882d8cc3e08aa106eb59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531942, "uuid": "5a480bcd-5738-434b-b720-787b58bbca82", "comment": "Malware payload (Mirai)", "value": "a78effd4954b823e174525d91bb18aa337795d7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531942, "uuid": "5149a1ae-25a7-430b-89c9-cecab51c96d1", "comment": "Malware payload (Mirai)", "value": "82ebfd06c940c91c23c10c29b2fa1d3149acc9b0acd76419df5a2d88b8d2694f98ece5dd5daa35afc14231d83b2934b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531942, "uuid": "0baf7a5b-fdb5-4732-b3ff-10f0c9dd1cd5", "value": "T12E533B99F4028E3DF88FE9B984160E05B93123D212931B276BAEFDE37D331659D12D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531942, "uuid": "665155c6-eff3-4ef0-bce4-ad2ddc1decb9", "value": "768:Ge4gpsM204GEkRbjveXHVnQiiQthUv3gFHu1eu48B8vB6J7EzNfXuuJpozGq7PC:Go3EkRbDoSiPMIFu1X48B2SEzNfeuJuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691531942, "uuid": "f3eb9fdd-3ec5-492f-9a4e-a6ff14e0ee5d", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691531942, "uuid": "db977167-1f94-4f63-9413-b424e9d887c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531942, "uuid": "f54d795e-e7be-4e70-9094-bc9cfae17c69", "value": "58d00fd032bb25b01a1daec4561fe599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93771a8c-35ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691500069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500069, "uuid": "f42a6bbf-42d6-49c8-9b1d-737da12a350e", "comment": "Malware payload (Formbook)", "value": "128ef7e989c8c321d4bc5abd0ab28f1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500069, "uuid": "d12cd38a-ebf4-4e6d-a4e1-d453343a2107", "comment": "Malware payload (Formbook)", "value": "8530eb2ac08a8c6847df2c92e782bfaea1435aa135ccb0d192bc07544c6725c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500069, "uuid": "0d51948e-dfcd-4960-bbbf-d488786f953b", "comment": "Malware payload (Formbook)", "value": "fd1bf4e94b60d006f8b563a46aad48e1c822a997", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500069, "uuid": "580278bc-5344-4d3f-88bb-6725d527221c", "comment": "Malware payload (Formbook)", "value": "4edb71466b00ef2078d201e7d6783caaf3f0f84a9704c3f68b3d0576950176ee4cef85524307f4b98a22e9e6d79594c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500069, "uuid": "7affa246-3d4d-4e9b-8ee1-053b4680c25e", "value": "T153F4263C19BE223BC179C7A58FE5C527F018A5AF3121AD65A8DB87664706E5234C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500069, "uuid": "7f281e25-77fd-4bb6-a00f-55b4275e9eb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500069, "uuid": "3422ae7f-d4df-4526-8638-629357413c14", "value": "12288:UgYMdFLudSoVfAj6wDLa5h5PxOuXQZ99+uaLomc79OIyC:Uqd8lAXaT2uXQZyVoT9ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500069, "uuid": "64c19894-6230-4c9f-9791-bc15d4bb9aa2", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500069, "uuid": "1ffa4434-c209-4e09-9e0c-25dfcbf8514f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500069, "uuid": "621bb726-6d6f-485a-b438-d2d6ad450b01", "value": "8530eb2ac08a8c6847df2c92e782bfaea1435aa135ccb0d192bc07544c6725c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d36c0d-35af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691473824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473824, "uuid": "9ce3ec19-6a28-4153-809d-c6d2d54f5914", "comment": "Malware payload (AveMariaRAT)", "value": "6942d622cefdaab1ed632fa149f0920e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473824, "uuid": "810ea751-79c9-4b95-94a9-ebb3ac863e1d", "comment": "Malware payload (AveMariaRAT)", "value": "85f6360167007d5c4d5f8fdaacf17c69448b7c87cfe87f46014e413bbe14da28", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473824, "uuid": "66b507e0-2dd2-4bb0-b17e-ddcb943a90e7", "comment": "Malware payload (AveMariaRAT)", "value": "b21a4012f022facd1bbfc8dae08df17dacdc3683", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473824, "uuid": "789b75bc-0401-4f34-b176-f3e56b96c6cd", "comment": "Malware payload (AveMariaRAT)", "value": "d6e899fdcad0b2521dd8019e001f794f9b956d519e8a82ae2b385a337769c84b49824ead31d8d6354a8e66e33f57a984", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473824, "uuid": "52d90181-ab02-4885-ba9c-75faefbc82d8", "value": "T1DB053513267CDAE2F4AC7EF4152513500BB12C5A217AE64BC98F7CCAE9B3B13C511AD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473824, "uuid": "79b7c3b6-472d-49bd-944b-9c5c12cd9fd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473824, "uuid": "7869fec9-a0cf-4634-8f7f-f0c5ecdf60ec", "value": "12288:Hsq3iF9Fn0ELoFH9wDGayOrLoI7PAX5+29+Op6eLLVkPE5Gw4PrcFf7:Mq3iNnadgyXIU/9+DELuM5R4Pr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691473824, "uuid": "74c2174b-58bc-4fe5-a9ef-a0fd1605940a", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691473824, "uuid": "7ba3ac10-ef16-4208-821c-bac3141a9def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473824, "uuid": "fb039081-bb6d-4791-8462-0563e94beb67", "value": "Poduct requirements and Company Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d8429c-35ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691500671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500671, "uuid": "059a22b7-fb61-4f4f-ad55-d63bb769de7f", "comment": "Malware payload (AveMariaRAT)", "value": "79a6f712cc73066c92092fc4579990c4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500671, "uuid": "34e7aa93-0c1e-4696-8f76-f75b599174be", "comment": "Malware payload (AveMariaRAT)", "value": "86648f1e1a5b64739d1ce7fb718567b0a2e8f96f1f5eb5361d32e3931b0c22d4", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500671, "uuid": "e453db6d-25f5-4bd9-aaaf-5994e43f5135", "comment": "Malware payload (AveMariaRAT)", "value": "83f738eb080079bf67d184cb35c337edab2d61f9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500671, "uuid": "c11af559-7d1b-4f05-b20c-5d06576eb209", "comment": "Malware payload (AveMariaRAT)", "value": "efd9b0539ac917ae94ca6a8f22ffe273318d17e3153d44476f4b2b3361bfb5b4a0e6fad4f36c25de2f102a8f11edc08d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500671, "uuid": "31712209-084d-4f94-ae16-3008ad86bad4", "value": "T12274CE1AAEC611B4C0A4CC71BBF9A1ED1AF5632F64166BEB208856F5EF1175F20031F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500671, "uuid": "292f1a71-e9e6-4e4c-ac54-92e0fa890cb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500671, "uuid": "648d7df5-145b-4193-9d26-e40b104f43ce", "value": "3072:FzTNwme7IkrAsypLIDyimbNWo/KwlppAX/JhkF/ynQNaWW3FIWAnBaN9b7iE8BwZ:Ume7WPpL6mbNWo3lYMF8W/HngNh6rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500671, "uuid": "b9f01e55-ab03-46c9-833f-a268a6d16359", "value": 365568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500671, "uuid": "1c08a2d0-4ae9-4f90-ad53-7d2b7987786a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500671, "uuid": "a4c3a75c-ebc5-46e2-9351-810013cf2713", "value": "PO.No.660240685.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5abf5af2-35b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691478070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478070, "uuid": "9fbb3465-e3c8-4c7c-916b-b31ec84272ec", "comment": "Malware payload (AgentTesla)", "value": "0ea39e7280920192d2dafdf6ffa561bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478070, "uuid": "373a2929-efb2-4de9-b9ee-c0d91118af89", "comment": "Malware payload (AgentTesla)", "value": "8889e85b6156b23dd3afb944e1c92e5f810ce7c2c8d09c6320426203a1c187ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478070, "uuid": "23affd3c-b0e2-4e94-8e52-92c80dffbfac", "comment": "Malware payload (AgentTesla)", "value": "db827215bce61b9afd8f3351c0b1cb4497ad17d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478070, "uuid": "a8be93ae-a3df-4c6e-acd1-cba8e6a0a0d4", "comment": "Malware payload (AgentTesla)", "value": "0375f14e02eb70aa1f5f0f2d8d75cd4213d92feeb43955ce70b96a2eaa520921a21d66c75786b5f7be4f4226d692d483", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478070, "uuid": "4bd7ef9d-5a87-4113-ba61-038e26832381", "value": "T198C4121430ECC755FEAC4BFE3C5911B903F5320A2270F399AE655DEA6423F0E9A51963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478070, "uuid": "accfe057-8654-4cbb-b99f-777172093a85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478070, "uuid": "77943bb2-7eb3-4f87-960d-df6f8c41f011", "value": "12288:RGpqHyv/Px9XI2qtOBCPmp6oXRWaQv+YJ0ksdtZHc:Qwyv/ZqBICPmpdXR1FYekm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478070, "uuid": "de9d1713-323e-4bb5-a101-51921c91db44", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478070, "uuid": "c38b4b1e-64b6-46b6-8019-2b70c5be76cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478070, "uuid": "74f5d111-ed64-498c-a960-79ccb96f43c4", "value": "\u0e0a\u0e33\u0e23\u0e30\u0e40\u0e07\u0e34\u0e19\u0e40\u0e14\u0e37\u0e2d\u0e19\u0e01\u0e23\u0e01\u0e0e\u0e32\u0e04\u0e2107082023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf95e34-35dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1691493349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493349, "uuid": "97b520ca-23d8-44ab-8d80-e94f5b65b37c", "comment": "Malware payload (Stop)", "value": "38e0b331f24bd33671588c4b864f20d8", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493349, "uuid": "6c95ab5e-af26-47b9-baf9-8f879cfd2542", "comment": "Malware payload (Stop)", "value": "89fd2bb04241c20ad5c4b121ef76ad7bc562a88454406e7ee4a2eba7c7cb46c3", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493349, "uuid": "73650ebc-0c51-4e8d-bfeb-9416c098b841", "comment": "Malware payload (Stop)", "value": "e61a9735459fcfcc57942e08b52b13846f3894da", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493349, "uuid": "68db9a5e-3dfd-40a5-a026-105ff70a64a4", "comment": "Malware payload (Stop)", "value": "2883876f07d40d2c643ec0ab4525575baf6c944eb5e7b2234d82c35f63e73592bad5d0d218a268937f1e6f3bdbc6ee9e", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493349, "uuid": "5a19c965-fb9a-420f-94f1-ebf32fc2f055", "value": "T14B35AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493349, "uuid": "33dabe99-b063-44a8-acaf-410d6b81ead1", "value": "0c756c849bc7b459f78f7a5ce46cd4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493349, "uuid": "9c2d6c87-43e8-49f4-9380-ff0b01461193", "value": "24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/XRPOO8HbHUq7:F0dwAYZt6C31WeTPRPOhHTUq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691493349, "uuid": "83e4d4b9-1efa-4256-90b1-7a061b507d96", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691493349, "uuid": "0a005794-58b9-4a36-af7c-a8c89a3a46d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493349, "uuid": "b8cc57c4-29ee-4d98-b212-c12e8f0f0b8b", "value": "2023-08-06_38e0b331f24bd33671588c4b864f20d8_stop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4351a8-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691477675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477675, "uuid": "b62d2add-3fd0-4eae-9c80-d556f07d55c0", "comment": "Malware payload (Loki)", "value": "b489f7580d80d6d1b2b2ff6948455920", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477675, "uuid": "9efe1e78-778c-4f17-9363-429ed986c771", "comment": "Malware payload (Loki)", "value": "8a410e64e1d936608d81d50f26a188da0640a7bfd67121dbbc4fbf705485ff25", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477675, "uuid": "a3ca2056-1ee4-489c-bac1-eb1bffd2689c", "comment": "Malware payload (Loki)", "value": "07e43a7a9c8cb54ac0aa39a2577dfa95288e2368", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477675, "uuid": "ff915738-8437-4deb-96aa-323df6454a56", "comment": "Malware payload (Loki)", "value": "7e50fee2c93dbaecfc57f3cfd34d09d467485da6a34dc76cea5bbf95a613b61e17ce015df7b3d2c0741c64384e7f4bdc", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477675, "uuid": "d77f49d4-e97d-4f86-af4e-9d97982a41e2", "value": "T128E4F145367C6F62E1F4E3F9187620500FB1352E39AAE7680DD270CB2DA6F209A51F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477675, "uuid": "312958fc-be56-46ed-89c8-9d48c804ec5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477675, "uuid": "14d9ea8c-b0ac-412b-99a1-407075e2d7a0", "value": "12288:PshrAiF9MeWFqv9v1t8yCCXtXP+RmyXZyGo/O3scCqNe:k1AiUdsv/8yCCX1+tX4GrDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477675, "uuid": "7e064387-25bf-4534-b14b-b1f3c106632f", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477675, "uuid": "76107bd2-7b61-4cdb-b041-a0f3c47ab4fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477675, "uuid": "2d35b51a-b0d5-4a08-829d-1767e11b654c", "value": "DHL Invoice_UTJUk1GTKE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c020c16f-35b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1691478240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478240, "uuid": "c091ecfa-a7bf-4249-8164-f06fe3f00c36", "comment": "Malware payload (LummaStealer)", "value": "19122289de675e7d76857845c98da6db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478240, "uuid": "5b53f1de-ba8f-4802-a976-de6050dcd298", "comment": "Malware payload (LummaStealer)", "value": "8a77b510d0699fa9c6f656f1129e4dd9a1b3c28f0a90d54a28cdaf8a9a39924f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478240, "uuid": "a125939e-7bbe-4f84-accd-4d42831765a3", "comment": "Malware payload (LummaStealer)", "value": "358fea8e645f1d020349a976adab93d9d756e297", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478240, "uuid": "b2f903bb-908d-4088-8ddd-e1b84fc8c5fd", "comment": "Malware payload (LummaStealer)", "value": "e702eeef508150f9e1c21a9bcdec3e81f790dcf488317af340efd7cd996abaef8fb2ab3842e167bc1e89cded79ee87db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478240, "uuid": "2531b997-3581-4f54-873b-b33984bffd99", "value": "T19B45AE2261A16437C17E16786C5BF2619C257F10EA28AF46EFE49A7C0FF42513B3D386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478240, "uuid": "e30f7ff9-2ec9-4bc4-bab8-da4686c69075", "value": "5c0e7521ed9cc753f058ffd780ae96f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478240, "uuid": "2f42f29d-e9f0-42a3-aabf-d8f0eb3ee2d0", "value": "24576:mCLHDWEdlHCwLE1WSLkjdE4wTbSs/HNoc3XDT5pQL1U:mCmELbpkkGgAoc3zTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478240, "uuid": "9388536c-c6be-4535-bb2e-97a4e10170dc", "value": 1213952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478240, "uuid": "79d60fff-c654-4475-9bfc-ee635e5c3064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478240, "uuid": "8a7e4fa1-c3cd-41ee-bcb5-a4916df2d7f4", "value": "19122289de675e7d76857845c98da6db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fd1e04-35f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691504134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691504134, "uuid": "ceb38b6b-d7a5-44cf-a6da-732bfe5eb2d3", "comment": "Malware payload (DCRat)", "value": "78494ebd7c4146d098af9d2589fad4ab", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691504134, "uuid": "945562e8-1e27-4fea-9516-d9aba0e8c10c", "comment": "Malware payload (DCRat)", "value": "8b4a47e57395171cafab9358545d665ae3168d6ba96a67f4af029e639586d2b8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691504134, "uuid": "2ed931e7-67d6-47c8-89ce-7839b79e0b50", "comment": "Malware payload (DCRat)", "value": "00b9570bb5055b460250ffd9328057d48ac28905", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691504134, "uuid": "8a11afff-e5de-470f-b0c9-a84e560e42bb", "comment": "Malware payload (DCRat)", "value": "2e44748787c33651498fc57fe5bf8030256c5513774514992a5a75092aa142d42a0e8f67ef5ddd5dba0547d5bb105ed8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691504134, "uuid": "5f13a556-9d0d-4489-b3e2-f58e56dfeda2", "value": "T17F6520342EEA502AF173BF7D8AE47596DA5EB6A33707985D00B103CA0723A42DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691504134, "uuid": "cdcd8d64-72f0-4fd3-80fb-7f6c6358cfbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691504134, "uuid": "51dca028-2f28-4544-946f-28190288742e", "value": "24576:ccNiGfUvRY+ZVaT5tP4Jx9dCbPmF0RpmpGRDGxLiW:xHf+7O51eGRDGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691504134, "uuid": "42911f98-2cf9-4d8e-8012-8a73224a965f", "value": 1440256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691504134, "uuid": "c9c30c57-0249-4f7d-b28e-0bbd0b09ef97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691504134, "uuid": "c851ba36-8eab-445e-9663-394943e1495d", "value": "8B4A47E57395171CAFAB9358545D665AE3168D6BA96A6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5056f475-35f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691503822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503822, "uuid": "d6a06beb-7ec1-41de-b55b-372dd802a4f1", "comment": "Malware payload (GuLoader)", "value": "822ca31c5b8abc31d5b81fa02278907f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503822, "uuid": "560e71c9-00f7-421b-a386-d244b53d0116", "comment": "Malware payload (GuLoader)", "value": "8b5a7b79e5537e3f9bc64570f0671948ca33f7a8c979e74be718669c1e20f075", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503822, "uuid": "190cebd5-2435-4c36-a376-f016ea09b309", "comment": "Malware payload (GuLoader)", "value": "a105e79b85f8bb3c7c66a50af1c7b3f8a21ef5ea", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503822, "uuid": "9badd511-a096-4da8-ac76-b7e1471d57b5", "comment": "Malware payload (GuLoader)", "value": "41a6ea2083157ef61ca8e84f6e25d0039fb834c1342db4e1da57ee4547913382d00585301600483141a172c63d7f702f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503822, "uuid": "cc66b514-a223-4f7f-b572-e3ef4171a59e", "value": "T126832669D34F01A9CF525337AA5B1A4542FCBB7EF28452A1346C433933EE83DA1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503822, "uuid": "175a4206-3801-495e-9841-e60ff3ff01eb", "value": "768:UwAbZSibMX9gRWjLNZMyhwAbZSibMX9gRWjOLz2C2AHcoYdEYVbA2rUN6NmV:UwAlRObdwAlR1zMAHfzYV5r7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691503822, "uuid": "1064ad4d-1878-4301-b4f4-797cb9c5364a", "value": 82541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691503822, "uuid": "1e3ef8c8-d4a3-420b-a6aa-fe9f0219430a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503822, "uuid": "aaf74fa3-8858-4bf1-a365-996433a6e923", "value": "822ca31c5b8abc31d5b81fa02278907f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2932accc-35d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1691488295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488295, "uuid": "aac76bc5-98dc-496e-abff-08fa2d7d0b3e", "comment": "Malware payload (AZORult)", "value": "8df71313dff890f4650214dfa0a7325f", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488295, "uuid": "f47ab079-9e08-4655-ae81-ea53db4605f7", "comment": "Malware payload (AZORult)", "value": "8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488295, "uuid": "86ad294e-7ae7-4ae6-8e0b-4e091c0a261a", "comment": "Malware payload (AZORult)", "value": "cbc9674b5b99c5a0ccafeee429ad3f495ef914ee", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488295, "uuid": "b8face31-6f8d-4f30-bb57-e1816b3a111b", "comment": "Malware payload (AZORult)", "value": "f8899c290b6867235f9ef22d749108d37253af8532321a6b3d57bc46efc52b11594800aea0c10b0f4f723a469b158818", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488295, "uuid": "0dd3d5de-ac43-4d86-ba45-2ca1b6f57337", "value": "T14DE402643BB99B52E2B8BBF9D6A06520037174556873D34C4EF220DA1E26FC52F91BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488295, "uuid": "7679560b-ad03-4cc1-aca4-517d4440ee1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488295, "uuid": "25f2311f-f1bd-4cc1-a737-5163788ec08a", "value": "12288:8yvJRBusyOgG00Fkon7epLV9nn13QxydyLXIpOB5+Z27+9p:PFud0FEfCSqXIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691488295, "uuid": "4d38060e-3689-40cb-aff8-553bf8d4fc4e", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691488295, "uuid": "b6aa3e3f-b4c9-430a-8678-2c35578c6747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488295, "uuid": "1fb22f33-a678-4cd8-8432-c1dc5e18cf7e", "value": "8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca9cfb5-35e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691496004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496004, "uuid": "71a32293-321d-4ed6-9cc8-7c3def7e5c5e", "comment": "Malware payload (Mirai)", "value": "46239968e8ce83b9e5ba04807b2c1cc3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496004, "uuid": "0889d7fd-c683-4310-a986-e5b5e848bab0", "comment": "Malware payload (Mirai)", "value": "8cc372ce943b828454aea20e090b2b26af1ed86660a62845bf6d7c8abc8e7d43", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496004, "uuid": "fadade2d-fbc2-40d9-8ca2-c78086c68891", "comment": "Malware payload (Mirai)", "value": "afb8e76930046afd3249d170a24ec5412ed9f3e6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496004, "uuid": "26408910-47d2-4290-8ca3-b35493ef6780", "comment": "Malware payload (Mirai)", "value": "13ed5b10da8316e591fc7eb8493b847dfc4c10a503a497613a3da6b6781d63bd873b3b86a74dfd3bc5445336fd35f2a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496004, "uuid": "7b3ab749-0165-424f-addd-6baf1284f12c", "value": "T1AD4302F1CB95BBE4D0B39BB961B80313427B557E49FD2A7D04A2431AF7E934218B9085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496004, "uuid": "d795957e-e002-4134-9b1f-3618be22cd6b", "value": "1536:fdAgSAOaKqWssqo8tzAmBz4ZwooxIvCgGQqfme:VAZA0FbwAmBz4Zw4vx+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691496004, "uuid": "52c6102b-ba44-4c64-93c4-e9c19888d90a", "value": 56056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691496004, "uuid": "f810efbd-e864-421e-a98e-b5b207292082", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496004, "uuid": "dd433d98-81f2-4b5d-b386-661a9ba942ae", "value": "faecha.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ee4735-3601-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691509202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509202, "uuid": "cafca952-79cc-418b-b04a-e18c5e0a01aa", "comment": "Malware payload", "value": "b8edf74b8c8f6426ed962b1eb8f9cf33", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509202, "uuid": "6715a84b-6672-4f0f-88c3-988409ec8955", "comment": "Malware payload", "value": "8cc4d5bce567ab972766f0ba434e0117823d96a15778822b8e99188b707fdae3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509202, "uuid": "915ac236-2dac-4be2-805a-455632081ccf", "comment": "Malware payload", "value": "a8109455b7c21e4b453f91ef90a0ef6e3d50ecb8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509202, "uuid": "55bc16d2-0fcf-4419-a74c-5145249ccc64", "comment": "Malware payload", "value": "3c0352130d239f1b258883807b7c3dda3f938f5e26d2ec972b45f9df38616c0684e7584119da8b45cee562ca5f8ec230", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509202, "uuid": "f4a925be-566f-4f73-a52d-6e97a258e6db", "value": "T193054008A7D8B491832737F5F81E24F8EA7F166D89A84C5BF404A84D65ECC2DD9F2874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509202, "uuid": "b440ce3e-0425-4c7d-a832-69539dcb8025", "value": "6144:HG92fHfFoVG5jjeBEocDjF5Xs2e5Uybt7zvawilHIit1XZgiW2:S2fjF5nyt+5t1XJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691509202, "uuid": "6ae738ad-657f-4382-be9f-64467d5f7dd6", "value": 817927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691509202, "uuid": "3ef719ea-981c-47df-90e5-8f89d6b5c3ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509202, "uuid": "65342761-cefa-4ff2-b8ac-bd6220bba898", "value": "js-beautified-1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40193b51-3603-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691509808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509808, "uuid": "340817ea-beb3-4ed9-a9b9-d67ada2893e2", "comment": "Malware payload", "value": "4f61e82e5c07da9a45df398b8b24ea20", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509808, "uuid": "15038b1d-78d7-41fe-8234-6fa15a01f346", "comment": "Malware payload", "value": "8dac231eb765c2e06e303fcc3157cb6f344671bae4db5752df6e5a36456d12b5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509808, "uuid": "56f1708a-dc30-4637-8a70-6bb664822d9d", "comment": "Malware payload", "value": "b0eee04678846a7b8eb608622a2789cb3565ae6e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509808, "uuid": "ceba8f66-009a-4c69-9d7e-7b7dafd6ba05", "comment": "Malware payload", "value": "d7aa74d8146ee33210d786facde527f497f8ac2aeccdcc8789b54f27b336b2423c55d11b9fc752b89f7e41d5e4b9da6f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509808, "uuid": "4fd07436-804e-427d-a460-2c7c2ee0cba2", "value": "T11B13F124D3CF30F2C7F11AFAD1E7C94847E26290048A397A7689953E29E6495FDB1B03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509808, "uuid": "796bfbad-98ec-4189-8571-8da431d816be", "value": "768:KR2nRsIEAk2PL3M5IoEz7KLMrpWz9TmGB1pjjxH+dxOxAXQ3U+:K0GO3LSw61B5HWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691509808, "uuid": "eea02f23-f49f-4c1f-a2d3-93243e580134", "value": 43464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691509808, "uuid": "434f01eb-1706-4a42-a19f-e823c8d8ed53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509808, "uuid": "428c3bab-f3c4-4396-b92c-758092e0dc31", "value": "VRarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88190aba-35e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1691497903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497903, "uuid": "3fee4bb2-cdaa-4889-a6fd-3ef834604544", "comment": "Malware payload (AsyncRAT)", "value": "ab161491c05bb4e14c9956bd90dec42f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497903, "uuid": "1cbdcc9d-9c88-4393-a213-18a2ee863e89", "comment": "Malware payload (AsyncRAT)", "value": "8dd48cd023c9f13b6b41274c1b6d3be2907dbd929dda7701972b73a029df74b5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497903, "uuid": "4da012b4-4461-4946-9d16-fb278121006b", "comment": "Malware payload (AsyncRAT)", "value": "4f3fa749a5ab5aa69fb762c4f438f2759abf2c31", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497903, "uuid": "1b75ed69-d9a1-4f8a-a8f2-5e5613931193", "comment": "Malware payload (AsyncRAT)", "value": "641b90f002fd01a977fbaa67e46eb7b36fe8fbe2c23919e0ccf235f560670de2840c92c2286b4c2ff587beb8921fb306", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497903, "uuid": "0aef1480-fd0d-4cd0-8537-4919a9768cc8", "value": "T1E814199C715072DFC85BC4729EA81C75EA616C7A832F4203A1A735EDAE7D897CF140B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497903, "uuid": "a73a1a08-d132-4eba-bd6b-798547c88ddf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497903, "uuid": "a0089bf4-19e8-4008-b624-5ac8a73039a7", "value": "3072:0v+8ni6dAi2D6r99PsY8qswZHM+JdBsfUKQn1b8oCikdOFqDdI:0v+uT289RZs+7mobkdOFEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691497903, "uuid": "f9c630c0-5104-4b2c-8575-10695d464692", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691497903, "uuid": "d403b4ee-08bf-4ba2-8c10-6237dda8cafb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497903, "uuid": "00a4b854-6113-4921-8686-4b4d1f3a3305", "value": "SecuriteInfo.com.MSIL.GenMalicious-R.22780.24410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624befd1-3619-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691519314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691519314, "uuid": "2bec7295-1aa8-4b42-a2dd-d775867ae1e4", "comment": "Malware payload", "value": "0f19cd2a3143f61147aae6ad56c00224", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691519314, "uuid": "f096ad73-6e07-4b29-b10a-9da82d06c2d8", "comment": "Malware payload", "value": "8e1c1decdaa34d7c990dbe1b993a72c5e56ca685747bd6cbd4283eb89f3ff1ae", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691519314, "uuid": "cda9e3bb-8b44-4818-9c67-ac10e94c36a7", "comment": "Malware payload", "value": "8874d0304b717a87871b35a688dec09e5493b05f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691519314, "uuid": "28fff4e9-24b6-42b0-ab23-5653e1da895c", "comment": "Malware payload", "value": "4995199bef607dba0554a8a598c76d763f3a2b9d2d951c25bd2cf96d5143cad67b85beb329976dbc8def523595dd99df", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691519314, "uuid": "f62a8cda-8e49-4cb8-8b4e-33f60bf00801", "value": "T1D053B986175C9FE9F24938790580BC710DA8E9B57A3F489AEFC7DC8EC41CEC11168B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691519314, "uuid": "1ca065d9-16d9-4ee9-a188-660cb5085d85", "value": "bae1d9c100f237579a900595adc00dd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691519314, "uuid": "14da1de9-7435-4974-a91d-cad111a0bf38", "value": "1536:5ScK6rmABOliawL54InxzbMjV2Rgb+DOWd1:51cRlwL6InNwjVcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691519314, "uuid": "4c2fc04b-30ff-4031-b4a0-ab7c78073e75", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691519314, "uuid": "c5088820-f17b-4e0a-901c-40a557bfe756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691519314, "uuid": "e7f085af-12b2-40c4-b070-ab9bd74c6a07", "value": "SecuriteInfo.com.Win32.TrojanX-gen.24713.13273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e703357f-35bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691480882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480882, "uuid": "05a42772-6aba-443a-9f68-58f280a10e52", "comment": "Malware payload (RedLineStealer)", "value": "421c0fcd0b48e598de245fea4232ad27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480882, "uuid": "fb63fefe-93a0-4216-a994-1ca98554558f", "comment": "Malware payload (RedLineStealer)", "value": "8e60039ed9a791f944abbbbf5d258157c65c192674939b1bab395f71204dc5af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480882, "uuid": "0947997d-0754-4df1-af6b-b1e50694b951", "comment": "Malware payload (RedLineStealer)", "value": "6700bbd85a9cd025d2312378c10196889e647016", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480882, "uuid": "8aa6a4d2-abf6-4778-ab3e-4e60bc603c7a", "comment": "Malware payload (RedLineStealer)", "value": "93cf0db4bc47da54c2fc8f0a1f8419dcba5bff0686fa321be0566b82692adfa6b531f283dd04ecb19f08f51914f6826c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480882, "uuid": "dac9036e-d028-415f-9d68-648fe5a2ede7", "value": "T18CA4CF12E6DC6B71E5D28A324E2DF6F4661EFC908F193BDB125CBE2F09711A1C166702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480882, "uuid": "34ca04e8-3ccf-4ebe-a5ea-9482dc6ff28f", "value": "7574067d27f1e097e97a79381564790b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480882, "uuid": "60730d67-aa2d-4abf-be9f-8b666a141185", "value": "6144:kBiHTrcXeYqRbK0KBP1Pv/qi5AIa7B5YchuMpvKyu:k4zrcXwIPXqiiIeBFvpvKyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691480882, "uuid": "264ff3e6-008a-49cf-919d-fa449eafce69", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691480882, "uuid": "54740cfc-3814-4205-b67c-c7a21db16ef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480882, "uuid": "36ce8764-211c-44fb-8253-964abaa8732d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88989d7d-3635-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691531404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531404, "uuid": "663a4512-b210-495a-8176-0cd635dca513", "comment": "Malware payload (Mirai)", "value": "1b1187963d7d64fc9a8376859b886a8d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531404, "uuid": "4fd04446-f684-4ac5-9d6d-be9a0a7b934b", "comment": "Malware payload (Mirai)", "value": "8e919cccbf3078b13c48921d959e99698a9bda28dfda545a859c1ef020400b40", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531404, "uuid": "ad33ad53-c3c6-4b1a-ad58-3ade3c7ca276", "comment": "Malware payload (Mirai)", "value": "d3cb2200b90293f532cb8ede1041b47658cbdf23", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531404, "uuid": "39c8da6a-b1cc-4a41-8760-3e625672e7d3", "comment": "Malware payload (Mirai)", "value": "7b9d89a9398d8dce64e397dda4d9b1f95ac161e91e9f43fb867c0cf6e7f73c0b1ffa37ce8db109774dd25e0b1bc74e5a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531404, "uuid": "f431777c-e03f-4ca3-bf1e-b225f4579c5f", "value": "T12A33F1B682AB9D71C57042BB162D549D64162338E3F5F00366654470EACB2F39AFE7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531404, "uuid": "686e6cc3-a60f-4f49-814f-4ccc67766d7b", "value": "1536:uCoqsGR4eB3g0Vmh1IxIpC8J2L9VE8amFZP7R3X:Xoqs2Twh6P8J2LJ9ZP7R3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691531404, "uuid": "2d63a60b-2659-4f3d-ac34-77ee2df18ad7", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691531404, "uuid": "3aacf12e-a88c-4cf3-aab3-c1665400695a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531404, "uuid": "d5fe804d-ac86-4374-b566-2ae75b09aa5b", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc324bb-35db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691492757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492757, "uuid": "30c808dc-638e-4d49-8f40-6b976da08910", "comment": "Malware payload (Mirai)", "value": "fe5ed2458023c15fcdc525340318ccec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492757, "uuid": "d4a2d31e-ed70-4a42-ac32-a801ca468278", "comment": "Malware payload (Mirai)", "value": "8ec9f2a569c5af60924a3575bba0d7112d3777ad44cf4c84607a5c3ea7f1878e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492757, "uuid": "c25b42b4-0675-445e-83ac-14751f9145c4", "comment": "Malware payload (Mirai)", "value": "f568ce1bfe44fe7c9523e3161f78b803d945e9c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492757, "uuid": "76b72b81-5b95-4280-a8d0-5d94db8d655c", "comment": "Malware payload (Mirai)", "value": "74b446ffb3d88053cfac911365b49f3707fa1866a2d37bcb3cfad54fc22c3be8f895616703d4590d7912dc807be9747c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492757, "uuid": "3aaea409-adb7-48a3-af51-061e9ff429bd", "value": "T188539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492757, "uuid": "aec8c2cd-d7b9-4111-860c-a7a22e3ca336", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691492757, "uuid": "05c87583-03d3-4199-b64a-c42d9726d67d", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691492757, "uuid": "dcfd0104-e781-4433-9688-645a9ffb96c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492757, "uuid": "832a05d8-655b-4a21-ad57-60fc49c07e6d", "value": "fe5ed2458023c15fcdc525340318ccec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db69558-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1691478880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478880, "uuid": "0c9e53ba-12e9-43ea-8916-77e10cf1909d", "comment": "Malware payload (Smoke Loader)", "value": "3216b50579a822d3bbe41fd9da1af579", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478880, "uuid": "c63c6bbf-3e75-498d-b533-30fd9ed69df7", "comment": "Malware payload (Smoke Loader)", "value": "8f4aaf64cb7faee632b3ed744a1c1aee1d156e77a01a636002e7fd940182ae95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478880, "uuid": "11cb59e5-9891-4a24-a5f8-46807c8b9861", "comment": "Malware payload (Smoke Loader)", "value": "64f75586aa16796409661d397804d70e42edbec4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478880, "uuid": "bd66f8de-67ed-4ed1-a854-1d8c4d8b0538", "comment": "Malware payload (Smoke Loader)", "value": "ba83f97fad84b644f35842b51091258ab85bebb68cfc7c06a90a37c2ad9d0c14fdab42da588cd54bf89ef9a537c54260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478880, "uuid": "9237115c-5800-413e-8ec6-95e5923c978a", "value": "T10FE41252FBE884B2E5B1277118FA02830B3A7D62DE3443AF63419A564CB36D1B53573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478880, "uuid": "0b22226c-c8d1-4f14-9f23-a3f9673a4d09", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478880, "uuid": "7c65b7c9-ad2d-4822-bc5e-64fe79daab2d", "value": "12288:iMrEy90ifWbR9GxkZK7c0DjT+8zcVQtcmP8MSxKdh+d83k/mux4Q4zIDl/:yys9cxBr+8zcU+K+dUk/mBbsDl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478880, "uuid": "254868bf-efc8-4140-bee3-ea1e18507dfc", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478880, "uuid": "aeef0f08-6c71-41bf-9985-9cb25f001d3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478880, "uuid": "eef4627e-9a31-4449-bc05-0a69479f7a41", "value": "3216b50579a822d3bbe41fd9da1af579.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ecde67-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1691479028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479028, "uuid": "bf66976d-afd9-4ed9-a7da-158823c5f7fc", "comment": "Malware payload (Smoke Loader)", "value": "df431bd1e37bb561047e173dddd531d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479028, "uuid": "3d4cc8e1-a246-4c61-90a2-2d42b23bfceb", "comment": "Malware payload (Smoke Loader)", "value": "8fbd221432cfe23380e7275c97c160c410318ca53dd0f25d3e9e368b5bedc6c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479028, "uuid": "0b78df6c-47e4-4af0-a6a9-ed23efb71162", "comment": "Malware payload (Smoke Loader)", "value": "79dc7e6703db36c846bdd1257e9bf8cb9a464fa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479028, "uuid": "c93874b2-79eb-48fb-9959-dba825d598b4", "comment": "Malware payload (Smoke Loader)", "value": "027e4e937dfac8a6344216e0ac88d9b208f5d7947d830c7bfa0eed13ee3f3fdf28cad587748015b28464f874214e51e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479028, "uuid": "63b18ce9-4bf1-4312-b4f5-102378166673", "value": "T16DE41302EBE84076ECB627712CFA07931E32BCB26E74435B1796A85F49B354075B172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479028, "uuid": "e9fa4dc3-fdee-4bb2-9ed2-7261ac27d237", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479028, "uuid": "f6f2951a-6f16-4151-b0b5-e1f7b1330739", "value": "12288:4Mrqy90SevVo6SlzJZW2zWVNSUCKYJHeiEr8FRdzHhWMbj7C/inYJ3Lh:CytevV8J4dNSUfEeieIbAMbXYWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691479028, "uuid": "8aed93f0-37fa-45d0-8f51-284e20f76066", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691479028, "uuid": "220331a4-8132-4e1b-b00a-6a3d7c57ec75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479028, "uuid": "e1d1a6c7-7ca8-4b86-9f26-2f0310673f7d", "value": "df431bd1e37bb561047e173dddd531d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b89afc-362d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691527774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691527774, "uuid": "84e4a4e6-0f56-42e3-a420-af9a35a18a2b", "comment": "Malware payload", "value": "150ab79406488c170480b421e26c4466", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691527774, "uuid": "af51e3cc-28f9-4607-bcd1-7e72dea18de5", "comment": "Malware payload", "value": "8ffd3d48566f4f4a777663e2a3c6f75f5e86e10c5c81e22784c5841289d680a1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691527774, "uuid": "7d51bf42-ca7b-4888-8ac7-ffac7c0bb650", "comment": "Malware payload", "value": "ce6abae99440b067267c3c02b1832808cee96f1b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691527774, "uuid": "01e6b10e-cadd-4afb-adad-32af7e288770", "comment": "Malware payload", "value": "3f9c10488600598787c3ccda63921f6b7cd6a03a93958e2e719ed7cfdf842f808b34a01f39e1eb10673eb2b955938e92", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691527774, "uuid": "b7ebba75-0302-4c47-891b-e49611e25c32", "value": "T1AFB5233C9217EEEFD7BDB17829F36F626E6C68E1611C0020354417AF9DC3A665E942C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691527774, "uuid": "1aa19958-93bc-401f-93af-95b6b93c0f8d", "value": "322e138467bbd87f73c7e9753c744e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691527774, "uuid": "490134b5-798e-4755-a02a-f97b3eee971b", "value": "49152:NCtYY7PMTFSIYvifkJAjQyJ5ICiywACsQohCs7pwHoXUd/YQ:NC96SDqsJAkS2+LjoIXUdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691527774, "uuid": "f1e40353-b601-4106-a5dc-882358be85bf", "value": 2371584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691527774, "uuid": "d8d059cd-d713-4291-a41d-49af95bae63d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691527774, "uuid": "6a9a165c-115f-48b0-8944-bc2c5d87a269", "value": "8ffd3d48566f4f4a777663e2a3c6f75f5e86e10c5c81e22784c5841289d680a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002539c4-35f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691501540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501540, "uuid": "7631f6a2-bffc-4e04-a29d-fa1a97897084", "comment": "Malware payload (RemcosRAT)", "value": "1053a307f5c8f033b351ad836b6fcc54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501540, "uuid": "1426bd90-78df-4cd0-9f2c-0574e591bde4", "comment": "Malware payload (RemcosRAT)", "value": "9029634466c96a75b004ee2ad1de6188db1f20dc769aef7575c8c7dca382eb15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501540, "uuid": "677ef8a6-45a3-403a-8f02-52b5f7355301", "comment": "Malware payload (RemcosRAT)", "value": "32c07d4677f665f904516a6c7a6b519f465da9b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501540, "uuid": "a1ff3118-b94a-44e1-bc13-e3ed2c4b1444", "comment": "Malware payload (RemcosRAT)", "value": "9a0235de87a082b46ac72407a65b2a47017ca72a2be6a7125c3fb5aa0fe85db6bc49763c10062d696576b90b51a2e518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501540, "uuid": "57972396-a89d-42fa-a3a4-b7c12aa7631a", "value": "T19D15533F1489AD27D239A3B67424EA5DF152BBC637A74B4EF7C22662903232537D108D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501540, "uuid": "e3dfe714-8e21-4364-bf92-291d3e0ca7ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501540, "uuid": "28a03ad9-312e-4940-b6d7-55d3ad655483", "value": "12288:4L7LnM2Nt53sKrX0vv0OJEayyj7VwXA2nQc9ftFzqZAwC5vr8EAmD9:4OX0OR1wnVe1QvAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691501540, "uuid": "500522c8-9c86-4ee5-9084-e70000988d8b", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691501540, "uuid": "bebb3c5b-212e-4b56-9f48-46657bc0112a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501540, "uuid": "2d1884d1-2ec4-4fe0-ace4-0a74165c8829", "value": "9029634466c96a75b004ee2ad1de6188db1f20dc769aef7575c8c7dca382eb15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02aef0f3-3606-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691510993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691510993, "uuid": "7238e0ce-1999-4d94-a1ef-915046fa727a", "comment": "Malware payload", "value": "fa83becb63b85d7d54e506857cae8017", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691510993, "uuid": "daca51a2-7674-443e-9249-df6637855865", "comment": "Malware payload", "value": "90457bb78ba96cefe86336dc292d5cceccf140ad44c680a01cdbd9e95d5ba93a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691510993, "uuid": "1b9eb45c-5e4c-488a-801d-87681b35e2e4", "comment": "Malware payload", "value": "663a348a85e6099093d851e0ee017eff8316ab64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691510993, "uuid": "892c3d12-6ea5-45a3-9742-6e5337122268", "comment": "Malware payload", "value": "748cc9a3bd8c54dcc5b3d2900a3d7f055ee1fb05dcebd6d25cfb3cbdac16e5e51fc1db1ebd5d90fba4f604202d86c9c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691510993, "uuid": "d4b1ce6a-bc73-46b0-acc2-ddfbb6b79b77", "value": "T1E8E4230897A0845BEEB33E365A3C9CB66A5C701700F4C55F37E89D88F96A641A13D7F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691510993, "uuid": "45181048-4f73-4e00-bd87-a04ca653cc5f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691510993, "uuid": "a3d53317-bf84-4078-80dc-1a0efdcf47cb", "value": "12288:ZYD4tQxLiP8CT6pSxzGLdYsp/HHFzfW0ft1oJ5P4TvqQY5wCTk83iBh1Lpr1u:ZYD4tQxoC8xGJV/HlzD4R4z25wWW1VM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691510993, "uuid": "3b9c6989-9da9-4637-9b05-4eb5156033cc", "value": 680977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691510993, "uuid": "a714260c-8571-41a3-9490-4322cd2a8566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691510993, "uuid": "e04f7350-5d84-44eb-9183-338cde5ab8ce", "value": "22001625_REV001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180121c1-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691477528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477528, "uuid": "041958cd-bf47-40ae-bdcf-aec0ef60e06a", "comment": "Malware payload (Formbook)", "value": "5483f87473dc372d55856bd4f39a63f0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477528, "uuid": "bbe8f3ec-77ec-40b2-8faf-7bd8fb84bad4", "comment": "Malware payload (Formbook)", "value": "90663dfd5691be398242b17d42aa2923eafae8e77644a859458de5fed58e7b8c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477528, "uuid": "e331922f-930b-42cc-ab55-0b72546732c5", "comment": "Malware payload (Formbook)", "value": "24f579f552a6b5d2f31843aea9fdbb1309cc3ad2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477528, "uuid": "4c438999-9490-4038-8d1a-78d06cf2559b", "comment": "Malware payload (Formbook)", "value": "dd68794e6abb21e1956a1f5acc55d0af5b41ab7dbafab1ddc14a28f748040eae4049d98bc303f03e7888dd13b6198885", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477528, "uuid": "dc2f886c-46b0-410d-ad76-8c050874c654", "value": "T1D3514C041BD90310E3B38E7B967993008977B815EA718F1901CC60CC276B911FC75F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477528, "uuid": "4d49030f-8b5d-48f2-af62-2229cbaed0f5", "value": "12:8APW0m/3BVSXzZUBW+fxf5i4k5nLCnh44HfMNkPb3+UcIl1lDmIfcI6iN33YKYzq:8AuJ/ByUA+f3iFnuhHj3+/E4I0aHCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477528, "uuid": "a7724436-2c82-4679-825c-d5306976e597", "value": 2650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477528, "uuid": "1c90596a-b9a5-48c9-aed1-1b9b331e26b4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477528, "uuid": "ce883947-67d7-429f-8bad-928293765582", "value": "Request for Quotation.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d218299-35c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691484087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484087, "uuid": "8769a342-befa-4309-b921-b91c057fcd80", "comment": "Malware payload", "value": "fd5981d5578cadd2c368ba4288854ce4", "object_relation": "md5", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484087, "uuid": "52c03748-e106-41d2-8f8c-feafa4a42cfd", "comment": "Malware payload", "value": "908f2dfed6c122b46e946fe8839feb9218cb095f180f86c43659448e2f709fc7", "object_relation": "sha256", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484087, "uuid": "cb3a28cb-755e-479d-9da5-779541caef8f", "comment": "Malware payload", "value": "e04beedd40ff08748ed0fd90fa5110df7db43e05", "object_relation": "sha1", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484087, "uuid": "f3320b95-bce3-4204-b6f7-3ec2aeaf9057", "comment": "Malware payload", "value": "6ee42ae4c6431da4906cbb8a66bebcf29d164111e147014d7a089346d48180e4744a5a1299735b4fcecbae7098e908b4", "object_relation": "sha3-384", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484087, "uuid": "c6c2ace7-4a86-46e9-9b9a-75195eb4785a", "value": "T17485E0496EF5E12D5CFDFB646F32898965B4D4E1E3E2734EE6139CB10208AC7B4CA181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484087, "uuid": "1c377e04-edfc-47dc-a08d-eb228d1ad637", "value": "49152:KHZ16g22bJKCep8yFkG/aeHEiAU0kdryl:KeMAp8saer3ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691484087, "uuid": "439d3e25-dd6d-4886-8139-aaece4b4f9d6", "value": 1814293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691484087, "uuid": "9276bdcd-411d-41c0-af87-36b9e69b5a4b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484087, "uuid": "a7d0f270-0619-4504-9445-ddbb105e8b3a", "value": "908f2dfed6c122b46e946fe8839feb9218cb095f180f86c43659448e2f709fc7.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44582693-35d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691489629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489629, "uuid": "69c4b98f-4e6d-4e92-91e5-974979e8f165", "comment": "Malware payload (AgentTesla)", "value": "e8aede2f0d379d887ac57436cc464537", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489629, "uuid": "a9faa9d3-6425-44f4-871d-60d20960b769", "comment": "Malware payload (AgentTesla)", "value": "90db10891045ddca4c90ec37c2bf1096d48ce07b69ceaf0845a12c78a40909cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489629, "uuid": "e65e8048-fa62-4e3c-853b-fe909b952837", "comment": "Malware payload (AgentTesla)", "value": "b6ef8cba22d7c00a67099e9e2fa0ef6615749d16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489629, "uuid": "396a92bf-a71c-43ec-8726-f3b98bff8fbb", "comment": "Malware payload (AgentTesla)", "value": "ea872df74dbbf494c0139ea0363341c514770e0c05d87a2ba84d42c0b263b974853ddf7c4b5df8d45d94c281d9d55314", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489629, "uuid": "1bb14fa2-5deb-4eb1-a991-013bfdca77eb", "value": "T16E051262262CA7A2FC2D16F92517448B57F03C766A64D2243D677CFB08B1B07D807A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489629, "uuid": "57318ccd-01d7-44f2-8bc1-89d3faabc513", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489629, "uuid": "49cafacc-e1a6-4738-8318-d61701b8298e", "value": "24576:C3hx9pI/mdFiZdud2ycSOzMiOgJj70GDs:SsmdcIOdL0Os", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489629, "uuid": "76b2988f-b1dd-49f5-9516-9d8021f64c10", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489629, "uuid": "b86a701c-06b1-47c1-b2e0-4726bb1b14fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489629, "uuid": "f0034cee-9b02-415b-8eb5-c560879de44b", "value": "Invoice20230811017548CPA.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bc911f-35c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1691483163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691483163, "uuid": "c7919bcb-9e06-4b52-95af-a5f695525b3d", "comment": "Malware payload (ModiLoader)", "value": "28e9623a577dbebf9ed0d35ba407a395", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691483163, "uuid": "4ae3bbe6-6605-4a8b-8940-d88a09622702", "comment": "Malware payload (ModiLoader)", "value": "915a715f89754848b9dc3d5cb7bdb37a1522da854497657a299576fc4ff23763", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691483163, "uuid": "ac90434c-7a9e-4b6d-a406-093395067c0a", "comment": "Malware payload (ModiLoader)", "value": "ef97c9afcfd8fce38b3691d0e40b6960758381c4", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691483163, "uuid": "34119f6d-c5be-4392-951f-b712906cb144", "comment": "Malware payload (ModiLoader)", "value": "21199beb76f4072d38fcb165ec66f08bae9e896f53ca361989f7dc4dea1f47b84b2a36f6e4ea1e0934f7039cbd77dd5a", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691483163, "uuid": "7e177b76-87ed-46a0-9063-946ab34ad68c", "value": "T12F859D32E6514833E2B605784F3B1FF45C2FBE73592859457AEC78B96F2B24028391A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691483163, "uuid": "4e4730b3-7c35-4a96-b333-a3cbab69cd36", "value": "24576:5+wrBX18XhVRGTbabra2OYSuf9PhHt8AE:5rnHQKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691483163, "uuid": "8ba3475a-ee70-4fb5-843f-2f04d2295b5c", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691483163, "uuid": "41149769-fecb-4d09-9958-b7701d565a44", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691483163, "uuid": "93ac33b8-dfbc-42ac-81b9-0bd524bee3c1", "value": "PO823.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe50be8e-35d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691488652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488652, "uuid": "d57d39c7-b1b8-4345-bbaa-86e5bfa1a2c4", "comment": "Malware payload", "value": "151acc9275f8c12fd6d6c8d1aca259a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488652, "uuid": "1bbca35f-da96-492b-a9b1-d53596333749", "comment": "Malware payload", "value": "91a0da981986acc352dbc955aa595556714306c8de9af8ab2a35af4b04db6f40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488652, "uuid": "844e55a2-64de-4d8e-a960-3d91b1aab701", "comment": "Malware payload", "value": "afabb1f0a8c629ee786a08d340034db91ad7a15e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488652, "uuid": "dcec209a-68ca-41d2-950e-ef84a49e8ad8", "comment": "Malware payload", "value": "a4b1b5d1f283b8c79be62e9cf159b561d38bbda3899042d13d0e39e0d1a25dda3ed4cec3779800c41f70c0c3820c05f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488652, "uuid": "fa04607d-043e-49b7-80c2-faae2c58acc7", "value": "T15AE44D90F785FDF6D8498B7448D253196379F080D71AFB2F6624FF38092EA889D63609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488652, "uuid": "3f2e8d1f-08ea-42ab-a741-78f65a76ecb5", "value": "3c2803e8c3d6d3cc1b9ea7682adf9962", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488652, "uuid": "bf3a7f19-fdeb-4b5e-8a3a-32fb022b5507", "value": "12288:VvK8mk/0MF3Un+TiceoEcbyAOtEzkvcMCLkjNGo3W0CG:VvBMMF3U+GceoEcbyAOCzacjLoNGo3Ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691488652, "uuid": "39863717-f931-4e35-9366-9e68155c4417", "value": 699053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691488652, "uuid": "b7603e78-4610-4d5b-82aa-d9971f7c5ffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488652, "uuid": "e597afa8-175c-4f58-8dd5-5db3e42fccc9", "value": "91a0da981986acc352dbc955aa595556714306c8de9af8ab2a35af4b04db6f40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc3b33b-35ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691478447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478447, "uuid": "dc36f423-c2b2-4ee0-8d28-2dd80a0c2185", "comment": "Malware payload (RemcosRAT)", "value": "0f95499d05d50e30419226e989598cac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478447, "uuid": "69e2e657-51a4-4531-9eb7-5f218e62c116", "comment": "Malware payload (RemcosRAT)", "value": "920fae943bbfb6cb7dd1a1a13e6abfb6f951ed79eaa01b9b693ff6a8224ae1e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478447, "uuid": "fb96cdfa-e1c0-487e-93e1-8882e2680eff", "comment": "Malware payload (RemcosRAT)", "value": "d00eeeaefcd22a9b5490a4a4485d3871fe288dcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478447, "uuid": "95f336ee-b31d-4e32-adef-f7ef444f5c5a", "comment": "Malware payload (RemcosRAT)", "value": "4fbe874f93911294c85a4374f1f2d6a77bdd014da945e3e9228cbae0d3c08c625345fdc7b84279e054a67c0012c5a0d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478447, "uuid": "a18df778-9410-4b00-af82-8a0748c7ff3e", "value": "T1E915239AB0ABE2A1DF7C57F53C3CC55D07B928395066E06A6E601CD831A3F6AC521E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478447, "uuid": "f68be2f9-ebcc-4827-ad76-dec20af30c98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478447, "uuid": "e67692b0-f1e8-47ea-8502-4056f21077b1", "value": "12288:5wCINpjuMufGQioH36YyN5ugw4K/0HJhX+1n7h/QhqdtyDQxC4KfWXMGzFBE39i6:GCIX69H3xQ4t0HzXM7h/QQorGzsNiPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478447, "uuid": "5eceff23-c43c-4865-918d-0588213fce19", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478447, "uuid": "fbc7c767-d431-4c5d-ab3c-00764e7c68e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478447, "uuid": "e7d96f17-0827-4a68-a9cf-81822b342e3b", "value": "0f95499d05d50e30419226e989598cac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd5728f-35f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691502607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502607, "uuid": "d7ad5f7c-1cbe-4ed1-ae79-596360b0161e", "comment": "Malware payload (Mirai)", "value": "0a6f479159b98bd92f1000d5d7a400c7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502607, "uuid": "0d2a4b51-4863-4c6d-bc89-5d5004fb9c29", "comment": "Malware payload (Mirai)", "value": "92c5cd1c4682b3927d77c974a6df841d6ca39491fb8f1ab7f26fdfa17d9a0411", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502607, "uuid": "78852a7c-55e0-4837-a142-bb466f3f568f", "comment": "Malware payload (Mirai)", "value": "e7240b74da8bfe078f462a5b2af328ea5c09a5f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502607, "uuid": "003d1568-ae8c-4049-a74d-0c2c5d4bd593", "comment": "Malware payload (Mirai)", "value": "a5ccc8f2dafbd8d825ea6ebee15e8ff744a79d1e866769039f5d9e9af37983443ea00076d20991a4bd27927166ef3eb6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502607, "uuid": "163d044f-92fd-4841-a83d-921f5d27298b", "value": "T1E9A2D034B79A6A70D6E46D7FE03AC24632B2B5F4B5F3353216084120D6F4412A8795F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502607, "uuid": "cb6c0913-3080-4f4f-b097-644845f2a46a", "value": "384:YkOGa8O84nlXDiDHQKNyAOX87LA3mnRRbiZoihymdGUop5hS:Y/Gy8clXDMzikAYRfis3Uozo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691502607, "uuid": "63a7bed9-5e85-4935-a804-da28e6e771ca", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691502607, "uuid": "c9144782-f498-4442-84eb-e127db196038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502607, "uuid": "4a5930dc-9bf3-4365-8996-bfba3e6e1b26", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc9db3f-35e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691494956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691494956, "uuid": "4f79e23c-d145-4c7e-a8a5-5777aec81bac", "comment": "Malware payload (AgentTesla)", "value": "82f395f1b81b6a3d43b7ad2715a0baf4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691494956, "uuid": "45cda52a-57c5-4204-86bd-cc2f2fde777e", "comment": "Malware payload (AgentTesla)", "value": "93d1edaf3b6cd939f6e3011ab026fa1b78090128d5e1d3f85cccfcbfafacb93f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691494956, "uuid": "f5daec83-5def-442c-bc3f-8d0174d222e3", "comment": "Malware payload (AgentTesla)", "value": "db2eea9b34b146d594b3e08c7f6fbab57a90430f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691494956, "uuid": "5a144d31-83c3-456c-8d79-007504ecc36d", "comment": "Malware payload (AgentTesla)", "value": "594025da127d886825bfab3a577d9a6839b94d8b03268c85c9bbb4cb4b4529a0d5ba8b4f287be30e6f600844030e0f19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691494956, "uuid": "e3f4e74b-7378-4dca-906f-a6d2b80cf0d7", "value": "T1DCA2BF6BDA101C3FD73582F1A5C52645EA5C7147B21A2D8A6B32E31DCCFA6CE8D39884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691494956, "uuid": "efa92c29-73ef-433a-8d89-448d8dd709f6", "value": "384:mR6QgSWG6f59UORfqNy4Y0Fivd7ZMM4EUS9rDhCl0mppOrFkO9Dxpr:mRVgomfsRYKiAMx9Xg0mpqqYDx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691494956, "uuid": "aeacad0a-09db-4884-866b-d3f094658640", "value": 23230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691494956, "uuid": "e5883e81-4f26-4063-be7a-755397dce041", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691494956, "uuid": "da12e597-463b-4618-abb6-86cc6c45eeb5", "value": "82f395f1b81b6a3d43b7ad2715a0baf4.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d774729b-35e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691498036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498036, "uuid": "2e0a3e6d-6e21-4421-8c90-167aab4a4868", "comment": "Malware payload (AgentTesla)", "value": "1eafe1a1e825811bee9e2e37bb31203f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498036, "uuid": "797be2dd-af66-4160-b9b2-0ac7f5ce16b4", "comment": "Malware payload (AgentTesla)", "value": "93d5fb740afe932aec452032bc39786d85ae3254d79a8e388728189a53174226", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498036, "uuid": "4afc1811-81cb-4493-a271-d77d3828db12", "comment": "Malware payload (AgentTesla)", "value": "5df438f277081f32fc15ab602292c5678ca5ffcc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498036, "uuid": "29c7baa9-85f1-4da5-8eb2-cd4cf64b482c", "comment": "Malware payload (AgentTesla)", "value": "69de1fcee2eb546bc56a270531fe2437a604e7896f3203ada04e14a09dfe79cbe2265d7d373cf4b257bc772dd936756d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498036, "uuid": "4703e586-d94c-4096-929b-cb4bd8f3bf22", "value": "T1FBF4F050B2AE5F2AD97BE3FA0151621053F6ADBF666DF31A5DD630DB2191F000A00FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498036, "uuid": "1e07aab4-0caf-4f49-95f1-dd17524174d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498036, "uuid": "8c1381a7-0827-4a3a-8acb-d61c88210ee5", "value": "12288:5hrQr9S2iNtOF9wSslcgXIJ7TV25GHaGWo45kQ5ylEsqBqshVeEWBt0HEyWC:frQr9S16pYXG7E5GVGwl5wNWBt0kxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691498036, "uuid": "d552407e-39cb-4a88-a138-4d5a183b3f2b", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691498036, "uuid": "42fcb613-cc7e-4cf9-b12e-e3d226af036e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498036, "uuid": "2d0f1e6e-d27c-43d2-b81d-e00fc3eaa6a6", "value": "93d5fb740afe932aec452032bc39786d85ae3254d79a8e388728189a53174226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741b71b4-35af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vjw0rm)", "timestamp": 1691473817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473817, "uuid": "075f2599-d8ff-41b2-a3c9-bf7f593682ad", "comment": "Malware payload (Vjw0rm)", "value": "528d4b33434e3c8ce689f137dba1c894", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473817, "uuid": "9c719555-fdd1-4cb5-b096-e9f6e5c23f78", "comment": "Malware payload (Vjw0rm)", "value": "9406c764fa44815b3cb4c105f2cc051dd2e764086ec7df66e49992e5c9681f01", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473817, "uuid": "33fcc2ee-cd14-47ee-a08c-8a2c4769bcc5", "comment": "Malware payload (Vjw0rm)", "value": "09cf5206b5b80e2cf130a313699cd50f3d62709d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473817, "uuid": "0eb1e60b-0d68-40c8-81b6-e1eade61f581", "comment": "Malware payload (Vjw0rm)", "value": "f4e3472ca9909ae673ace070fee5232d21ea06aa5866f4d666d9c3a32190a02069000678f0bfce439f91546aab319bfe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473817, "uuid": "c3cc3a2d-f9bf-4860-a075-6935df4f4a90", "value": "T1EFD54C1968FD5117A2B3E4DBDB12B505F034ED80385291DAB8D83F89BB36D83A46DC39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473817, "uuid": "76f3176f-cd05-4e8e-9322-ebfd17c39a45", "value": "6144:STNgGWMXjQS3H1WfCovS9TuaDqFBpgU5MXZDJ+5svwXJ6ho1LpEieK4W2WxzD2pi:qtid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691473817, "uuid": "4f5c7f05-311c-4550-aa8a-c484600c2b6e", "value": 2786150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691473817, "uuid": "f9cdc2ff-849b-44d7-920b-a5a358683f73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473817, "uuid": "ba128425-3b01-4e88-938f-bef0dde3127d", "value": "GXB032199034.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d756b54d-35e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691496318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496318, "uuid": "2598c3bc-0395-49e4-a4e6-396fe31585d2", "comment": "Malware payload (RedLineStealer)", "value": "7392af49870445a1d1c1422e7b10ee76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496318, "uuid": "e5a9a717-9a56-404a-8df9-23fd80c6772e", "comment": "Malware payload (RedLineStealer)", "value": "9596390fa3510502294f557f423d576f09e965d5e8eb21ad1878a8f4cbaad1ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496318, "uuid": "d0bedd90-95fd-4d95-a228-90c54a8e980e", "comment": "Malware payload (RedLineStealer)", "value": "9441602aff049020330136fa2e6abdc4810efffc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496318, "uuid": "c42878b2-6439-4dec-aa03-7178e9c73c32", "comment": "Malware payload (RedLineStealer)", "value": "9f57bd146ecb7b2d89f520af364697cbabc623b82c2c091381ec490c298513d9cf723c95555f7a60ee93457435c1d315", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496318, "uuid": "7118effa-1a77-437b-b3ef-fb5112054ea2", "value": "T1E584AF12A6EC6B72E5D28A328E2DF6A8661EFC91CF1977DB120C7E2F04711E1C175712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496318, "uuid": "01648d9f-dfdc-4487-bbc9-3348a91073fe", "value": "81d6121cffaa48653088a63c1ee15a1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496318, "uuid": "32168e61-40d5-49d0-a6b4-814ca3fa1dcb", "value": "6144:p6B3M6wcTtKPfgkGKHeGf3i51k5jTcZu98WL8pZ3Qt1k5G9oa:pkc6w8KHgE+vk5cxMu5Qt14YJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691496318, "uuid": "16df8276-a09e-4909-93f5-2fb99634a42e", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691496318, "uuid": "f8a3f373-c914-4188-aaf6-331e31d82f8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496318, "uuid": "dc1bdc52-7786-4437-ac0a-8f3f90d13b16", "value": "9596390fa3510502294f557f423d576f09e965d5e8eb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a1d1c9-3623-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691523475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523475, "uuid": "4d0b2229-7cce-406c-b45f-24d73036d84d", "comment": "Malware payload (Mirai)", "value": "607c9fd1ebd9c3ca011915a7fceed021", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523475, "uuid": "98df2018-e664-4ee6-ab55-2812ead735a2", "comment": "Malware payload (Mirai)", "value": "96704f1229481756bc19eebb6456f64658951aedf8f55a1a2c868a6cf4e30aa1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523475, "uuid": "b2730732-0858-40fb-80e2-efe8307e94a2", "comment": "Malware payload (Mirai)", "value": "8f01fe8279bdaa8bc4273ffc7f64ef073d293128", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523475, "uuid": "b483dd86-d3b3-470c-9a54-515863dc0cc4", "comment": "Malware payload (Mirai)", "value": "9b16f3dd8400beaa2eca5ce8e1623e5d6c2c377b860d5c0b633cb43c0c418bbbc51b6587dfb909c9fa16342d802d17cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523475, "uuid": "902b4da5-f1e0-423b-8ca9-bd3bded98a43", "value": "T19DD2F0AC7981B5FBCCC98B39B61F617A304EB4E972F28322B346C9435A1B140D922D4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523475, "uuid": "3fb1de9c-1a50-448d-a0c5-961054e5e817", "value": "384:Mxd/PxEDLd2TwcMzP6lowYcEaqsY9WC4t0LomNw2XYyXhUE9wwde4WNyo:WlxKd2NMWxEnsY9OQNwqr9P33o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691523475, "uuid": "8a4bc6b1-99de-4cdf-a00c-5c4f916f4e98", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691523475, "uuid": "86f15489-edc7-480b-861f-68222c01dee6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523475, "uuid": "5c8d5f7e-b5a0-44df-8d92-c4fcafe634fb", "value": "607c9fd1ebd9c3ca011915a7fceed021", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef826810-35dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1691493352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493352, "uuid": "fda2c224-4425-4627-93aa-a703b7224db5", "comment": "Malware payload (Stop)", "value": "95b9be45ff0a72f604aac010d769ff10", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493352, "uuid": "902d8f61-418c-4943-ac94-cbb5789df4ca", "comment": "Malware payload (Stop)", "value": "96bcd9b93ceba1b42e9bbbe07e20750ada32ac67a89e2bf6a4e01c9b161ca122", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493352, "uuid": "8d9b35ab-e43f-4592-b432-8d3e66079149", "comment": "Malware payload (Stop)", "value": "f8effec3f6eadb8e45dbf9cd3ee32f12806c2d03", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493352, "uuid": "b4a5daf6-efb3-4ab3-a30b-7d4b33cb1219", "comment": "Malware payload (Stop)", "value": "a39ceb73e5e463a5ddd8076ab2417dec0a4578a169720bb42034ea5320cc270ad9d9f16dbc049df4cc9ad70a37203dcc", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493352, "uuid": "23973d14-2624-4333-9798-495dfee22c27", "value": "T10835AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493352, "uuid": "0eac1323-5f63-44ed-a38b-f194d8f37440", "value": "0c756c849bc7b459f78f7a5ce46cd4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493352, "uuid": "1d1875c8-72dc-4f48-bf68-971f7035bd67", "value": "24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/XRPOO8GyHUq7:F0dwAYZt6C31WeTPRPOhGWUq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691493352, "uuid": "fd917e28-591f-4445-80f1-e0a085b22aee", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691493352, "uuid": "593fd5d4-538b-4d4a-b7b7-5d4a68346869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493352, "uuid": "3ae6a8a1-5765-4c18-bf60-1b6227595205", "value": "2023-08-06_95b9be45ff0a72f604aac010d769ff10_stop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d82180-3616-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691517897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517897, "uuid": "91461613-cbb8-485c-a7b9-97f27c2f8947", "comment": "Malware payload (Mirai)", "value": "5a24c49ff2756542b1df8def5330ef8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517897, "uuid": "0cc09620-4a09-4d30-a92e-ff232004a3bf", "comment": "Malware payload (Mirai)", "value": "97ee8c68c9cea144d469d9c5aa33004d689ca0c1b5b3f6f652d600dffab8a513", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517897, "uuid": "c6179dbf-a7df-46d2-8a8f-91fc098443b7", "comment": "Malware payload (Mirai)", "value": "870452720fb9ad4ca66ddda7ecf05fb5c5c4e9db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517897, "uuid": "675da9b3-5b22-4695-87aa-ceff6f6a9955", "comment": "Malware payload (Mirai)", "value": "8cad4d1b40954ead75c64a43a5fee5ab644fffca3711c738ca80fb868179de28886e167e4c9bd03478f771f43e7e2945", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691517897, "uuid": "4ed8a472-a59a-43d5-a2c2-4e5f05e733e3", "value": "T13E336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691517897, "uuid": "b5ae776c-200b-4874-a59f-5e313f07141c", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691517897, "uuid": "2d2b599f-3515-489b-b593-f94b4a6f6426", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691517897, "uuid": "e8b031a1-c0c8-4164-8fa1-a8349633a7f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691517897, "uuid": "61af2282-c289-44fd-9565-53380b40bfcb", "value": "5a24c49ff2756542b1df8def5330ef8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8520db04-35e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691497898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497898, "uuid": "c99ce81e-b608-47fc-b423-69d51d8ba9ca", "comment": "Malware payload (Mirai)", "value": "ef87599d1253e020fb6198948dda841c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497898, "uuid": "3412b50b-600a-49f3-b50a-c6a10fd5ded0", "comment": "Malware payload (Mirai)", "value": "98810f1dad2d49c1a7c098505e9982e62244f046c85272a70eb7d17d81d39fc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497898, "uuid": "15bef812-bab5-4ad6-8996-0e245b18971b", "comment": "Malware payload (Mirai)", "value": "6c936aeeb1bd4dc43d4d0812e446f334693b2190", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497898, "uuid": "e38dce2c-628d-400f-a14a-74eaeaf82e88", "comment": "Malware payload (Mirai)", "value": "67d991d9a21e26ecfd6f57e135d96a88a80315551edfed4b8718249f0a0860b26ff27ffa3990ae20477c92221cad4d71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497898, "uuid": "6da826b9-f9e8-48ac-b09c-e6f6e4739599", "value": "T1C3336B36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497898, "uuid": "216dd54c-f634-4bbe-91df-98a859e35924", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691497898, "uuid": "90bae7ac-c46a-4d7e-95c0-727c964dc5ba", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691497898, "uuid": "824d729f-95c2-4c4d-a4ab-aa4c6fa93ddb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497898, "uuid": "4c8a934e-dac3-437a-a55d-4563aac7940e", "value": "ef87599d1253e020fb6198948dda841c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874f5588-35e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691497472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497472, "uuid": "65a5b866-46fb-412f-b205-092b8c2da56f", "comment": "Malware payload (RedLineStealer)", "value": "2ebf23cc8f39bd8fa10ff8c4638b0d0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497472, "uuid": "bf4da71b-8bcd-4016-ad78-ab47bf747641", "comment": "Malware payload (RedLineStealer)", "value": "989bf8e0d175239e3bbcaf55a5fd9608b02f231e7173d5c521f45ba2fb93a377", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497472, "uuid": "37e74d80-3bda-4912-8c79-dd69a9a8a700", "comment": "Malware payload (RedLineStealer)", "value": "6be72b22c3cfe2c3489aecae72b44517cc1f8cd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497472, "uuid": "17339e6f-c6b3-4d0c-8a2c-cdf85a1dc620", "comment": "Malware payload (RedLineStealer)", "value": "fde8655bdfa9446d81e67ba4b28bb9acfd845eaa2e4d3a396ebb29f6b7af924bf24359291ad203c7a1a1344b267b2ce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497472, "uuid": "4059e7f4-3f52-4508-9158-63ced84ab573", "value": "T1BC051253A7D08033E8B11F3188F643871F39BDA28D39626B3B84EA454D7269576B137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497472, "uuid": "7c4395c8-9367-423e-8757-26a0bee5b991", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497472, "uuid": "5e31c989-6a80-468e-ab66-ca08802758c4", "value": "24576:ByQU7pZWt0wytBfrUZTWpaCwnI63buTXeNBRcfQC:0Q1SwytFYZTTCwI6LQ8BRcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691497472, "uuid": "7f906db9-e27f-426f-99fc-ac9c81347549", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691497472, "uuid": "520b8a8b-653e-4d71-82e4-caf64ad89fab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497472, "uuid": "ecde2cae-995a-47e4-96f6-0207d58da70b", "value": "989bf8e0d175239e3bbcaf55a5fd9608b02f231e7173d5c521f45ba2fb93a377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8d4e1e-35cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691486129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691486129, "uuid": "fbc57695-06e8-486b-8c7e-9b56bc686eb0", "comment": "Malware payload (RemcosRAT)", "value": "6b6a4031a7c6cbe5d6a73729750f01f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691486129, "uuid": "34ded951-059c-4f9e-817a-b28eee851210", "comment": "Malware payload (RemcosRAT)", "value": "98a4d17d6dee54f9242c704af627da853d978d6d37738f875d08ea0e7eaca373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691486129, "uuid": "1cc59959-2cd6-4297-82e3-2f7ae1af6b9c", "comment": "Malware payload (RemcosRAT)", "value": "54a3eefb9126ae9605fae7397cdb6625fd0020a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691486129, "uuid": "a3f60b3e-a86b-4ba2-8061-c257fa99d6d7", "comment": "Malware payload (RemcosRAT)", "value": "984acd3030fadb5d9242a56d0e61b8c4ee041a4cfd608c04ed10c22084874c611d36c6407d1a608547be738f954b9afd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691486129, "uuid": "2e460a17-00db-4201-a2d2-62d1a2f5ca01", "value": "T1CD45AD32E6524833E2B6057C4F3B1FF45C2FBE73592859456AEC78B96F2B2402839167", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691486129, "uuid": "a879c7a2-82f2-4e6e-98e5-6f4418066d07", "value": "a4dea6841158221e1f9d51cae1534166", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691486129, "uuid": "f25a4803-78bf-4ffc-8c22-0ec94bd3ff36", "value": "24576:O+wrBX18XhVRGTbabra2OYSYf9PhHt8AE:OrnHKKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691486129, "uuid": "8713933c-651a-4b12-a1c9-f8b84670e6cd", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691486129, "uuid": "b4ae3188-f027-4904-82a7-18b3e4f3fb9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691486129, "uuid": "98a12d7d-965b-4e03-933b-2a565054a9e6", "value": "ORDER90112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85e88ec-35e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691495407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495407, "uuid": "d47d6ef0-2029-41c7-82f9-c65b6646f3b3", "comment": "Malware payload (Mirai)", "value": "5b0e464ce1b8a0892945459a660e5701", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495407, "uuid": "9bba76f3-8adb-459d-aac2-cd44f513f367", "comment": "Malware payload (Mirai)", "value": "9920b50251a3a97110526fc92cc6a19399a2032839055a4ecf00306d94a4ab46", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495407, "uuid": "bb39674f-53df-45cf-82d7-f04bd564cd02", "comment": "Malware payload (Mirai)", "value": "5d717497cabdf35b4fbafaaa2f3e24b9fe434fab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495407, "uuid": "8a254b92-d59e-44f2-8671-64ed2b2287f6", "comment": "Malware payload (Mirai)", "value": "df6ac28b16f12ac04c131a6c7b81bd8d50ae158fecb4794f5a3b5bf69136a9ee85e89f995b04d2abf4154a3126d536f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495407, "uuid": "73f72386-27c5-427a-bbc8-b6b5be587c4d", "value": "T182A2D01572632E66E3EC1C3DC96AC257F9A71BFC90F5327679412520C94D24A3E38A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495407, "uuid": "a4945416-bc09-44ed-a962-f58eb062a183", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjyhymdGUop5hg:UvQn4j+ZO5fKAlxus3UozO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691495407, "uuid": "e27685ab-b00b-46eb-9f4d-31c06a19383e", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691495407, "uuid": "dc2c0699-85c7-46a8-ab1a-25178fc2175a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495407, "uuid": "eee35f37-bddf-446d-b013-a4b740e2efa1", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c51c07f-35c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691483602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691483602, "uuid": "fa8bed8d-9af9-4c58-8330-475a50f4d263", "comment": "Malware payload", "value": "6294e7dd34212d55c1b0ffbf13fcf91a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691483602, "uuid": "01a9bffe-7c3b-4c3c-8e12-c5da97a10a41", "comment": "Malware payload", "value": "99747e6163d26aa3a211615ab288f8a32afd85233244fda482fe9672594e5d64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691483602, "uuid": "2860c273-042d-4734-9054-ae8ab56df129", "comment": "Malware payload", "value": "8eef153573e00e1b8faa05a593a1df733f23b97f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691483602, "uuid": "0b213890-b866-4bce-a89e-7b4729024e30", "comment": "Malware payload", "value": "837d1732650c3bc21a60cba00737948cad2aa621c160eb863673d5dea877f2f8b1f91f6a8bf5b7c36dcadf5b882089fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691483602, "uuid": "d46e4256-24fe-49fc-9013-f9906ce042e3", "value": "T1CE24BE2A32D1C473E96700345D96C7B26F7ABC305B365597BBE837A94F30296873A342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691483602, "uuid": "f50dc542-685a-49c9-8efe-fa01c1fbd51f", "value": "6d7a6641c4401973050d7711ad00a347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691483602, "uuid": "9dc69c5b-6c15-4df6-8d67-d3119da59292", "value": "3072:K4OmZgi21psE33gnlAsvc6I1A3PD52lsDnAv8Zm++l2ve:mcspsWAU1Af0YnWem++l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691483602, "uuid": "d0e52ef7-01ba-40c1-ba02-5dd451f362d2", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691483602, "uuid": "e6e31b42-436e-4eff-b5f5-5b3c591716ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691483602, "uuid": "a12f797c-e76e-4315-99c3-f20583e5e4fe", "value": "executable.2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c66530e-35e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691494850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691494850, "uuid": "67dc9d3a-0a75-4744-a594-52e913062b8c", "comment": "Malware payload (RedLineStealer)", "value": "8d093a4353d11b4a6591d945f4a4855e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691494850, "uuid": "a64b2946-8413-4b69-b3cc-190d7563b657", "comment": "Malware payload (RedLineStealer)", "value": "99bd949bb95d531c8047ade15df066625d7f534864a4fa066b354b958b620284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691494850, "uuid": "7c5135f1-974a-4461-badf-12c73199f612", "comment": "Malware payload (RedLineStealer)", "value": "b7458c9207961a3e8187862f6d6d5b2abf89df95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691494850, "uuid": "8d1352f9-33d6-4032-a90e-b3fd989d5e9b", "comment": "Malware payload (RedLineStealer)", "value": "df665e717c6dd3b49ff67fe2a6806fe59f6134b3536377f44027cadd999c0aeb41c7eff8e5f42e06a06fe32455f84e3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691494850, "uuid": "45f31656-ecff-4dff-8821-ffd6a1c81582", "value": "T109256B603CE08926DEA610BB09ADF924027E90A20F235ED755C77FEB96109D16F37787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691494850, "uuid": "d4aed09f-5a47-4834-8683-980f80222162", "value": "99618c39aafbf01419fbcd53cea0e110", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691494850, "uuid": "fba4999d-d6b3-4ac5-a7c0-7f1e2d16ea2d", "value": "12288:HehArhpIF+G5PMZ619yEaLup3mzrgSyszQuUAAks3duzzoK0fJBzEy25Cddh:+h4hpIwG5PMZ6JgQuUAc39JBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691494850, "uuid": "652e7f69-230a-4a45-83c2-8b8138633921", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691494850, "uuid": "ca653788-f0c6-4029-9a3e-d5769120876c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691494850, "uuid": "22090aee-d80d-4616-98fb-9131e8b04293", "value": "99bd949bb95d531c8047ade15df066625d7f534864a4fa066b354b958b620284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59167cbe-35b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691478067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478067, "uuid": "bfd05806-9103-4f20-8d22-4665346a620d", "comment": "Malware payload (AgentTesla)", "value": "16f3c95d1f1486d0081ed5f793687364", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478067, "uuid": "0ca1920b-6d1e-4942-948d-407c483966b5", "comment": "Malware payload (AgentTesla)", "value": "99e76ca97c74ea9e8fe112a45a88f4fd6a684cda8d8666dfe20dc2eef4d61455", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478067, "uuid": "5b7be8a4-68ff-4f90-a52a-6fbf2b16adb4", "comment": "Malware payload (AgentTesla)", "value": "a34654bba5b0e60a75eab60ba490ad0344ad0be9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478067, "uuid": "d460effa-b1c3-4f3f-bf21-a9d29d930b30", "comment": "Malware payload (AgentTesla)", "value": "0a92405c39bf375663c48513b20fd2f04bd517e9a95b1154a33e9d89d2b7820031525206e7281a734425e67f09e0f4d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478067, "uuid": "cca9863d-b2a6-4c3e-8840-22983d6dd439", "value": "T1ABD4221C689CD749EE6D07FA292C507903B2374E6471E3AC8EA16DF821A6F0B4E11F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478067, "uuid": "25c25266-9445-4c65-baa2-73104b33b4fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478067, "uuid": "d18c69eb-c33f-479e-b49d-680663583b86", "value": "12288:8JUUgdp2rnIgU0sE14sNDExngp7KzAouSVUXbwJFmhVYy:K3gdpiwm40ig0MouuUXbqmhGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478067, "uuid": "eb38e0ec-e5b0-4249-90a1-7d495dd56fb1", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478067, "uuid": "43f74e20-684b-4e97-87bd-b6d89d3e4cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478067, "uuid": "4db69049-b03e-424d-a416-69fa59cc83b4", "value": "\uc694\uccad\uc758 \uac74 \uc0ac\uc591.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7041fc4e-35b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691477247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477247, "uuid": "17a6fe0a-117f-4cd2-ae8a-d2e102a0a3ce", "comment": "Malware payload (AgentTesla)", "value": "bf6599840c58c54dbca625ffb0ab7854", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477247, "uuid": "74088692-f566-449a-b902-cbe888184849", "comment": "Malware payload (AgentTesla)", "value": "9a6a29e35db6e67dd531e8d1625beac0d1f83ab6694aa2a00d4759ad33e6d176", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477247, "uuid": "4c781c92-5827-4f69-be21-c2d15d7270a2", "comment": "Malware payload (AgentTesla)", "value": "d2332cd5077c7d919a9eb70fd7ae5b52055fceb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477247, "uuid": "feb5cab6-5879-415c-8133-404024d2afd6", "comment": "Malware payload (AgentTesla)", "value": "75766f7790e357c38c8f8052745b4dbbe3fd8d89319e5364cca278175521c1da573de1a4c4adaf45e922572b7937fa27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477247, "uuid": "92aa9352-f3d0-4c32-95ea-373c148aa1ce", "value": "T10B35E003E804DBC3D41D83F87E530ED91F0A6F19E99569EB04627F9B3A70A72099E52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477247, "uuid": "000f930d-8ec4-485d-922b-e1537cc890f5", "value": "24576:5RZyQw6VfZyuw6V4jKaWlEzp7a99dlzZbtQA3Qp5EfIwsx:5bQ6VRe6V4jKjOzYdHt/3XfIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477247, "uuid": "e18c0bd2-7757-47ce-9b11-f803f2eafe93", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477247, "uuid": "025dd163-96ee-4694-a3bc-b07eb38f0d72", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477247, "uuid": "d0db39a3-cbca-47cf-bc59-66ea07113b4e", "value": "Order Po.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4809e91e-3606-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691511110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511110, "uuid": "73c2d917-2317-4766-832d-13b590e7d94d", "comment": "Malware payload (AgentTesla)", "value": "1986c16fc76fdb39d6a974b293abc987", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511110, "uuid": "12f10645-c183-48b0-a2b2-28d1d79a301a", "comment": "Malware payload (AgentTesla)", "value": "9aaf43bf1332584fef746b25cb8ce5d649476c0f2f9c97b2f1eb786846015d2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511110, "uuid": "5f007046-d1de-4e77-b4ca-39dce0d0f7ca", "comment": "Malware payload (AgentTesla)", "value": "2bda3e9fea15674d665e1370c03e3abb87f863db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511110, "uuid": "b13ddf3d-2d36-401e-b37a-5675ed20a859", "comment": "Malware payload (AgentTesla)", "value": "7a3dde7755fd139660e4915d9f334677cf42fe3f655ab0803f4f847fe6cc49a2bd5545c21573e4b97c449659dd31cf48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511110, "uuid": "e8a02ad1-acd8-4f5c-8146-744478b806e2", "value": "T1B2450119B6788132DC18C77458F65E1282EBAE9D37E1991928D4F76C0F326BE8F039C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511110, "uuid": "47309b37-333c-4766-ad50-8591b3c02428", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511110, "uuid": "8d230fd2-d8ec-4114-9d71-6e8421783aeb", "value": "12288:7bMnVz5pSMM7s2NQNoMdoPORnMzIlSZMAUsUirdYJvs9xghcDhhJU4VZyz/6hGo:kdSMmSdoVzT7UqxZxxEU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691511110, "uuid": "53f0f460-f3f7-4517-b9d3-391dae33f777", "value": 1182120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691511110, "uuid": "44a4e060-9112-44c9-92d1-c334ebd06a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511110, "uuid": "ffd136ce-e249-40c0-829f-7029bdb48a3a", "value": "ORDER LIST_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649f16f7-35ef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691501279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501279, "uuid": "4ea38187-f713-4efa-89c0-b32745ddda97", "comment": "Malware payload (Formbook)", "value": "58c4621a018a62f4b19939102eeef69d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501279, "uuid": "92556c5c-4bba-4baa-b753-b9e43834567b", "comment": "Malware payload (Formbook)", "value": "9bee385e9ed1fd5a2687089848845843ef58e463e1c7bb64c7c88436562dcd02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501279, "uuid": "84373d03-1d40-4b72-b758-c538ebd2bb05", "comment": "Malware payload (Formbook)", "value": "0c9535df13ebc175805bebefba9ea9ae850782af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501279, "uuid": "6d340ad3-e4bf-495a-8c76-8b8fd62193ee", "comment": "Malware payload (Formbook)", "value": "bfcf9e3ba0646b74bfd90ef5762b5a95151388bc30cee5a88e704abdd3b81b692ccebdc3eccc3ca32acda2d1bb9a50ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501279, "uuid": "b76cdcae-727d-4dd5-900a-15e19e2342b8", "value": "T16934125567A0819BE95303317F7ADD7A8AE9D8832CBA4E570720AF91FD21391850F373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501279, "uuid": "f86138e1-d02f-4c92-a41a-82c97ce1108d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501279, "uuid": "b4e5f598-aeae-4491-af02-db579ba9f609", "value": "6144:/Ya6BruJFD3R5mqWvU2nknWxXv+NmQZoB:/Y7ruJFDB5mqx2yUvEoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691501279, "uuid": "9a5db171-27e2-43ed-bea7-73cd96fdb154", "value": 244592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691501279, "uuid": "1ba2be26-c751-4f00-8055-9110408a9fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501279, "uuid": "5e5b31c2-fada-480c-beb8-82b0d687f97a", "value": "9bee385e9ed1fd5a2687089848845843ef58e463e1c7bb64c7c88436562dcd02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0396da7-35e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StormKitty)", "timestamp": 1691497514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497514, "uuid": "61cd8c2f-4b5f-4672-931e-5474cddedd54", "comment": "Malware payload (StormKitty)", "value": "87e8c813255d7a8768b98765cdcfed67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497514, "uuid": "70cc63c1-656f-4b65-8701-bad3ee39af76", "comment": "Malware payload (StormKitty)", "value": "9d2b93c207ed97cc7b272da9a8d388077d97dc389e2c0e9645e917aa5f0619a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497514, "uuid": "c8501305-7b45-4246-bf3e-2dbe75953f6a", "comment": "Malware payload (StormKitty)", "value": "1613953ba8a07e11e89ed77c28afe58d872891bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497514, "uuid": "11192fe9-f5b9-4ec6-be7e-48fbefa5b148", "comment": "Malware payload (StormKitty)", "value": "f83273fcbaebc0e45a18aaeac1a812f4d73a156f8e402087960dd8a68dca9678d07649f1b3d35e3482425d1d015ecf3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497514, "uuid": "b40ed7c0-eec9-4fb3-b3e1-b030f2940c2e", "value": "T110C4226457474B13E59747F659202E3943BF5BDAB834E7830C83F3D46A81B922628F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497514, "uuid": "611c0792-6649-4581-b88b-fdfa55b60bea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497514, "uuid": "631dcd3f-fdf4-4e97-9f1a-1b56b4e458c3", "value": "12288:25LbzIu9+r9GJ+iyhAGkFuT/r2GGjerRWvEF8xLCnysHu:25LA9IvGTqY/XueosF8xoy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691497514, "uuid": "e6c36d26-a5b9-4c95-a9d1-51408bbcae7a", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691497514, "uuid": "c3a4a0a1-0b28-4121-b716-4b43dd0c8677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497514, "uuid": "44d23176-5278-4de2-ae52-70a4f7ba4744", "value": "9d2b93c207ed97cc7b272da9a8d388077d97dc389e2c0e9645e917aa5f0619a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608d2df4-35dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691493112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493112, "uuid": "6539b95b-6e5c-4823-b806-0c7c579d7b5e", "comment": "Malware payload (Amadey)", "value": "8dc81aac9c43bd40f721c9cb3dbd9af6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493112, "uuid": "961353b1-dbdd-4e9b-a4e2-15e0ab480181", "comment": "Malware payload (Amadey)", "value": "9d615a07eae5b1659a1a42ca7bae0cd205336f7a7b6a5f3ad0e82e345e08ea90", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493112, "uuid": "8dd63a8f-af24-40d5-8b7a-c25eb49ddfd4", "comment": "Malware payload (Amadey)", "value": "e0ea0c93b5c864be3b25db5793e383074fb1c2c0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493112, "uuid": "5a444ce3-f8e6-4a81-8a05-f7f37434c3e4", "comment": "Malware payload (Amadey)", "value": "83162489cf4e4fd760bd1dc989c6b1508964cddf5e980803919ab47b69c084a16024d2410ec0e62d5187dff033d93552", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493112, "uuid": "02b2d557-b5ac-4d8a-9686-8562d93f0d88", "value": "T176E412D2B3EC9072EAB52B7018FA03830B36BCA19D75975F2389985B4D722D89470777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493112, "uuid": "7a4291a4-b2e5-4953-90db-e4c57a10070c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493112, "uuid": "a31ff54c-c6de-46ed-9fc0-a2d0e3849e46", "value": "12288:oMrOy90fFnqLKBjzf5Molj2szu0WeTf9ePMPjHiJ/HXezhBDjvMNnNB2yLV:mymndBv1xBWeLc+LAHXYBDjkN72w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691493112, "uuid": "0f489f37-5082-4338-85ea-1958f4e7d20e", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691493112, "uuid": "9d646805-97de-4f85-8943-639273a39ac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493112, "uuid": "65130061-3a8a-4be6-b82d-fb7ef4cdf77d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7c5067-35e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691496511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496511, "uuid": "610c551f-4db8-4ff4-8243-cd50d74ed3c2", "comment": "Malware payload", "value": "39d8bda3ac0245335b33347dffb19e7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496511, "uuid": "792ca59a-e4f6-43f1-8876-fe947d93d148", "comment": "Malware payload", "value": "9d9a14067ad1b470357d99d72bc1744b173adc27b1efe49e083b90f75920bff9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496511, "uuid": "939d9de4-a2ed-43ab-9c52-83902cc7c83a", "comment": "Malware payload", "value": "8225fe4560310468db2a414159326d4827875a4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496511, "uuid": "b4d106f1-6018-4879-a48e-7485a6568f9b", "comment": "Malware payload", "value": "df2b78b53f071c8da268cc9faa7d6ac875dfbe3d4f753f0e621f6d4d99717cf8259ad34e6b9e05392357dbf0e0131747", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496511, "uuid": "d7fac497-2fd5-43bf-b2b6-fac424cb417d", "value": "T101343736F7B81B71E78A02F6132B1987DA38C45C1F9540DE1328CB9A5E3689097B7B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496511, "uuid": "b0e276cf-e68a-4c71-8fe7-9acc3ecaab6c", "value": "07c47b8c637f1d2bcf7ba467f1ae3256", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496511, "uuid": "bb7f0035-a7ae-4a4f-90b5-45331eadc3e1", "value": "3072:4PBmuUGL34hpAPgxed6BYudlNPMAvAURfE+Hxgu+tAcrbFAJc+RsUi1aVDkOvJ:4PBzr2pIyedZwlNPjLs+H8rtMs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691496511, "uuid": "d4ccba22-b324-4e21-a377-e79f677384c5", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691496511, "uuid": "0e95ad14-9724-47f7-9931-571ccec50789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496511, "uuid": "ba05a14b-ad47-41e5-b405-edf3fbbca76b", "value": "9d9a14067ad1b470357d99d72bc1744b173adc27b1efe49e083b90f75920bff9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f9188e-35e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691498572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498572, "uuid": "3f23397f-21c0-4b48-82f5-abf3d2d73962", "comment": "Malware payload", "value": "89333738292ae456b34a0027e057d8f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498572, "uuid": "e8c04b69-9796-49bc-97a3-5d23d3f5800a", "comment": "Malware payload", "value": "9db238125c4edde646d3059cce9b20142026abdaf38f9a6e61ce7c370a117772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498572, "uuid": "f797c075-8a98-456c-896e-2808a4849888", "comment": "Malware payload", "value": "c54568b92330b16953de4d0f922ca33d42a6db2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498572, "uuid": "3f5b1ccb-d867-4f49-8cc8-8737f8633a61", "comment": "Malware payload", "value": "b6d5a56df11435cae0095dfa034628b56e8fe16cb80c873946a53d3b290196e0c786a1c0cf107a29f94b73283a078c3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498572, "uuid": "3ad0388b-8bfb-40d1-947a-ab7a502a2198", "value": "T144749E28FAC0C176C5A260749129D7B3CBBD7470676964CBBBC626760E796D0EA3130F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498572, "uuid": "3ecdde34-087d-4d8f-bb1d-5f86fac1394b", "value": "285ef1ee25868adb73e72303fd540efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498572, "uuid": "75c20737-fc80-4afc-81b5-195698684a97", "value": "6144:X6114h08ng9aChe2+WwqlhhCmMFfUskeH8c87xv+bQYHKVzWTPrvr:q1142sChe2jhCFfvNH8c87x2bDKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691498572, "uuid": "6592b1b7-d2b4-42a8-9f99-a2239856e1e6", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691498572, "uuid": "af6775d2-e3cc-42bd-a916-65f983382387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498572, "uuid": "6f5e30c1-f3f7-43e1-bf2f-6c3cc448e0a3", "value": "9db238125c4edde646d3059cce9b20142026abdaf38f9a6e61ce7c370a117772", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974aa312-35ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691499217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499217, "uuid": "2aeccc05-2fc1-4ade-9ffc-8e3493322035", "comment": "Malware payload (AgentTesla)", "value": "e9694e09adb311c0cb64991b19169782", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499217, "uuid": "66c9cddf-68b6-4299-a88c-776e3fb47130", "comment": "Malware payload (AgentTesla)", "value": "9e26aaf10da280b4742f2cde0b06f66ad02b975800088ce1a39507e5be47bdcb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499217, "uuid": "02d6cadf-6b39-4b84-8dba-09ddb96d5bc4", "comment": "Malware payload (AgentTesla)", "value": "69ff6a8bc2d7a84fd6da7c24f76f026bb6eaf7c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499217, "uuid": "8fc16781-a98f-4030-92b3-e1ab8ced7fc1", "comment": "Malware payload (AgentTesla)", "value": "0c95c4d988bd9ee153354c65f10df3486a857660ebae0bf6515f5c577e0493167733407a4450a1162095ed73fe14da23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499217, "uuid": "cfb6ecad-7e78-44f8-aea1-82f21da2d6ea", "value": "T15315F159AABF5B2AC0366BF80630713007FDF95570FBD69A8EC324DB9464F306951A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499217, "uuid": "0ef00998-0aa2-438f-ad83-b0e7f464fa90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499217, "uuid": "c4507424-21c9-4e2d-8114-3ac30cad002b", "value": "12288:dx+OSUAh3NVhW2iNa7xdvo/MdyrhFgtDsuBHsSj5J4+saBGJXm7DycAIElo/WH0+:z1U9BqmycgiH75B4PQ5BuWXRef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691499217, "uuid": "be8574b9-9015-47d0-bc7f-6912b9312ae6", "value": 953856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691499217, "uuid": "3968ed5e-f9cc-4adc-8f27-44ef1dd5af74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499217, "uuid": "143e07c0-dd0b-4945-a757-6ea4f10b6802", "value": "9e26aaf10da280b4742f2cde0b06f66ad02b975800088ce1a39507e5be47bdcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9653369-35ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691499274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499274, "uuid": "c4285a75-4fcc-4cb5-847a-cae828e94006", "comment": "Malware payload (RedLineStealer)", "value": "8ba13e371904e713320ab3c64bf1e9be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499274, "uuid": "69a31f05-f4f3-4259-a024-0aa82246e9f9", "comment": "Malware payload (RedLineStealer)", "value": "9e543438f1fabe7b20d49a82debf12f515b40c247930b8af72fadd097fa27f2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499274, "uuid": "353fb41a-6e3b-4dff-bedb-8e4549aed0d6", "comment": "Malware payload (RedLineStealer)", "value": "bf38a937305ba1d5c546b1c6bc3ca813d97a1764", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499274, "uuid": "f1d7c8bb-d619-41c4-b617-f157e9d6f534", "comment": "Malware payload (RedLineStealer)", "value": "737efd8888b0af103029c6a66b7e09a21e72ccb5839f5e4e69b8a463dc356a808ab8061b09cb4fb7166075107bae25f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499274, "uuid": "081c28a5-4332-41ce-ba38-cbe63f165665", "value": "T114948C322290A874E5274B728E1EC6F4BA6EF5605F557BEF27484A3F09701E1C6B230D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499274, "uuid": "9d18bcc8-8463-4cc0-9e25-b8275f6b5b76", "value": "e690d90f10792337897b6f984bebcd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499274, "uuid": "5f3dd597-613f-4067-8ae9-4b4d486be269", "value": "6144:fKqAGTVwKQJQPwJ8luqN1rH0tZ1UpUxuPlLLa9n28:fK9GBXQJQPwJrq3H0t8wQLL8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691499274, "uuid": "b0c4bb38-fcef-48a0-a2b8-4bb2524bf1ad", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691499274, "uuid": "d28a4acb-8f65-43d4-8f33-aaa57b8d7832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499274, "uuid": "c63d21e0-54f6-4474-8a54-3567ac7b64aa", "value": "9e543438f1fabe7b20d49a82debf12f515b40c247930b8af72fadd097fa27f2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f14149-35e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691497493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497493, "uuid": "9da09b6e-e505-4b84-a143-2ad9842f8993", "comment": "Malware payload (RedLineStealer)", "value": "49932c0dfb5dba746f2d69b4154e419f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497493, "uuid": "940324c0-c77d-487b-9b23-fda8e84b7abf", "comment": "Malware payload (RedLineStealer)", "value": "9ef6028dd63e09d7a1be0e4d115e2636e14051fc92f2d8c58940aad0543d7f03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497493, "uuid": "dc788d6a-34a9-4c8b-bbfb-4c8affceb15c", "comment": "Malware payload (RedLineStealer)", "value": "879835b1d875b0ea8a9b9c17aa604018b5bb93f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497493, "uuid": "d9716dfc-3447-4fd5-b7d2-11d1b96aa59b", "comment": "Malware payload (RedLineStealer)", "value": "94b3586998f13cf13cbf9b3e55543d6977c770f274c557c0d5a7e767523105e10f350539c8c987a0b7a2e12f4c41a8ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497493, "uuid": "76af9b98-0a55-45a7-b129-688f6482cf4f", "value": "T1B7D41242A7DD913BD9B53B702CF712832B353CA15A7493673686188A1C72BC8E931B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497493, "uuid": "c8672a3b-f189-434e-8e92-65427e434553", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497493, "uuid": "0d76b572-ee31-4b57-8b29-49e67ecb4a13", "value": "12288:6Mrjy90M54QZf0UPxwErgkSzZykke1Uy1FoOdKb:tyx5RuSglZMe1j1r8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691497493, "uuid": "ceb62c88-1bbc-4c54-ac8d-63e088a4d21f", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691497493, "uuid": "e8a2150b-76c3-4d5a-bfad-8e1f863111f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497493, "uuid": "b359acfc-f699-4254-a5db-d662b7907961", "value": "9ef6028dd63e09d7a1be0e4d115e2636e14051fc92f2d8c58940aad0543d7f03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554a0926-35e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1691497388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497388, "uuid": "01ce4bfa-3e12-48ec-8563-5289cf0ee803", "comment": "Malware payload (Smoke Loader)", "value": "d540fc0858922ee3826b33eef26a42e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497388, "uuid": "81ae29ae-ecd3-4ea1-85c7-f801ad07dc28", "comment": "Malware payload (Smoke Loader)", "value": "9ef9557d48bb2e2e564481e6ce857f0525de3bd1157534bb8064e2eaa788c5b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497388, "uuid": "c3515d17-665d-4157-ab16-c6ddd93f44ee", "comment": "Malware payload (Smoke Loader)", "value": "4fe41d7744c5c7a378915cc7baa4362f8e09fecf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497388, "uuid": "b39a1b61-f959-4a3f-b542-b08d87c2c91c", "comment": "Malware payload (Smoke Loader)", "value": "3851625a352600efac6059e8b6d26253ed385de87f5d1e63c2f6291acf6031c622036eb6a92a5f075244cd9921a4e00e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497388, "uuid": "5d3d748f-4030-4aff-be05-c78980548167", "value": "T18A03F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497388, "uuid": "52f48eef-7311-4d5a-88fb-72c6e410febd", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691497388, "uuid": "fc680897-5d2f-4859-9d40-2fa4013a83ba", "value": 37940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691497388, "uuid": "fc2d5de1-a883-4d6d-82a1-5afd89140c13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497388, "uuid": "0cc3d8ca-1c0f-4f3b-bdbe-bd9338697e7f", "value": "9ef9557d48bb2e2e564481e6ce857f0525de3bd1157534bb8064e2eaa788c5b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896db757-3635-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691531406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531406, "uuid": "a146e9cb-356c-4c29-b26a-2fecc0587acc", "comment": "Malware payload (Mirai)", "value": "4d0f6f4f50cdc452fae42ae9c6979bd0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531406, "uuid": "02b69b0e-415c-4b86-ae5f-e08eebe5e937", "comment": "Malware payload (Mirai)", "value": "9f4149869d7b253c4483747f9f5b39f28c54fd64fed03278de0df8ad79fd5e2f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531406, "uuid": "a760f028-b6ec-49d6-b896-0d97446a5816", "comment": "Malware payload (Mirai)", "value": "ab5b22ccff9df8776eb01dbea7eed856d596d224", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531406, "uuid": "ff399a83-48b8-46d3-a76f-4707f74a8ed7", "comment": "Malware payload (Mirai)", "value": "e71bb87b9ddc65f05913de4dbec95952c047af746afeb8299531af71a2f457d5f3a6248550f690048adc716a1b389e72", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531406, "uuid": "bacb4020-f51e-41de-b5bc-6bcbb4ed2879", "value": "T17063010AC555F9928752877DD42AD095B21E0CFC8CEF9063A63A02CC57C3949E9FED1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531406, "uuid": "e5b9ae8c-d76c-4270-8a62-df267dd7f749", "value": "1536:iPa2XGxx8nqV0ztpgguy0UdKEmUIAg00LIzt/y3Yny+:SDXGvepmpKqgrztqSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691531406, "uuid": "5b0ae214-3f2d-46ba-a7ec-c85366f2465d", "value": 69316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691531406, "uuid": "db9a0e1a-69ce-4ec8-b85d-a65e331d0e6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531406, "uuid": "9a9fcc33-0f3a-4218-bfea-6cb6523647d0", "value": "Vhoats.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2f4924-35b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1691477378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477378, "uuid": "1416b9fa-44be-48c1-ab7a-8e5eca4e8e2b", "comment": "Malware payload (AsyncRAT)", "value": "12b91ec80591e1316df0740794977b64", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477378, "uuid": "43cd3fcc-6b35-43dc-803d-0f06a2cee9b5", "comment": "Malware payload (AsyncRAT)", "value": "a0116231c4906e164b7398c42afdec8e6d7c23d978e5f77a7aa2af1e24a687ef", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477378, "uuid": "96754d22-5802-46ca-8766-7dbe5028994e", "comment": "Malware payload (AsyncRAT)", "value": "e01a44d655847477b77dee93ec6ebec67d709ed7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477378, "uuid": "23b52e9a-5ed1-4366-ab04-0ab1837aab7a", "comment": "Malware payload (AsyncRAT)", "value": "f9fcaa7673939bd389ba7008d57d10a0ce127b0bdcb25db73f2ee60cfebdd6e4675a73381f2233bbac01b2f8b057f94a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477378, "uuid": "703f1d33-a6de-404d-a4a9-6652c2a18887", "value": "T1A9234C4037E88136F2BD4BB8ADF2E1418676E6676903C65D6CC814EA1F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477378, "uuid": "5c510a5f-9d05-413d-a89c-a2ebf237e3e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477378, "uuid": "7c653291-b5b1-4cb6-9391-e396175052f9", "value": "768:dOEuILWCKi+DiBtelDSN+iV08YbygevoeKZxvEgK/J9lZVc6KN:dOtmBtKDs4zb13ZxnkJ3ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477378, "uuid": "cc90e24d-b1c8-4487-8ae4-49131b361262", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477378, "uuid": "e8fec584-4629-47ab-9e8f-81bedba79720", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477378, "uuid": "1cfe5e9f-d4a2-4b7c-b4d0-2f953586d990", "value": "12b91ec80591e1316df0740794977b64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23ae7b3-363d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691534883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691534883, "uuid": "138f8349-aaba-4b7e-9971-e372cfba74bf", "comment": "Malware payload (Mirai)", "value": "36024437efe8f42fb13d0a937e8466a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691534883, "uuid": "b19dc28a-0879-4c4c-94e2-b57a8c0f91d4", "comment": "Malware payload (Mirai)", "value": "a0221a5a56ae3ea42f9b40cc23d3edc040593ac53d4e571f2aedb155b28022d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691534883, "uuid": "5c8d57c7-ebf8-4407-8a4d-3a544d7be50f", "comment": "Malware payload (Mirai)", "value": "7cda8eee441ba5f223719a5f986211f6c85ab63a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691534883, "uuid": "13914ec7-0e0a-44e9-bedc-4d491a52bc8e", "comment": "Malware payload (Mirai)", "value": "594e6c5d62adc8aca32b915eb315d60f2d798a545103d33008461b744401ed974f68cde10cb75980773c247316fbe718", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691534883, "uuid": "507ad81f-2ebb-4aab-9cf8-e353b9235380", "value": "T19113F1F6E25218B39ABA3D39F4FD865F620116FCF080312962A897B14D97446CDF0B1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691534883, "uuid": "2d931132-370b-4774-a2b1-e9357df1e86e", "value": "768:1SJBhM0LKStwBIrNklOc18U9mBduQcdJpvnr+cx+QPl/nxO3U1:8J7KzBoNm7mbIHfrt+QRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691534883, "uuid": "8daa7473-5a2e-4548-810d-ec1e4b75f275", "value": 43448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691534883, "uuid": "96cd9188-4a40-448c-bbd7-3c400e867378", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691534883, "uuid": "1efc01b9-fe66-4442-8ce0-1353c3b83d4d", "value": "36024437efe8f42fb13d0a937e8466a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9889218-35e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Picsys)", "timestamp": 1691496751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496751, "uuid": "2ebca5eb-8a48-4fee-8f12-26a7535d5752", "comment": "Malware payload (Picsys)", "value": "20812eb1281e499bf9bfc34b26dbcf16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Picsys", "colour": "#71CC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496751, "uuid": "af70480e-21a1-45e0-a083-441e4d1c7297", "comment": "Malware payload (Picsys)", "value": "a0eec8e2089c94aedf1972e7bd6131087a624eff48d25e5cb87966cb431075d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Picsys", "colour": "#71CC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496751, "uuid": "c4108850-cb58-4674-a675-065922c01373", "comment": "Malware payload (Picsys)", "value": "cdcedb9e029044c2c539a4833d704599f2e2e928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Picsys", "colour": "#71CC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496751, "uuid": "18555244-01bb-4f41-8358-5fddb1c5b361", "comment": "Malware payload (Picsys)", "value": "35cdc6a183101189b478017e6c15912c289c6e716da68a627c6fc04fbf99d946578199497c7e48e3d0cd7adfd2e9cdd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Picsys", "colour": "#71CC2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496751, "uuid": "db5ecca7-f346-43b7-be20-cc86e2a3a6d5", "value": "T101730230BDD06F00C5C3DABBDF13A779B40B8AD95A7D1369A611B31639D62A264CB017", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496751, "uuid": "ba7c9e69-886f-4992-a00e-7e295733e780", "value": "359d89624a26d1e756c3e9d6782d6eb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496751, "uuid": "4a753f6c-642e-45b3-ae66-4fb33247963e", "value": "1536:y4QQ6NSyM61l19piO+LV8YEoI/EU9RUe4mW0Dso5dvqhy:y4X6NSyfnpijeYEoIcq4qQo5dvGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691496751, "uuid": "8a18b465-d666-4c38-be8f-79e2d6e8ff96", "value": 75546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691496751, "uuid": "46dcc1ac-92ff-4efe-9600-765d9d3769a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496751, "uuid": "6f7614b0-b1eb-4e32-9cd2-26e7cbf03d27", "value": "a0eec8e2089c94aedf1972e7bd6131087a624eff48d25e5cb87966cb431075d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15640b0-35e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691497972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497972, "uuid": "8d70919f-82a3-4902-96e7-e77c0b6e6bdd", "comment": "Malware payload", "value": "b8af7b2cbdda1d28d1f816698422f740", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497972, "uuid": "43ed04f8-dc8d-48b9-a9c4-7bed7b836720", "comment": "Malware payload", "value": "a10124b645e663c7abd7bcbe8373b8e11c69bb2ab2cf1fad78417a15b7f54dbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497972, "uuid": "e4cd2482-c717-4993-a9e1-f22ecc70dcc3", "comment": "Malware payload", "value": "a0cbdfc6232e666b069db2b4c28579ac7539a231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497972, "uuid": "741463c0-34fd-4212-bade-d91a017a88d3", "comment": "Malware payload", "value": "fb8b7d2441f351e9c9e0f8c30098ca3e4d589e83e3f0ce478b65fd6f79fde6ce33d75458c370aa1ba76c56a6f6271de9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497972, "uuid": "6bf56e3e-3950-4733-afbd-d31557dca101", "value": "T16B34F13628B82F14D4626335B1071F3196F59B1F3B7A129EEBFE47B5B1A4A0119230DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497972, "uuid": "b97ff884-daa9-4ed6-9227-f1328ea4ea1b", "value": "f418afe0379776397753ae40798cc2e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497972, "uuid": "662aca35-5095-457f-a44f-0ccb193ed2a4", "value": "6144:iMooVQnnOBccnskYPmTpUxrr1XRA7WHxWoN+J0EafCUSYibN6WGm:dQnO/s1mTpG5bUo4bafVibvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691497972, "uuid": "17c7b4c0-805c-4fde-89bc-f678ad7afd5f", "value": 252298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691497972, "uuid": "94baa044-10ca-438b-94ba-4752029bf7c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497972, "uuid": "9f17ddcc-7c6e-46f4-8e2f-81bf71c2332c", "value": "a10124b645e663c7abd7bcbe8373b8e11c69bb2ab2cf1fad78417a15b7f54dbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610c304d-35dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Conti)", "timestamp": 1691493113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493113, "uuid": "377365fd-69ee-49cc-91f1-a82fea274b2a", "comment": "Malware payload (Conti)", "value": "18c5aa3538f2b7c268b0b947efeb2776", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493113, "uuid": "ccb48c73-b2fe-4030-8fe7-48452fb8b70a", "comment": "Malware payload (Conti)", "value": "a2581ec030e1fb08e26ddc61b11445286aaf7271932146e7e1442a49fff734de", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493113, "uuid": "46240f60-2848-4014-ac37-0ec15d40b206", "comment": "Malware payload (Conti)", "value": "645158945c3717ef6b1f2a2d276c9a38988f6d32", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493113, "uuid": "a8d89931-351e-4eba-b8e7-00c17ecdef8a", "comment": "Malware payload (Conti)", "value": "b568083c7a7b77da29cbce2ec9d0990d7259e05b591b174fd88083b62443589684785f3094567bce3b86173bfdb13274", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493113, "uuid": "811b928f-2e8c-44d8-bcd4-7c64744eaac4", "value": "T155144A15B64D4674F25A98701AFC6DB354A89A38336FC8F7B3C9867D2A25AC27430F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493113, "uuid": "0949a0b7-c429-459d-b66f-cd56e6ae10d0", "value": "a22b460d14f0476da8c1385a0abf2d2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493113, "uuid": "cdfba339-1668-4245-8ead-4edc7afd248f", "value": "3072:0LJGBP1t82ETTwPAobQ3tOqmb14Gul22QZkN7S44EXZy0Rx6kh5n:qJEPCTwPp03YqyNulak4u6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691493113, "uuid": "08ab3629-4476-4dab-8631-53448246345b", "value": 208568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691493113, "uuid": "25a60bb4-340c-4e5e-86e7-8fe59fde7524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493113, "uuid": "2456fae8-a624-47f0-9a0a-9822e88b011a", "value": "2023-08-07_18c5aa3538f2b7c268b0b947efeb2776_conti", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce4650f-35f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691502823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502823, "uuid": "7c339a1e-8feb-4760-a22f-1348053c464e", "comment": "Malware payload", "value": "fe12c32387c05814d9d52cfce328b870", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502823, "uuid": "46a303ae-6ffb-4597-996b-3ab03849cae3", "comment": "Malware payload", "value": "a2d82d8e06a084178725241a39392002c472d4a8faf2d24205c316fb3347c252", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502823, "uuid": "a134a322-75f1-4456-a12a-3952b793360f", "comment": "Malware payload", "value": "bda53f658c4566eac54a2ea50858b5a8f1693147", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502823, "uuid": "70cbe55c-1e4e-4586-a95f-47e989269794", "comment": "Malware payload", "value": "eec1c9748cfa6c9b8a757cdc0610ea4d9811924911260d7e9768d776637e36c9193d7803eb48f9505659acf76df4c23a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502823, "uuid": "f3f2c73f-cded-4fa1-9aea-fa967f27a515", "value": "T113237690179E9EFAF20A30B844C47D311DE578B9722F95E9CBC79C9F8408EC512A1D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502823, "uuid": "2d0ef5eb-072d-4e41-821f-98e7682bb578", "value": "1c7eefe1b293bb45bda67a61a652b8ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502823, "uuid": "a2b6a5ed-fe35-4f3e-af6f-fa168963295d", "value": "768:snM0mWvw0YHmEjTJkjVTjFm1zR7XKJsVp1TsQAI7+CW5f3QLM/Vd:Gbvy/uqFdXL1oIHY3QLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691502823, "uuid": "e26496f8-9c2d-4c5b-ae66-82614afc2eab", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691502823, "uuid": "494975b9-d508-4ca1-af39-de6afec78654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502823, "uuid": "a5b56ded-634d-42bb-bb48-2afbd94be50d", "value": "SecuriteInfo.com.Win32.MalwareX-gen.19037.2263", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb163b87-35de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1691494150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691494150, "uuid": "09d61430-8628-4e7b-9385-9c8a36effd0e", "comment": "Malware payload (CoinMiner)", "value": "bd5d95592e0c1b65f6c555d22cc793cd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691494150, "uuid": "fa52ae24-8a8e-446e-b500-dcf9cc543121", "comment": "Malware payload (CoinMiner)", "value": "a2df0b37e25765d60698ceee32af870516c28aeadb480752de1eb86fa7d37729", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691494150, "uuid": "4997d38f-6783-48c1-9432-9ea0bf456767", "comment": "Malware payload (CoinMiner)", "value": "eaa85be2a9dcbb9ec013612f9cd7d412a08a83ac", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691494150, "uuid": "51ca07ec-92b3-4f88-b841-a15ca8df1b25", "comment": "Malware payload (CoinMiner)", "value": "08489c8525a843bd3e9e15ef86f6861d1a15944aafb2d5631494c7bfa870f9c3154f9e6278baa670abebb329578b265d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691494150, "uuid": "ebd20a82-2a04-47fa-a453-8d71f2b7b17d", "value": "T1F9B5B60B35DC5C5FCDAE45F48F2795118B55CAFF1282928B290A10E8163F243AED9BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691494150, "uuid": "f01e8cfb-115a-448d-ae4a-7944ab52a6b6", "value": "24576:OSLxbNLZPFOAF7U4N7wuIVzey6mTKxlrlaEnXfwG2Qs/Ezm7eG:OUTFOIoFV6Cm/XfwG29F7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691494150, "uuid": "0ef9ae18-9b9a-42ef-b32d-f149e4991c29", "value": 2478592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691494150, "uuid": "04cf6ada-c6d4-4fb0-8d76-887593ea0974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691494150, "uuid": "aa162e4c-3b8e-446f-b35b-034320d0482a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ae4c11-35e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Bitter)", "timestamp": 1691497171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497171, "uuid": "d561d0bd-d9c8-40fc-9bfc-4771048bb3af", "comment": "Malware payload (Bitter)", "value": "86b57b0ec360f45331fc5e4eb5c99611", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-08", "colour": "#5B0B3B", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497171, "uuid": "7f164d94-7a28-4f73-961a-bb0902a6e5a8", "comment": "Malware payload (Bitter)", "value": "a2e3f464e1c39909f47f0b837b04e1256061f4a9698678e097b4dd09aa4de9c1", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-08", "colour": "#5B0B3B", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497171, "uuid": "0d139a73-1600-4949-a521-e21d9890887a", "comment": "Malware payload (Bitter)", "value": "8d8fd0dd072608167ec777300f6a644c08b6b904", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-08", "colour": "#5B0B3B", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497171, "uuid": "3d02e6ae-9e94-48d6-a4d8-4eb5f7da457c", "comment": "Malware payload (Bitter)", "value": "f7a6dd78d51957eae9a200f550864309a543cd770e6ebb6bf776f04a4eca5f34d7a7b789b6c4d65c13120889dbbf3e66", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-08", "colour": "#5B0B3B", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497171, "uuid": "5c684eec-83e8-442f-9998-e53869960223", "value": "T135324A386B418220E92485363EEE5BC3F537FC80A9C48359113A7B2C6DF7F0D16B1896", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497171, "uuid": "3b5c27d5-1263-4b23-8d42-1cadcd1d4eeb", "value": "96:hnV1ra4uzxuoLllqJhgoKAJGnZaVEZeydYRdi7D:h72Bxx47XGJoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691497171, "uuid": "75dea817-7b1e-4a79-9ee5-e52cdbd8ed33", "value": 11260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691497171, "uuid": "91eafb62-a3ba-48af-af3b-7d57b3b56d5e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497171, "uuid": "46a897c3-cf11-4b39-ba19-2583d3b8515c", "value": "Nepal's Relation with European Countries.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4ae13e-35f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691502336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502336, "uuid": "2bf0a561-81be-41b0-8362-2853557d6a52", "comment": "Malware payload (AgentTesla)", "value": "27082c3c39a5676feb8bd06259a62986", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502336, "uuid": "74f828d2-d644-4452-a475-e8faa92720d7", "comment": "Malware payload (AgentTesla)", "value": "a41a510e1b3347f7d73eef2ba37cc1b2345cb77f8063e5632af9695ead6f36be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502336, "uuid": "f6d66ce3-933f-4f5e-b48a-64395ac3fe50", "comment": "Malware payload (AgentTesla)", "value": "3b71575eb1f20d9891193f22cbc48c0c2ebf3006", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502336, "uuid": "202917cf-042f-4ef1-a44d-7fc89986b7f5", "comment": "Malware payload (AgentTesla)", "value": "a1f9f32b38447870886723e0ad494473a563f86b893b0342b968f633c3978848dfd290264d06fbfd76dd21cff25ad3fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502336, "uuid": "203c2232-6036-4a9b-9b05-ca021bbbe6bf", "value": "T1014413A8B7F4C073F8B34A325D7D5B4B2FB878156178E7072B600A5A7E22842D51F7A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502336, "uuid": "ed9f451b-35f8-4379-a807-4e2211cd29da", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502336, "uuid": "c1c8eac6-defe-4a92-a63c-7ca93570aded", "value": "6144:vYa6nu8pnYbVHcHyhjGW7gyCW6Ao0DyAYXN/OLa/TX:vY9u8pYhHwEjGwgDW+N/ca/TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691502336, "uuid": "bdc0ff60-04a1-4820-86a3-91058f522865", "value": 272577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691502336, "uuid": "62cf7d4b-9414-4418-9afa-f1432a144909", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502336, "uuid": "81bdb492-8fc4-40f0-8f02-d25fac1a0806", "value": "a41a510e1b3347f7d73eef2ba37cc1b2345cb77f8063e5632af9695ead6f36be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884463c4-35ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691500480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500480, "uuid": "da6b7ba9-4c99-4a5a-aa3b-92786601678e", "comment": "Malware payload (AgentTesla)", "value": "e211d10bedb3b88797da5e1b1bc8078a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500480, "uuid": "83a68347-8533-4e55-bac6-e7536167f5c5", "comment": "Malware payload (AgentTesla)", "value": "a496cfdcaa099d866a51c5390bc5a01e628de20791f355f7c716f484ba9b690b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500480, "uuid": "1edf24a1-6ebd-4189-8d6d-ea5487d2ca9b", "comment": "Malware payload (AgentTesla)", "value": "6670f59ac566e8125e2341bd7a46a6bb5cd57aff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500480, "uuid": "1eba997d-3cea-45c6-9284-07000fab8deb", "comment": "Malware payload (AgentTesla)", "value": "1d76f3b7e861e4b076f39b9ca5b16f836745cf02682d03ff332a5130ed6301477061cb91fc363dbdeae3c61c3b6f69bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500480, "uuid": "409c2481-3e41-43f6-b34b-62dd8a601d23", "value": "T1F3253A21E77B655AEF29A6E85E1F847239D5DCC0F1B1C488ABE72C0385C23514E35BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500480, "uuid": "dd0cf823-3fc0-4131-a7f3-0b7a82e240f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500480, "uuid": "58b02e5c-4187-4d65-8df9-b77d5dcb82c1", "value": "24576:01I1R1I1nRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOxOguCU89gVRi/1:0GvGRRs6CE3jLbO9Rs6CE3jLbOPuC/gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500480, "uuid": "141b5def-c348-411c-b4b8-aca103b4ca4e", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500480, "uuid": "44742547-db5d-4883-90e6-dcb9e5dd63c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500480, "uuid": "08699805-081d-4be5-9830-d891eeebe8f3", "value": "new invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32809e77-3593-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691461681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691461681, "uuid": "d6641979-444c-47b1-94e5-9eeb78196223", "comment": "Malware payload", "value": "ddd14210bbb7351205299266eb0f28f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691461681, "uuid": "3dff8f07-9f88-46c7-a4e0-57b1726782c6", "comment": "Malware payload", "value": "a4a5101486223b53c957a30635f1d116b1b9ef051229dd07815ae9321d160098", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691461681, "uuid": "573fac90-7c5f-4f6d-b944-5fe3d341b144", "comment": "Malware payload", "value": "3c029199c8cae8a70a0a9966c81d1193152dc4c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691461681, "uuid": "89e31914-9288-4667-978a-3f900c32cf84", "comment": "Malware payload", "value": "3a54fd460126b60bd788e4523d2fbb7dccd16d20d4c7af42934bfea81a646c97c6dac231da9436ed8ed190bfe7dac26f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691461681, "uuid": "71aff31b-8aa0-4e17-9586-e7a183837f98", "value": "T18763013867230D9DC4363CFAF58ED66729871F29304B001501B9E5BB1FF729CA8E9226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691461681, "uuid": "3776c538-05bd-467a-9dcb-4100da9d319c", "value": "1536:XtBTX941eYF8NblpuvnwanQ3zWYq40LZ51g6b:biMYFJvw6Yh0b1gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691461681, "uuid": "45eeee2f-ecc5-4135-959e-0f8b26d20bd0", "value": 71400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691461681, "uuid": "3436e030-06d3-464e-a2bc-0e6c20392f79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691461681, "uuid": "57c24009-d468-428b-af3d-7af082eace93", "value": "SecuriteInfo.com.Linux.Packed.1255.18896.7745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3faf4ce3-35ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PureCrypter)", "timestamp": 1691499929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499929, "uuid": "eb2ab639-e942-48fd-9f53-13289c58fd5f", "comment": "Malware payload (PureCrypter)", "value": "b5b634079d39106b62b5407c8f983c6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499929, "uuid": "0d8168ca-b9c3-49ea-a9e7-013c2520380f", "comment": "Malware payload (PureCrypter)", "value": "a5116026e4465a9ad21179b190ca84fcc679076206e04b99e00e95a97b085cc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499929, "uuid": "afee63bb-1a90-43e1-86b1-9bcbee877c0b", "comment": "Malware payload (PureCrypter)", "value": "afe25deb48d274996ae2a17f0be6ad04be3d7a78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499929, "uuid": "342a092b-1fb5-4609-879d-efd04d54c214", "comment": "Malware payload (PureCrypter)", "value": "6b5ada8a46024b6c91b0fa1c0e3f3e9672b37b6d9dc320a1935f63bd64575e2687cf8e6be103ef8eac5256259d1ee8cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499929, "uuid": "2cfa9043-0dce-4bd0-8618-361baf3d35b0", "value": "T17BF22B50EBA88636E8AD177154725B1007F7FECA7821E79A4C45B4D72E333833852E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499929, "uuid": "e46b7b6c-38a0-4a0a-a08a-fd090a343f90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499929, "uuid": "e2703703-8a4f-44ec-bfac-55457ea2ca7a", "value": "384:27QNNJsWxuIKKeWew5KUVL9KPeXGhq/gMlML5RUt6v1+YGQeqx7jOw6RBEaRvtzy:27QNNqWHKSP5KgNWhK81RG3FBEafzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691499929, "uuid": "c2521183-fa50-4990-a0f5-0d4370fa85ff", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691499929, "uuid": "95d1c6e4-62e6-4bdd-8622-dffe4784ba6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499929, "uuid": "8143d598-7fa8-4d5d-a77f-bcc40b3c77df", "value": "a5116026e4465a9ad21179b190ca84fcc679076206e04b99e00e95a97b085cc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c505b422-3623-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691523775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523775, "uuid": "15881220-fec7-4ed2-80e7-6efeb64b9233", "comment": "Malware payload (Mirai)", "value": "056d7ee86340a93f1fdabebbd429cf1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523775, "uuid": "03fefe4c-cc35-4677-a015-b16a7941dbfc", "comment": "Malware payload (Mirai)", "value": "a52d7923effd732db709def40287193b5650351aa567c0c30c27847a9e04f4be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523775, "uuid": "9c9671b8-8834-4b4e-ba3c-1b6d8a5bec43", "comment": "Malware payload (Mirai)", "value": "d13505ace07101546040db8be04775c33aec4620", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523775, "uuid": "8019494b-b243-41d2-a981-3c4a8b0a805a", "comment": "Malware payload (Mirai)", "value": "ae69604df94f848c80ddb81199572ede13a0ffd09e9d9d2b3d10983319efcfbac37406cb1a3bea52447dd23ae367077b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523775, "uuid": "187da385-eb89-4949-a6df-9bdd7e9d7077", "value": "T176B2D036028E6AA2CD508570FEE5C608335306B9D17F71463B820BB9D7D1299E3795AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523775, "uuid": "085684ff-c52c-4d42-a266-c507d98f549a", "value": "384:5sdWyZ1lp0E/Z6uy1AEZZBTCU9HT5SExCDtEFL88lKOsl0SEcSqhymdGUop5htg:5sdWCp0E/oZ1zZBT31TYsCcL8zXR9hse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691523775, "uuid": "af79a257-c114-4143-92b5-97455806c504", "value": 24516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691523775, "uuid": "418e3717-bc9f-4928-a0fc-7c51c0c5dd30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523775, "uuid": "6eda5dcf-83aa-4c48-8bf1-cd9cb3460deb", "value": "056d7ee86340a93f1fdabebbd429cf1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aead727-3638-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691532643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532643, "uuid": "18a70092-3fba-4998-aee6-c486e5171e2f", "comment": "Malware payload", "value": "cf9f190e2b2a5bc9ecbcc2ea936a7d2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532643, "uuid": "18289dee-11dc-482b-a239-a6dd64e48860", "comment": "Malware payload", "value": "a540f9417751bf4d120f8c586b55961dd659ecab3045ac112c0057287d4816a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532643, "uuid": "463d3810-b829-4988-99e4-5b3027cce701", "comment": "Malware payload", "value": "1378a9c3c09b5f849d9d530c56418e2e84dbede3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532643, "uuid": "14afde4a-1699-4519-b5b0-9eacca03e70a", "comment": "Malware payload", "value": "2671c4ad1b2c379cd49b0af603e9fb95cced67dba7b57cd9223c5a97654d78a33bca9f367f367879d76ec998e5ee5d45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532643, "uuid": "ec0a460e-9f88-47f8-9b59-b49364529fda", "value": "T16E35F1083154C649C1BA65B6DD84A5F80FB76D25E932E20F9AED3D2F37736128D00FA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532643, "uuid": "3e8cf7fe-2970-4c70-a9ca-837dde3367e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532643, "uuid": "2f372e5d-0874-4ccd-b524-fe1dc8a1bdcb", "value": "24576:l/+ik1YB0aWDwXwwcQpCpwltUBsvtgzZ1:l/+ikqBxatv/gYgmt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691532643, "uuid": "f0cd96e8-8a55-44ff-be29-21d2f92f722c", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691532643, "uuid": "6557163b-25fb-424f-83cf-3ca560e9a875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532643, "uuid": "32c08527-5789-43df-8ce6-4002ca8b6dda", "value": "Indk\u00f8bsordre 672363#pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31982a89-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691478860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478860, "uuid": "f473425c-d447-4f1c-b5e5-ebb66bd175b7", "comment": "Malware payload (Loki)", "value": "44306c039d9c7ae4e1ffc6f3241331f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478860, "uuid": "cea8f157-a671-4478-9dcd-cdd9327363b2", "comment": "Malware payload (Loki)", "value": "a57c6fff4fb8840ffb5a1968aed725b5c5e4c6b5cd6184b681d6820f1f830fad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478860, "uuid": "e86e1b77-2647-4d27-bb11-9f74d713e955", "comment": "Malware payload (Loki)", "value": "eaf71996813d33be1412129f220f4df01720e62c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478860, "uuid": "e37e0caf-1640-48f2-8193-57bfe60a9de9", "comment": "Malware payload (Loki)", "value": "99da73b14764d2657d8a652c72ffaad1025d1e776f0befa13bd0247d379198a0335838f1f605ec2cc6b7f2b56bf94852", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478860, "uuid": "923159d2-de02-4bcc-a521-f4133db74e54", "value": "T11324C02179D1C0B2D16B41305934CAB06A3FB4766BB7C987F758172D1E332D2AAEA306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478860, "uuid": "963dea35-83c9-4f5e-8f12-781dfc470b37", "value": "2de346935dc4b8f552af9d851541677a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478860, "uuid": "641b8ca3-e150-4ea4-b422-74728a5781c0", "value": "3072:uEc9uZbHLv2xqGGlVJnWofcuw0mFCHPzCDlvxHJBROWGq53PpS:V8u1HLv2xqHl3QuwisxHf1Fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478860, "uuid": "fdfd364c-bec3-40b6-b6d1-91bd115128d3", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478860, "uuid": "60f147bd-b0e9-4b12-aed7-2da565b72f18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478860, "uuid": "ab4d0c7d-7c17-494f-a2f8-93e7445a1fe6", "value": "44306c039d9c7ae4e1ffc6f3241331f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcc7f1b-35c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691481917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691481917, "uuid": "bb7d6929-aaf7-49eb-a75d-93b008edc000", "comment": "Malware payload (RedLineStealer)", "value": "5aabceb5e22bcf0c55065b23689d59cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691481917, "uuid": "c5832162-b78a-48d7-9e5a-79217ca96f86", "comment": "Malware payload (RedLineStealer)", "value": "a58085c322c3b652925c69fcb94127e0aa222b44e2938132ee81f4474b0d97d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691481917, "uuid": "51af80c5-be65-4694-b068-60b80ad2be30", "comment": "Malware payload (RedLineStealer)", "value": "3ef78ef9208937eaa88658ef6299026948057eda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691481917, "uuid": "3be2d478-8621-40a1-a915-9a3539a629ca", "comment": "Malware payload (RedLineStealer)", "value": "7523a04a826be394c00110e02f30b654af9bef529e0457072806d42667cd939ccf2b008cee3a8ce5299f52180509c8d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691481917, "uuid": "49087e0b-f354-4d48-b96b-fbd51ca09ef3", "value": "T1D684AF13E6EC6B72E5E24A324E2DF6E4661EFC918F1936DB124C7E2F09711A1C176702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691481917, "uuid": "1f2a8f1d-a988-4f7c-8749-c1f14e487e11", "value": "7574067d27f1e097e97a79381564790b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691481917, "uuid": "14dafe15-693a-4c24-b27b-af3b81ed3fec", "value": "6144:pbF7DK61HJ5COEQ9VA7tvBgXjkUi5bmGboN9f:p5/K61pjz9VAhvGXmmGK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691481917, "uuid": "420adfbe-f147-4148-a566-af0206672aa7", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691481917, "uuid": "147bd5d1-dfaf-4bea-8f34-e576aaaa1ffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691481917, "uuid": "7da391bb-7799-4e1c-ad5d-4c81ed6da9da", "value": "5aabceb5e22bcf0c55065b23689d59cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be63bb30-35ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691500141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500141, "uuid": "5d000f70-7d23-4c1a-8299-4289d2455344", "comment": "Malware payload (AgentTesla)", "value": "6eb08d938ccd6583bfc6e1e600bf8f67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500141, "uuid": "4eeeaa81-da9d-4db7-8387-c29926bbe214", "comment": "Malware payload (AgentTesla)", "value": "a592b7b1a314858abe413bba6793325bfabc81c996dea6965b37aa4fe23fdc5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500141, "uuid": "d0904185-9ee7-4403-944e-d1f6b14374a8", "comment": "Malware payload (AgentTesla)", "value": "df132dbf114cc8d98620477a12ad504149efd81a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500141, "uuid": "80519b07-d4cd-4e44-af73-69d8cb33ea53", "comment": "Malware payload (AgentTesla)", "value": "2d62ff1c6c6f7d464525f5f30806bacfa386bded3c9dc5fb327252caaeafa4957e841788c6e240fdb9c737d38761b84b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500141, "uuid": "c11d6153-1166-469f-ae65-b0e3b3cfef40", "value": "T16605F182B032DE31E6D6327F416391286B11D3A466D3F5C203D146CE9CAA767953AFE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500141, "uuid": "c424a211-3304-4f16-ac23-1307c9a22dec", "value": "12288:LE8dteg0lNxkyFUl3dABMWJLhJab7hmC7ckYAiYiwns4/P7tkgsL:LE8dte/h5uABakCVYAiY7DJHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500141, "uuid": "f5dfa0fa-cb43-417d-a004-641a0297db9d", "value": 800840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500141, "uuid": "3216c705-dd77-4657-acd4-2074b46e0efb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500141, "uuid": "adb0b531-b314-47fc-b853-4351a3f2db52", "value": "a592b7b1a314858abe413bba6793325bfabc81c996dea6965b37aa4fe23fdc5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201621e8-3606-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691511043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511043, "uuid": "2a0c2ede-7725-4e34-bd0b-51c3807febf7", "comment": "Malware payload", "value": "dd1d2cd71e23b302a7265ff9bd1fd755", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511043, "uuid": "98ac0b47-bd5e-4307-8109-df69a6360966", "comment": "Malware payload", "value": "a7150e93b46b98c9ef846e044b01b46b56d13852ccf425a76917e33f542eaf4f", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511043, "uuid": "c108a107-afb2-4cc8-bd27-3c862759b1b6", "comment": "Malware payload", "value": "095b22d5af1a4a1ad5dfad0a0e4fb4758b2da604", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511043, "uuid": "31efe702-2512-481e-a11b-cfe7dadb5a2f", "comment": "Malware payload", "value": "fa8e62083dee445c17f95041a1ad8e344b98200d517de40da2462f10fdf1d07381fe92d0c09a083018a84ac78a828fd3", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511043, "uuid": "49039d4c-5496-4809-ba03-c136142f6177", "value": "T12C328E2DFDB485BEC34F52F56060B095D7A875EBE628820FD974AB50C0BE38E8721716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511043, "uuid": "75733114-a68b-4bb0-bc18-b9261c29dd5a", "value": "192:Pya0NsjXh7W74N5eNA2A+EnVs+mg1SoBNJY5O36PvaK0hgY9mcWevkyd7itHSS:PyXsjXh7W7u5+A2bkBdBNJY5OqPGhd9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691511043, "uuid": "9de593ae-b5b2-4e70-bdd8-5c545d0e564a", "value": 11493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691511043, "uuid": "da154a86-a7b5-4ac4-8473-3c3bde9ec8bc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511043, "uuid": "9e70fb0c-0e80-4f53-a058-3fba35c20ba9", "value": "33885.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5981b11-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691479135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479135, "uuid": "70435aab-04fc-4050-bab4-3beec55e4a74", "comment": "Malware payload", "value": "32ee6d99af70df54347b78903fb086a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479135, "uuid": "de5d11c3-d046-4c51-a44c-f681d0f31d87", "comment": "Malware payload", "value": "a76a4270910078824ecc3e2bb465a321dec375de50093338fb3d425b16603235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479135, "uuid": "44f9d3a7-d624-4ab5-ab1a-ee14ce457e03", "comment": "Malware payload", "value": "de76cc01052884bc892999cfa302b282c4a74f62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479135, "uuid": "ffa95103-acbf-4755-93b4-4028b18a6871", "comment": "Malware payload", "value": "dcf3bab3d314ae41568675cb744b6f2d187fc891e1c86cafeea1e8f46e7394032d90c64d1ab3db17b1a1e4091afd145f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479135, "uuid": "8cbd0788-aa4c-453d-9fa9-32fce52e5edb", "value": "T1B5E41267ABD84533E8752B705CF602D31B353CB19AB5836F2796981F0CB26D0A57232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479135, "uuid": "5b0f9894-31e5-4571-a254-57d8fd3475b1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479135, "uuid": "f5dcf379-74dd-4acc-b039-91ec6944f675", "value": "12288:VMray905S7ZdCKZPSjlx8g3RcSKX/ER+/HiLd0N4PzlMTsAvTiBh:ny6S7vBZPmx8ghc3//ady4PLgOBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691479135, "uuid": "11d7d191-8ee0-4027-a526-946255bcd250", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691479135, "uuid": "0e4c21d1-d929-4f33-a817-80a9efb9be81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479135, "uuid": "52ae01c5-b1a9-4e19-a329-7ae2f2be5569", "value": "32ee6d99af70df54347b78903fb086a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd9ef97-35d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691489722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489722, "uuid": "716212b0-5bbf-4c36-8066-367e0b13cdb6", "comment": "Malware payload (RedLineStealer)", "value": "c30feb6c9c747d590d77ccfa1e15d719", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489722, "uuid": "b414cc8d-baac-4ecb-b8e9-a8bc36830874", "comment": "Malware payload (RedLineStealer)", "value": "a85e18b20a3a73f084789d9d4b4a8d140e7d4c85b60b0741b585510cfec89df4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489722, "uuid": "6d8b045d-0e37-4e26-b44c-d15e1f916bc4", "comment": "Malware payload (RedLineStealer)", "value": "a25c36f12ecfa778f0d93ee625dc9bf7b341078a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489722, "uuid": "32bf2b2d-100b-405f-812d-4c29fd67af69", "comment": "Malware payload (RedLineStealer)", "value": "aa47a8ab606fbefd7a89dc177d5e6a5b3cff1ac9f30ec354cd4cbbf9951b70ba80faf3b9adae00f67b8717b94bc3398d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489722, "uuid": "b047aefb-e76d-4d68-bff4-94931d4ff88f", "value": "T16484AE12A69C6B71E5E28A324E3DF6B5A71EFC918F1937DB124C7A2F08711E1C176702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489722, "uuid": "dc0690fe-1f83-449a-b9ee-d5bc8df03768", "value": "46c207d29e8eaa8317918259507bb42f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489722, "uuid": "38a4e6a4-e3e3-472f-b78c-6e1bd8e04aac", "value": "6144:d4qo+62RpmrofFTIEuz30y8tt7ma+TkocdI7dc1r:dZJ62Rm2TIEU3W7maKkocWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489722, "uuid": "0f882f1c-2610-4fef-b93b-d9966c146a01", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489722, "uuid": "e6b7b926-8e67-4af0-bf2a-099f02a3a00d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489722, "uuid": "365936ae-f48e-4684-af93-586373764e9c", "value": "c30feb6c9c747d590d77ccfa1e15d719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d177e89e-362b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1691527232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691527232, "uuid": "3379d1b0-4bf4-4b52-a1dc-9a8018ee84ad", "comment": "Malware payload (IcedID)", "value": "2ae0dfd2fa525bafdab68fe3dddaa3f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691527232, "uuid": "8308d6b2-c839-4cd3-bbfa-e72c362e431e", "comment": "Malware payload (IcedID)", "value": "aa12b98218cea9439c2933c78d3d6ee17ed28de11ccd439e9093a3263ad0b25d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691527232, "uuid": "cd2f9fe3-5567-4844-8126-d5d4d2285881", "comment": "Malware payload (IcedID)", "value": "ce43a369ca7d5ced4a5cf13cf492d0f9739bfcd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691527232, "uuid": "68e7bd22-660d-4139-a6ff-06c61b920d25", "comment": "Malware payload (IcedID)", "value": "63828044ff6322aaf6c1d0425fb555e51a697be84e18c04547841c194d5461dd78c3829ca092d643693c0d75914fd15e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691527232, "uuid": "635f3b06-f819-4f58-a1cb-d3d2223039d2", "value": "T1FAA4E047D6920FFBD562D47FD4815417DB22BC43BF128BAA264CC1523EA39904FA6B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691527232, "uuid": "042a902d-ec32-4f90-8fb9-25132464310a", "value": "c90c1d9ea33b38d68a9f1fc5584c8fe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691527232, "uuid": "423488d6-ca59-4c3d-9aa8-619c819a9dc9", "value": "6144:OF8fQgr9ElYIn8MQpcYMZOFSlAcUwcNQNBZId6Ti6N05/bClsINtFBkoS5:OEhwYI8M6xl5cTc+dId+A/b8sINtFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691527232, "uuid": "8093fcc4-0d0f-43d4-a2b3-300fec6cbd22", "value": 484384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691527232, "uuid": "28183923-6649-4c15-a22b-8f0997e9ac7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691527232, "uuid": "a908e240-6065-4dc8-ba41-d2aa83e8348c", "value": "2ae0dfd2fa525bafdab68fe3dddaa3f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89aa9742-3635-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691531406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531406, "uuid": "2c8086a7-4018-46fb-b19c-bda9b089064b", "comment": "Malware payload (Mirai)", "value": "2d51f940c9d63bdaa99131b9c7e9a0f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531406, "uuid": "cbcd8a66-821e-4382-9a43-58f301c4ee7d", "comment": "Malware payload (Mirai)", "value": "aa2a2c6a64e09640f4154bd3822505e722df32269ce93a5acbd899eb04da0b1a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531406, "uuid": "f9463cce-aa92-49e1-a7ff-11fe592e96e8", "comment": "Malware payload (Mirai)", "value": "78eb64c2a3277ebf5c8f4e9251a38538c5a1f2ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531406, "uuid": "f20900c1-eaea-40eb-bf41-7150d534b74a", "comment": "Malware payload (Mirai)", "value": "e2cdf1c0994c9afdfd8ec51dbd7110887c50c9be58d00d453ebc147a4ae9160cf794a897d0192db9c0312aaeee346e58", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531406, "uuid": "8846011c-dc65-48bc-a131-7768b1c36a54", "value": "T1ADC2E15360F9CA03C8B3837B5A3D4AA622609435634DDE2D776A9FC873420D0657ACCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531406, "uuid": "45a85e04-7085-4736-abbd-9a86568eec47", "value": "384:Ms59WXUx5+bkbRaliVErjrL9VD9jPwrSaf5QwDNN5DyBTwfflrTHOBFR0j/y5ZC5:t5+Kcrb9VDJeU8ETgdTHOBcK5ZCAyXJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691531406, "uuid": "7ae3f6ea-e5be-4075-933a-de1afe46a48f", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691531406, "uuid": "793369e9-4bd0-4746-a227-f6fca20a0ff7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531406, "uuid": "4d44e951-543f-4b55-9e4e-e45975614405", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e099fb9-3603-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691509804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509804, "uuid": "1409432e-2349-41f1-ac01-f42aa04cc7b7", "comment": "Malware payload (Mirai)", "value": "912b95a0861d132229190de6236227c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509804, "uuid": "1e3f38b3-b7e0-4003-9616-1c1ad858523f", "comment": "Malware payload (Mirai)", "value": "aa46ffabd5834ff8fec3f0495abae24cc6503602474c974fa6c09e228d6f2789", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509804, "uuid": "1e450aba-ce84-4ed2-90ea-641969a462ed", "comment": "Malware payload (Mirai)", "value": "94c8b8278bf8c4cfd4d7987b9ca9b37b3abbbf7d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509804, "uuid": "f8e0299b-21cf-412c-8364-b5377c938288", "comment": "Malware payload (Mirai)", "value": "eefc8a74868b55c8ae42cadcae181f6e0d8a2fa618aa23eb540a84a6ec8d4275d5d7e1c2d35f5b0de5a019eb493b5003", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509804, "uuid": "8cd3a5e4-3d98-49d7-95c3-5f1601a67d25", "value": "T10D13F1B37254DB4DC0E211BE289FB58A1061E31FE7A4AA219FE9B139DC41E75362C731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509804, "uuid": "ddbc7f7c-cbc9-4c0b-b613-d33dbf568e30", "value": "768:IzhlEnnyINwB1e277wB35ZN/z44Ak1OpKmlnbcuyD7UiyqRi:ElEnQBXUB7Ak1OpKmlnouy8Zqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691509804, "uuid": "04bccfff-1ff7-47c1-bfc7-1ca5ca344ab5", "value": 43608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691509804, "uuid": "8532a623-217f-4027-85b8-262c1e20b7dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509804, "uuid": "91b5afe9-7f30-4358-b624-60e1aafdf17c", "value": "VRx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7883f5ac-3637-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691532236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532236, "uuid": "5357a7ed-4361-4793-9f0a-662f7fba7058", "comment": "Malware payload (Mirai)", "value": "e544641a952cfabd742ace5893cfac43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532236, "uuid": "37de4c65-7f7d-439f-a056-8b2ce2092863", "comment": "Malware payload (Mirai)", "value": "aa616c5bebcb80ab372bfc2e43ac352823bc52cbad725c6b9ff74753e8874312", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532236, "uuid": "520222cf-4e66-4fde-80a6-91e999465f1f", "comment": "Malware payload (Mirai)", "value": "6718c10c33d7ccdabf5b5932f61cd70461eb272a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532236, "uuid": "ce01fd5b-2354-4e3b-98c0-a0d4d186463d", "comment": "Malware payload (Mirai)", "value": "5af9facab59b7f39bed887de35523aa560b5b5bc904dc84539e10d73e385b07adb861f5b8e9f2ec922be9fad023cad2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532236, "uuid": "40b20768-5822-486f-ba90-a0eb79acf021", "value": "T1AEE2F1116916C4BAEB308471E0F6858377691BBC7AFFB1A245A3020DDD8294293F1BDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532236, "uuid": "e2ee4fe7-f0c9-4b6a-8a21-95ffd33b9393", "value": "768:wEKkUgXAnURCr6HmDFStmYtcM9q3UELdG:IkEn7uHEem3VLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691532236, "uuid": "e8ec9328-3185-4320-a2ef-c0585c07520d", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691532236, "uuid": "9b3d13d8-4e0e-4468-b6a3-77d5036d60f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532236, "uuid": "49e065a0-2881-4549-b252-ede110fcf1c7", "value": "e544641a952cfabd742ace5893cfac43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b28e0e-3607-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691511701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511701, "uuid": "dc76576a-a5d3-4d20-a54b-638967f9a72c", "comment": "Malware payload", "value": "f236d9ba88fbff875165e3b92249b098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511701, "uuid": "0f34732c-85ac-4e16-8bf3-93b07bb6798a", "comment": "Malware payload", "value": "aad7a088f309c1e0671f327db2428a470c14d08d5f6489fcb628071d2361b6a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511701, "uuid": "fd4e6c66-9cea-43f9-911f-3b3c295ed6bc", "comment": "Malware payload", "value": "9cf06b0efbc6264e419a5ba9ec36a1a7b51c5abf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511701, "uuid": "716601c4-223f-4272-8c03-b387afe9c653", "comment": "Malware payload", "value": "2769fe375148521b78ee8c66fe398dd023c502d86d71850ef3fb98b5a110d5a9f4fc6ccce379ebdb235464ea92061f3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511701, "uuid": "9e0baca9-e73b-4868-aa75-ef7552ccf348", "value": "T18A66123FF268A53EC4AA1B32457387209A7BBA51B41A8C1E03FC354DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511701, "uuid": "5dbf70f9-0463-4afb-856e-e2559785d816", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511701, "uuid": "ec18c72d-4085-4b6f-8bdb-66b8905566e2", "value": "196608:dFKej8dnCn8DQCnOHCF2JReWoPFOXKej8dnCnUt5o9r:fKecCnDaOTJoHFMKecCnco9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691511701, "uuid": "8f5c7f06-a493-472b-9477-0955e7a38d91", "value": 6914982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691511701, "uuid": "8edcbcaa-2d66-45cd-ba07-a86107b995ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511701, "uuid": "0147d500-8c53-4d59-90fd-0ef35e81e195", "value": "Windows 10 Pro Anniversary Update PT-BR 3265 Bits.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b840027f-35ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1691473502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473502, "uuid": "710be4b4-5c89-4252-8c64-07384f26326b", "comment": "Malware payload (Fabookie)", "value": "0489d588cfe0df896215ab7b5520895c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473502, "uuid": "de070e75-67b9-42ea-b98e-8c5e3aa2db33", "comment": "Malware payload (Fabookie)", "value": "ab52c1b084899f26f4589de51763cae42cfa3b0ef49ed199f75c47dbfd704a15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473502, "uuid": "fea0f4b9-2af0-4210-9c4e-c67d29a43a33", "comment": "Malware payload (Fabookie)", "value": "d2352939b2ce02009a9aff19450673ad0b42f8e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473502, "uuid": "929c71ec-6222-4f95-bb72-c5d8aca398e1", "comment": "Malware payload (Fabookie)", "value": "1bdcc79c7dc5c9979b9df2bf7273fdfbd8dbd1bd2adbca44b78154b940d81496853f3c12ab21c5c0d6dc16baa9b38d0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473502, "uuid": "34187978-aed3-4415-899f-036040ccccfa", "value": "T1BD949ED2E34040E5D577C2B982734B62E7F27C285B214ADF4659B6392F337D28936A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473502, "uuid": "54f1150b-6e4a-4a20-a5c7-28a3c2db4bf0", "value": "d1884757532ce7b0014241f40262c929", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473502, "uuid": "aee0a0a3-107e-4b61-9083-d76741e07801", "value": "6144:ul073J3gpJ1K4t1O9rdDWC4t0+eoJAbB3T+cbJp:z3Jwp/KMqJs0+5cCIJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691473502, "uuid": "f2aedadd-d83f-4ff8-877c-df0d3282b657", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691473502, "uuid": "093b9470-c035-4c08-95fe-4d144269e885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473502, "uuid": "dade0122-d8b5-4186-bd31-d8cce6149316", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279fd35a-35f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1691504183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691504183, "uuid": "53f6e1fe-6ea1-4e43-8019-700733cdba98", "comment": "Malware payload (STRRAT)", "value": "274b5bd1ac0b6b0b9b55922244a1585d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691504183, "uuid": "5a03ecb0-d617-4bf6-8d37-45d294c35551", "comment": "Malware payload (STRRAT)", "value": "ab8eaddc3fb1fcb67eeac0a3fbd2ef010a92ecf3db64007b3c5f4c5e50d40e84", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691504183, "uuid": "f6b7163a-2788-4739-8e50-6463794012ee", "comment": "Malware payload (STRRAT)", "value": "2553294c4ae88968d8013ed54adaa91ebbf412ba", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691504183, "uuid": "face2904-f204-487f-a9db-eafff1550058", "comment": "Malware payload (STRRAT)", "value": "c3929f9e3b446db8e853a6ea86cbce676af7c747d46ed5e84085963f47d232e064ca1b26a2f1f1c09c443bad316fe448", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691504183, "uuid": "083b3fc4-b9c4-4429-9f3c-98fca2a87e5e", "value": "T1DCA4120E3D79D564F0D3563A48819E76F75EC8C4C409143F26F8249ECEA2CA8656AFCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691504183, "uuid": "6613eb56-94f9-4a29-b287-a809266e694a", "value": "12288:aP0oUXRtKv3CeK9LYDpdY5hlezSeogQW16riURU8cHve:5TKvSLf5hozVoXrXKJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691504183, "uuid": "13aac95a-6ad1-4a28-9e6d-99e8c1dc4a4a", "value": 457139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691504183, "uuid": "1704d238-331b-470b-a779-bdacef0c60f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691504183, "uuid": "2b85f565-ed12-4020-bd30-55ff3173ca97", "value": "beneficiary advice7876687 from Wells Fargo.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a00879b-35f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691502604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502604, "uuid": "f9dc6cc8-bed0-49b7-9fed-e79674f6a5f8", "comment": "Malware payload (Mirai)", "value": "b0a7ce4e15592007bc7500d52bab7f38", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502604, "uuid": "9dc1708d-29ad-4219-aefc-9a10d2becd7a", "comment": "Malware payload (Mirai)", "value": "ac51654a61367255702cc94f32dd50ee8fb4c416e175baa3d8e190aade72eff0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502604, "uuid": "d1674f5e-bd7e-4ace-b395-f5efb01f3ca9", "comment": "Malware payload (Mirai)", "value": "27423bfedcd7881f951431530079e7f7ff2e5b86", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502604, "uuid": "5c2b937d-0946-452e-afa2-c6ba266d9bfb", "comment": "Malware payload (Mirai)", "value": "928879412fe2eb48730475606ea88964ba191136c83d2c4af8b9b406d381a70bffc26d725aecc85baad5d95f07f0a7dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502604, "uuid": "ea2f530b-1a1c-4091-9a79-4dce4e45f778", "value": "T18F2302646100BA75DF10307ACAD81FD7F75CBA3C5BEA92A526444F5D8E2044327BDB63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502604, "uuid": "be92772b-8dd5-4200-9bbf-c7754069511d", "value": "768:FxKBxIGailuG3fjBzF2+/kzEB1/RhxADPiTQxjW45Ln9q3UELYUXfi6nXxEq48xu:FxsKGQG3fjBzgohui/45L2LEMOq48xan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691502604, "uuid": "c080444f-4049-43ba-9cb8-df37b1f5c541", "value": 46620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691502604, "uuid": "29394466-1bcf-4208-88a0-c8808cbc8815", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502604, "uuid": "0f2b1321-e6c3-45a4-9e5f-d5cbb3127369", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3c9db4-3623-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691523495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523495, "uuid": "264f8d68-20a1-4820-aaf8-eecfec599e92", "comment": "Malware payload (Mirai)", "value": "d9c82be8a67dee54516ffb104755a723", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523495, "uuid": "3ad4319c-caa0-43c0-ae9e-79fab44ac876", "comment": "Malware payload (Mirai)", "value": "ac549455708747ac04d834bca9a486fb6c278bb26d4b0fa5707668df91a4b84e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523495, "uuid": "8ea4285b-2b7b-4875-bcb3-681ba9478a37", "comment": "Malware payload (Mirai)", "value": "ca7f4f5169c77cb9e3f347cc5dbcde901dd647b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523495, "uuid": "2bfdb417-5065-48e2-a9fe-7efa245b597a", "comment": "Malware payload (Mirai)", "value": "5663c25f902eb7615c35ec079750753a567f07c9297dfdc44d24e330bb067a943d7ca88ff3ee6c039f748aa29a821d7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523495, "uuid": "67555fa0-9688-4611-8dfa-49a61381e62d", "value": "T18D539FA5C5ACAD58CB1445B8B614CD388723F408A5E72EFBD646C796800BEECF1587F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523495, "uuid": "0d9b8f2f-07d6-4196-8c1c-a669b5eb90c2", "value": "1536:XaoJRnrB/mUU5XtiYmG6u1KUDYofs3Qb9jQrNUxb9CH:XHJRrBeUUfw9MXBf+QJjWNUxb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691523495, "uuid": "461c0ffb-eb4d-4576-a702-228271be79c9", "value": 63768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691523495, "uuid": "2de27468-0b13-4023-8567-b66cbde24e17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523495, "uuid": "e4ffd144-b1d9-4f05-a3d8-a04c5ee11024", "value": "d9c82be8a67dee54516ffb104755a723", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937bd3de-35f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691501787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501787, "uuid": "cc6232d2-5e36-4961-8415-cc38f9602a86", "comment": "Malware payload (Formbook)", "value": "90d13a35138fd4954554855ac8a3c350", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501787, "uuid": "e059470d-1ed8-4102-bf7d-5d6b523fd77e", "comment": "Malware payload (Formbook)", "value": "ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501787, "uuid": "5726b74a-af2c-4c0b-8845-3cb9483564a5", "comment": "Malware payload (Formbook)", "value": "6fc1d502029e8fe0d6c49b257c1e640bc16eecd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501787, "uuid": "a46f9863-356b-4444-ad51-4876c73e124b", "comment": "Malware payload (Formbook)", "value": "41d87bd3526e55a77d1d91d566f36125b8f8675d2d3f27930eea06600711fe0dd61ceaa3f6025052a2e4179139391a20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501787, "uuid": "529b8f41-483c-4e0e-a2bc-e37278d9e2a1", "value": "T19BF4020466E84F52E8BB5BF46520023043F36AD73D76E3464DC2B1CB99B6B814A18F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501787, "uuid": "c2c23850-c554-46f0-8aaa-aa7b5ed07695", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501787, "uuid": "51dcc755-b86e-4eca-9991-d268f5e0afa7", "value": "12288:b7UZnP7JZP0+oKbAGxmFlccmFepgu6DLxtOXzd04+uB4Hkrplgen2mUpEE:sZP06Xx1puqLxtaB/lD2mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691501787, "uuid": "878c56a7-f881-415a-bed0-f2c93317f943", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691501787, "uuid": "fbbad2a6-4a88-4863-a792-7e5771717cf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501787, "uuid": "d079af59-3a4d-427a-9f6a-e449e4ec5549", "value": "ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ea4862-35dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691493435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493435, "uuid": "4a5fd810-f503-4955-8318-006eaea21b1b", "comment": "Malware payload (RedLineStealer)", "value": "c77e1769417d38027c61fce59723e3ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493435, "uuid": "6230f8e8-0b8d-455a-a423-666774c12477", "comment": "Malware payload (RedLineStealer)", "value": "acbc1af187a5a90d83de3ff62b02f3815657db6c0c6c4286cd5ceedf7e871d81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493435, "uuid": "a29dcbba-f694-4510-8e40-e5b73d468642", "comment": "Malware payload (RedLineStealer)", "value": "5b8f6673979ae922cd9d927955224b2838118d74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493435, "uuid": "8d19613b-15fd-4084-9e0a-ab80b541a1f5", "comment": "Malware payload (RedLineStealer)", "value": "0057de6fd84fb0602e7dbe5b42b374ec488183208ec5785b89639d8fb772730ff0a7710ba6a91bbdc1c345ff6ce53d19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493435, "uuid": "789b52c2-c616-4ef3-b9a2-981f9aa02bf0", "value": "T127A4C012EAAC6B22E5E28A318E2DF6E4661EFCD18F0977DB124C7D1F09711E1C576702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493435, "uuid": "9d8c281a-417c-4a21-9ef3-5db0318575f9", "value": "46c207d29e8eaa8317918259507bb42f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493435, "uuid": "ac1139e1-2b38-40d8-80b8-05fce2f17887", "value": "12288:9A0JvXLD5JasYfeCrz/jzZlUo/rn9qO+fWc:9A0tLDesYfeq7zXUs9qO+fW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691493435, "uuid": "775ded2e-99c0-42c7-a4d2-0f5dd3177aa3", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691493435, "uuid": "72d55024-c308-4008-8737-3df71f568d56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493435, "uuid": "260df044-e3f4-48fb-95e9-a75b3a707b39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7294a80-35be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691480480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480480, "uuid": "b84451fe-0e49-4c7f-89d4-0081674350e4", "comment": "Malware payload (Formbook)", "value": "dfd8b48d20dff29d4881b11e224ab08f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480480, "uuid": "2a334e24-eccd-44f1-8795-ce646d619157", "comment": "Malware payload (Formbook)", "value": "ae1ffbd6408649a583bafadf961a0eb20adc52519dbe39f54f2067b7e4ae0f2a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480480, "uuid": "e1a8adcb-f9b3-459e-8af8-313dcc716b3e", "comment": "Malware payload (Formbook)", "value": "b9872a73c19432e83a7a2e90063d782073667194", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480480, "uuid": "2470f0e3-67de-4445-b9b9-ff6bd3fc5bcc", "comment": "Malware payload (Formbook)", "value": "bb57dc2b48539c58a8c93c89995cdcb17bb36caff26da41ffeb2df7991d1ce9e39bc27ea9829abd9b33ad39de0b57c9f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480480, "uuid": "d3646fb1-5e6e-4415-8e44-e489724fb798", "value": "T1E853E06D834F01A9CF925277AB1A0A4442FCBB3EB34451B1346C537933AEC3D56262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480480, "uuid": "df1dc15a-e408-4191-9a64-f0292b6534a1", "value": "384:vL0AbZSikcMX93wRWjEnNTr/j6FwLfpASamWlZWsXLwXkLPPojy:vwAbZSibMX9gRWjcZv6FwO3DWVXKIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691480480, "uuid": "fb4b0cac-28de-4cdc-9f5e-715be2395028", "value": 66641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691480480, "uuid": "bcab6245-3c6e-4954-a9ad-71204050fd05", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480480, "uuid": "0a2e2864-d824-46c0-8c7a-d1cb756408e5", "value": "dfd8b48d20dff29d4881b11e224ab08f.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3964c33b-35e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691498200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498200, "uuid": "a2d1c0e5-c979-46ec-98ad-7113ec99a9d5", "comment": "Malware payload (Mirai)", "value": "8cbddc1a99d68af35ddf7cd23a72ef8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498200, "uuid": "26c7b814-1d7c-41f3-8dfd-fc1912ff78ec", "comment": "Malware payload (Mirai)", "value": "af101adc360ce10accea7fe552134b459c35954c9338c7149b173ce00061e2df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498200, "uuid": "bfc7e235-bf4c-4f82-98eb-b30d7e728aa2", "comment": "Malware payload (Mirai)", "value": "0d99c3cd12d5a9c55d1f6dda4116b798906199ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498200, "uuid": "8df14159-15c0-442c-b5ca-ce69853fe172", "comment": "Malware payload (Mirai)", "value": "8772b9dc4a41a3b07d3330b9b415bf28d445482e82c9d95a51b383308d4277c0b975946eeb44346b8b6b44232e139d61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498200, "uuid": "73df20fa-01ae-4edc-9acb-9847f8023058", "value": "T16782CF3011AB74E5DBE10431EAADCEC2972A0BB8C1FC36E317586B78C94510261F93C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498200, "uuid": "6df86649-4aad-4dca-b57b-dd09fc42c768", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaydhymdGUop5h5l3:6/V0P6+kom0tVAoNvm+to1yds3Uoznl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691498200, "uuid": "49d9232d-67a0-4564-834b-03096d83af6e", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691498200, "uuid": "297af3c2-f2e8-402e-b4c3-238b366de4a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498200, "uuid": "0357cd91-86a9-4765-afa6-81ca85876b83", "value": "8cbddc1a99d68af35ddf7cd23a72ef8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976a7825-3637-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691532288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532288, "uuid": "a4cfa836-d347-49c3-85c4-53acba77f02c", "comment": "Malware payload (Mirai)", "value": "30513e32fc47f6a0c3126135a173b839", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532288, "uuid": "42338793-3366-4e53-8bcd-2b768a14eb4b", "comment": "Malware payload (Mirai)", "value": "af424e7d3f58450ece22395269dc2a8a6b678ce5acb092d01df96b21461fef4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532288, "uuid": "0ec94d71-d329-45cb-aa1f-fda6f0880512", "comment": "Malware payload (Mirai)", "value": "835499447f1c02a1e597017e50e2b059e4dea465", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532288, "uuid": "9493a073-fc56-41d6-afae-de16ed1d9064", "comment": "Malware payload (Mirai)", "value": "1034e5643e6b6f893b1eea19357fd8ff348ff31e3e79b032a8d7fea9486daa61aab4257b968c4066971844b9e82a4f5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532288, "uuid": "38e2a6a2-d0d9-4c82-a402-930ac849ab17", "value": "T180232B99E8035E2CF94BE6BD14220E0CEA11635161D31B5B9BAFFD832D7227C5B1DE42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532288, "uuid": "ae2d8154-9f55-4049-8c36-79064094e91f", "value": "768:HNemSeoXATGYaIWx+7bdbcfuY1ePevDRimF8FtSNUfRFJs8IlDStGD:tPss7bdbY5IevDRimF8FMUfRXs8IlOoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691532288, "uuid": "59962035-32e5-4155-beae-f980503b44d4", "value": 49328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691532288, "uuid": "86e2dbe3-646d-4abb-ae1a-c2ab3814a5a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532288, "uuid": "8d4131ab-31e5-494d-8242-2ccdc3c51424", "value": "30513e32fc47f6a0c3126135a173b839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3f2dd0-35d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691491009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491009, "uuid": "d7380a6b-47e7-4ae7-a89a-5997c96d9028", "comment": "Malware payload (AgentTesla)", "value": "a42377e988ebb3d257556f86aeed1dc1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491009, "uuid": "0abfcaec-89ea-4d41-8645-2453f480871a", "comment": "Malware payload (AgentTesla)", "value": "af73b666c551961360880e9d82c7fd14d9d3e41ef446e4199a0a5e82812a9a56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491009, "uuid": "978e993b-5797-45b3-88b1-56b2a6e305bd", "comment": "Malware payload (AgentTesla)", "value": "2d9ff53f15043d338a11534b9555381c91642724", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491009, "uuid": "6a7b1e20-ef79-4910-a8f1-202ae2007131", "comment": "Malware payload (AgentTesla)", "value": "1c725158f153d3056416e38de8c51d1141a2484bbc1dc0025cf046cc5870b593e3bf8a7babacfaa639fd541c551f014f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491009, "uuid": "b5d46f85-612e-45cc-ade9-0a512579fd3e", "value": "T12DC28D638B582C16EE478E7070E5D63A6E70B3924DD1C6DB311AC2569F853822FA81FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491009, "uuid": "80eb42d7-aa22-4eca-ba2a-4313c519d602", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491009, "uuid": "c2011e41-c5b7-4886-8597-4d1cfc45d632", "value": "384:f2ABtBpNyb8E9VF6IYiTPxXtFRMORF8tIYiztFRMOywrjTkJ8JN77hhl5:fxLtEpYiTPxdFPYi5Fqwnd3hT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691491009, "uuid": "0c1f3211-ee84-4af3-a3d3-28c6e7b62996", "value": 26688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691491009, "uuid": "ef7bdcdc-462b-40a5-bf55-27d9935faf42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491009, "uuid": "ab35705c-ef67-4d78-95c7-eba346ce0ade", "value": "SecuriteInfo.com.Win32.PWSX-gen.25983.21046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45bfcc9-35f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691502272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502272, "uuid": "85269079-7fce-4fe5-bede-90f80e656dc7", "comment": "Malware payload (AgentTesla)", "value": "905524772d9e4f76441b4558e2b0f151", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502272, "uuid": "edea7299-ec3e-42ed-9f71-bda1a96690af", "comment": "Malware payload (AgentTesla)", "value": "afe76c98b98a456cd1d72cbedfd856706006149048244109fd8e2630af9482d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502272, "uuid": "92808275-e86d-47ac-a3a8-50c3ca253931", "comment": "Malware payload (AgentTesla)", "value": "97a21f6239deb009ce56fbcbdf7e3d88e993f92d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691502272, "uuid": "c35b6c80-e4b4-4cf8-8a0d-eb05882d0630", "comment": "Malware payload (AgentTesla)", "value": "fddd37e15fcbc3b655b536c275b8ec1b94868c33a7fcfd02586008b3cdf00700996c0587653c5709c03397abb080c52d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502272, "uuid": "b47d4ef8-db06-4a9d-b3ec-a2498a927667", "value": "T123C4BE38503C87AFE757DBB6E424255723F013562BF2D38C8CB6249F3E79624A2449B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502272, "uuid": "2d2211c3-5f02-4b11-8c96-6df707032d67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502272, "uuid": "7fcb710a-ea68-4868-a6fd-b1b42a78de01", "value": "12288:nVd1tA5KtAAdDczevf/gNcqDdBqO4XiAocmWzLfFqTrQaSejL8Z:nVqKJRcgngvpEO4pmcLfFqTrQaSejL8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691502272, "uuid": "10c42ad1-1029-46fd-8ae4-8ef9aad936fe", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691502272, "uuid": "8b78fd29-f5cd-4064-a222-766e9570e70d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691502272, "uuid": "24015490-999d-40d5-9b10-05541eebf40a", "value": "afe76c98b98a456cd1d72cbedfd856706006149048244109fd8e2630af9482d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f80bb6-35e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691495451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495451, "uuid": "5fc0a04a-09f0-493a-b154-b3ae20dfe92a", "comment": "Malware payload (AgentTesla)", "value": "f08ba9686fa0fef8a19cae1acc94a679", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495451, "uuid": "ff481fc7-1292-4fa1-9936-17738b671c08", "comment": "Malware payload (AgentTesla)", "value": "b001b583435c4391f13b35f31ae8677779fe8e28d6fc0ae91a3bc58c01549843", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495451, "uuid": "1d34d885-d990-4fbf-a309-9285ab364cb7", "comment": "Malware payload (AgentTesla)", "value": "e6f344f4b0685fcbcec169ec458a3e3ed01a6fff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495451, "uuid": "933fa167-2800-4e55-9c67-9ca0fa662e5b", "comment": "Malware payload (AgentTesla)", "value": "c6f01a9b86f321eec12caa35128a1f5259329b1d720cd3f5f1fc7d2b1475b4f2a6c77a4c751e6e06757072be203b6726", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495451, "uuid": "ea73aa00-c695-4eff-81fd-79b1e3c6f7ff", "value": "T16334016693C48D72D61C10764163E0518334EEA62B83E7CB3CE1BA5DFC71BEC5A3AA45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495451, "uuid": "d3084e7c-4b61-452e-9fff-d3ec3021d606", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495451, "uuid": "9573525f-241b-4b59-9425-491bee2ee15b", "value": "6144:OKEIX/tBI8HimnxRJ1vAM8EILNQZdTva1XFEMU3w7O7tW:OKEIX/ftnxqMILNQtMUg7OJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691495451, "uuid": "af332f8c-e8cd-4737-bb75-ca37e781d4c9", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691495451, "uuid": "77cedf33-daf5-4924-884d-c1a69ce33789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495451, "uuid": "7303502a-631e-4b53-85e0-3e505b0fe3a5", "value": "b001b583435c4391f13b35f31ae8677779fe8e28d6fc0ae91a3bc58c01549843", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69290446-35c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1691484107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484107, "uuid": "1e47f361-8507-4f82-a5ad-e36b54cf9232", "comment": "Malware payload (ModiLoader)", "value": "8c7b3ea4887b797a34ed982b0ceb1adf", "object_relation": "md5", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484107, "uuid": "69090eb0-e573-4337-a154-f54c066df727", "comment": "Malware payload (ModiLoader)", "value": "b0542a719c6b2fc575915e9e4c58920cf999ba5c3f5345617818a9dc14a378b4", "object_relation": "sha256", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484107, "uuid": "6fafa044-fa49-43e2-aa88-e0fd28beb000", "comment": "Malware payload (ModiLoader)", "value": "021f6cbb94a32ccd0ffe48e51f28cc20d0958779", "object_relation": "sha1", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484107, "uuid": "65976bc2-26d5-4a73-8cdc-a0d1149cdb3a", "comment": "Malware payload (ModiLoader)", "value": "c3a7b6c93f20f02d60976340908e789ea7572deb3366ad80a86eb9b05f6826595bd41694b36d889df529487bd11e4821", "object_relation": "sha3-384", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484107, "uuid": "7526b130-b4b9-4572-8057-af8717964207", "value": "T151859E364E377C9E376D2808DC001C920CA89B475F6526ADEE4D9DF3E94B909C6AC4BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484107, "uuid": "8219ac65-659b-4e38-928c-64887634575b", "value": "24576:3Di7eeqvTf9nXzTL47O/g1/9V9ISAPsn+lHO49JLPIaqxJ3h8GS:3WeRnXD4nGXzuBGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691484107, "uuid": "8807fcd5-642a-43cb-95d0-0483e4d4bc61", "value": 1807293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691484107, "uuid": "ae5dc4f4-cd2f-452d-b7d7-374d4ac62d82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484107, "uuid": "399d508e-fc92-40d9-9789-9510f9502031", "value": "b0542a719c6b2fc575915e9e4c58920cf999ba5c3f5345617818a9dc14a378b4.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80a656b-3623-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691523780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523780, "uuid": "068ae7d7-cc49-4810-8975-065735b3a510", "comment": "Malware payload (Mirai)", "value": "73adbd8c915da026adcba119dbea96f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523780, "uuid": "5cb4e141-9b1f-43c2-badb-cb5c05d47535", "comment": "Malware payload (Mirai)", "value": "b0af669677e14d85fed4da7ed3beea251dd17d84ab0a551fc98d435b9bee5d93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523780, "uuid": "73e8a9c4-cf52-4d30-a0c3-7220ee03ba38", "comment": "Malware payload (Mirai)", "value": "51801035e593a0a92f83e521cd966a2cf40e990e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523780, "uuid": "e8d63f2a-fa6f-4764-8898-fcea41b3bb92", "comment": "Malware payload (Mirai)", "value": "985cac6563ac036df54cd5d4b1cd8307e451ab146eac6b27d076ec2e2d3402639a006bf2386feca4ae9e2080eb823e73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523780, "uuid": "c7397e0e-cc05-42dc-9225-c71320a9b548", "value": "T13D536DCAB8119E7DF5CBE6BE85210D0EB821722150931B17BB6FFC83BD731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523780, "uuid": "2e43925e-f4b5-43f7-bb06-a6e38d60be4c", "value": "1536:sXyRgQFVTbSX5pxLepSGYocF1ohON2P3B+qo76E8L:R1UvA8E9oON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691523780, "uuid": "e481e4c6-aa36-4a70-876d-560dbc3f3f08", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691523780, "uuid": "0b831440-4b2b-4560-bdac-39c51b3a715c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523780, "uuid": "ea690eea-b24d-4b94-b7f8-14c21be74170", "value": "73adbd8c915da026adcba119dbea96f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c7a4cf-362a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691526544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691526544, "uuid": "69d34c31-90c9-487a-9d4e-cb917850a825", "comment": "Malware payload", "value": "23540c83cc4620f33d45dea691c6888b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691526544, "uuid": "767a1679-ee45-446b-a9f7-56418ff40fc1", "comment": "Malware payload", "value": "b17f6d86a9b9d63e841046b6b999e1197e81b2cf5cc6bcf376be9698e5d0f84b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691526544, "uuid": "ba2e6a09-caa9-43c9-846a-31f7725c2ea4", "comment": "Malware payload", "value": "bbdb961ad6fd8ad40cc3b8174242ca64f9a446a8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691526544, "uuid": "cb28474c-126d-4c91-af6e-3c8f93e723b5", "comment": "Malware payload", "value": "3f362c20a4fc390cfab304be571a466a42da937885a5ad1392e73213f8f7884d56fb4f45a1072151c85364b1a51f6e75", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691526544, "uuid": "dfb4dbe5-9c56-43a6-9154-a776874a07a4", "value": "T1E85623AD3284371CC01BC4748833FD46B2F6521E1BA4D5AA76DBBE843BEB515E602F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691526544, "uuid": "9c221c70-1420-43a1-9d1d-67aedd3be0af", "value": "531372f8fed94a7a0e3b8ef647c7fcb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691526544, "uuid": "278c1d06-798e-4e23-aef8-5b6a1ed0c85b", "value": "98304:Oz3igQYVx9ZE5nYiF/VoazNgNEGlqlls7aJAUMLy6ynCU/W4+EBEA4oPNp:EygQWbe/VooNy10s2ZMLylTtrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691526544, "uuid": "5b8ef770-cbad-4349-a008-6e5429c27024", "value": 6395904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691526544, "uuid": "616520cc-f4e5-41e4-97cb-a518e290a9c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691526544, "uuid": "9be7ab9f-40a4-4c1c-a1d5-d7196268edb6", "value": "23540c83cc4620f33d45dea691c6888b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573b31d0-35d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691491808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491808, "uuid": "9a57a5cc-f06e-40a2-8f16-ae2ea920d20c", "comment": "Malware payload (Mirai)", "value": "ac40bd03e28c4e759cdb7b01e8d6c7f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491808, "uuid": "222b0e91-a3a9-4461-b4fe-e0fca9b2f835", "comment": "Malware payload (Mirai)", "value": "b1958d8ce99a718069797061672b72210166b902cc6b45e22c78f70eaa8b14b9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491808, "uuid": "df47febf-241b-4715-83bd-99381ee86e85", "comment": "Malware payload (Mirai)", "value": "89e8d0e27ea4f071a5779a3592f87c42dbfa7429", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491808, "uuid": "364bf4bb-18a9-41fc-bcf4-9c789bf36ec2", "comment": "Malware payload (Mirai)", "value": "df06138753cebeb608b3373292cef825554116b82633e2aa686e0eee150f0dcbc4e2f8a354ad8ec9f8f8714e5e623471", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491808, "uuid": "bcb44541-26a6-4a1d-8d1d-5e403143a88d", "value": "T173C2D130A2ED1CF1C6500572F7B85AC5BA530F7DEAEA3890214097BA7D829066DDD9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491808, "uuid": "65966533-5429-49ee-ac2e-823892c95c44", "value": "384:Ejt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNErKaWwVI5KhymdGUok:ERsoTAZ3alkXLvFh8nNErNWMTs3UozQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691491808, "uuid": "15649f74-8cee-44af-ad23-e876e12f29ea", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691491808, "uuid": "764b33d4-3b85-453c-956d-a9049a5808da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491808, "uuid": "c11833ff-4b7b-45cd-b758-1f0334a45ed3", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99cefb2-35da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691492456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492456, "uuid": "68b903b9-e692-4354-9e05-b2a682442ad8", "comment": "Malware payload (Mirai)", "value": "0599aaea187c6c0a9f5805313eb85ac4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492456, "uuid": "743a3be1-ab17-442f-bca8-a48574dda8b7", "comment": "Malware payload (Mirai)", "value": "b1a618b0433044f27c7de86f2be4bd0aef33de3dc8545b21bf68977f0932bd8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492456, "uuid": "0115923d-0f34-4c35-bfb7-f37e34ce49fb", "comment": "Malware payload (Mirai)", "value": "2edc40065dc3a0b3e6454ea3e24bad2fd0bfdb8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492456, "uuid": "511072b6-7cae-4429-ab93-26c607917693", "comment": "Malware payload (Mirai)", "value": "d3bddeace9271d76b037a88f38a35129c8ff9e38ffb532474e8d3226b844f8543a4b9d64cc3b6b81090d30ca75ad846d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492456, "uuid": "e97378f7-1ec5-496d-850a-fc5d7bd1760a", "value": "T1F6536DC6B4119E7DF5CBE7BE44220D0EB821626150931B27BB6FFC83BD721A48956E07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492456, "uuid": "d9fbea17-3b6d-49de-80c1-d0b8e236c64c", "value": "1536:kPqRg0FZTbSX5xZLepSGossFpxhOx2X/ZOqc/yA85:p5ofF8I9cKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691492456, "uuid": "4245a375-4646-4ac1-bbe2-eff90c5e4231", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691492456, "uuid": "22778df9-5691-4e21-b0dc-2c282024eb09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492456, "uuid": "ab4479ef-ca28-4a44-bc35-d9365b2f8132", "value": "0599aaea187c6c0a9f5805313eb85ac4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e192c3-35ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1691472349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691472349, "uuid": "ee3614f3-04c4-45d5-9719-423f61cf9482", "comment": "Malware payload (CoinMiner)", "value": "4abf4307d3c34c700ba5f3bfcc9d8fbe", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691472349, "uuid": "82007feb-6d3f-4b59-bdbc-893a06cd7ea5", "comment": "Malware payload (CoinMiner)", "value": "b2587af66ae9a2cc8daa61c4b752571509730679f8cd853344c6977dd63afaa0", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691472349, "uuid": "fbdf8655-849e-41cd-9779-53533af0d4ff", "comment": "Malware payload (CoinMiner)", "value": "215cc86274dff3bf3da6dd1f6392cb42bb527c09", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691472349, "uuid": "2fb44681-acd4-443d-a03c-4fd4a836fd1a", "comment": "Malware payload (CoinMiner)", "value": "6e6410227825c97de09cfec6f32936c4cd33a85a7e051c2345eb75be7d0fd0bcfe9af0e796da76c4111312cd26f82449", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691472349, "uuid": "a1f67866-91e0-4182-9486-a37313f6d5f7", "value": "T131E423B09B32AF34CEF3023CF98A11BFB26DD15703D407D4763AAD4AAD96468F142994", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691472349, "uuid": "2a191341-ebc1-4858-afbe-c90ea7e2f85a", "value": "12288:ygNz7hDhASCIORFW1Z1iVSpB3wv0/JNjk085BEylkKMx2LlpuqjePXpW6Wr:yg5tDhASC7Wlpuv03j38LESkKMxHqjeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691472349, "uuid": "fc256ccc-92db-4639-aa2e-81704a85a911", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691472349, "uuid": "742035e3-175f-4387-bda3-3af3c51525fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691472349, "uuid": "86a2a4b7-5be3-41e1-b65b-1361303e1f09", "value": "4abf4307d3c34c700ba5f3bfcc9d8fbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4cfdbb9-35e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691498058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498058, "uuid": "404b0b9d-6b23-4516-96fc-ae1840f42e23", "comment": "Malware payload (AgentTesla)", "value": "221470642f009424c2fad11891d09dbc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498058, "uuid": "88916c97-b1d8-4acc-a078-959b3460f9bb", "comment": "Malware payload (AgentTesla)", "value": "b284e8db2893ddfdaf33888c5be2e93de724655f9feeaa7297100cf488f29dfd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498058, "uuid": "fde657d0-4623-462e-8f5e-055d9f21a917", "comment": "Malware payload (AgentTesla)", "value": "5f8717ed91dcaea8d0ebff3b059dda02b2184b34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498058, "uuid": "82e63048-df95-43b7-a1e1-4043dc601f10", "comment": "Malware payload (AgentTesla)", "value": "6047d0ff605e8880d37b23ca4ae1424735be116724e9e68834b08b39a955278e6516576856e1f63e8750031646a6b901", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498058, "uuid": "df6d0469-0ee9-4f28-bbd4-7a4acc4e59ed", "value": "T124052317E9B78DB3E6A307FBEBA180800FE7E4506D37D64630C5A24A142B7F95A076D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498058, "uuid": "fde0b0bb-69d8-427f-a767-6769df05bdc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498058, "uuid": "cf689108-5040-4312-b15b-fbd8268b2d1d", "value": "12288:OfEJ15P5alblhVTQbdPxKn8JaeqnbtnJHzBFCddL/qlcZN2rz1UHVrrLRt69+1cZ:OfShYpsE8knbhJqdPN2r2Rf69+1miDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691498058, "uuid": "d7bfc368-a5f2-4adc-876f-7ad38e44677a", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691498058, "uuid": "76cadca1-9dc8-4c2c-99f5-1ee0930bb9e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498058, "uuid": "f93e6d36-89a3-4ad8-92d4-0276bffb6380", "value": "b284e8db2893ddfdaf33888c5be2e93de724655f9feeaa7297100cf488f29dfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7944e7ba-35d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SystemBC)", "timestamp": 1691489717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489717, "uuid": "27caa7fb-66ca-47d2-9d7d-0052877ecfdd", "comment": "Malware payload (SystemBC)", "value": "62813c6cab9234e83949fcc563c33b57", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489717, "uuid": "8fc201d9-87af-4366-aece-8f90edaf0a03", "comment": "Malware payload (SystemBC)", "value": "b2b82c1977c17aec7ba0074f56c0d61100e616a0ce72dab748ec4269db6c0793", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489717, "uuid": "11826fd2-6296-4913-b2eb-4ca601b18c00", "comment": "Malware payload (SystemBC)", "value": "474c9abc14fea035d0e80128dbd7260f0cbc42b2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489717, "uuid": "ceac7cf2-4b98-4f6f-93ee-d6d475c7c541", "comment": "Malware payload (SystemBC)", "value": "ff714fc9479d95271fa042489ff561e6087258a4825300ad033989800a0aa8c11be70c65413cf3b08681fa21e84e48af", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489717, "uuid": "d562123b-ca67-413e-a738-58f2b4cc9a5b", "value": "T17956225D624873ACC01FC0749827EC05E2F6992F1AD5E9FE71D7ABD0776E821DA02B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489717, "uuid": "16ad831d-63a7-4a25-be8f-a228e6eb53b3", "value": "531372f8fed94a7a0e3b8ef647c7fcb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489717, "uuid": "7b43b970-fb62-4025-9498-b2d6e51b4a47", "value": "98304:Yk/CgBuUFSDyJ6FqBh2Rvtu9+GdULsSuPbm5u1et8yDD27AadUEpnoj:DBumcyJ6O3LdCgPbSket8yDDTsGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489717, "uuid": "0c3442a7-9a82-43bb-8052-a24837268177", "value": 6267904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489717, "uuid": "6b45057b-5e51-453f-8a32-06bc36a87537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489717, "uuid": "45006a12-da01-49bb-91d8-88f112f8ada1", "value": "62813c6cab9234e83949fcc563c33b57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb56346-35e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691495444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495444, "uuid": "862f32ab-2755-4d54-82df-d87640dbf606", "comment": "Malware payload (Mirai)", "value": "78e3d9d7d82229ea0bf8f68c5e6dcab9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495444, "uuid": "86c36670-dbce-4d93-8b26-fff7c10beec4", "comment": "Malware payload (Mirai)", "value": "b320dfb69373ce1e559fa5d2f96dbb0857222756bf54876c714210824abafc46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495444, "uuid": "3d4a85af-f0d2-489d-9408-de2d9660f861", "comment": "Malware payload (Mirai)", "value": "9ec5eddb7c3a1d84be31d65e994945b71fd7c31a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495444, "uuid": "761d6fb4-d85b-456c-9d82-2744b82be796", "comment": "Malware payload (Mirai)", "value": "2f32446d17f6cc5f4449a6f633eaa3e5d581230266c1a6da7d18b8b864dc577ad2e77e41c6330afbef7663abbffe0d28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495444, "uuid": "1ca9a382-a801-4c7e-8f92-5fb559fb4e52", "value": "T174735D24A97D2E26C0D4A17B62FB8321F2F6230E2570965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495444, "uuid": "14b63067-1d47-431e-9bb7-33dc8ae61883", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws80:YwfdNu4cmZvFqI3w70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691495444, "uuid": "dcdcbc06-a7fb-42b6-a8b3-bc51be8bbff1", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691495444, "uuid": "76250a56-8387-45df-9830-490d410400ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495444, "uuid": "95b7c4df-d04d-446c-ae6d-bac1f0c7fec6", "value": "78e3d9d7d82229ea0bf8f68c5e6dcab9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a20da3d-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691477666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477666, "uuid": "2dab3548-dca4-4c39-83ef-b6f148d85134", "comment": "Malware payload (Formbook)", "value": "14a7622d624114455125aa2cca26bf90", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477666, "uuid": "21583b3d-489f-440e-aefb-40377830ab72", "comment": "Malware payload (Formbook)", "value": "b321a1ea7cd14d6f159deef8feca34bcd4820ff2dbbf935be2003ced08a06d5e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477666, "uuid": "134918cc-0d94-4295-9395-2d1c96745494", "comment": "Malware payload (Formbook)", "value": "16cb24fd3d3755e191e2351e5b7d10d09dc67f91", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477666, "uuid": "ad3e95e5-9d76-44be-a467-8ac5733d533d", "comment": "Malware payload (Formbook)", "value": "e56b28f9b0e532d3ffba4a7fcf9ccd538242443a2ea5bc80b9ff3c4437642eb839f388359a78b57d2af94307ba70dcd3", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477666, "uuid": "1332a3c8-f7d5-4f7c-9e55-5cb6cd4af0a0", "value": "T1AEF40101772CAF62E1F593F9187A24444BF1746E39AAEA680CD670CF5EB2F104A51F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477666, "uuid": "55d92b06-6a11-4436-a8cb-eb17b8171857", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477666, "uuid": "8024602d-dd0c-471e-8299-b43e7abf5903", "value": "12288:8sveiF9Dt9hdZgWrIgsNkWtx8eaSEbUZTLWpXThACfacgL2jh:Zvei7h7tM8eZSKW/j1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477666, "uuid": "89130c06-63b0-491e-be7d-84f5cd64bc5d", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477666, "uuid": "fb7c1d19-f924-4803-9bcd-1a2451bc738f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477666, "uuid": "d634d67f-2ca8-4708-94b2-e3e17d02bf3d", "value": "DHL-Parcel Arrival NO GKM3684800048.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b4bc89-35b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691475504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475504, "uuid": "887513b3-cf9d-47fb-a06c-884e0d38e3fd", "comment": "Malware payload (Formbook)", "value": "796ce6d2ea329a127087fe8d8b1bfd44", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475504, "uuid": "bbf27c83-35a4-4271-9608-a8fb53d8752c", "comment": "Malware payload (Formbook)", "value": "b36e3816f34a81c4f0b01b3b501e466e8b0fa58e531d4ca80d4ea41bb632dfd7", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475504, "uuid": "310e9958-d030-4a75-860b-27e5b561db2f", "comment": "Malware payload (Formbook)", "value": "a9edb8b1635fc7a557e34a1be11037b30f51d10b", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475504, "uuid": "39f97b8d-ec72-48a9-a233-5c811000ccdf", "comment": "Malware payload (Formbook)", "value": "7dd86589b9a81e35d4a8e4a782edc5ca24dcdaa95b58ca8281bafdda17b587c09a8e44397e0cdfa6bd8543a0824e5b39", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475504, "uuid": "ed2dcd7d-7f26-456b-8d8e-b3270ab9fc86", "value": "T16C327C3E9DE841ADE31B11B651602095D7BC7AFBE328428B5D70FA5482B63CF4703B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475504, "uuid": "2c216569-41de-41ad-b652-b94239c4735e", "value": "192:uya0NEyd8WE4N5eNA2A+EnVs+mg1SoBeJYqO36PvHrK8623Y97cWeWSjKx:uyXEyd8WEu5+A2bkBdBeJYqOqPD62o9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691475504, "uuid": "a5de97e7-d367-4eda-8554-3b1a3823cbb0", "value": 11493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691475504, "uuid": "78db6195-0626-41e9-945c-91b4b9ea9bdb", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475504, "uuid": "99abd1e1-103a-4353-ba30-bf73175c2b5d", "value": "RevisedXPO.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ae4288-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691477570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477570, "uuid": "7eb4c8a7-879f-4d05-a28f-7e1ccc9d22c6", "comment": "Malware payload (AgentTesla)", "value": "356d1a72570052ba72ba16cbfb76ff9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477570, "uuid": "6ad956f0-1d20-47c3-8219-4745d9eae745", "comment": "Malware payload (AgentTesla)", "value": "b3dfe1cd5433b5a18b178b28deffd2858e7c73df374c132beafb4dc89f5ffebf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477570, "uuid": "64313089-29fe-42d8-9d31-9b40cb39a02d", "comment": "Malware payload (AgentTesla)", "value": "6c2043fd6e6392b4b8115a7b955ef8513eaee665", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477570, "uuid": "cc11d680-3bd6-4470-ba9f-fcc38a9a5c74", "comment": "Malware payload (AgentTesla)", "value": "ae995695484bb9815d73ccfd044f17f7581e4cca6261714a3507360ae566039000ac982ad70c52b0bbabfe2f13dbd573", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477570, "uuid": "d5a5c8d8-2577-40d6-9dd6-462528ccffc8", "value": "T195E423AD650709B9E309633316A058A9767F730EF320F793CD1CC76B91426E4B9D6A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477570, "uuid": "eeaa8ae5-bbfc-40f3-aa51-246b37a5af28", "value": "12288:MLgnW7NBONvCjwLcZLcPIb55zU4QytanTyoRPfgIASykIVfewXM+Hot3Pspj0xF7:4gqLjyuIIb5RU4QytanTlRgKykIJHoR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477570, "uuid": "d20a47bf-23af-456f-b040-986b6576ecf7", "value": 685094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477570, "uuid": "fcd14571-cbf8-419b-8331-54f845a8c1d2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477570, "uuid": "20ad0602-4b89-4cb1-aad9-dad13236aa21", "value": "Group Details.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a92a4b-35be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691480127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480127, "uuid": "32e4ff0f-cd61-4ffa-a262-b0d135ebcd1a", "comment": "Malware payload (DCRat)", "value": "a005e6c41068334ca6627c92941fe649", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480127, "uuid": "b6c20b40-fd50-4954-a22b-820e737f9fff", "comment": "Malware payload (DCRat)", "value": "b59c894f844768f8d1c0a9531e998d27395e7337d5f0174dfdf50c2bcac794b5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480127, "uuid": "123dfbb4-a886-4cdc-8b5f-7e42f1d78fd4", "comment": "Malware payload (DCRat)", "value": "060b9379cc35ca733c8f44b13b74d49077f5d2df", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480127, "uuid": "eee2d22f-bf82-44e2-82cd-15454226afdc", "comment": "Malware payload (DCRat)", "value": "91a9bdbe1ba6a6afcac4c7873d746711ad0f187ce1e8cef418f7ea5540cf0af614e62b6223e1d4a9852948a11922fc27", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480127, "uuid": "18a56442-f58d-4536-b167-0ccda15928a4", "value": "T1D6454B017E84DE12F0191233C2EF85484BF4A991A6E6E32B7DBA376D55123A73C1D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480127, "uuid": "b8addbf8-1b82-47f6-bde6-96a1372eeba3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480127, "uuid": "d0eed9a3-7e13-41ca-af80-cc47acf0d12a", "value": "24576:gC0hXPnDBRI/ka6yTIcKNBOE2tCjZsEhTRVkRURPFeff:R0JnDjoDMPTRYURtef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691480127, "uuid": "67c0e4cb-ef78-487b-900a-0b0118901164", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691480127, "uuid": "fba0b54b-1b6e-464b-bd41-4da515d71a36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480127, "uuid": "f8ea1a68-85a3-4c82-9f12-551d40fdd446", "value": "a005e6c41068334ca6627c92941fe649.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5e18b2-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691478796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478796, "uuid": "3f98953e-cdfe-4c8f-b55f-adc5d708fed8", "comment": "Malware payload (Mirai)", "value": "5669d75b34dbde11a95d2f63db5b196b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478796, "uuid": "93a250ae-df51-4bbc-8f81-8ebaf6703cda", "comment": "Malware payload (Mirai)", "value": "b5f9911d215ef9ff2eebe50cb3082abf90269985ef26826ad081b12871f4da54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478796, "uuid": "7108b9ac-f04f-443c-9b4a-1b797847a4ed", "comment": "Malware payload (Mirai)", "value": "accb45b975b94553d561d8516f10d4c22bbc06d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478796, "uuid": "d5814e24-6924-4afc-8694-98aaf8ed08a3", "comment": "Malware payload (Mirai)", "value": "afbaf976169a3ad1fd45cc42baa076a976a884695251c8228a533a64e328023f923ae4e520be1052d99dbd7aa65da26a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478796, "uuid": "c90e9eaf-9a7a-41f2-a7f1-92505ad62172", "value": "T18F633C4372280F47E5A20AB4253F1BE093BFED9024F4B688694FDB5A4635E761186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478796, "uuid": "02fc40eb-98e3-4a63-9010-8e728f8a7720", "value": "768:btrBMTY6xuTFrRnk/qPRTS1aReKqL/7PHc55PI9vM8bgOCK2BHVReB2hMRiK2uAS:YgraETS1aR5q/7k5qx2d3KEZIJO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478796, "uuid": "751fa26a-5d3a-4edf-a398-73edbb992718", "value": 66824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478796, "uuid": "5d8ecd8d-23a6-4d51-b513-ae7d8db2e872", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478796, "uuid": "4c6feded-b03f-4547-84ac-91ea54f02961", "value": "5669d75b34dbde11a95d2f63db5b196b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ea9a96-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691478887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478887, "uuid": "3b29fca2-5e8b-495d-8afb-7fa387389d3d", "comment": "Malware payload (AgentTesla)", "value": "7266d01b13259f70486280871f90a845", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478887, "uuid": "7823a554-42ad-4080-92a8-a85ce772abb5", "comment": "Malware payload (AgentTesla)", "value": "b665c10dcc5cbf5d062c9463e775fbb6ae997f357a0349370fa6dd56718a2d73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478887, "uuid": "37848576-0582-4ea8-bc23-b174d1c88104", "comment": "Malware payload (AgentTesla)", "value": "3d650304747a1855a90faee5b3910b6b14764c69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478887, "uuid": "ee7ab215-ac4a-4386-9ce4-b28324da74c5", "comment": "Malware payload (AgentTesla)", "value": "82fa7bfd2840133c35b568105d1e448614e2b099a087c564cbcdf8a59e2723cadd3aa89294e491bc270d228b08850227", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478887, "uuid": "0b680e1a-1803-47a2-8fce-1c1cd07d0ebb", "value": "T1E9D4238353AD81BAF05467F92FE68C351A6D270176D9E6DFADD0F14C4CDFB201221A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478887, "uuid": "3330314b-17e9-45dc-a2b8-511be71e2645", "value": "12288:yMfpG45J2SxCjhF+fS15qOa4VO1G5Aipy+9m7PHY:yMxGW2uCGfPOBVWG5ASg/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478887, "uuid": "45af61a4-e19a-41ba-a714-a7c6d840100e", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478887, "uuid": "eb4c44ba-fd33-4d45-9538-ed7dfae01e11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478887, "uuid": "003c44d7-ca5a-41e4-b189-4ab50f525624", "value": "7266d01b13259f70486280871f90a845.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb48734-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691479013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479013, "uuid": "a4526c2b-39c7-44a8-af2d-2552a5e48b54", "comment": "Malware payload (Formbook)", "value": "5e37b3d27287573d421f80f9428d3ddc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479013, "uuid": "6ee9d2de-c161-4dfa-a7d9-e2284e466714", "comment": "Malware payload (Formbook)", "value": "b723fa6187dd823012646cc23268f9a05550e8fb5018110df4ef24fa995d2141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479013, "uuid": "6be924a0-3d66-4175-a43a-6ff39166385c", "comment": "Malware payload (Formbook)", "value": "4adf80bc3bb9ca07d2367060a7f6e069d5d4a466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479013, "uuid": "390613e0-fc0a-4ab7-b6c7-55be85a9d021", "comment": "Malware payload (Formbook)", "value": "1c0b3170338e4e0ce5dc487e086c85c24f663339d27970269f3bd069163cc7cf9dc4bb82e384a6253cf2f1964c84449c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479013, "uuid": "e6febee0-880e-4ad0-ab2c-8ab804fedcfb", "value": "T17EC4238431DDDB58DD3893FE3924412D43B5B29D1666E72C4EA62CEE1963F0EDD01A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479013, "uuid": "a5671a97-5f34-4ea5-84eb-dffc135b47d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479013, "uuid": "b250d386-c271-4871-b3a6-99149ef6f22c", "value": "12288:4tyZF6zSLyojUYFRnbFeY6wJJ8uUG3tj7z:ayGzyyGreY3G5G31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691479013, "uuid": "b6627095-8c16-4cc9-8033-f6c7d84a316a", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691479013, "uuid": "d0149028-317c-4892-a951-ae03f64f93ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479013, "uuid": "b7246334-7057-4a08-8086-30b5341a1549", "value": "5e37b3d27287573d421f80f9428d3ddc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a85b8c5-3606-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691511141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511141, "uuid": "58b8a077-92ae-476b-a07b-609d31ce079d", "comment": "Malware payload (AveMariaRAT)", "value": "333aac40f8c35335fd4fe2eb24a7dad4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511141, "uuid": "ca9b9ce7-1205-4934-9c10-7fcd5c53c37f", "comment": "Malware payload (AveMariaRAT)", "value": "b73e195266df81de789d37b4659da0467f9cdae883642341b45722a931b47620", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511141, "uuid": "d3e7223e-1b74-4f9c-a04a-e0b2b8f2d8b0", "comment": "Malware payload (AveMariaRAT)", "value": "4f91fc489be8064901c4b36849272c82deddada0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511141, "uuid": "aa4a1561-39bb-40b6-9bf4-5e2ea052272a", "comment": "Malware payload (AveMariaRAT)", "value": "a6ea1cfe8bbf50a621e3376cbe06d7613949e4b7a05d25ae99685932b28812b818710d31c34490febdc52699c0c02b3c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511141, "uuid": "b4b22a47-c197-49dd-8abe-83806a21ab32", "value": "T11E342225B6B925D6A079312C6B549F37FFA632F9A430CB270976D0D60CD4C936F0E1A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511141, "uuid": "fa7e514f-a9d5-4173-b9ae-38443f9d879d", "value": "6144:vSAD1oBKUUEFCZjtWoLYF+0sllRIjwHnBzOIhcR5hp:PuOqoLYqRCengIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691511141, "uuid": "73dc4461-a05d-4908-afb5-425b64f28ada", "value": 242344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691511141, "uuid": "8ca4ab7e-1047-48f9-9f9c-5d85c7f59fc5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511141, "uuid": "156b8dba-e77a-4f9a-8de8-5a9d75c78084", "value": "PURCHASE ORDER.xls.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3f79f8-3623-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691523790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523790, "uuid": "97a221bf-e469-43ca-9ad9-a443ce8ce092", "comment": "Malware payload (Mirai)", "value": "984cf8012868c08282c2fa6a40562ba1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523790, "uuid": "5dc4bf04-5497-4e82-8c29-02a8733ccac4", "comment": "Malware payload (Mirai)", "value": "b83fa71bae779718dd8892079de7e391029e2274345db3971aed201b0a0ef9bf", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523790, "uuid": "65c36c52-1cdc-458e-90ad-98412ed3595c", "comment": "Malware payload (Mirai)", "value": "9fa6add1c867039e48dd9f4b023bc645b8426db0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523790, "uuid": "ead8af41-f3a6-4b1d-acc3-faeecdf9fe17", "comment": "Malware payload (Mirai)", "value": "d49c1c60a24236896b7d901a4dec15a77b6fc54267fec931a7b32ec5683abc14794b291bf851ae94a85911e61b4abacf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523790, "uuid": "0fbafbfe-d3a4-4521-b19e-7fc01f9d7087", "value": "T15FD2E14A45E7E4B1C4B8D87328B5BAC0FBA46560E32D2B7B089DFABF595B24C1335700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523790, "uuid": "0c0c1b14-5507-4cce-976f-24fad25ccaa7", "value": "768:kYSoXdJZUtqz0hVGTa/V7t4zY/R04O/uSx0sM:kYJdJZmY03GU5042tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691523790, "uuid": "012ce6ee-6df4-4f1c-af26-75e73768add9", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691523790, "uuid": "a783c871-3576-44ef-a69e-63c4bd8755bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523790, "uuid": "d60b6b72-66b8-41a7-8e24-87361f082d45", "value": "984cf8012868c08282c2fa6a40562ba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2186c3-35ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691500728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500728, "uuid": "ea17ca18-39c9-41db-b89a-b3f1e2c86aa1", "comment": "Malware payload (Formbook)", "value": "a17a049127ed50b05c2fb5f0a695270f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500728, "uuid": "fbd9544d-0b98-45cc-b6d0-ae7d7946845a", "comment": "Malware payload (Formbook)", "value": "b884c2251b7291036331d340c2ec96842d198e858cf1e8cbca7b80bf95a75727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500728, "uuid": "e233cc05-e1e0-48ea-acd5-0f4fae3eeb69", "comment": "Malware payload (Formbook)", "value": "66424afb9d4832e769ea410486669a42d48728cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500728, "uuid": "9f50b159-3bbf-4f54-b23d-657f213ae7b1", "comment": "Malware payload (Formbook)", "value": "2f53b4008ca403d24056beefd7a17714ed89cbcdcc4e8e5cc63d0bf867e9185fe68ed039be81a9900d195d307f3305e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500728, "uuid": "e10872ba-cb66-4572-8421-9e616d2850dd", "value": "T1C0C29D638B542C26EE478E7070E5C639AF70B3915DD1C6DB301AC2569F853826FA81FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500728, "uuid": "82e1687e-4221-49dc-b3f8-080d8656a2e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500728, "uuid": "42a0790e-f451-4c97-a37b-99a4995ad1c8", "value": "384:pygHothpNyb8E9VF6IYiTPxXtFRMORF8tIYiztFRMOywrjTkJ8JN77hhl5:py0ortEpYiTPxdFPYi5Fqwnd3hT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500728, "uuid": "38fc038a-1626-4fe0-bfd6-7972f1cfc868", "value": 26688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500728, "uuid": "e7f8dd2c-8349-4988-940f-2ad7c2ca540f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500728, "uuid": "83d1a5f6-1cff-487d-8ab9-92e523fedf57", "value": "BJKH87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154f46d3-3623-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691523480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523480, "uuid": "ae096639-c2b3-4e4c-8b5d-521012531c13", "comment": "Malware payload (Mirai)", "value": "62038d156e7769d1691d110e524a2066", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523480, "uuid": "4e066777-535b-487a-b6cb-dbf3d0732b48", "comment": "Malware payload (Mirai)", "value": "b92dfc2d228287f0cab892d190efc95a1ad744fb07b59ab1822031ed94147945", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523480, "uuid": "91f5043e-9475-4e1f-8e96-c329de0dce5b", "comment": "Malware payload (Mirai)", "value": "b65ede1b7e5a5423f41d2e357e4a669341e3b225", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523480, "uuid": "38bae76b-2387-4207-8c2e-fb32b9bd296e", "comment": "Malware payload (Mirai)", "value": "6d00459e159e1e3b6b0fbc40de7b4e3e16a406b313d7ebc479bd60bb835d50515cc8fe11d71e8828c800443c6d6e114d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523480, "uuid": "71ab1639-2f74-493a-9efe-5f76242d8950", "value": "T15CD2E19CE656BFE9CD8CA57C09EE02266EC434C33A9C068E472384493A7E747FC1D164", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523480, "uuid": "6b0c9a19-8d23-40f9-9553-c2ef692525f3", "value": "768:11uUtLrVDsAp6tLkFqok//xDMfesVbJbiWUo:1bDs06t4fYpwGs5mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691523480, "uuid": "acc2d31d-ff16-4732-a015-ee3261b4895b", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691523480, "uuid": "111c4954-7b33-45f9-a1a3-428459b44269", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523480, "uuid": "fc738d9b-0d1c-4245-ab89-62b31d2e71da", "value": "62038d156e7769d1691d110e524a2066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8cb8d0-35b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691475897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475897, "uuid": "ea739474-f7d0-4cc9-84b0-0eeb1effaa21", "comment": "Malware payload (RedLineStealer)", "value": "0000309d6043e2a318c6cf55bdd5cf41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475897, "uuid": "e618b8f6-7358-43ec-a47e-b58c6cb755a9", "comment": "Malware payload (RedLineStealer)", "value": "b9458e5ccb3e716b7970988b9d2fdd2ecd3c77f57be0bae9e6ec9948f427ece8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475897, "uuid": "6366d598-1419-4fc1-819b-d6f06c749af7", "comment": "Malware payload (RedLineStealer)", "value": "96550a8fde983623769e8fd5ad4b7debbaa4556c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475897, "uuid": "e5501964-9981-489a-a7ff-5d1a3049dbfb", "comment": "Malware payload (RedLineStealer)", "value": "8637886acddf903195837dd5ad3e95887cae5dafdd798f8a91c35e17ecd003c6515b4b065f504361d39b84e2cf0394bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475897, "uuid": "7e8879b7-c864-4c1a-864a-208489da653c", "value": "T1BB04E658364BA9BEC86F483D9D700CD0767CAC631642A7079C8EF4E43A3B7919B151F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475897, "uuid": "b42caf76-dc51-4904-aa1c-172835f315ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475897, "uuid": "e1590b8a-725b-4f42-aa53-76e2226ffee4", "value": "3072:Zs8GVvoI0daVVHOQYJZVxPEHUYE0CE0XwTvHtEgJI8e8ht:ZsZoI0daVVipYE0OwTvHtEgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691475897, "uuid": "9df71688-6345-4817-a45d-284e24c79a21", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691475897, "uuid": "5e81e8ba-dc61-4d34-af1c-1d371731d85e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475897, "uuid": "2902dba2-04c9-4f2a-a4a6-7807443b22a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e28cbde-3616-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691517911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517911, "uuid": "d40876d5-eb40-476f-8734-94ddc2051c01", "comment": "Malware payload (Mirai)", "value": "47450616840855ecb67804422c150f04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517911, "uuid": "c04fa900-830f-438f-ba6e-a80b76fe5523", "comment": "Malware payload (Mirai)", "value": "ba5928e20d69d9975f082ca11c44d231526eb31f6c58d939c44594dc90029a9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517911, "uuid": "ce272d34-d7e9-4a3c-a015-23068e741749", "comment": "Malware payload (Mirai)", "value": "8349f15ab272b429b233e7da9be19e1285f98d15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517911, "uuid": "e06a7f87-d104-4352-abab-adc90b522d4a", "comment": "Malware payload (Mirai)", "value": "a01d2a637b34ccf21a0c70fe7040e77ac87ed3b02906416011ef3adaef9720778fe5dfe42a2f9bec10d2e26dca411b42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691517911, "uuid": "73c510a5-e3ba-48e9-8e08-9e8eb8429347", "value": "T151330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691517911, "uuid": "2993af5a-8201-4c38-8135-6efa19647fd8", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGC:r/hqaJMDg9eqK806MHdkfQX6HuCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691517911, "uuid": "f37f6124-7222-4500-b379-285511f42ce9", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691517911, "uuid": "2e30f46a-c83d-497f-9962-3db08481ebd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691517911, "uuid": "ea93d50b-513e-4bfe-8f98-8150a056e31b", "value": "47450616840855ecb67804422c150f04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509c9f00-35d0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691487931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691487931, "uuid": "5ce11ac0-c7dd-40ab-a926-4f31db27cf95", "comment": "Malware payload (AgentTesla)", "value": "056702792a4c47d46ac1c36170cd812f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691487931, "uuid": "ec13ff28-40cf-4b05-b92b-875b5455cff1", "comment": "Malware payload (AgentTesla)", "value": "bae13205fc47c30c47974aa9b9c352662130ba220e97e267054fd0c9ecb218cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691487931, "uuid": "ac01ca64-9ace-47d8-b941-bc405efa16b4", "comment": "Malware payload (AgentTesla)", "value": "9de1ebf452c12eb7833a5a5dcfc15b2412d87de5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691487931, "uuid": "60dddd5b-6c96-4a89-bab7-a4f478b43cfe", "comment": "Malware payload (AgentTesla)", "value": "6d9a32fc907fa5b19ced9a665380b33340890a322d5ea27addd39b93fc0e7f30dd995da699d476070b09446ac34633d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691487931, "uuid": "d898565c-2807-4cb2-84ba-8f72f6ed345b", "value": "T17F05F12D32AB8B4EC0BA7BFC5D256231C3F9AE563063D34A4ED374DA9C71B4448915A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691487931, "uuid": "63a6de9d-67f4-47db-8561-73739de2e5f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691487931, "uuid": "06edd6f2-426f-4bd8-9fb9-99b1eb4dcac7", "value": "24576:1JT1mOV/NOa8xmVKjOd9cCgNUtJTABXI:XTUOV/NOa649QNIJTABX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691487931, "uuid": "95703a32-3bec-48ed-a75c-f3633d9bfaac", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691487931, "uuid": "bc7f87fa-2473-4066-aeaa-da434fd31032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691487931, "uuid": "89f0e24b-b635-4c6f-b194-d5c76aecf9ce", "value": "bae13205fc47c30c47974aa9b9c352662130ba220e97e267054fd0c9ecb218cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28b6b2a-3601-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691509114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509114, "uuid": "78bcbf3f-e0b6-4982-8ec5-0daea05bfa26", "comment": "Malware payload (RedLineStealer)", "value": "807916e6b1df79788af9136127b8c969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509114, "uuid": "e163f759-c989-4ca9-b9a9-cae8e93129d4", "comment": "Malware payload (RedLineStealer)", "value": "bc3df4646e8d0ebbeb3dbcb94cea81a59f9d8eac7acc0420e9bc0f1144ee5f3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509114, "uuid": "e82e719c-5474-4176-9b63-d985de001272", "comment": "Malware payload (RedLineStealer)", "value": "3e38a92fdc06bf452eff0125a8b48ffd67e2e41f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509114, "uuid": "970eb630-72df-457d-b5bd-f6031b5385a9", "comment": "Malware payload (RedLineStealer)", "value": "c14988f0f471c73b28d601ea30b43d83102dc3b04b55522ca8d5aa403899950b1e911a253756f2669655eb7b3d6e0d15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509114, "uuid": "c71cb7ab-9476-4cf9-bdad-62c45ced8556", "value": "T1703418507C4C1521DB49DEB01C9BEAEE577ABD3D336EC34992228462FDD1BDE4B62208", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509114, "uuid": "eeb791ce-c62b-40c0-9bfd-510f455a003a", "value": "bcdd4d273da3ca6900ef6c172d455ed6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509114, "uuid": "bcbde583-bf07-410a-8884-fa0974dc942d", "value": "3072:fsn+amYKthK2NyyX0eua33Th2EDslI2GsYFh7XAh+/NOaLYlQnPF0clriOguz3N:frdYkhK1ehHP1llOaLyQnPF0clWuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691509114, "uuid": "1c2edc5a-833a-4670-8962-a367770b57c8", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691509114, "uuid": "d6175887-0dd7-402c-b511-c2a00bbe1751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509114, "uuid": "d6f9817a-46b1-455c-b7c8-e535a6076891", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ace1271-3635-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691531408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531408, "uuid": "1c8840ae-2400-4938-997c-c1444a298f30", "comment": "Malware payload", "value": "81a81af52752bd0030d319bb2756ff5e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531408, "uuid": "81ab5d12-5b98-4e08-834c-f5ca83067b4e", "comment": "Malware payload", "value": "bd0a2ea7dcd98ef78ac420e241db2cbf4646b7045a16b3adae02a606c91a5d63", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531408, "uuid": "359a9045-5436-4d3c-8022-fd3e058cdb89", "comment": "Malware payload", "value": "79e24d5cdca250ffd56324d79c5faca9f7f9f11f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531408, "uuid": "48a36e53-9e71-47f3-bdfa-e89d2404cb5b", "comment": "Malware payload", "value": "884ecff1bcd72c964c3dc06a0eb64c56f45a5dec3e60ab7656b80d6431484cfa88913d68298264af480ca79e8f2d6619", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531408, "uuid": "77378eae-ae71-427d-afa5-cc23f0eba597", "value": "T1ED92CFE4204AAA30E3F71875C9FC81EB13D94EB4C09774B639018B68A5C355B9BB47D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531408, "uuid": "2834d214-ec88-43ea-9f0e-12fb2ce363e0", "value": "384:1H4HEsuMPo6+cuUzqHg/yWlqPZONznPhymdGUop5hAT:1YHEhPR8xYPOPs3UozW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691531408, "uuid": "39344faf-2ecc-4cdb-9692-e5522972cb1f", "value": 19472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691531408, "uuid": "9a2012d8-f415-4692-8e14-6c1c6e6fbd48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531408, "uuid": "9dff7518-e597-49c0-89ea-d9464dcd8acb", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e320a6-35c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1691483481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691483481, "uuid": "1e46ecee-67e6-49be-b777-f2e737b17287", "comment": "Malware payload (AZORult)", "value": "1d7066e8915345654b28017ccfd4796d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691483481, "uuid": "55ce44d3-69d8-48a3-84d0-4d5b339292cc", "comment": "Malware payload (AZORult)", "value": "bd1c7ec15243ad6dd1da4a464403ed54498f36dd709247d95feb4d0193768b38", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691483481, "uuid": "60df62da-a011-4c09-aab0-f044afb56ef9", "comment": "Malware payload (AZORult)", "value": "0db8b93502e4db14f2b89698e576d22a87af1d02", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691483481, "uuid": "9959d90d-8b85-4024-893f-190124d2fcfa", "comment": "Malware payload (AZORult)", "value": "6512d4c5d0f504bb5d8065a4d995876188e6270c7189039fb4ce50a4ea941b13d7cb4b470c79aabb97ed7121b3c53022", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691483481, "uuid": "87ce18f8-5045-4dbc-81be-332dc550854e", "value": "T15EC533EE5E54CB10CFBE8E7F5B2971A845759500450CB34F630E2A96AC51C3B8B32BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691483481, "uuid": "7a64e3c0-55f0-4a3a-9d6c-067b021642fd", "value": "bc1e76d24dc4cdec92c0428ca370877a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691483481, "uuid": "0ecf8b5f-447a-4249-9bda-bb5c00c21d5f", "value": "49152:2R7QbbIxHYrpGNNfJsmJA4nAl9JFXIihHfVuIy29CIKyk4:pHIOpGNNhsmJA6Al9QMH9Q/y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691483481, "uuid": "a5762acf-8224-4d20-bb22-f7aa39badcd6", "value": 2547200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691483481, "uuid": "f1f197c3-deb2-4514-89bb-cc68be3eaae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691483481, "uuid": "731e920b-4dbb-438a-9330-4f5d62ae3148", "value": "SecuriteInfo.com.Win32.Evo-gen.22886.29060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53267803-35de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691493948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493948, "uuid": "2b5f0ad0-b520-4397-8f65-60af01d6f99e", "comment": "Malware payload (Formbook)", "value": "9bbab6bed661e858c568c87f22462e63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493948, "uuid": "7f6afb37-ad0c-418f-ad56-53cc03d9f956", "comment": "Malware payload (Formbook)", "value": "bd7648396981e710c1fab16660abff989bbf276e62b6928423855cf7cdf4d1cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493948, "uuid": "bdbf8b4a-c996-4cc3-97ae-bba71e034694", "comment": "Malware payload (Formbook)", "value": "e65a14ba0e78de16149966fe65b129b903a0179a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493948, "uuid": "630ee921-8d1c-4681-ad18-5e4762142c30", "comment": "Malware payload (Formbook)", "value": "f0d3bb54fba830df8ffa926d0df84cd88fd76c718603b979b2a8bb0030fe1bf317ac578dc53563631872d266b84d21f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493948, "uuid": "6eefdac2-8e36-4db2-a19c-cfa1c16f4fb4", "value": "T183E4DFE1A744C529D8A357B98836DAA76573A64E9C38C60C2DC2FF4B7D333060067D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493948, "uuid": "576c4296-ee15-48aa-b2c9-529eb7f50b8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493948, "uuid": "b9557fa2-b600-4b6e-9bc8-99a8939ce738", "value": "12288:of2iN2GULVaz6uFtloOM66Otxa6v5/6OEk0gmnN+Q04fMG42wdAA:of1xULDuFrq66Ora6v5/5K+afh6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691493948, "uuid": "b8de385c-156f-4810-afa2-f0184f814d22", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691493948, "uuid": "a03abce6-6fc0-4ef5-893c-8f7633a77fa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493948, "uuid": "d5c12d5a-812a-4932-b774-5f674e3ac435", "value": "bd7648396981e710c1fab16660abff989bbf276e62b6928423855cf7cdf4d1cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecdbf44-35dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1691493351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493351, "uuid": "e2650cc1-d4e5-4dd6-a9aa-6e2aa98f3001", "comment": "Malware payload (Stop)", "value": "f4658bc56d20b31adb00aa3a36dc5797", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493351, "uuid": "9eb5922e-2474-444b-bc77-065d4a3f119c", "comment": "Malware payload (Stop)", "value": "bdebf6117d598f14d49d5348c8b7c0d622f0038523ee529154cceb5c4b39851b", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493351, "uuid": "94862e2f-59cb-4460-9e3b-b12e015b70af", "comment": "Malware payload (Stop)", "value": "4501cca1f84c0ffa3794e036afa2b0d663a8f47a", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493351, "uuid": "0db887db-a50c-4f8e-811a-57c2d7105fa5", "comment": "Malware payload (Stop)", "value": "f14f195bdfabc8e20468f0813d122110b4dd93ae577baf550a2d099ee240c890bf56ef967eaa6bd41ee53fad2d4e8d31", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493351, "uuid": "dfdbb2cd-c53a-402a-a334-f13e87c9b3f4", "value": "T11935AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493351, "uuid": "0f75207e-340a-4a20-80a2-cf22810400c0", "value": "0c756c849bc7b459f78f7a5ce46cd4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493351, "uuid": "541695fe-92f4-4d15-a95c-74125b546877", "value": "24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/XRPOO8oKHUq7:F0dwAYZt6C31WeTPRPOhouUq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691493351, "uuid": "c279818c-0751-4a79-ae39-c3db82f4e80e", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691493351, "uuid": "72e1e897-d062-4658-a530-e2b73ea242e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493351, "uuid": "29bba81b-95d8-41e3-8206-0aa433451a86", "value": "2023-08-06_f4658bc56d20b31adb00aa3a36dc5797_stop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91969127-35ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691478591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478591, "uuid": "6a998554-850b-4b9a-a944-b57bb77ecb82", "comment": "Malware payload (RedLineStealer)", "value": "0bbdbb6b557206b0f4a2b40152b6e501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478591, "uuid": "f296c270-0c4e-4abe-8150-8db856393dec", "comment": "Malware payload (RedLineStealer)", "value": "bf556bc848f7d7b3fe7a3bd28fb2e02de9eb189d6445bbba9f02f68d81943031", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478591, "uuid": "79d25070-fdcd-45e4-a9d9-6c07dfd58fd1", "comment": "Malware payload (RedLineStealer)", "value": "523d46561d6c91448fa55a338749820e3109fc24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478591, "uuid": "dd6fe289-95d4-472f-ab38-f3ab78b56168", "comment": "Malware payload (RedLineStealer)", "value": "3da06c87f16bebbc0d3173bc7496828d5aee7b6966e9df5cd5b237b447a09c8be6fa9496cc688c852e918f0206255795", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478591, "uuid": "9f82f262-ff4e-4fc8-ba66-df210266956c", "value": "T1ABE41202B7DC5572D57517B0A8FB12D30E39BCA0CA79C3AB3646685B1C739A0A53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478591, "uuid": "1a93d660-a81a-488c-bd23-7a115a48c9bf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478591, "uuid": "bfd68d85-f365-4ba6-ac7a-b56cf166f091", "value": "12288:gMrWy90Ib9/6iD1HXr72sZDhJ3Kkx1+i6CyHceHRHjeRvjkw24EBRvIRr9:myF1/FZDhJakX+/c1tndE9IN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478591, "uuid": "73f0dcf2-640f-460c-8c7f-a4db0792613b", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478591, "uuid": "206d99fa-480d-43d6-a0c2-be8c675d14a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478591, "uuid": "b1214557-3b68-43f3-aea2-a872239ee2f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc59947c-35fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691506205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506205, "uuid": "351e2b54-4571-480e-bb48-8b354ea7c661", "comment": "Malware payload (Mirai)", "value": "5e761d75da88d191f4d2c7d6728ec749", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506205, "uuid": "a689cfed-b94b-4d6f-a2db-b4e09e9dbe79", "comment": "Malware payload (Mirai)", "value": "c0077317cd32913bd7d6d1f6ee643e46096d8dcb0d3af97d13de6387d7604e69", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506205, "uuid": "dc8d008a-6676-406a-b66d-4227fe6d54f1", "comment": "Malware payload (Mirai)", "value": "adf0f7c918413a5f2d09df7186ac171a2f9afbc0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506205, "uuid": "9f98910d-6f32-483f-a6dd-8491486342cc", "comment": "Malware payload (Mirai)", "value": "9c016ff9c67f6080850dd3209dd068730027db1896878c2b83db2b581e1b62c0d9d5767a43c858ec0defcdf3e1a7bf78", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691506205, "uuid": "1d3fb149-eb36-46dc-ab45-de686e668b69", "value": "T14F6302C086203473D0284D3988794F4F6E076BB0E5ECFD4A9B26569492E15032B7FDD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691506205, "uuid": "31de2d65-09fd-4b85-9fd3-58df578ea767", "value": "1536:Bc2GygzMaYePZBBmqhPXdDSoAlDKG08yELjQHjRX7:DGNJP3DPXxSz0BELjQh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691506205, "uuid": "f262e72a-13dd-4079-bd29-1637da645dfb", "value": 69384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691506205, "uuid": "731859a7-1d36-4e03-916d-504f1af08382", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691506205, "uuid": "b67300fa-9d1c-4156-8dfa-aa81b106c83c", "value": "VRarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7712eb8-35e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691495405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495405, "uuid": "bd43fa6e-a1b4-44a3-8c35-96799e8269f0", "comment": "Malware payload (Mirai)", "value": "956c4f15e69782d294da9b86ee992262", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495405, "uuid": "c1d2566d-0c1a-4acb-85c4-a4bf58b8c3c9", "comment": "Malware payload (Mirai)", "value": "c0cf9fd145882bf98a01bf650aa4964a1052533d923ec8d77620d6c8c9945840", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495405, "uuid": "bbd60afc-1a3a-482d-82a0-c885060880e6", "comment": "Malware payload (Mirai)", "value": "5cead8a54078475696fcff1629994a3781390142", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495405, "uuid": "d9b3fb90-bf99-4b77-b241-f43ffb032d76", "comment": "Malware payload (Mirai)", "value": "4f7a493cd3792cb1c3192af32ca6a698de9aba886da8490acd34316ebc24fbb81186bc4c96d8d0d680da6ddbbcd19005", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495405, "uuid": "ae5133bb-aea5-4605-96f4-b2db98172aa4", "value": "T13D230261890E8EF125303C76EA99D39376F12A71C6673123D6290A3C2FB57131E5BE4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495405, "uuid": "8b618af3-51b3-4d99-a9a6-e00fee969f71", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b309q3UELbUXfi6nVMQHI4vcGpvw:gECFd+A6YHAxdLRQZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691495405, "uuid": "72a68844-810b-4eb1-a42a-0d269f7fc395", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691495405, "uuid": "da875be6-4da4-4206-ba3c-8fc242459fbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495405, "uuid": "d24e35b1-38fb-4b99-83b6-2541b0c8e2aa", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5c11ee-3583-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691454908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691454908, "uuid": "c00e0d0a-75b2-4496-a6ca-5eb739cae046", "comment": "Malware payload", "value": "60c09568374a7cc6fde4472e2f381d25", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691454908, "uuid": "6639836c-5d70-44b9-8f91-df659b05924a", "comment": "Malware payload", "value": "c0f4ea0ef091c50c5e7219dc0944e0f01700dd23d0a37c956269ceb044e47264", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691454908, "uuid": "a5e55490-c614-4848-a74e-b4e29a0182bb", "comment": "Malware payload", "value": "1dc729ee188e1b1b0874675d67dcf90e0de34078", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691454908, "uuid": "195c0793-5e74-4ad2-975b-9c1ea049fea2", "comment": "Malware payload", "value": "72442612f07b0b229b997dc9d1a37ebea91c42e858eaaeecc3b4d63193537c39954449333381393a24e7a9016294e6dd", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691454908, "uuid": "a53d32aa-b261-4fa2-854c-dc59cdf5eb8e", "value": "T17F74E1AFA7087986CE1997B68436D67A22307C6167F4111D76F9FF3BA173207940B322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691454908, "uuid": "848d6bf2-8512-4b29-a755-9dc079e8828c", "value": "4329317f7ab113ac74b684563abcf41d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691454908, "uuid": "0315941d-2d75-4d2a-ad60-dd818a82362b", "value": "6144:6JOV4xvpsoZcMetN3wUpvwVP570Kk6NON77tcJN0LQKmfF5Ibxm:B2NqkWN3whVPjk6S7tcJNF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691454908, "uuid": "45180d3b-3065-4e5b-b8ca-6f65140d438b", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691454908, "uuid": "8ca8403d-23eb-4f9c-b769-b23d4b4f44ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691454908, "uuid": "f669ccf1-61f0-4316-9f1e-6e7d06bf21e1", "value": "60c09568374a7cc6fde4472e2f381d25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467f0fc8-35bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691480613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480613, "uuid": "5b83b169-616a-449f-875f-6aba15e10aa3", "comment": "Malware payload", "value": "e26e544560e4dd0075bdb5cdba53392a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480613, "uuid": "8dace22d-8d34-4f9f-8929-d1c77265c869", "comment": "Malware payload", "value": "c12a429b8f2e87dc05a8fcc324b5dae87495415bf7630dbb1fd58cb4d623abc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480613, "uuid": "7db36ed8-8f62-4a4a-b703-ee58293d9ed6", "comment": "Malware payload", "value": "4105657951ffd8496fe9b92ba54d72b056068ecc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480613, "uuid": "a2c71b8a-0805-43b3-9af5-26d0f85ea0ce", "comment": "Malware payload", "value": "69c86824e22a56fbacd1d0b9f514e07d7bdfe0f6b13b723ce34bc802a1da7a8db27783ef09bb475eba458491b588c6de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480613, "uuid": "490eaee3-98c6-4f7f-872e-cea81c22297f", "value": "T1B4C4F113748781AED326AAB51057D7F659F0AF632F2A3219A340BB1558F7EC46D0B323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480613, "uuid": "3adba021-38ba-4ea8-85ad-5317eb432bdd", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480613, "uuid": "3b06040f-3b7e-44ac-9acb-7c7d6d5dfb76", "value": "12288:rb3L1QJt1kbCOjC6fs6OA3Umc+gLB4Rq3TJWHo2CE7:rbCsTsDsuTgo2CE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691480613, "uuid": "72fd0b9e-3488-49ce-83bb-875e6bdec3f0", "value": 567985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691480613, "uuid": "81c8744f-c125-4dd2-855e-51353ca70c88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480613, "uuid": "5d1a360e-1535-4231-bf30-b44c78650c5f", "value": "e26e544560e4dd0075bdb5cdba53392a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bf3c92-3616-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691517916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517916, "uuid": "a9c1a5f8-2c9a-4e9d-8a4b-5240a96b630d", "comment": "Malware payload (Mirai)", "value": "827f603b7cf2cf1043b24df82bc03c35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517916, "uuid": "def14d38-d91f-4117-825d-43fa437a2fba", "comment": "Malware payload (Mirai)", "value": "c194493026897428296aa87e916a92cea3ee0a478884be3b9500ee81e8405f56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517916, "uuid": "2ddaf768-1199-4bd2-92dd-64954f8c970e", "comment": "Malware payload (Mirai)", "value": "f550df8a4179ba5b7b5fbc2cd9e6dbae70ba2671", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517916, "uuid": "b6901c85-8084-48ab-9bbf-b5e886136ad0", "comment": "Malware payload (Mirai)", "value": "2acfe49825440b1ebd1f11062f1db5d20f007247e20bd567aa09db82bb1294650cea24e88e65ac6aecaed7fdc0c6b9c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691517916, "uuid": "58376278-dbe0-41d7-9009-a889e028386d", "value": "T1E2432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691517916, "uuid": "a0e2192f-8de4-43fb-84bd-ea228a79c859", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwK:RqtmZPuutfbltZFBSJsBcfDSTFI+BEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691517916, "uuid": "773ca700-eb41-49ae-8945-f73d3d26f21a", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691517916, "uuid": "147259c8-b185-4585-9f1c-80898b635bd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691517916, "uuid": "3e7e07f9-d28b-4c25-a1c5-eee2d532ccaa", "value": "827f603b7cf2cf1043b24df82bc03c35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554f5ec7-35d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691491805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491805, "uuid": "d492ccbc-0dde-49ef-89e8-32aaacb82885", "comment": "Malware payload (Mirai)", "value": "1d06e81515a8452622b7e0facefde398", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491805, "uuid": "8c78b05b-54d1-4c30-a596-ab003d37f46d", "comment": "Malware payload (Mirai)", "value": "c310a54be70f32eddbbdf91be1568d15eb3189b3736672551ee01c27b2308006", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491805, "uuid": "6b3757c2-094c-41da-a6e5-4047f482229f", "comment": "Malware payload (Mirai)", "value": "8d20ba8206aee02dfd8507863ff308e12ac9da44", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491805, "uuid": "bdb88a4f-4b2c-4aec-a2f1-e8933a3b3893", "comment": "Malware payload (Mirai)", "value": "fd66c3cdc40c422e603886051d835338a2008e80b8ee23354b28bde9282f9d2e97c4e2bb56cd9552084de6657f34dd33", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491805, "uuid": "998cfb1f-88f2-4641-8ab0-def9d088ff50", "value": "T187C2E1E63E77395BDE35013D28ADCE375274E422C7AEA313A241520960071BCBB369DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491805, "uuid": "c153b8b8-7805-41ab-b322-88cc668f9aea", "value": "384:Mn1DMwk8JPyGYhDZREXVZVBy6sIye1iWLRYh4Sw4cGJYeRzOFGBzd8Q1eouCsjNw:CMwKDZOFbBy6sSHRYfeAxdd8GVuB40NQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691491805, "uuid": "d0b399a0-56c0-496a-b2b7-20bcc1bb2ae8", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691491805, "uuid": "337ddf3a-d0e2-4404-9232-7a801c88aa5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491805, "uuid": "59a0660b-f4c9-4ce2-8b63-5e667be5ad09", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9843c78f-35fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691506520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506520, "uuid": "a1ef2448-a108-4640-af95-d6004091f5a8", "comment": "Malware payload (Amadey)", "value": "c3ee25c18f2c408c9054d9c6d4c1e147", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506520, "uuid": "9092c84e-28a9-46c6-b93b-0099e0be7cac", "comment": "Malware payload (Amadey)", "value": "c406b733897d091408ed5a656cfbf043623a8d08092269918184ccefd87971f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506520, "uuid": "55e7ab07-6953-4ae5-993d-242974680524", "comment": "Malware payload (Amadey)", "value": "80d2395709b713647b199c22fdec5415d3a68052", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506520, "uuid": "88cf6bac-5721-4a56-a9ec-399c808cdc78", "comment": "Malware payload (Amadey)", "value": "82bc5a8226727975f6328e0788715d35c2ab5ff2f5f42728557004be96a4d70159cc3073f8d113dd0818d737e7f34931", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691506520, "uuid": "c85cfd78-6c97-40a3-92ad-1e80e7b46704", "value": "T139F519113AE5CD32E07A1632E9E9209443A6BD852A14D30F25C233FDD9B37494EE5F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691506520, "uuid": "e4849a4d-32bb-4888-bf7b-79b29a956109", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691506520, "uuid": "5859b27a-ca87-46f0-ae40-34179ad4f01d", "value": "24576:0cUe92VHXy4fv6hfZQGwSWF6r+tLq9rNE0TR5sTlcJxbTGX+tIonLiMjrWD:rt9L4p7GJEeR51TGX10LPjrWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691506520, "uuid": "26cd123c-a095-49b0-97d6-86d0241a5006", "value": 3358128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691506520, "uuid": "b303e99f-8756-4dd8-aaf0-c7feeda20dc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691506520, "uuid": "26a14dc3-4b8a-4996-8187-4ed3271097c0", "value": "c3ee25c18f2c408c9054d9c6d4c1e147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f002eff-3605-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1691510746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691510746, "uuid": "7a6e2a0d-4bc1-4c62-8fd5-0cf1fe56d1a2", "comment": "Malware payload (Tofsee)", "value": "d73df70fe2615db913959e1fe00af53c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691510746, "uuid": "d9dde943-886a-4883-ab09-39d54092e09d", "comment": "Malware payload (Tofsee)", "value": "c432b63967605eebc7e50bfc54cde5461678ff9f21804d31e1097e9ce32bac52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691510746, "uuid": "0ac2304e-4867-43a7-8dba-966a4a2a9dee", "comment": "Malware payload (Tofsee)", "value": "622b43769d1b672301dace6099f7ec363d4a8658", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691510746, "uuid": "084a01a8-79b2-4e9a-bb63-22af048cc457", "comment": "Malware payload (Tofsee)", "value": "8b7503e52ba8259ad3115e91f783fa3f39aa70ede81ae62d7ec699ba8cad1f668ea2955256c9195ffb66a9ee2ca52d2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691510746, "uuid": "19b14a4c-5821-4696-bcbe-f1b7aede798c", "value": "T138546DD366D07875E6234A327E2AC6E86F2EFC918F5577DB22447E2F09711A1C632702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691510746, "uuid": "a75a3d78-0b67-479f-8431-9b67811c0d61", "value": "52d0e35c520458543d7ae579063fd12a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691510746, "uuid": "214b5555-5b82-43f4-8165-a3eed1945041", "value": "3072:Tcp98ww14uzl+yxYFnplvcDkV951snWqbNDB5TMLTkjoiK5NYMXwC:AcwnT8sDcYj51snjV5TWTjD/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691510746, "uuid": "f2f349a2-6338-4e2f-bceb-29c549c949d0", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691510746, "uuid": "d836b1e7-61b9-4538-8ebc-0a4e12881fdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691510746, "uuid": "766a6ab1-1a62-471b-a86c-7862b8e32df0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60312e2f-35b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691477220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477220, "uuid": "48bb83ea-87f7-46c4-b37c-3b88c801f79b", "comment": "Malware payload (Loki)", "value": "860644571629d3bc44453d52224c1a06", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477220, "uuid": "26ab1f74-85f5-43a3-a543-91b653f109ea", "comment": "Malware payload (Loki)", "value": "c459445bbbc3c95295b1433dd235fce72948c8c4051d3992127236b4e9bff13e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477220, "uuid": "89a22956-d5ce-4dc1-820d-a6fa43a64c8d", "comment": "Malware payload (Loki)", "value": "07d466be281db2a289f6dfc4af4cd69995f7f5a0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477220, "uuid": "7e6e64a4-4344-456e-95f5-7198376d7b2e", "comment": "Malware payload (Loki)", "value": "2922454516341b115873af52fd473cda1db0da4ddbe45d2a7eafe374982e90308be7a9aa2d77b3bc6ba0e526005d31be", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477220, "uuid": "a469836e-d351-4262-9264-2fe421f4f0af", "value": "T13935E003E800DBC3D41D83F87E530ED91F0A6F19E99569EB05627F9B3A70A72099E52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477220, "uuid": "350e0fd4-e53f-4297-9666-bef7b4194549", "value": "24576:DRZyQw6VfZy5w6V4jKaWlEzp7aR9dlzZbtQA3Qp5EfIwMx:DbQ6VRJ6V4jKjOzUdHt/3XfI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477220, "uuid": "21f411c5-972e-40cf-a62d-7bfc17e1ebd2", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477220, "uuid": "29b9a350-c227-4657-8624-0d417854210f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477220, "uuid": "20864e3c-51bd-4173-8f00-22f895048e0e", "value": "Shipping Documents.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4202390b-35b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691478028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478028, "uuid": "6e331d75-1f30-42b4-9886-d04facd8fe94", "comment": "Malware payload (RemcosRAT)", "value": "aa8224b8818169f85a6cbf23fd26ded0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478028, "uuid": "fe9a7e2c-c031-4bbc-b10d-503c7614340a", "comment": "Malware payload (RemcosRAT)", "value": "c60d11fea5d4bdcbd8174762341be6b73fd99eb5f5c0c5ac26f50225c9d0c5cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478028, "uuid": "ce7b2440-827d-4b16-aa55-3391097c7a7c", "comment": "Malware payload (RemcosRAT)", "value": "6eb907a8e73874bf2e040531ddfa997055e6ac77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478028, "uuid": "a693368f-d5be-4e5f-9c93-4d97e01baf58", "comment": "Malware payload (RemcosRAT)", "value": "6b9c9abb1ca8f1fed19519fe0aaf93db494c894509d190851e6eba6b1230789cc0ea71cdf8387f93174c13ae7a2fa6ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478028, "uuid": "b0f1cfa6-15f9-4932-ba83-2458d319f067", "value": "T1D974232516A1C177DA478DB2DCA62EF6C737AD94D1E4854303933FBA3E731A20B1258B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478028, "uuid": "21fc48b8-6719-45aa-9e52-196565ea927c", "value": "076b06e6a65c9b7cca5a61be0cd82165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478028, "uuid": "8c67760b-bc19-4780-a11e-f21f6c01e60f", "value": "6144:2zAJFBOTqrHdSvdGyHan7tQvOZWSqPlHT5EzjXHn0fp2ffVsAPZpwCXzHSv8z:cCYTkH0If7t0OASklz5E6cfdbgCjQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478028, "uuid": "7c8d2275-d66d-4c4a-86d7-6c4c7a506365", "value": 337632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478028, "uuid": "f2b2403b-2bb1-4a66-b509-4e9d91a1e9b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478028, "uuid": "e23606f0-c9ea-42d9-b9cd-c2a7fe6c77f1", "value": "Befragtet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd276ef-35b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1691477025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477025, "uuid": "25f7b60a-c8ef-48c8-b424-36c3ffca1fdd", "comment": "Malware payload (CoinMiner)", "value": "4f0138b76666d40673be97ceaa9245b4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477025, "uuid": "396c6e31-a0e8-437a-9ab0-86fdc9386570", "comment": "Malware payload (CoinMiner)", "value": "c6241fb13d004daf47866e7429f16a386fce1675f15339e337145d59502e8310", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477025, "uuid": "e7a28ce2-551c-465d-9a0f-a2ba6a04db88", "comment": "Malware payload (CoinMiner)", "value": "fde6b65326786bea75741e09942fd5b375e07b54", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477025, "uuid": "f659b335-ea3b-495c-be91-7be564c04542", "comment": "Malware payload (CoinMiner)", "value": "4902088c23e249803edaecdd5b6a5a95dc22f3b0f7d4febc4bfd336b11018cbeb5210911a6196cccbebbb6ef4acf8653", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477025, "uuid": "8f5de136-c789-4913-aecc-974e0b2b34ac", "value": "T10E63F72C23FE4534C6FD1F726529601884B9A4877953C29F4EC8E8CA6B63BCA03557E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477025, "uuid": "9ae5fd2a-8913-4db4-9f66-47ddccd5dcba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477025, "uuid": "4771bcce-6c21-4e88-9026-259bc02714aa", "value": "1536:KPmzSPseKLZdWFKy6W3AyMAfgobU/gW8x5mMeP:qmfL3kKXuAyJgobmgW8zeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477025, "uuid": "5790939e-d909-4ffc-85ca-382121d9b804", "value": 71548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477025, "uuid": "f5904987-08df-4820-afc9-1b1d69a3e089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477025, "uuid": "01ab5268-6cc9-4711-91c5-cdefa778b77f", "value": "4f0138b76666d40673be97ceaa9245b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10379942-3591-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1691460765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691460765, "uuid": "a5895ce1-105e-4bc8-97b1-991eefc6e9af", "comment": "Malware payload (ArkeiStealer)", "value": "5c3d28d428bb30d59eb8ff498540a5d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691460765, "uuid": "6a2afa47-0535-4e3f-ad18-def8a8323c60", "comment": "Malware payload (ArkeiStealer)", "value": "c65843189ff4683d957d94ad74b7a455a96736a51d66716182208c45bdb08c55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691460765, "uuid": "9cc1904f-f25f-4ee3-9125-45207b9cb6b2", "comment": "Malware payload (ArkeiStealer)", "value": "676859d7a9d8b6a44e0fcd1384284aeb0a37f1a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691460765, "uuid": "92a6748e-3bf0-4735-8af9-4cec9cbb30f4", "comment": "Malware payload (ArkeiStealer)", "value": "21cdda9d3e39776166f008d79a9b0706ce541b5d41e7777df64eaa4eb87f40c33cf7f26a22579ea6b4973ee7778e8640", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691460765, "uuid": "da0f7b40-cdac-4780-984f-3e20b63a48dc", "value": "T14FC4B00B89994D9BDBEEA5FB2C5CB6953D93F4241740411E7CD814EE8B6086B3D2EC32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691460765, "uuid": "a2ae5063-aff6-4c10-b887-be1244c71169", "value": "035152f08fc01104c539a9694e78d939", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691460765, "uuid": "633de6ce-3174-43e2-a165-3bbb70f62308", "value": "12288:o+Gj+NagcanPVUynnIe26AL560FgkMKqWST1XH/KtBY:otjzjanP2+o0BpDRKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691460765, "uuid": "2150f045-7122-4813-b352-ea84092cae60", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691460765, "uuid": "5c0ac162-84ef-4554-b2a6-1b608ea5f158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691460765, "uuid": "1091e046-dd71-442d-8217-f4feb31c2238", "value": "5c3d28d428bb30d59eb8ff498540a5d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983e9b3b-3609-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691512533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691512533, "uuid": "07c768af-d5a3-4800-a29e-be469587bf9e", "comment": "Malware payload (DCRat)", "value": "145db42cdf890d3e8c738760eede4620", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691512533, "uuid": "4bde320c-1e13-4c94-8212-7e5e3e326372", "comment": "Malware payload (DCRat)", "value": "c788cd33585bd77221b645a9fb5cf834955ba10e9ccba3c6d0df57c26ee7cb9d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691512533, "uuid": "850dde18-a89b-4382-b96d-54ad5b11f2fe", "comment": "Malware payload (DCRat)", "value": "3adce4a51723fb5d6deb5b03af8367aa194f058b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691512533, "uuid": "4ce4fcaa-396b-4828-a449-699570b54d54", "comment": "Malware payload (DCRat)", "value": "6b5ea52c1fb7d3c4f5da823b3ff50535586d174b5c335a1fd18ca457762f2890e3dbcf56bad6d3d743a8b303ccdd75e3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691512533, "uuid": "a5b82bcb-d24d-4aba-bd0c-ad8de0138358", "value": "T193C69C292CFD19B7D066CBF68FC8D467F621D2B622521A3A288B47544707E4B2EC317D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691512533, "uuid": "4a2f0277-ef57-44f0-95d8-d894dee50c40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691512533, "uuid": "c3c8aca0-65ce-4666-8168-9581af60f2bf", "value": "49152:q+UNQmGuOIGyXC2huGO3D2uwpiI8kvA4:q7amGuO1yy2hrwWpiavA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691512533, "uuid": "b13548f4-14cd-48e3-b5e8-f67145fd649e", "value": 11718144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691512533, "uuid": "148f4626-4f4b-42b6-b8b7-195e205a4f1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691512533, "uuid": "94ca0d7a-99c5-4fe5-bd9e-e02398e8aea0", "value": "145db42cdf890d3e8c738760eede4620.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6a742b-35c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691484112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484112, "uuid": "872eed40-4fea-44c4-9b52-396617869bf7", "comment": "Malware payload", "value": "eba9adb24046ff8b2bc8615096a8bb70", "object_relation": "md5", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484112, "uuid": "c4bf08b1-4544-43da-9a92-3e54331a8418", "comment": "Malware payload", "value": "c88eab30fa03c44b567bcb4e659a60ee0fe5d98664816c70e3b6e8d79169cbea", "object_relation": "sha256", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484112, "uuid": "284f77f6-52cd-4f5b-b426-6c54080360d1", "comment": "Malware payload", "value": "f5b55992672decf55ac919898d448244ed69850a", "object_relation": "sha1", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691484112, "uuid": "ea8d37eb-d560-4d48-99ea-d1d94df6b8ea", "comment": "Malware payload", "value": "4524a9f03d6b4d28af6451684c3a61b23283a34e3daf60633c45fe1c0b0bda88b337b3b9e7cabf6f440c13edccf02486", "object_relation": "sha3-384", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484112, "uuid": "5d72008b-72fd-4581-94e3-e733cad88f43", "value": "T1CB85BF698EF1455A2CB7E9A453BDD980C164E0B1C618B73FD4035CB49C88FF3BCAA664", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484112, "uuid": "a9f740ff-7cc0-4302-9fd3-aee5673c9326", "value": "49152:Hlm+b210sEp9GHQkAy5Y8yy1kIdEpahwA5a:k4R32Qk/Y4kIdEpVA5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691484112, "uuid": "ec8a0989-f268-4865-be00-556b3cabf4c0", "value": 1850138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691484112, "uuid": "3526d305-4c7a-4779-a22c-21d3ad0c30fa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691484112, "uuid": "56cd5f44-e019-4f61-9d74-fea103bce11f", "value": "c88eab30fa03c44b567bcb4e659a60ee0fe5d98664816c70e3b6e8d79169cbea.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08f078d-360c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691513969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691513969, "uuid": "3ae97fbb-9688-4d7c-bfb6-11637d101901", "comment": "Malware payload", "value": "790c519cd25cfc22ef2ec4ac8daceb92", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691513969, "uuid": "beeaad47-92dd-49f6-9602-c112ac54a2d8", "comment": "Malware payload", "value": "c8abe1e1b31df61efdda905a29639f609ae3d61655102cd8d328284995d7758d", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691513969, "uuid": "e13f4161-5ae9-481a-8942-7489f637cb09", "comment": "Malware payload", "value": "e621b93069ebea960267601fd0520146f1ca1976", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691513969, "uuid": "91b6e2ea-b188-47fd-82db-8d742cb22176", "comment": "Malware payload", "value": "f63434c116940d3811f35959234f272b0609e4184249a4c5b5155097b57383df656665f6ae85252222b431796330be97", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691513969, "uuid": "59bd29f6-7395-4c8d-bd62-af31e432766f", "value": "T1B9A533134B329EC4E423317B6CD57930FA6D9236B9627E7CC25ACA8720D8DDAC96CC04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691513969, "uuid": "86396b1b-d045-4a37-80cf-664ef8ffbf53", "value": "49152:OcqtE+5PWZMB1qEzda5D/GatWTjvE/OOKncjznXi:OVtEgPdiERqpWvMOODPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691513969, "uuid": "7976fd5b-9556-462f-96ba-c796488cc281", "value": 2190806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691513969, "uuid": "83063a71-a802-459d-8e27-86dedecdfc5a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691513969, "uuid": "8864a0bf-a63f-4011-a6bd-6381ae8a8844", "value": "spokesperson.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c5c92c-3623-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691523484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523484, "uuid": "21b955c2-cbea-4683-a1a9-67b5186bfa01", "comment": "Malware payload (Mirai)", "value": "422ce225607302cb89c2a87964c30dc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523484, "uuid": "3409d876-a2ed-4493-b2de-6a7d337d081a", "comment": "Malware payload (Mirai)", "value": "c9948c7256326b723b2ff5af47f3d7bef32ac2aedc5d7b2cc47d43773715f7b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523484, "uuid": "9ea52de8-f3fb-43fd-9c61-712b63400234", "comment": "Malware payload (Mirai)", "value": "3a55c110e79dbdd4f2ab910a03e0bec90791a151", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691523484, "uuid": "6371424a-ef3c-4415-abf4-c436f361ed1a", "comment": "Malware payload (Mirai)", "value": "cf347fbdf9282917f57fcaf6e6c8b32e45ae80779433f7e33412ea15dd698865c7f650171957d5be66550147e86d4a44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523484, "uuid": "af10ce7b-9ac6-4932-9c3e-013beef12c38", "value": "T11FC2C0E6E55D1F4AC7FF54B32E81CB9073942F097338C9AA6448F753162D926AA02AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523484, "uuid": "264a26e8-6877-4cfe-85d9-3d976b5704f3", "value": "768:1qMkNa3MeiQoOX1UO5sHLSI4uVcqgw09m:agMetbX1UO2H+I4u+qgw09m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691523484, "uuid": "6846a58e-1643-4d00-b8eb-9e572f0fce10", "value": 27056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691523484, "uuid": "fa79bd1b-3e73-436e-b329-14c80b583398", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691523484, "uuid": "977e71c4-5fef-4430-8e5c-a132332a6e98", "value": "422ce225607302cb89c2a87964c30dc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8c094d-35dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691493728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493728, "uuid": "f3e523aa-187b-4d08-ba05-9706a62cc94c", "comment": "Malware payload", "value": "596d5aa3e4494c995c3379623b18856f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493728, "uuid": "3fbd00b2-1b13-4428-a5d0-a97f55c30cdd", "comment": "Malware payload", "value": "c9cf50feecc2ff17b094ca7b4577868d2a3d9d0cd58e1b6f3d59654005df9c10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493728, "uuid": "e97ae4c9-de04-4591-81a4-2cfb170b8eb0", "comment": "Malware payload", "value": "3d9573d58c7a41ae5aed29e5a01bd0c2ef2a111a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493728, "uuid": "161e120b-d3cd-4716-9cc8-a8765b30b112", "comment": "Malware payload", "value": "bb8a864139673ac40a05ef1bfa05cfa06d34b1dda66adb4eddc0ffa745a81f5980bb11ee09373b5f4ca82589c246c7bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493728, "uuid": "64cef179-38c6-42ba-8464-68e8c4da4288", "value": "T148F1B662EBE88636ED770B326CB35240477AF785CC67DB2EA484510B5F7374149A2BB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493728, "uuid": "e5cd3fd3-18b7-4a02-b85a-b85f397e7eea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493728, "uuid": "321c5707-bdfa-44cf-b3db-cc36f18467d8", "value": "96:ZiB3JHjnczmKhKxkCPFolY9G2+o9z+4+vFNXXDGFcJfSaUs18o9pUfiixtzNt:gJDkmKh6D8215pWFNDres1X8fXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691493728, "uuid": "42ae0d67-b596-4a29-9f51-3b73e531d95e", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691493728, "uuid": "70b3e474-00a2-45dd-8796-1133f0ea6d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493728, "uuid": "cc30a2c6-9e9d-4a1d-93f7-dcc4532bea9f", "value": "c9cf50feecc2ff17b094ca7b4577868d2a3d9d0cd58e1b6f3d59654005df9c10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc4c898-35b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1691477268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477268, "uuid": "533010a3-f4e5-44ae-a92b-c541631e7703", "comment": "Malware payload (AsyncRAT)", "value": "0f0d1ffc614418954823dc5a1ef2ed68", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477268, "uuid": "b343bd2b-05ff-4511-9eb9-2145071b8e67", "comment": "Malware payload (AsyncRAT)", "value": "ca16c541bbb3cc2b1db8fde1c3b066a201dfe8fa93c2135e837dd60393d828a7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477268, "uuid": "46310e30-39e7-4156-99c7-7ff36b15bb6a", "comment": "Malware payload (AsyncRAT)", "value": "4203e94a5beee4f94ad212be7ca9272e4c11c599", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477268, "uuid": "66a14eb1-9cbd-429b-9b2b-aa6f1180819d", "comment": "Malware payload (AsyncRAT)", "value": "bf93093d54881ecea3f3f13e8e13763e07e406d07503d27a5e0ab8a9bcbf693c87633d2e8c5a66b8dfcee6c96fd90f62", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477268, "uuid": "39de207d-8ecb-4fe8-b1d5-e41e074220c3", "value": "T104D3E0147BB3D479E36248351D9BC6E177247D488E6982077647FB2EAC7E2A8CA0C7C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477268, "uuid": "805f034b-b255-4d30-8e88-7a6c1619c44c", "value": "3072:C9llhodmSFSm6W6o0MCa+55ROTgnN4Glq:Crlh07F/6ACB5LnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477268, "uuid": "8922a4be-0367-47ba-a080-2141c0459e88", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477268, "uuid": "6752f837-2da3-49cd-9136-12968400741c", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477268, "uuid": "b46d4480-78e1-48bb-84a7-88d3abd9f133", "value": "MENSAJES SWIFT.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef05a911-35b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691475312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475312, "uuid": "50332e72-5a82-4a6b-b51e-57669e282d04", "comment": "Malware payload (AgentTesla)", "value": "c07b11daf27add4253f3016ec0efaf6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475312, "uuid": "78bfe6a4-6a7e-45ad-ad06-0aea8c8f2fbb", "comment": "Malware payload (AgentTesla)", "value": "ca795021776edc15ad2b9e926478634c9d0516174f57c0c68872ad1d6f2da97e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475312, "uuid": "f8d4457d-3db8-47a3-8117-0d3231bf65a4", "comment": "Malware payload (AgentTesla)", "value": "dc637cf1f46bff8c2a8f13bd9e6fd0cda4f0fedb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475312, "uuid": "7da25385-cb7d-450d-9ae0-40ba5512ce77", "comment": "Malware payload (AgentTesla)", "value": "0a6c118975bc79cf19846fb7d9097905fbb416f93a3e374b1061f65197b5457cb6e009ad8f0774a7cf8a3a0ca13af9cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475312, "uuid": "c4901aa0-fcc0-409e-ac5e-9ba11566cd17", "value": "T12D353921E77B655AEF29A5E89E1F847239D5DC80F1B1C488BBE72C0385C23514E35BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475312, "uuid": "091d83ae-1a6f-46d1-b119-dd43bf9a95f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475312, "uuid": "6076ba45-1cc3-4ef6-82bb-669f0abc1034", "value": "24576:q1I1R1I1nRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOlOguPhhRRYJjB0:qGvGRRs6CE3jLbO9Rs6CE3jLbO7upPRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691475312, "uuid": "f66c670e-b879-4933-9f5e-65d59e6dc157", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691475312, "uuid": "a40bfb64-c609-44e8-b923-98f812c46631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475312, "uuid": "b7d35606-44d8-47f2-acff-ffa6e2ce73b9", "value": "Payment Advice - Advice Ref[A1T9IvYc5tfi] Priority payment Customer Ref[PT3000030881A].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738d7b5b-35af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691473816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473816, "uuid": "cfd5be21-031f-41be-a035-23c45706d976", "comment": "Malware payload (Amadey)", "value": "b9333b9e3925983e07757b06f5e95572", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473816, "uuid": "0b0d950b-d333-4912-98b4-e8c23f3e3593", "comment": "Malware payload (Amadey)", "value": "caaf2ad88abd9d91104a3b0254448dcab24a59dd0459ef5cf170aabdf2d29b1f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473816, "uuid": "69633a9c-4251-4e4e-96a6-e8bc6595406f", "comment": "Malware payload (Amadey)", "value": "ee365b47b05bdd5e7335da0b45cd81ba23eb3d6d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691473816, "uuid": "6b7fbbeb-1df4-48c0-b478-1070bbc705b0", "comment": "Malware payload (Amadey)", "value": "91706b084ac2c314fe4be3538ad7b1b192f1c7d53c62881388edf537ce6d6546f11e52bc661bf6db4bc6a7172db132d5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473816, "uuid": "4a7b6597-1f29-4785-9785-2e78bc980274", "value": "T14B546D12E6DC6B62E5E28A324E2EF6E4571EFC918F1937DB124C7E2F08711A1D176702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473816, "uuid": "429f501c-9781-4221-b9ae-5fae2b44e178", "value": "7574067d27f1e097e97a79381564790b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473816, "uuid": "ddbf9d76-b98a-4486-9539-c867844f7d0e", "value": "3072:m20c3p9yjcXg7+I1ZMgSFId0ok1dTVwbvU9CXHNcHbK4jkw:5D3yGgisYF0A9VMUcXHN6bK4jj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691473816, "uuid": "78c60083-47c5-4c44-abfd-610de0012726", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691473816, "uuid": "4412ce60-58e7-4819-9d9e-87e7f6d72231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691473816, "uuid": "b0ffc2a3-0841-4c0d-8c65-e9ef9588dc9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114770fe-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691478806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478806, "uuid": "ec62f968-c297-49a0-8290-2822b8f3f511", "comment": "Malware payload", "value": "7d7dc9605abb03a2c0b598797926d1ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478806, "uuid": "d5cf9ca5-e6ea-408b-94b5-260be107b5f2", "comment": "Malware payload", "value": "cc3cf05869bb2d5c82c3c9ebc92853d4125dfe01199bead4efaea035a0d4d639", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478806, "uuid": "87eee22d-9db7-4d97-b88e-d082aa19dcc5", "comment": "Malware payload", "value": "6744c5a8ee9d2be8c750f2b95661d2aa9e54e26d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478806, "uuid": "cd5eeb61-077d-4bf1-bbe6-85fe2cc68db8", "comment": "Malware payload", "value": "038426fe50746ffda4577dd52698d6cd8edeca5a31c75105c0ca055b38f679b3a368d669ee817baaf035ed1300c81a64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478806, "uuid": "3c5825e9-6873-4ba4-9d9f-f5fbb7cb58a8", "value": "T1A8C523417A819032DAB2183555D2DB366B7AFC304F3A4ADB5B44671E9B700C0EE7E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478806, "uuid": "bc1c144d-6c35-4165-b2b3-1b85f7c0e403", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478806, "uuid": "33984728-4e9b-41c1-a624-168e0b346ed6", "value": "49152:8cbi6c/dgkp0TXw58MWzl3r8yjMCQyr3DpaJ7Vxpmd2l38z4aF:8cbK1AI8BZ7jMCQA3DpaJ7/L+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478806, "uuid": "47d28b4f-f3dd-4f13-806d-06fcb2712624", "value": 2613316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478806, "uuid": "09505c40-5606-48c3-aeec-4dd42694f41b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478806, "uuid": "f146c82e-8d1a-453f-8942-25c5a8b6e9e4", "value": "7d7dc9605abb03a2c0b598797926d1ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b7ae6d-35b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691475704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475704, "uuid": "308f073e-19bc-475c-ba8c-f876220aa431", "comment": "Malware payload", "value": "f315cea9335f7dc21f0b294778313764", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475704, "uuid": "6933b69c-4800-4a67-b079-f5459048de29", "comment": "Malware payload", "value": "cc63d98bf382b7c27e9921e53fad344d821abf4818a6a777e0064c962df9901e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475704, "uuid": "a3ad0c8a-07ae-418c-b5a5-dd4a8276e752", "comment": "Malware payload", "value": "9ea0c35c854ae27b08f9dcaf72c755ba26992a38", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475704, "uuid": "c90ac752-92f2-4e2f-b6f7-fdda153d7b94", "comment": "Malware payload", "value": "09ad3ca1ebd97952d6ce2cbb2ddf31e2c77ff650f0e9cd59e025b731298042bcd241b3849356eb7bd17349d211fdf37b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475704, "uuid": "3d0fbb61-d5ef-45e5-8cf5-0703db10ddd0", "value": "T1A82423488C35090B121AC77B3C6E17AAAAAF05D06289CC4A90958C7F54473796FFDB4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475704, "uuid": "17aa2028-2cad-4659-8614-edcef47feec9", "value": "3072:vCUUqVJlJF3z1HfBO0rvVV/r4Nh1b5jPjnZ2tG9NOEp/479OA9J7AX3y9B7J0bDu:aUUqV7jdZHad7YtG9vg70eBWUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691475704, "uuid": "9afc5ec8-d1e7-4e35-8cfa-ed0d729ad42b", "value": 216128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691475704, "uuid": "b283bc09-6543-4592-bbfe-845f09d6fee4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475704, "uuid": "854d3bef-363d-4697-9de0-d1bbee4f00ff", "value": "AHEwSVkC175.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61338d3d-35ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (zgRAT)", "timestamp": 1691499126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499126, "uuid": "dcda736e-2fed-4fb1-8f45-63a132a733c2", "comment": "Malware payload (zgRAT)", "value": "cf98c4f6d02404b15748d44346cb1da7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499126, "uuid": "e55bcefc-16f3-46bd-9395-d2bdf497e9b5", "comment": "Malware payload (zgRAT)", "value": "cdcca2d1c840c08915debb2b0d83764bfb447369d476519b8dc0f61bc000d08c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499126, "uuid": "4b6e9be4-3401-489f-81be-7faf653019dc", "comment": "Malware payload (zgRAT)", "value": "74b26598f6dcbb6d68b876c233576dc4d4d5252d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499126, "uuid": "9718b5a8-0ba7-4ed6-bb2f-32b8a51f8bf6", "comment": "Malware payload (zgRAT)", "value": "e531972391fa6b7e38506578ae72d47c230769c72728f361509fd8871316fffcffb51f9a353a5c678b95a76578d5f4d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499126, "uuid": "0b1b3951-a8c6-44cb-ad65-ec13cdf0003f", "value": "T128143C46EBFAEF30CF28153FC29573245F7E1EE141A2BA4A344CB2642DBAE449444797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499126, "uuid": "34730cae-d8be-4841-ad54-9c303a5d5cf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499126, "uuid": "4f331b3e-83ff-47cb-ad3c-949a2f6c3906", "value": "768:7Xe741MDfhe6JYpNoxU5alvdLsKt0jzr+gZQwxRJES0JXtghVm13j2tSHPWcaaYN:76VDk6J1O5alvdLso0nrlZtxISl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691499126, "uuid": "d345c3da-3c2e-4453-94cf-376dd37f518f", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691499126, "uuid": "81ba5646-2dec-44e2-99fe-d3248b22cdeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499126, "uuid": "a12f617a-56e7-4ff4-b325-d78ee780b572", "value": "cdcca2d1c840c08915debb2b0d83764bfb447369d476519b8dc0f61bc000d08c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1602c28-358a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691458109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691458109, "uuid": "a50d77b9-6b7e-4a70-b370-fe156e55d1c0", "comment": "Malware payload", "value": "089428711dddec20eabf7732eea8fb8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691458109, "uuid": "0d013d6e-9e58-434b-b136-da990ccb4dc3", "comment": "Malware payload", "value": "ce6716a18c07d64059b961034a2ca46b1cae66892885d9e63063a0726a391461", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691458109, "uuid": "69ffe062-bf8e-4165-8981-152f417931e3", "comment": "Malware payload", "value": "6af845c71d51350dcd7d3ea5915a0649e8408f02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691458109, "uuid": "ba2e42b4-558f-4004-9768-6b9c600fb64a", "comment": "Malware payload", "value": "24a4295c5be8d4fe5a3a2b0af9a5d4b746a5cdf9ff8ff4e5b34cc69dcf5da36ab733d350fec1255f2d3cde7a0abd5aeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691458109, "uuid": "f1a9e8da-b2f7-45b8-aba0-356628d3c0d6", "value": "T1D81639342DEA602AB173EF699BE478EA9A5FB7733B0354AD109103864723E41DED143D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691458109, "uuid": "9c9fdeea-3f89-4aca-999e-b2ae5e95f565", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691458109, "uuid": "c1bcd539-368a-4065-9973-9d7a76c13ab5", "value": "24576:qozi/cws4dKqNKN59W8JY/AJs8tpfL3ZBXNXBfllfXRzQHwzHwcMZ5sm/IRImfwE:EcGviAWzrN3rzjWAkHpxMjrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691458109, "uuid": "1646c684-4e6b-466b-91cc-24b18688feef", "value": 4300288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691458109, "uuid": "2009e567-25d3-4b5f-bd49-1ebd816604f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691458109, "uuid": "da4c24ca-1446-42cf-a640-827f6a4374c3", "value": "089428711dddec20eabf7732eea8fb8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0a72d9-35fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691506207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506207, "uuid": "2710bdb8-8337-4083-b106-6c2406398903", "comment": "Malware payload (Mirai)", "value": "06b629f553ab198915bb1c8447638f32", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506207, "uuid": "4bb9386e-f3e8-438f-8f58-fb04d8c10a37", "comment": "Malware payload (Mirai)", "value": "cec15d60d6c485bfd687eb9658b67b3163d207c0fb3c663a2188f66879a00dd5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506207, "uuid": "a72ad84a-916f-47de-92c0-0ef99d0328d4", "comment": "Malware payload (Mirai)", "value": "a89e9405e05c1821e47ef09a4c9cce40bfd79e8d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506207, "uuid": "ce188617-d4eb-40c9-9577-75a95921d78a", "comment": "Malware payload (Mirai)", "value": "574d543240e5fe2fb98e5a9148da18ae4ca9fbdb95bbd40e25846561137f8b47e3f4e716cb91739fc4c11cdb0f3d050a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691506207, "uuid": "68ee52f4-7f8c-4950-b257-5cea1c01d9b5", "value": "T1AB13F1653309DCD1C7B46C38CD3D9390F554AE64EEBD72360AC443685AB17873EA821B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691506207, "uuid": "58fb4e82-6b2e-4e80-b71b-c16568cd556f", "value": "768:eEqafb7sG2ggaN65OhMf5W05gEMQR1QvJPz2rphyxbpEbGjswL8UWZs3Uoz4:eKugEgOf5W091ezCpk9EiowL8kz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691506207, "uuid": "3a1b6417-95fd-4bd5-a241-1ea6c5942a96", "value": 43412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691506207, "uuid": "80c5ca7f-fd35-43b8-b32b-a6095b928102", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691506207, "uuid": "b1867ac6-5c33-41dc-8a58-d45634636cfb", "value": "VRarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d406d6f-35b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1691477215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477215, "uuid": "812ee748-c295-48c0-b30f-bd9f4d76cb2d", "comment": "Malware payload (AsyncRAT)", "value": "f3babdf5425d5b040e1d0d6a964ef839", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477215, "uuid": "6a571f0a-e3d4-4e78-9d30-488505e89e8b", "comment": "Malware payload (AsyncRAT)", "value": "cf3446d715f387885ce9dea26a9871aca80593a8a5ec081bbd98f9a79ffb6bee", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477215, "uuid": "90c41a39-da5c-45ff-b718-e47d355c5e24", "comment": "Malware payload (AsyncRAT)", "value": "37f3762c62647b7292334c4cda204733fd2acf2c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477215, "uuid": "1037ffde-87b4-4407-bce7-c98f90063676", "comment": "Malware payload (AsyncRAT)", "value": "8f91cd8bc5a9a9c00e2e7525e4f2934d5adb017c46f20c34c6ba9f35ea04a3d28f671d86f649a365dd196adf1159a8d0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477215, "uuid": "f72d1eb4-ea06-4f53-9a7f-ed3c8e78033e", "value": "T1EED3CF2877F7E4B9E32044741DC7CAE46A657D188E9247073686FB2EAC3E524DB0DB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477215, "uuid": "8aea12aa-eb33-4ee9-a8a5-f3abcb9089ef", "value": "3072:y2kLbg5S8mQM7O69vspZI4QUJ7neKzlWlpN:y2kLbU16hGtQUdef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477215, "uuid": "85b3161d-a2ce-4441-b97c-5a940de2e4cb", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477215, "uuid": "b06e6822-2baf-4dc6-917d-2399050ff9cf", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477215, "uuid": "5b787aa3-5fd3-4c14-972f-6bcee18d0816", "value": "OUTGOING SWIFT MESSAGES.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8f6d71-35c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1691483170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691483170, "uuid": "4dc4de63-2942-43aa-83a1-cb4f4a791b93", "comment": "Malware payload (ModiLoader)", "value": "204a42353fef2268a299cab3c3a3ac13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691483170, "uuid": "8f4c4672-fb2d-45f8-a0cd-ca7b5cc0bc71", "comment": "Malware payload (ModiLoader)", "value": "cf88620c3c0e2ff7cf3f6b1676ca6cff10bb65abaeb95b73dc0ccc378a7023e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691483170, "uuid": "267ae368-d808-4671-a0e8-1922e474c16e", "comment": "Malware payload (ModiLoader)", "value": "2570dcc7070de000776b98862dd831a0b9480ae5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691483170, "uuid": "a6e8485e-9574-40cf-9cce-230cdaaae4de", "comment": "Malware payload (ModiLoader)", "value": "e72b3005cf7085c3c3f47d0a0172c7ee5582aefc267053277f9d78c6d85bd03cfca1fa74fbee44182f7a7160db2b8ecc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691483170, "uuid": "98a40220-5ea7-4015-a4ec-b4eca093a76c", "value": "T1CC45AD32E6524833E2B6057C4F3B1FF45C2FBE73592859456AEC78B96F2B2402839167", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691483170, "uuid": "84defbc1-ffe0-4b91-a04d-93ae18ef7292", "value": "a4dea6841158221e1f9d51cae1534166", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691483170, "uuid": "b12b3e60-0917-44ae-9343-cf1dc7450dd8", "value": "24576:O+wrBX18XhVRGTbabra2OYSuf9PhHt8AE:OrnHQKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691483170, "uuid": "fa07fdc4-73c4-4090-8fc7-4e78e64797f8", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691483170, "uuid": "bb83fcfa-89cd-4b1b-bc3c-8bf65119c369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691483170, "uuid": "bb104525-09d8-4977-9e76-d0eba6155388", "value": "PO823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf65cc5f-35d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691489835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489835, "uuid": "cae7c85f-144a-4ee7-9d5d-dfe1f9a4de39", "comment": "Malware payload (AgentTesla)", "value": "c82033478239c0ef789f92622f6b4351", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489835, "uuid": "1cd38cde-46bb-4061-9ef4-3576235ca3b6", "comment": "Malware payload (AgentTesla)", "value": "d016ca7d62e88fc7df80866588b24d324b6671a23ad0e7159a17677a07a5ac45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489835, "uuid": "3a628f39-9472-4ded-9038-78a1a3f612fb", "comment": "Malware payload (AgentTesla)", "value": "240412bb10124751ad19b58141d2e5b0db53ef76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489835, "uuid": "ea8d1c88-7334-4bd0-9edd-268d3a92539b", "comment": "Malware payload (AgentTesla)", "value": "ad494029d350a98f747fd4ae19548ef44a75a1f9d6a76e8df3903ebd9eafb87066bb6efbc303c7e6f3b0333c13b5df5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489835, "uuid": "9c71d9bf-e186-4dab-86b9-8a1b38cdb3b1", "value": "T1B915F5126AEE1080F6B777408BF865E85B2FF6C55DB4841E414C696E63DFC428CB1BB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489835, "uuid": "996d12a0-ad26-4364-93df-285f6fd9bdd6", "value": "3072:5eBQ8PfACOTqFwPq+fwhiap79colYFExNe4VTdRnTT8w4TWUZq0JMRuepi6Yw0S0:J8PoCOTqFwPq+fw/colYFLZq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489835, "uuid": "9b6fd3ae-15c8-4882-bffb-5fbfde79746e", "value": 954210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489835, "uuid": "b7b06955-c8ce-46ec-8eab-58c8419666a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489835, "uuid": "a89a1914-8fbb-4d9e-9c5b-fe8f031ef65d", "value": "qasx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9594c41b-35f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691503509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503509, "uuid": "bd4e0bad-4bd8-4e77-b02a-936f6b771d78", "comment": "Malware payload (Mirai)", "value": "9908e556a2137d618a71ac8b24138c74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503509, "uuid": "fe2dd50f-ada9-4d6b-b446-697ce37bee02", "comment": "Malware payload (Mirai)", "value": "d0e62827868f0ae53ce4b71b3b94ff4a374b4f2de6f0a43143bfece85d0a6b32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503509, "uuid": "9f73277c-cd9b-4387-9564-5100659e9c7f", "comment": "Malware payload (Mirai)", "value": "37c1d7f7c9aae06a494c94e5f95c01c869581cf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503509, "uuid": "7b93e016-aad7-4735-8d34-8e8bf1098495", "comment": "Malware payload (Mirai)", "value": "6518143d2e34bfc525307b9189966b04741ce995ccd0899aebb02ec6d4d846803798595d341590808d53df3c96e5b0c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503509, "uuid": "857d7bbd-7725-4332-83d3-14d147591eff", "value": "T18F82E020B0B4AF22EBB1127A967E855AF2C7067CD2F6317B005456B46D96C0E33FC6C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503509, "uuid": "adbcd8e5-91c4-408c-bbe8-a69013e42315", "value": "384:eedcgcK0WB8EEwJymCydgMPltgbOxuHU1rnqHhymdGUop5h5r:eedCVW/FJymz0KxJ12Hs3Uoznr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691503509, "uuid": "8db69e05-4b12-46cc-8c5c-79f46429761b", "value": 18480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691503509, "uuid": "b3e8d805-2eeb-4ece-b43a-e265c561e154", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503509, "uuid": "2c6f4260-2bb1-41ea-8bb6-02105f605171", "value": "9908e556a2137d618a71ac8b24138c74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52738c6-35bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691480772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480772, "uuid": "9f99038b-4fb4-4a59-999a-22a2ee6dea75", "comment": "Malware payload", "value": "9fcced2214748d5437b1303ccd5a4891", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480772, "uuid": "090ccd92-1037-45c9-aa49-f54234a9fbd3", "comment": "Malware payload", "value": "d1b9ef3681a054aeab3d53ab3839afeb2f196c60e356d328decfdf61f16bd856", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480772, "uuid": "d8288bab-1a25-4bef-9ee0-be554d8e4a35", "comment": "Malware payload", "value": "da11ecd979ca729cb34d3c05bfa6848d3c00b8b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480772, "uuid": "190772a6-36f7-4921-ae8c-792c3fcff8b8", "comment": "Malware payload", "value": "0136172604c8126a0b0be63bc4ed90ecbead55b9e6e0632a2c82df9da688d5082e01459a396852ced917c636151028d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480772, "uuid": "8d337b79-4c0d-4d59-8264-112ad7e5fd13", "value": "T114E59E6663D1CE16C3D93B71906384296731DA627746B35F5F2C3BA82EB27B48C403DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480772, "uuid": "3ee877f1-e888-4157-bf82-e99af784f9b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480772, "uuid": "cefa9835-a78c-4739-b5af-a65fdc5d9426", "value": "49152:Vdoq+XmJXTZMlmpgm2y5y8AJBE6j0KoFHfEfi3WOAaPNLlTwvxC18wTO23RA:ViKdTky5oBE6ZA/EfOAsxTi723W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691480772, "uuid": "f839f500-c0f8-4a4f-9fac-61aab6cf960e", "value": 3178496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691480772, "uuid": "85410520-466e-4feb-8dde-8fd026c0f4e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480772, "uuid": "b9a7c37f-7590-4593-91dd-366f54f8abfb", "value": "9fcced2214748d5437b1303ccd5a4891.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de1ba0d-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691477592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477592, "uuid": "d288a7e9-b6c8-4498-a2d9-3b3ab0c64bf4", "comment": "Malware payload", "value": "bc802313367fa8e3e95a8febaac30eef", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477592, "uuid": "8b1d5133-71be-4930-b4fe-32d3c672911a", "comment": "Malware payload", "value": "d1e6ce0bb1b6370887610365325b052b2be95fb20f160f7bed6d28f16f93e7d8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477592, "uuid": "4189ed11-0376-40eb-8629-55d817c5bbf8", "comment": "Malware payload", "value": "fae8073b8bb36c8112c980f77af462589791457a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477592, "uuid": "f5b2d021-9252-41a0-9d49-9fbd3dc37dce", "comment": "Malware payload", "value": "13f89ff756b53375336bb697e0e873ca4f767190c2398c669619eb67bcdb8247d322e0c9e94699b1e4354bff738434ae", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477592, "uuid": "135f1b0c-b447-4f0b-8bcd-b1d02ff3448e", "value": "T147727E408C86D635C5CE37A6BC4684749C60B7B715113CAF6C9FB268399133BBB3971A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477592, "uuid": "91fc89e0-b773-4ed7-9119-69011f666a04", "value": "384:cMerh4avZ9DMwRXR59o8FvsWIa/+BSH4//eeXoOj:cvrh4gD37Bds0XHreZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477592, "uuid": "1943ab30-a698-4e6d-aef1-8fea1ace427d", "value": 17007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477592, "uuid": "ca3c690f-3794-46bc-9878-d8e959d2c6f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477592, "uuid": "7f33a0b2-2b8e-44f7-9528-29700f9c07ec", "value": "SALES-CONTRACT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60e6b57-35d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691489846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489846, "uuid": "43d41518-2aef-4a11-96b7-af3d57449b79", "comment": "Malware payload (AgentTesla)", "value": "e03c043b1a3e86b6dde4b27049089272", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489846, "uuid": "65d9ca1e-9643-40a0-bbe1-8f07910d64d6", "comment": "Malware payload (AgentTesla)", "value": "d1feda287249dc562cb50bf9fe7a09ac4b34aaef7366f9f99c7450d3de5251a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489846, "uuid": "4a05b0b2-9efe-4ee1-9b85-840243d077ae", "comment": "Malware payload (AgentTesla)", "value": "c2b2b0d0c3d20a2d75fdb69cce67db833fa0ccbb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489846, "uuid": "c4bc3385-eb01-47ea-8f4f-aa7ba225ce15", "comment": "Malware payload (AgentTesla)", "value": "6317c9dd0965eaadaa3cea0268e881b92b00b71ffb96134f8e80f426d29a47225e9fb8dddc7071a777b146fe7d2d4475", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489846, "uuid": "6f7cc699-da5d-4d1b-88cd-b37864518c6b", "value": "T11BE46D8565CA209AF3E2375153BE2CDDDB2FB8D48D7D540DB0889A1E2BEE71149603B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489846, "uuid": "9b443fd1-6f1f-4930-b6a0-5616bab331eb", "value": "3072:W2cL5qZDRr+dxPr+9gr+Ejr+gMSlcWO+JxqT/fQi+j6lwPauvQhy5ZoWWWWWjWW6:Yly/4i+j6lwPauvQAZHNj5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489846, "uuid": "bb3dc7ec-2092-4a80-b487-063f75c56698", "value": 676824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489846, "uuid": "f5a4bf74-40e5-4004-9d00-eeebd62e9b12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489846, "uuid": "b050cadb-7d31-4599-b5ee-3f5ef10dda85", "value": "EDH.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02af6a0-3637-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691532303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532303, "uuid": "dd83e02f-d7a7-4f31-806d-b542d6b4c900", "comment": "Malware payload (Mirai)", "value": "7673979ce0e52b02b8e855f8c9e88ef2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532303, "uuid": "731362c5-e866-44ff-87fa-b8c7554626d6", "comment": "Malware payload (Mirai)", "value": "d240eef6224ee560c48a1e79c4a372d8c281dfdf83a6bc623724bb161f096098", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532303, "uuid": "73b8dbc3-81cd-466f-8c95-cdf0699e5a0f", "comment": "Malware payload (Mirai)", "value": "83a6e81c01168b56540ed3fdc6272ebc6c122d82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532303, "uuid": "e7c30e4e-2970-41a9-bc9b-8b912a80fa24", "comment": "Malware payload (Mirai)", "value": "84f99de089978e36d24647cbd206fc9cabef5579bfe689da289886e4785ec5c71af32cff4c8a9e51a814c1613b428639", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532303, "uuid": "3954a4ef-627e-41f4-ac38-e9a49d1730b1", "value": "T1F7B2E1255533ADF186900CFAC998EF823B752D7E80EBB1532018971C8DDD9872DFA8C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532303, "uuid": "c69a4c83-ab3e-4fcf-ae23-9ad5b8564cd8", "value": "768:eGOfKwXZ8a0bN1Mhmn/cNAs4tiUqI9q3UEL3C:1AvXZ81sQcO3qxLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691532303, "uuid": "792d343c-6ac8-4c04-aa22-6d13547de801", "value": 25464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691532303, "uuid": "fcd1d22a-03c4-412f-ab68-2e23355f0f86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532303, "uuid": "e756a6f3-3602-4419-984d-27c11b069980", "value": "7673979ce0e52b02b8e855f8c9e88ef2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a921febe-35bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LaplasClipper)", "timestamp": 1691479490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479490, "uuid": "3760633f-f301-4dfa-94da-43f740255113", "comment": "Malware payload (LaplasClipper)", "value": "ee194a0b6f6c6c28740a697a5466c44f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479490, "uuid": "0db988bf-5755-404b-9820-d8242ab1e1e7", "comment": "Malware payload (LaplasClipper)", "value": "d30e2337e87b5bad478d20dea2fa51d38a4a9506542bdaaea7640dcc68a4432c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479490, "uuid": "27243e71-8c5b-45fa-80cd-ec24d3006518", "comment": "Malware payload (LaplasClipper)", "value": "6408895a89575bc618094c785ec3e5720ce455a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479490, "uuid": "26363a49-f967-4bbb-ae37-7be6ee01819e", "comment": "Malware payload (LaplasClipper)", "value": "b96dc8e1218e4b3b5e29dcf769f66b0e4831e07ee874449fb0e3d4658c8543b5de243e61d0aea1c7e4dd3c9c5ccb1e73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479490, "uuid": "1f4ed10c-3036-4c14-a7fa-308a8e2a776d", "value": "T14C163306172011F0FA243578D81589DC229CE8E998175FAFBBD9440BE473FA6776FAC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479490, "uuid": "af9b5f58-287c-4fa2-a948-d2137b14fcd1", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479490, "uuid": "415df0ad-88fd-44f0-9701-66b37c6f4336", "value": "98304:ql0TOAthBZtr+BHIvMZPEmZpHvYXMheVNyDqiGdS3q1/3:WAtrbrwtZpHg8e6Cf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691479490, "uuid": "f40a5b07-fee0-440d-a5ce-41c93e8861da", "value": 4176896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691479490, "uuid": "85c76f5d-1c8c-4ce7-ba4c-ba82365fac08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479490, "uuid": "c76f4fb2-f673-4674-a73d-28d554a7ee89", "value": "ee194a0b6f6c6c28740a697a5466c44f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c296c8a9-35d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691488552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488552, "uuid": "5d265a32-0f91-4bbe-9402-975cc23f4ccf", "comment": "Malware payload (AgentTesla)", "value": "276c326ea88c426cc169655b5e800a1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488552, "uuid": "284ac496-97d3-4f58-a6fd-8662a3912ff1", "comment": "Malware payload (AgentTesla)", "value": "d312f81dcda0be02b4e81072aea2bf33e95e1feac03c21fb5285f998a0e0c2d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488552, "uuid": "98cc25e1-de63-486d-a27c-26df6bab792e", "comment": "Malware payload (AgentTesla)", "value": "3956612959372554ac20d6ab268e26ea933315ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488552, "uuid": "878e9b8d-5f17-444a-a271-1082afa4a92a", "comment": "Malware payload (AgentTesla)", "value": "d8e27f2ad89b86a79496c929bd974f1d274cbe9178f93f7307a75d734e0d9a2bf769f5a167ec7fc2267104ff37d004e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488552, "uuid": "b928f4ea-3633-40ee-bd88-091f7af8528e", "value": "T16715F12136B99FA7C1BA93F84021323017FEAE9E3435D3095DC670DA19B5F808A61F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488552, "uuid": "93b4ed6d-cc71-4ecd-b469-8c40c49e2f31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488552, "uuid": "86775338-6875-46ae-92df-58bacf3bb11c", "value": "12288:ufgET/NYiIoFwIrG3XCCaEHsbHpg0PtrTRv6YIz2QtvwE7EKIU0fKzTwtBYx5bsJ:gxLNHIcTrGCSkg0lL2jppsQThn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691488552, "uuid": "2f2fb3fd-e731-40d8-a888-06b160f028a7", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691488552, "uuid": "9460ad44-7978-4752-9e6c-a468a713bb1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488552, "uuid": "6ab56f6a-66a5-4442-b23b-9565c9efe792", "value": "d312f81dcda0be02b4e81072aea2bf33e95e1feac03c21fb5285f998a0e0c2d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93128a70-35d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691488902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488902, "uuid": "29d9ad39-6c57-4d0d-ac37-a32bcee95d7f", "comment": "Malware payload (RedLineStealer)", "value": "f9e29e649b52c9a15409bc01848bcb6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488902, "uuid": "8fe79871-9868-4000-a465-20e1e22de2a8", "comment": "Malware payload (RedLineStealer)", "value": "d38cc3546ee0b013d4e66e0de3dcb072a074c45c2414ad66ccc3f589de98f72e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488902, "uuid": "2293d613-baf7-4245-be99-5b80ad38cac5", "comment": "Malware payload (RedLineStealer)", "value": "f6533bfc2e20c5dfa7e310d1de3a9d9bf9f5d7d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488902, "uuid": "960def0c-87ae-4148-af38-13b09b99529b", "comment": "Malware payload (RedLineStealer)", "value": "d9ae312e6d6834863016e4d34cc5d742089c4e42faa629321cf58276d2c61c070e08d8e689ebde0a5d5b9ecd198dddee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488902, "uuid": "f3945ac2-1dc1-49fd-b8a0-3bfb7c3ebdc1", "value": "T191A35D2067AC9F19EAFD1B74B4B2012043F1E08A9091FB4A4DC164E71FA7B865957FF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488902, "uuid": "802ee4e1-6d31-40d0-b4f3-1378ba8d1229", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488902, "uuid": "f044d606-f721-4f2f-a75f-8fe84e9fa065", "value": "1536:JqsKqq+zlbG6jejoigIT43Ywzi0Zb78ivombfexv0ujXyyed2hteulgS6pt:nZpZYT+zi0ZbYe1g0ujyzdFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691488902, "uuid": "f24fe1e5-8fca-433d-9c9c-3e0d342c1f66", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691488902, "uuid": "6aced888-7fe9-4e6c-821b-6f400fa7fb04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488902, "uuid": "f78ede2e-7c41-487e-9b39-a42a170da858", "value": "400000.InstallUtil.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49df3ae6-35fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691506818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506818, "uuid": "153eb17c-bda3-4a15-b2d3-1ff903dc4537", "comment": "Malware payload (Mirai)", "value": "d38590001330c73018805052026ef446", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506818, "uuid": "fc91c332-5d75-40db-a2bb-319a3c905cfe", "comment": "Malware payload (Mirai)", "value": "d41718adfb4aad2909af9371a61ab9c9babc5090a8655b594cfa97d3f772cba1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506818, "uuid": "28bec358-9fe0-4d9a-9267-5eb871ab4c31", "comment": "Malware payload (Mirai)", "value": "62ab0221dbe182c7f1c6d8e658516f5ef0c64124", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506818, "uuid": "45ffc11d-499c-4ce6-82e8-f85765ca82cd", "comment": "Malware payload (Mirai)", "value": "638c2f2168dfa11e1642eb52f118593cee42b2e40d6d7a50ba5c300207e951b39ca53e7ea1c7bbf5096ae5dbb69f044d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691506818, "uuid": "cc71fe8c-81c7-4de0-a86b-44fee24975b9", "value": "T1EA432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11640A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691506818, "uuid": "e61c9149-7500-4144-8f1d-576b23c5067a", "value": "768:xqowmZPu9wtnfbltWgC6BSJsBcfDCTFI7QjaQHseiSCxO+q5Awa:xqtmZPuutfbltZFBSJsBcfDCTFIpB0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691506818, "uuid": "c0c4ebaf-ec92-4956-8b3d-5820e5da3e72", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691506818, "uuid": "841ea571-ffd2-4741-a7fa-6f5f5d0274dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691506818, "uuid": "6364d742-b70a-4590-8302-158ed1074d5a", "value": "d38590001330c73018805052026ef446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a929970-35d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691491008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491008, "uuid": "755bbc84-954a-4501-afe8-c8ecfb82590f", "comment": "Malware payload (Formbook)", "value": "2ddb70c824caef7db50b7c30968871e2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491008, "uuid": "d683e08d-7901-4548-9533-664298d9ed1a", "comment": "Malware payload (Formbook)", "value": "d45223b23daf34e347b0056f52135e14b61e8fd5ee2bfdc1d1ef48693cf19d49", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491008, "uuid": "a969c87d-4b28-47d7-9b54-47620b7c065e", "comment": "Malware payload (Formbook)", "value": "a7395f10d5e67f005791c578169aaefb5282c1b1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491008, "uuid": "a7cf20ce-08cd-4a3f-9a25-7656c7b6e36e", "comment": "Malware payload (Formbook)", "value": "25ad7510eb31576824b4b2ebc55c9378d62bd3a4a6c94b589492d531c1e0452fb8eccd14a212ec0761424d3341e472aa", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491008, "uuid": "8b3da312-2c4d-41a2-8fa3-491fe9576333", "value": "T1F9D5836572707AC7D32601B1828FBC8AA218FC47B3D75ED8D05DDEB52CE55B5A302E0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491008, "uuid": "9448e12e-2724-492c-94fe-8b082761ffab", "value": "12288:Cg1f8PDQVyG2oYdvttYXvteihZ+eCBAfGq0/v3tTPgvzT+zGwrXMILYt:Cg1fwQVQoAtGvz/CBAfGLtjczTDILYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691491008, "uuid": "b33936e3-289e-4b38-b043-a5523aca1f94", "value": 2856138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691491008, "uuid": "9ee7d4bc-9aad-40c9-8c85-01989f82c9ce", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491008, "uuid": "2a43fe97-f233-4dc7-9984-8367206c6b8d", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.5660.13326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7652d3-3583-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691454799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691454799, "uuid": "3896f7b5-08b0-445f-885c-e89f7080e501", "comment": "Malware payload", "value": "d52ba02c8f04e5d3bc0111f5bfef0b53", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691454799, "uuid": "923ddd94-24d0-413a-8fe9-0a2288bb2afc", "comment": "Malware payload", "value": "d4966761cf347fbe36d704dd8a14a4af19a8c8534752e37d4b04725432010631", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691454799, "uuid": "b9285a50-248d-4c91-bbad-a23b66f30b77", "comment": "Malware payload", "value": "b76ba0ecab1ccbbfaa74f22f65e89d084b8f31e7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691454799, "uuid": "29a567e5-dfd0-4c73-83b1-8832028831ec", "comment": "Malware payload", "value": "c06cf37f47d4cfa91e1b6f5f809656d0ca43baa4b299135ca7c54bc1e6e5b8f337202eeb70ae4dd8c96df8bdd8365fd5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691454799, "uuid": "67a32a30-4781-47da-b6c3-04f6d6a55871", "value": "T1A0F31380A15ACEC7C60E25FC51E0B7C64D37B4806946CB9BDB6BE125B96B4408BCF7C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691454799, "uuid": "0d01f717-e3a6-4681-8039-4c298dbac0a1", "value": "3072:rdkpraPvVWK9qJqsYw8JTtn3lfsYkPsemQdW5aIh+PSFVo6yJMOQ9xBPd/sxwq5J:+YFNDjh3lfH8LmQdW5aCtcQ9xBPd/s6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691454799, "uuid": "94b09bf1-f124-4679-96bc-78d2fe9bffdf", "value": 169311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691454799, "uuid": "d96e4823-a5a0-4253-aa85-c85d762756f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691454799, "uuid": "653ef952-990f-4844-bbd9-8e524a848064", "value": "11419959645.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e870d45-35b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691476707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691476707, "uuid": "6c51fe2f-31ee-4d62-9a5b-db48c9b26dde", "comment": "Malware payload", "value": "8a0be24757d161762efb3d8440c65739", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691476707, "uuid": "1826a195-e45b-4150-a10c-c758d3591fdb", "comment": "Malware payload", "value": "d5172f1e2a22d2c18e226e6ae1f72bcb5473c513cbf1a21a13dcd0990016f360", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691476707, "uuid": "29e8e86a-9f64-4f6c-a000-c06a04f82e30", "comment": "Malware payload", "value": "57eddba49ae64d0f8ec9602af8e4297f126ffa14", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691476707, "uuid": "549b1e77-ef67-48d9-b2f1-10818c2bfed2", "comment": "Malware payload", "value": "c280edc55f62b018e88a8dedd4b09faad7d52e274190822fd6fd9d969724e14a5807a43d9a5278b320d575e52c5a15a9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691476707, "uuid": "9a322238-d002-46c4-9850-f74809d3fff9", "value": "T1D6E1003ACA31BCD8872D360093241C9F21E96457C7B38D64CB152CF63E72B92EF65988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691476707, "uuid": "a7bb5511-8bdc-457f-8eff-86be321b3b3e", "value": "192:UPtQCodOpHMz8Pdp0DI854JuL7KQdV0Za7NXo1:UPtLo4ZMzIjuHfOOV0F1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691476707, "uuid": "55e14f63-aa7d-4c2b-bf92-873167c82ae6", "value": 6815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691476707, "uuid": "1a426b7b-3ca6-4a59-9c12-663208f4bbc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691476707, "uuid": "97b10b1f-2b70-4215-9f18-cb06ea64a831", "value": "dcfadba525f96e47357083767bdacc80d5a93cb31de8d25852846272c3718fb7.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c512251d-35f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Glupteba)", "timestamp": 1691501870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501870, "uuid": "03ba22f9-f7fc-4a64-90e6-0b4afdf09afb", "comment": "Malware payload (Glupteba)", "value": "2588035f80d4c4c434db1c84d2183117", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501870, "uuid": "05292b19-7075-4163-96da-6191f35cc2fe", "comment": "Malware payload (Glupteba)", "value": "d571dbe3249950ebc2a8b600b9e3dcac5fa2393b84983709995df071d7f9a2be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501870, "uuid": "d1ebedd3-092b-48fb-acec-5eeecc29cf69", "comment": "Malware payload (Glupteba)", "value": "4d895334d8a4cdd57322986edfb7ce6141ef0a48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691501870, "uuid": "bcae0b93-e64e-483b-ab79-e84cbc474cae", "comment": "Malware payload (Glupteba)", "value": "5b9ee0650eaae6bb01c6981c444c53366b6b50257f6d4f4551bd74b0ca02bbf34656ba636e05a5ca0c86186820274695", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501870, "uuid": "6afc7126-5dd6-45b8-947c-51b0c0bffa2d", "value": "T1201633C532E05C56E84446729E5ED6DC382EBDF1CFC86A5772987E2B24B1912D273F20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501870, "uuid": "e54b1bd4-2136-459c-b1b4-a85cdf298fba", "value": "a05021a5e6a8299dae264887f82f8054", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501870, "uuid": "921714f4-6a52-4850-8716-1b0de164d07a", "value": "98304:WiJa4El2BL1om1+JZQY4oB2E2o8CwODZDNLgoMMo8nbHARY:TIl2daJJUcKolnNJLgKo8nbHA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691501870, "uuid": "e3700339-d33d-4f6b-a26a-64b94f3f030e", "value": 4329840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691501870, "uuid": "896f6d6c-3d37-47f1-853e-bf46f14b71de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691501870, "uuid": "2fe75496-20a8-4ffd-b885-88c28ef8f8ac", "value": "d571dbe3249950ebc2a8b600b9e3dcac5fa2393b84983709995df071d7f9a2be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19db9094-3616-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691517904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517904, "uuid": "4b1a1364-875b-4a9d-9215-d7daa4588f51", "comment": "Malware payload", "value": "057dc92ed6bc58b2700d55de204e64ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517904, "uuid": "965a5592-fb92-4cd3-981f-c1b957a80f22", "comment": "Malware payload", "value": "d7262dde14069503438599d2b04185d25809957e4968eaca004dd07eed4d5028", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517904, "uuid": "1a29b39a-f828-4131-9907-f600006ea9fe", "comment": "Malware payload", "value": "d4b514cc3c80f737de1c0848199058e9b9594bb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517904, "uuid": "c3a1aacc-e52c-4821-bd2c-34fe33e619c6", "comment": "Malware payload", "value": "1fd106493524ef1780b4c88859ebf85dc90957ef85c6f1e235c3b3bb4f3f9dd9f5b5455cca53f415cb943c604340d888", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691517904, "uuid": "2c3f839d-348f-47e3-8814-0bf1918891a7", "value": "T16B435B21A9792E07C0D4B9BA12F78364B2F6530E25B8CB2E7C720E8EFF5564016536F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691517904, "uuid": "716e088e-113c-40a1-b0a3-c84dfdfc3786", "value": "768:lCoKDq9783HEqXlBDtXAPY1nWd0KdxVBUOc1uW+Q0EO+uBLojosCJ:lC1S783HEqXlBDtXAPY1nWaKvQ/udb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691517904, "uuid": "2a4bc264-6a5f-4bca-bc9a-b58d7d20f95f", "value": 57064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691517904, "uuid": "b6e8ffd9-d3e9-4cce-ab54-af3eacfe2607", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691517904, "uuid": "4cb88739-8439-4d39-ad2b-f7980d708218", "value": "057dc92ed6bc58b2700d55de204e64ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0a0906-35b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691477211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477211, "uuid": "0e515746-0535-47f1-bc5f-d7a30e63e845", "comment": "Malware payload (SnakeKeylogger)", "value": "a1cc1a1c70ae831bc0141ea6f1a75f1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477211, "uuid": "d955adc7-69d7-48c1-af76-7d08fcd2f977", "comment": "Malware payload (SnakeKeylogger)", "value": "d757716097082fdcf35033613d1736f4cf02f07afb368b1381489ba8ebba3cb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477211, "uuid": "5bc4468a-e7c5-4fb3-8b1a-684038c80cee", "comment": "Malware payload (SnakeKeylogger)", "value": "e23ddd3c4e4cf099d0d9c2733d405d61084b0ab5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477211, "uuid": "11e1d240-1412-42ce-9765-6f43befac3da", "comment": "Malware payload (SnakeKeylogger)", "value": "f9a3364c11bac2db76ba1767832f7a7ce684c567510858e5c9ed6739c6b17b7f29713693e7d014ad1aa357a5587781fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477211, "uuid": "6888a60e-ee66-4031-bd98-1109fcc233ac", "value": "T14FC41223A6EC5FA1E0F21BF8603C51650BB3A54A4833EA285EE574DE5DB2F118A50F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477211, "uuid": "2966dcfa-f0c2-4fde-a631-b91ffe9017fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477211, "uuid": "0f5ff974-7224-43ab-b125-5b84bd6b0683", "value": "6144:aCSuQia89EjGIW519ifJF/sIQUePrasc7gjtCc/YsTCI4K0pU+kFH5YbIRip+82E:aDniF9P1Q/eTwEU7tIikLRo+8dO2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477211, "uuid": "cb69820f-cd42-4685-acab-f7376683e101", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477211, "uuid": "255ae878-81cc-4ab6-a6f3-fd3cbb463fce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477211, "uuid": "b9b757ee-4575-48ca-967b-bc44fc6c2d49", "value": "Comprobante de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7095344-3624-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691524154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691524154, "uuid": "f8dc20b9-9daa-46d4-926e-d29717810360", "comment": "Malware payload", "value": "8280d77f1fe4f3ad7e067180f6cf1ad9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691524154, "uuid": "a65e523f-6077-4008-b72e-d0184a0b401d", "comment": "Malware payload", "value": "d77d9d1e6a565872764d63888898c9fd1f27ae108bea1096b597ae5e9b00e14f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691524154, "uuid": "6a756a0c-11b0-45f9-ac1e-8bfb47312885", "comment": "Malware payload", "value": "9dcdbbd518fb6e76ab9c77f0dc8e204a4bf51d26", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691524154, "uuid": "2c23173b-8672-497c-b88d-eeb0c3acc539", "comment": "Malware payload", "value": "24a2c55f5659494a562d42d661c40180c9510c6cf881e04f7308301350d224314c904a737e11417c364565133a3964f0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691524154, "uuid": "59f88c9f-d778-4b20-b25a-786408f09a61", "value": "T190A159113FA7F58250B5D1FCC34857096B3E164ED637F9AFE6E4910041A70ABAE03A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691524154, "uuid": "22c3fc7b-dbeb-407e-aefd-6d81722005e1", "value": "24:lgPtE1wnIQHnCnp4WmnCnDdnCn2bxYA0QDkNulTmnCnumnJWWWWT:+PkQMbbxYA0duleK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691524154, "uuid": "57188d46-3d7a-4490-84e8-b01b57792baf", "value": 4747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691524154, "uuid": "419b8f1f-7c4e-4694-a02d-6f4070d56d6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691524154, "uuid": "4db04f3f-4dec-4616-ae09-afee4a01d8dd", "value": "lnvoice#20336.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8898a133-3635-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691531404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531404, "uuid": "9541bec7-7033-42e1-a3c9-86a1824f0d1a", "comment": "Malware payload (Mirai)", "value": "6709fb1a23ae3ee7c8fa18b929107c3c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531404, "uuid": "49187ba9-bdc7-4a9e-9b45-98e6f1cd4189", "comment": "Malware payload (Mirai)", "value": "d8e7ac3fe3ae8dcd348006ff8fb8e7cadc6d77e13c42eb099099b7b812e62a28", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531404, "uuid": "bec7947c-b076-43d6-9adc-52e28a3a3352", "comment": "Malware payload (Mirai)", "value": "978760562950c1b057a4b32e580bba38a77b98d2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531404, "uuid": "afe0177b-6dd2-4751-9eea-65798f6f86f4", "comment": "Malware payload (Mirai)", "value": "26c37b866f523cd341d5e2892fde4870dd751d67256f560d3b0e4064c9a1a4664c5ddc224c883b83012ac2fee651850b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531404, "uuid": "9c016d9a-736f-4bfe-9ab0-d68fe5fabcba", "value": "T11C82C097B0C48C27C1892A34841D4D7ED8113B9E872DD6A76E49FCC794FF83C416ABA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531404, "uuid": "9c607697-452f-4d52-927b-675ccdabc54d", "value": "384:MPGOkro8+R8NMreWPk1YMKJJbrnlLOs+v1RA:aGXro8TNS5PkK//lanA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691531404, "uuid": "c3f2ec52-29f6-4e9f-9ed7-13b578dde4fb", "value": 18820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691531404, "uuid": "30cabbeb-d111-474d-9fb8-ea6360ff2bf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531404, "uuid": "6255d823-b243-4fe2-980e-bb9a56a20b5c", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9066c9-35ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691500598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500598, "uuid": "d7f2747b-8edf-4612-a948-44225e82fd44", "comment": "Malware payload (AgentTesla)", "value": "fad29566796e0d799c02899b100d8da7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500598, "uuid": "29963a8b-d308-4b27-b3d1-4b0a57763717", "comment": "Malware payload (AgentTesla)", "value": "da0b8e7161db379ad99ba1900387d126ed0652ec331e2b3428d8ffbffc7316d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500598, "uuid": "08aa5eeb-dba9-4a0b-a26c-bf4ab1bff9db", "comment": "Malware payload (AgentTesla)", "value": "8a854e54e175df235f4d2464b7270e0ea29bcfd3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500598, "uuid": "a1fc4de3-07df-48cb-9cec-4a826bf2ac7f", "comment": "Malware payload (AgentTesla)", "value": "baa88eb37795d0217d9a91065a99d60ca5bc02ab51e42306e11526d3c8c8b7c5f23c8dd9f0f8b6edab101fc5e4c6eba1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500598, "uuid": "335fc117-4a9e-4bfc-b979-3b7bd4a15c50", "value": "T18E156E3915AC052783B692BD6AD0F847FB809CD33A0D8D5F46874FC61522A36E5CBD2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500598, "uuid": "508b8bdc-77c3-41ad-a009-47e44da7a439", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500598, "uuid": "411f99ff-96ff-40f9-9aef-47d9a752e1a2", "value": "6144:Qq49z2fTa7sH/Y1pJthdI34n5gRdJAIsl9XupV4A0zq/eMExbyCBBAVACbFbTyE+:Z344mI++pV4NGeBx+5VA+Ny59gYe5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500598, "uuid": "0c9beca4-1dc6-496e-bcde-fb3d0f5dc1b8", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500598, "uuid": "9a8aa8b9-bdb6-4cfc-8a12-c78cd840c8a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500598, "uuid": "6f6028de-4b33-4e4a-b763-547e167e0c4a", "value": "da0b8e7161db379ad99ba1900387d126ed0652ec331e2b3428d8ffbffc7316d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0ebc6d-35b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691474126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474126, "uuid": "52bd7f04-b573-447b-9f17-67fababc4f2b", "comment": "Malware payload (Amadey)", "value": "96918a57ce65b4a2f319ea81fc1432b1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474126, "uuid": "91f95324-ca10-405f-89e2-4966da0d67b4", "comment": "Malware payload (Amadey)", "value": "dc4d0bf6e5d2bf353bc082a3b15cd498cca83d09da8cb14ebf73b8571148d018", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474126, "uuid": "7397da72-6029-4d74-9a8e-53021edfeabe", "comment": "Malware payload (Amadey)", "value": "0ea856aa0644c1c644d1e5f066d4eb04e2dd786d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474126, "uuid": "ed3f78d0-f0dc-4b38-a0fd-3837866acb9b", "comment": "Malware payload (Amadey)", "value": "f08723c94f3a96a7389180957e40b2ced809f121c338b4afb5dbe92bc510829b90fb449e21a00e815702c35d88b674c1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474126, "uuid": "d84e0549-f5c3-4390-95f0-776fcc459cff", "value": "T126E41207ABEC8272D9B92BB418F707D70F317C612975429F3796696A0D736A0E43072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474126, "uuid": "3eae311d-6fe9-40d4-b7d2-b4d7bf80b4ea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474126, "uuid": "1d09867c-f60c-4f31-9693-319a13298585", "value": "12288:RMr1y90OfFzhqTPfGIXbKBdi8768zzoovjCpS/HdHxCjmTD6+jCWRs9:8yjGTmdX3oxk//6+jCWW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691474126, "uuid": "91280380-c358-4ae6-b1e1-bab14d98bd52", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691474126, "uuid": "aaa79cb7-dc91-45d1-a047-d9a50fd641f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474126, "uuid": "823dc880-b697-47d4-b381-ca1b8dd13c38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc301041-35da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691492460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492460, "uuid": "0d828b36-8239-4f6e-bdf0-f2501b9458ac", "comment": "Malware payload (Mirai)", "value": "9b1b52220a11e17fe7a4dafbea489862", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492460, "uuid": "5a6a6262-2c97-4d1d-a87c-f1a7d5003980", "comment": "Malware payload (Mirai)", "value": "dcaa8c1a4d41cb761dfa10d721a50a0a62483d92acd11579c4ad8c48bba75983", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492460, "uuid": "3162cd02-8cf8-4098-af5c-7f8699c611b0", "comment": "Malware payload (Mirai)", "value": "2142aa67f990ddefcc586f46e30d52e2dfdf1b32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691492460, "uuid": "2bc05391-90a3-4932-b9bb-5aca0ad4a3c3", "comment": "Malware payload (Mirai)", "value": "30ef21e1e60dc0e29cd4b7986eb349d6aec045d69c3ac2a90fcf09d55fa06e6a15ced2a6066a3be1e5407f8f865ed2e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492460, "uuid": "36260b23-72f3-4572-ba0b-b3184b7ca1f6", "value": "T15CC2D084F141DF45DFEA29F13E40DAD7BBA06F1EAA528E4066A463C25B1C2B74305DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492460, "uuid": "55fcae01-05bc-4eb1-ab76-979d23c92102", "value": "768:wVdafO76jpmNJJKehmA7trpfIX9KeA7P/Ki4uVcqgw09Y:Aam+AnKehPRa9aqi4u+qgw09Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691492460, "uuid": "b36423ce-b7d1-4afd-8aba-7df7861aae96", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691492460, "uuid": "e1617c47-43e5-4056-808a-853345036b40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691492460, "uuid": "d16e41a4-a0fe-477b-a390-df591512501a", "value": "9b1b52220a11e17fe7a4dafbea489862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38ce1ee-35b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691478326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478326, "uuid": "51bf58d7-ec1e-4a31-9ac1-23f5a1741607", "comment": "Malware payload (Loki)", "value": "e923ec2b220878f6f9f80ce6efbf9166", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478326, "uuid": "918413c0-f52b-4676-8a9c-2c72dba07293", "comment": "Malware payload (Loki)", "value": "ddfae8c9fb7d2c853000483343d60ad284440709ad67a031b83800529aace880", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478326, "uuid": "dccbded2-1859-417d-8b4c-d5cee1b6b9b3", "comment": "Malware payload (Loki)", "value": "d6dbef50d3c22d8193709489422e5e3d137136c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478326, "uuid": "a280bdb6-0db5-4901-910d-69b8c8f52ba1", "comment": "Malware payload (Loki)", "value": "391782dcf413b136276617069ef72b7063964e4102404bf6f1baf5919742cacbcfcf8794a9f21ec36e32c3e57ed110f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478326, "uuid": "5c4977b6-3dc6-43b7-a6b7-8e6e3dc5dd79", "value": "T1D0546D13A6EC6B62E5D28A324E2EF6E4671EFC918F1937DB124C7E2F08711A1D175702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478326, "uuid": "496f6e2d-aa6b-4dee-a9f3-6ae6d79fc19e", "value": "7574067d27f1e097e97a79381564790b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478326, "uuid": "f98918ea-e490-48d3-9851-09e38ba62c52", "value": "3072:K29CE3ixEk8ssNjBitgSetNsU9G+N/iVqxT4XctIaw:9fWEss5ITq5MuTZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478326, "uuid": "7c056a85-0606-45ab-8325-3c33e031860b", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478326, "uuid": "e9ff488f-913b-4695-89e0-a1a4969dc243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478326, "uuid": "f3a69321-e99d-4f85-97f8-a4db8b88b43b", "value": "e923ec2b220878f6f9f80ce6efbf9166.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b2a280-35dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Conti)", "timestamp": 1691493114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493114, "uuid": "26ec1585-dfd9-4ad8-b896-6691223b3eac", "comment": "Malware payload (Conti)", "value": "7400c96361c52256169263a41e9aa03e", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493114, "uuid": "f30d8330-1ac8-47d9-b7a6-b0d8b48d8649", "comment": "Malware payload (Conti)", "value": "de10ae21bb262728c616a707f90aa05088c9d8f2b810fc0f2fb1bddcf9aba938", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493114, "uuid": "1fc3ad9e-4ec7-4ced-9c61-5ba1487f1267", "comment": "Malware payload (Conti)", "value": "a9a6cc3c766c63a95f30b2df2f7f612a1a6ca3fc", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691493114, "uuid": "750bc52e-8dfd-4ae6-85e8-6f948e4919af", "comment": "Malware payload (Conti)", "value": "d56f7da7533c48f1579703cadb1d20116df7f90b3910d71129c7028b1a1c3f1ea8cee4624bfaa60c89127ffdde48b288", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493114, "uuid": "6e3c8d90-f8c6-4c82-84fe-23fb1ace2dcc", "value": "T182143915B64E4634F25A58701AFC6DB354A89A38336FC8F7B3C9867D2A25AD27430F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493114, "uuid": "fa59b30d-57f3-4fcb-a37b-7f84299677f3", "value": "0f4a90cab474867304707cfdfcea0cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493114, "uuid": "40fd88cb-666a-491e-8a66-ced022a5ca7c", "value": "3072:uLJGBP1t82ETTwPAobQ3tOqmb14Gul22QZkN7S44EXZ3S0Rx6ktF:kJEPCTwPp03YqyNulakAu6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691493114, "uuid": "b620a652-e107-4c91-bc5d-0f23d671a9bd", "value": 206908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691493114, "uuid": "611be335-c782-40d9-9b8a-fa623dca57bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691493114, "uuid": "5e237c00-04a1-4d7e-8bcd-fd1cacbb8a9d", "value": "2023-08-07_7400c96361c52256169263a41e9aa03e_conti", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3dad4f-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691478988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478988, "uuid": "6ca192a9-493e-4062-8717-175263263500", "comment": "Malware payload", "value": "ab180bc45124ffb428c0bd7552ea65b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478988, "uuid": "0b65eac1-5ca8-4c92-a553-b00815e43ee2", "comment": "Malware payload", "value": "df7c6d24656cd0ff5d23f8c275ebd91b157c81e55e7ea596176b461ffd6f9a41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478988, "uuid": "f16da913-2687-4e18-b8db-d1beae70c2e7", "comment": "Malware payload", "value": "4f30ea8d27658dcd8bd45583949a3f82f238799c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478988, "uuid": "12dafdc7-0d9a-4f1e-b546-ec214c22acfc", "comment": "Malware payload", "value": "61dc0c56496bcee83993158dcc5d3a2a5310186973da23de7285afdb4974ecd9b5db99569156adc3c0191767ff5c0f08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478988, "uuid": "b2c11ffb-2b4f-45a6-98f1-6221d7db3067", "value": "T130E41262ABD88071EAF61BB02CFB07970A397C25983C439B33855E5F5D721C0A97176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478988, "uuid": "fe9cc982-f105-4e9d-9f2f-f4c8d5fa8159", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478988, "uuid": "9d044ce5-a5c4-47d5-bc4e-683db0712fe3", "value": "12288:rMr6y90eMiX6+UDKcJpIdeZA7JJjytL+kEVtGqSasjHZyHcvLm6pkx+Woe05:5yz9UDlJbZA/QvEVtlSqgLFpzve05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478988, "uuid": "8d2aa2ad-00ad-4275-aa10-0f1f11ef011e", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478988, "uuid": "1d7bb8a1-7c60-454c-897d-5c43bc74ce89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478988, "uuid": "ee105460-ce97-42f4-b96e-3a96f2a43ab9", "value": "ab180bc45124ffb428c0bd7552ea65b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14343b4-3621-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691522936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691522936, "uuid": "abb0fd9c-ea5d-4bc8-986d-e3bcce94eae9", "comment": "Malware payload (AgentTesla)", "value": "6fed931072ab599890ab32916bf50c8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691522936, "uuid": "82e8b746-0d5a-44a5-9a3d-a3e233c6a7ff", "comment": "Malware payload (AgentTesla)", "value": "dfb81753edcca6ecada192d1140cb66be131d8c1155031b5d133c74b813a808b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691522936, "uuid": "24961aa7-179e-4ee7-bf05-ba933431ecb9", "comment": "Malware payload (AgentTesla)", "value": "d494a1bd0d53c215fabdf63e113c750eb36c9b2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691522936, "uuid": "f6ae34d9-a1f5-469e-992b-19bf9df67326", "comment": "Malware payload (AgentTesla)", "value": "340d4e6a98cd0c4b3923382dfb5482690dfb8746cc139047bd97b20e48e4af9fa8faf9a8f9134bfb58f4e5d9d7bb1601", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691522936, "uuid": "80af5657-886e-4c2d-8455-0eb16d33b0d5", "value": "T1B0E4220035FB4A97D1BE46F1679B154A47F3A62E8022E5D93CD220CA91E3F45F940FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691522936, "uuid": "7d0c6ea1-378b-4ecc-b45c-d3574bc5e844", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691522936, "uuid": "1bbd5d0b-30d4-41de-8960-4582ebbb9ffc", "value": "12288:kUOSLYTyEvYm6YTEJlITot6uvRjBgtz1mhbIA1x:kn6YTZv6BOTot6uFIz1mhbIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691522936, "uuid": "39d794d4-79bd-4e80-8a69-eadfcd60a0d8", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691522936, "uuid": "4a014b4d-c7cd-48fa-8abc-edb9252f2f3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691522936, "uuid": "ad3d659a-64de-4fb3-8132-d67c46e85c3b", "value": "SecuriteInfo.com.Win32.TrojanX-gen.23082.21429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b8f005-3635-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691531406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531406, "uuid": "c91c6d8f-82e0-4909-8504-55756f67c573", "comment": "Malware payload (Mirai)", "value": "5c4193469a971249e2fa6b463b73deb4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531406, "uuid": "32199fc6-44d4-49fd-9be3-6b4f7cc03bad", "comment": "Malware payload (Mirai)", "value": "dff9a5da07c598a3feb24ff684d7f01b13dc88016422c040c5693c1f1336cbf9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531406, "uuid": "3fd3d584-e998-410b-8e5c-6c0cbde95bc7", "comment": "Malware payload (Mirai)", "value": "9eabdf5f75d90ba58a19773ce9438953fe9208a3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531406, "uuid": "5430285f-6384-44e9-a99a-853885f099d9", "comment": "Malware payload (Mirai)", "value": "9e6f2764e916a3403ef941678cc6376e87597d54e81cb75f9467f6e2ae96c54064df307072fe4fcc8216a02e2c515e17", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531406, "uuid": "12872ed2-4917-40ed-b119-628e922990db", "value": "T11313F16E72BEA7F09310BC75D535C450B04B2FBD703E98B2D1D9996C7D460C868AAD43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531406, "uuid": "814a9d6e-3552-469e-a552-f3777642e719", "value": "768:gLL3nh2cwEn6mKO2NnngxjbAWUANH9q3UELW1kpFC/YLO5a7CMTk:gLbhtwEn6mKONxnAdA4LU+FCJT2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691531406, "uuid": "14737675-45d5-494c-85dc-d4677e503a3a", "value": 44532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691531406, "uuid": "1cf4e5e4-ead7-464d-9078-4f9d82f551a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531406, "uuid": "c6eef266-b2d6-4613-bc73-aede17af381c", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a88274-3644-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691537714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691537714, "uuid": "2641599e-aed8-4c8f-a801-7b1b23436f7f", "comment": "Malware payload (RedLineStealer)", "value": "f235938a2a7b1712ec278123f70f7529", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691537714, "uuid": "1c4317f9-3ced-4145-accc-c97f425624cd", "comment": "Malware payload (RedLineStealer)", "value": "e0414dcf39d1df273d8c94d6a977c2443ae0d115e903dda528d87f5d1be10ec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691537714, "uuid": "60a2d723-d4fe-4b9c-bd59-a56f30f7928c", "comment": "Malware payload (RedLineStealer)", "value": "28760a8523738bcfaf4e95b0de756d324ccc389d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691537714, "uuid": "c2eac2ba-4709-478f-9083-0ac71f4026db", "comment": "Malware payload (RedLineStealer)", "value": "8f63d8c8733465ec2f91c77ab7117cdf2575b68bb1f571ad707529d2f6f05b4cdf2df87ac13cbbcc2cbb30946d356d22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691537714, "uuid": "45bd565e-355c-4956-b856-211d8bc77f9e", "value": "T15784AFD366D47870E6660A327E6EC6E87F2EFC928F5467DB12447E2F09711A1C632702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691537714, "uuid": "a88a9f4e-6f78-4b69-bb86-ec5cd41372bf", "value": "e2fd91e72e5236090c506729ffb05847", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691537714, "uuid": "57f47092-2a55-4a86-9fb3-01ce97118068", "value": "6144:FnIvVNP8yPuW/UbnW9Pl997LEZKxmEq1Admg5b5FIXc5iDd:Fn8BuW/UTWrQOsoxkJDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691537714, "uuid": "ed9b38df-546c-4a6a-89c8-4e8187628745", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691537714, "uuid": "788b78e5-c337-4114-8933-9f8e17d00db3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691537714, "uuid": "f86a75bf-d98b-453d-b2cc-e9bf2c1a93fd", "value": "f235938a2a7b1712ec278123f70f7529.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c6641f-35d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691489550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489550, "uuid": "7747146c-efc8-46d1-a921-76cabf71af7e", "comment": "Malware payload", "value": "4178c9328d164a6171ddccb870875306", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489550, "uuid": "0831dc9c-6af1-487a-858b-8591e420c461", "comment": "Malware payload", "value": "e1890dc28d56e185e93a37e7a7ffc30c6a681f45f37cd366e4964643333c1983", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489550, "uuid": "0c02e12d-ca8e-469f-bb5b-9c2a678b92ae", "comment": "Malware payload", "value": "b2001909b10fe86fb9dc1378ee4ab8e3c2751e4c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489550, "uuid": "43007f1f-0cc0-489a-9a00-13bdbfc5e53f", "comment": "Malware payload", "value": "787776c883686998b2ae66cf353ecbc07a055ea9463d6212c8ef4401154e6fee216f4e483f6126cc49c6e8dc3d93376c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489550, "uuid": "5c02cd7a-ea8a-4881-969f-63a9c47df187", "value": "T1C0F42331271540F1E342BD37919079F81B38B8E82642E9613C6AB5FD16895FCE33AA7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489550, "uuid": "d8293f55-9fdd-465b-8037-c36dafd2d5d4", "value": "12288:ckLMwkWwoSNubsgYWVlwR8JSy9qklrd+akecnt7XUFZd+9j/50vQmnwCErRh:cD9XjgJz0mXYklrdbkecnUL+990vwC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489550, "uuid": "e5d3a530-bbb4-439f-9242-d4b4d65ab719", "value": 760226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489550, "uuid": "0574e666-2c06-41b6-90fc-ec5c9d28820c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489550, "uuid": "8a4ea0c8-be3d-4cd0-9785-62466242cf60", "value": "FACTURA_3609824.xltx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40089e57-35b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691478025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478025, "uuid": "c6c2f8d4-2015-4eaf-935c-330e5c9da4f2", "comment": "Malware payload (GuLoader)", "value": "4f11205da3e4d05588bcb5a6e518c1df", "object_relation": "md5", "Tag": [ { "name": "172-93-161-245", "colour": "#BE0DF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478025, "uuid": "0cfc74e0-3d23-4884-b1b8-49fc0cc616e6", "comment": "Malware payload (GuLoader)", "value": "e18ef37e6492ec36977361506b73efb434b23a3c5552edb9d0e5a3bb74094af3", "object_relation": "sha256", "Tag": [ { "name": "172-93-161-245", "colour": "#BE0DF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478025, "uuid": "400e80f0-b42e-4d57-a204-4d570fa6b681", "comment": "Malware payload (GuLoader)", "value": "95410e7b774bf3f1ba9171b8c2b9e0b154bb1c29", "object_relation": "sha1", "Tag": [ { "name": "172-93-161-245", "colour": "#BE0DF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478025, "uuid": "6c51f7fc-355e-427b-b6c1-7548fb04c113", "comment": "Malware payload (GuLoader)", "value": "9b9c2b9605f19ef038495dfb531201575f76313398da1fb23debc738f416ccb0cfa9a878892da29755ab79c9be50cfe0", "object_relation": "sha3-384", "Tag": [ { "name": "172-93-161-245", "colour": "#BE0DF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478025, "uuid": "181e72ca-3c6d-4f91-afeb-6605c57160ab", "value": "T1FB441211A6EAC1BBCD920A74D9FA76FB9731EE14C2A0550B47E03FB238756D11B4B243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478025, "uuid": "eb50c870-ff0c-4f30-9027-4d5d5a5cf281", "value": "076b06e6a65c9b7cca5a61be0cd82165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478025, "uuid": "327a70c1-52af-4739-9428-88237b8a815a", "value": "6144:/zAJFlyucwHFp7VzirVN+P1HT5EzjWwM7jpz5jU:rCfv8idz5E/Mnpz54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478025, "uuid": "3318c9da-6916-4a2a-9753-fc7265931a0a", "value": 267152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478025, "uuid": "b5fb3f08-d53a-467e-9eed-271edc8d56b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478025, "uuid": "6ba86dc9-7a1f-4078-86a0-1bb78dc0085d", "value": "anfrselens.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4777a3b6-35f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691503807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503807, "uuid": "f88c9b43-d7d9-40c5-aeea-62579adccdfb", "comment": "Malware payload (Mirai)", "value": "1fd8349458cc5b95f18d7b799fb8b4d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503807, "uuid": "4a8dd632-2f41-4b4a-b24e-c211b66e0765", "comment": "Malware payload (Mirai)", "value": "e1dced9021c150221caab7607ed0542de13307721d421a4dafccac378e3afb1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503807, "uuid": "a2a4b487-4451-4d81-887a-0b60d91cfc44", "comment": "Malware payload (Mirai)", "value": "67bab06fb7d7f0443d541f07a57163f191e97265", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691503807, "uuid": "e261172f-bf99-410d-b031-1574a5f8d886", "comment": "Malware payload (Mirai)", "value": "ee7773f5a64f6a76143e53b0df1d793cc42f3b9ad40dd56310ff63093ab7a3f19ff9a7707b0ba56bea091053b59097d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503807, "uuid": "846dfd22-3dfb-41ec-8056-c786e0ed1e05", "value": "T1DEC2E171ABA0DBE3D6715CBAC65DADCB061B1FBDD0F9313769104C2828D38C3A6B4246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503807, "uuid": "bedd867b-6794-475a-a255-5a6bd5c89008", "value": "768:tMKyhegCCMmueaLL8NlclK37zCa8ZEgfV9q3UELgo:yKy4mkYOILzIZEtLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691503807, "uuid": "d9e86a8a-e995-4d96-96bf-86e34908672d", "value": 27284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691503807, "uuid": "01d51efc-ab86-4e2e-912b-8b2f6d1ba80c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691503807, "uuid": "c494447e-4df5-418f-b3b4-0fdea29873a8", "value": "1fd8349458cc5b95f18d7b799fb8b4d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d940962-35b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691477242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477242, "uuid": "94e5a5b7-e1b8-4d1d-b60b-ae5d34963221", "comment": "Malware payload (AgentTesla)", "value": "2bcdfe1319b37b0959881dd7f7d3305c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477242, "uuid": "38aca995-8417-4bb9-87a0-271b39d10fc9", "comment": "Malware payload (AgentTesla)", "value": "e2bdf8f9ef5ed0958028c2ea491285fc140421f72266410c5cb98c5a19ed196b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477242, "uuid": "9654092b-c832-476d-9c1c-22c32a2aa7b3", "comment": "Malware payload (AgentTesla)", "value": "b4d9c7cac579303713c85106d6034ec19c16c2d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477242, "uuid": "f168d72d-73e0-4f5c-9264-dee313058a01", "comment": "Malware payload (AgentTesla)", "value": "71dc462b9a9937f511b96685a9e7ba08a5cb193f8ede99fc155decb4800b6549a4b576df3a6840ab3522e50bb7f089a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477242, "uuid": "507deba0-d1b0-4b8f-8706-e5e36fd402fc", "value": "T1E0E25EA6B2D6EC06D95907354CE7C6D67622FC615FA3838B3289F71E1F71AC08903617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477242, "uuid": "bd476d5e-5c64-4733-8222-ac0ef832169a", "value": "768:uPP1k3hbdlylKsgqopeJBWhZFGkE+cL2NdAJRq3KqdAYFXJ25x:81k3hbdlylKsgqopeJBWhZFGkE+cL2Np", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477242, "uuid": "46db1d8d-c4cf-41c4-ae56-e888eb9657c4", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477242, "uuid": "1c8a6c23-1fec-439c-bd17-665b8bcc9704", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477242, "uuid": "dee10cf4-9343-4b7c-a662-e35991a2fd43", "value": "RFQ-EUF5089.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6560c172-361c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691520608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520608, "uuid": "ed34cf06-7c0d-4814-9c9e-038eb2b36ab5", "comment": "Malware payload (Mirai)", "value": "ab5a2fe0072076dfde19d9cabf6800b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520608, "uuid": "36b34b75-1dc1-498d-81d8-81983ee1de10", "comment": "Malware payload (Mirai)", "value": "e2f2177cdd40879c59c7bc6daf381030f78eb81b33f5c39bd95626995c22febb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520608, "uuid": "58f0ae68-659c-4ec7-ac0c-18af82761a0a", "comment": "Malware payload (Mirai)", "value": "023a1ad87ecda5c0ba6e06860e16e99e119a13da", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520608, "uuid": "c8f6eb18-e112-47ff-83d2-7a12b187f5f1", "comment": "Malware payload (Mirai)", "value": "adfd7592ee9e5ea1e02f6dab74a15945e354382284f7d6d680f9a994691c2a25ca1e5b8b999bf1d71bf7530e318e2c26", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520608, "uuid": "1fcfa45b-68c4-4abf-8b8a-14ebee8b872c", "value": "T1F943F2976C577A42DA250831A0F244CAF3065CBCA1EC3F316D1294B4A275301D7BAE7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520608, "uuid": "8bbd389b-b300-46af-8913-a91d5d1ebb20", "value": "1536:sFbIYjvD5aEJ+ozbUSA8lQw+XydBeI3Q1pqUTY1J6ZDjiQCeS/:sFTjvD3Qo/Xf2w+XyrewUTe68QC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691520608, "uuid": "b0f3a8bb-70c9-48fe-a990-8966194a1f0d", "value": 58856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691520608, "uuid": "5b09bcec-df3c-4d73-819f-0914096fa06b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520608, "uuid": "259fbf4c-a169-45be-b1ab-e3b55e1a5f69", "value": "daehaeng.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340d2a93-35bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691480582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480582, "uuid": "8d35bbcc-f916-4754-a0f4-1270ff5cd874", "comment": "Malware payload (Formbook)", "value": "b5027bab17fb5aa21f00bf3ba4528661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480582, "uuid": "3d617335-9497-44b1-a6f7-23030ddc6ff5", "comment": "Malware payload (Formbook)", "value": "e4b8b19c8c8fd39ae06ba2ec632970e7fe16f78ca1f91582461de5da1403a4ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480582, "uuid": "ecc29aa6-4902-4387-ac48-0fd1c16039f8", "comment": "Malware payload (Formbook)", "value": "b355cce034c4c385e7ee27c979a7e10877e3543b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480582, "uuid": "74dd4557-b56f-445e-88fb-6d67c93cfc1c", "comment": "Malware payload (Formbook)", "value": "6b81548dc15fc1e55d0418829bd81b4ffff7e17c76654d9c54157998344ecda4a940498af067c05617b392e78f09a00f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480582, "uuid": "b10c72c6-6af8-421a-a2f0-312165d35fea", "value": "T1F5F40201736D6F33E5F5A3F9213614500BB2399E399AEA591CD170CF2A62F108E61F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480582, "uuid": "a95e6e6c-95e4-4501-8e02-db6c4a6d7117", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480582, "uuid": "c83543f8-d1ec-4eb9-8233-ae38bac81ddf", "value": "12288:LsokiF9BChPxxI4VTzCHp8z2ko1bnSSGM8WMupmLwiAdT6/F:QokiZChP8Uzwp8z2BF/AWAwdT6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691480582, "uuid": "a44a8e49-8b3e-477d-b102-36a1283880d8", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691480582, "uuid": "095172e2-de93-4370-9f01-36c7b2c15a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480582, "uuid": "203a5ec3-35f6-4b4e-bf98-1512492a8cd0", "value": "b5027bab17fb5aa21f00bf3ba4528661.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888f3579-3635-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691531404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531404, "uuid": "043d128a-3691-4891-90e1-45f56670c4b4", "comment": "Malware payload (Mirai)", "value": "3fb5f6b00feee15dacee1296f556dcec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531404, "uuid": "fa702f7d-275c-4399-9367-0827c31a9a36", "comment": "Malware payload (Mirai)", "value": "e52d3120c6bcf7d43712ae637cd65c94714d0a1138b49ca462087dc56a35f042", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531404, "uuid": "101c8a92-e2bc-4929-8231-4dc85a073b29", "comment": "Malware payload (Mirai)", "value": "0258c0617bd4761efd687c51cc21289a44189fa3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691531404, "uuid": "6b2b1637-0456-4946-9dea-d24e5b5150de", "comment": "Malware payload (Mirai)", "value": "78a140a00ef9a8073c9f7a3df4f406f9d6c8cad5540a615647f6fe13aa775ec55c6faba38acd5d49c3163b937a52183e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531404, "uuid": "c6a18cb9-8a97-4cec-8db1-11c06c17a98d", "value": "T13C13F195E1956386F82E103A0EEF7DAE02A6F21B42C839B57BE5180534A1F107E49DDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531404, "uuid": "8794b2f4-641a-4bde-8b33-e2fa55943591", "value": "768:jRuPmJj/FCYtbI8FeD+8lDeFQIwW94DERBF386feqnbcuyD7UiyqRG:jRuPmJrFXtGDtjERBFhPnouy8ZqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691531404, "uuid": "5864b248-5c00-4077-901d-e3c55e344bad", "value": 43600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691531404, "uuid": "8000c7df-6d56-4141-b06f-85d496a93126", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691531404, "uuid": "7495ea60-1df4-48b4-a0de-8b7fac760149", "value": "Vhoats.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad752fb8-35d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (WSHRAT)", "timestamp": 1691491523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491523, "uuid": "0d82047a-4131-4f70-8332-b757e1cecf03", "comment": "Malware payload (WSHRAT)", "value": "cceb6f7af35075d52fb1abbbcba9d552", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491523, "uuid": "9a5935ed-dc96-4511-95cb-e03b7a9661e6", "comment": "Malware payload (WSHRAT)", "value": "e65ec8d385c6ce480304b3ef59bcae22c5513e74394d0c4ddea7c3ce61bcc5a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491523, "uuid": "22572da4-bdfb-4765-a9ab-216cc9c28e3d", "comment": "Malware payload (WSHRAT)", "value": "db1fb42b122d7dfe6870a9a5158cd16a54f500b9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491523, "uuid": "59889eb2-0472-4a24-a7ae-0bc8d622f01e", "comment": "Malware payload (WSHRAT)", "value": "7fe75bdce93863f3458d53598a3dcf3f5f9b051ab530c761eccab2f0fd12b6fb71f15fb179ef9df80e74fc03dd14125b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491523, "uuid": "2e73685c-dbd9-43e2-b72e-c87f03753581", "value": "T1D7D5CF92315ECA73F3E3C08FD121990B0128C79C27936173A9967A4ED619AD432B9DFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491523, "uuid": "33d24be8-9fdd-4f4f-a364-08386a4c8448", "value": "12288:HEjhLV6ErrE79GfPIE9bR/Ncojw3Qxe1C5SsPuUhoGp8b+hRmgQeemB7JpPBgKq0:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691491523, "uuid": "952e066c-85a1-4472-9c60-74b4d40f0e52", "value": 2970390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691491523, "uuid": "5826b57f-ffd1-4bc7-9feb-5b18b6609449", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491523, "uuid": "ca788fd1-2499-4637-a600-5c0c5de19b7a", "value": "Scan00516.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffce1afe-35e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1691498533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498533, "uuid": "891d3439-1aac-46e2-b6d9-c969d42c773e", "comment": "Malware payload (ModiLoader)", "value": "61556b5231979379d593eee9cefb5ed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498533, "uuid": "01448444-bec3-4eb2-97c8-1207c7a27f75", "comment": "Malware payload (ModiLoader)", "value": "e6dddd0677a1d845a689a27df273161891a1ba2e0c7cf3f57b97f2da47377019", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498533, "uuid": "e73e7d18-8fbf-4b51-8a47-9157c2e8594a", "comment": "Malware payload (ModiLoader)", "value": "ff32ced915aa65b65a95dee643a9c8b014c1be38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691498533, "uuid": "d6feea77-8d0a-4910-91fd-0265c5f2afe6", "comment": "Malware payload (ModiLoader)", "value": "0a3cbc5bb1304f379e3d1166b9e3c18fac8a5de53567dc7fee61b8ccd6dd8df35bba7aa0537e236768ea70224627814d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498533, "uuid": "e5fc171b-ce90-42ec-855f-7553d1593b1a", "value": "T153059F35D1B444B2E02B29359D42F75898347D713C38A45AAAFF3DC8AE7B683F8191D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498533, "uuid": "e7529205-dcc4-4c93-9187-2bdd829c40d9", "value": "c1bc1b4428880431ffbb0e7b82ce2dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498533, "uuid": "156e17a3-6db1-4d9d-9450-18ffb6de08b8", "value": "12288:h3H75pQe3LJf1jpBVudoJrLsqkbBjXjrhGHxWgyFaB3Z6:hL33tfd8dgLTklF9aB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691498533, "uuid": "ddd8cb63-d211-4a0c-a71c-d2963fd6ff9e", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691498533, "uuid": "1f34cbfc-1f9d-47a2-a97b-5f414a198c91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691498533, "uuid": "acb1805a-af90-43d7-8a7f-d51c078fa2e6", "value": "e6dddd0677a1d845a689a27df273161891a1ba2e0c7cf3f57b97f2da47377019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667e1e7e-361c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691520610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520610, "uuid": "0fe6312f-472b-4c72-8238-aa537c86a8ca", "comment": "Malware payload", "value": "02cdb4d9c35cc95910003ea2a065e848", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520610, "uuid": "f1ea1cab-df59-4416-9702-4b029ccaef87", "comment": "Malware payload", "value": "e7b2546284bbb8939529d244df84d6af611c92307ddec9d4e05b45a71f624a22", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520610, "uuid": "64c6df85-de44-4f19-8da7-252c6b654278", "comment": "Malware payload", "value": "2884bd9639ac0479c354c2ee067fd3a74274930a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520610, "uuid": "bd455de5-6643-4611-aa9a-88717a62af24", "comment": "Malware payload", "value": "53b551a08a5b1fbdad4204c1c7549d64bb827682ff88bcdd928d4b69a6d74a7f5d9b2521b4901d313818b3ca5708901f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520610, "uuid": "0abdfbe6-8adb-4495-bcb9-fffaf5a478fd", "value": "T1DCE2F1A09A49213197F13D72F8B8438BF50602AAE5BE71F089744F39FF850951A7CC6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520610, "uuid": "113e61bc-c82a-4cde-ad94-b4c14de82491", "value": "768:+mGsRzyG0rYFD16f03znee6GpWv7hRTYHRkVwNvW3Uq:rGs9yGEYFZu6e4p+7L0HWIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691520610, "uuid": "414f4ea5-6b1a-4103-9a1b-56bb89232eb7", "value": 33776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691520610, "uuid": "4e7fa671-0b3b-4c19-9355-479d41769516", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520610, "uuid": "7b7de496-89c2-45f7-b8a1-6f66b82d37d8", "value": "daehaeng.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896cca27-3637-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691532265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532265, "uuid": "39d827aa-46e0-420d-9429-25a02e1a0175", "comment": "Malware payload", "value": "3a51de6aad19d6a1c4187dbe9737b5e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532265, "uuid": "486e5fbd-8b70-4d14-a4e7-7fc2ceb4b745", "comment": "Malware payload", "value": "e8591aa5e0e62c7a247c6f9689757d3fc5793c4f4ba3b5df620fc1afb7bb1385", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532265, "uuid": "1a0e9189-b672-4fac-88d9-156eb969400f", "comment": "Malware payload", "value": "1b3c89e516aa386573c5e21226e2234582a94459", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532265, "uuid": "be6d3d58-727e-4c60-b67b-27e238659f87", "comment": "Malware payload", "value": "410f5412b859b514e37041f5df2ee069600aee5220e2fc872a7bfecc705c3bc78b22ce01ec0b27596473fac50930bba8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532265, "uuid": "61c086a0-a216-43d7-9a14-728dd67b74ad", "value": "T1ADA2CFDD9A04F4CADA4D0EBB81A647328995318271C89F84837D81D9F337E0BBA9C07D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532265, "uuid": "922d7b8f-8f0d-40e1-91a8-f852b3e017ec", "value": "384:GdGXlrjPOXzc/g6JcuLchLn7d1wldr2/QLpud22p32KcTIRWGVCz0NvFi:pfWXzc/g6JcuLcVh1wldr2/Q9IGvEWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691532265, "uuid": "e7c98ea2-7f7a-4b21-a590-4f4ecfe6c996", "value": 21604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691532265, "uuid": "6d2ffec7-224f-4669-a28c-b49f197359fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532265, "uuid": "112ef371-9c67-463e-9b44-16b55a125b63", "value": "3a51de6aad19d6a1c4187dbe9737b5e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb16689-35eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691499764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499764, "uuid": "20880cc1-7717-4a5c-9533-a189cd056ba2", "comment": "Malware payload (RemcosRAT)", "value": "eda7106da6c217dd84a7d4cb3480dfac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499764, "uuid": "666a66b9-51f0-4f87-9e70-c5d8bb921f6e", "comment": "Malware payload (RemcosRAT)", "value": "e927fff10c8748b3940670fc02d0e72e9af8813db9481ac9afff720461f5f2d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499764, "uuid": "b7241d88-cd59-4c93-b91b-b1b9b28b0336", "comment": "Malware payload (RemcosRAT)", "value": "f60e2cfc0fbf166f7f7deacd1c9f8fc3243ec1aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691499764, "uuid": "686a7b31-ad6d-41a5-8809-bdfbea506b3b", "comment": "Malware payload (RemcosRAT)", "value": "c3d44d4d00a50f14f80dd5ef9f3a96211f399439959e4af7b9bbe2afe959271bd4bb272c26ab22397923bf082413c21e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499764, "uuid": "39b89384-49a7-46be-b0fb-22a504f98e8e", "value": "T1A935220DFF90A09AEA3A0F7014A1F3F053AE6FE92174D54F7E67B05A6F32745521881A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499764, "uuid": "4b589d7d-6a26-4928-9a48-46c70a34f5f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499764, "uuid": "4fe88177-4211-4ee0-856f-d86dd91bdb1d", "value": "24576:DHIcTrGCcOm0EA8V2P8ulFJ+f8j9NLcI4aVR/oGrCvVjCvC:DHIkrzcOmBA8VfuJdJNEaGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691499764, "uuid": "740734a1-2e4a-4234-ada2-eb8a0f50d953", "value": 1060864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691499764, "uuid": "b065e93a-96a9-401b-aaba-3047b106316e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691499764, "uuid": "791c3010-adb8-4d15-a3e1-ff127beda0c3", "value": "e927fff10c8748b3940670fc02d0e72e9af8813db9481ac9afff720461f5f2d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9782ebe0-360f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691515108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515108, "uuid": "d219ebb3-4ba0-4737-b42b-47a45fae5109", "comment": "Malware payload (Mirai)", "value": "9f2f668854cfc502e26dc41d51538e92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515108, "uuid": "18ade239-784a-4c2e-88e2-7aef9eba706c", "comment": "Malware payload (Mirai)", "value": "e9695490225eb13fe0aaaa9e050dd7f95d586c337ee442be26104e70916d5fa4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515108, "uuid": "c7993000-9458-4038-8063-7cf64e4f7193", "comment": "Malware payload (Mirai)", "value": "a8832aadeabf74bd130badd01da99681d3aa5ba1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691515108, "uuid": "5b702758-4ac9-461a-904c-50c2ba9b6f7f", "comment": "Malware payload (Mirai)", "value": "359a5efb4061fcbe984cd933fe69c7e8ecbe269a9069050ca1f1855f3722286e6f0ba233a9e399fd9968400268918141", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515108, "uuid": "cc50baa6-6627-49eb-b758-3b9b01a3d46d", "value": "T1C16302E496467770465158BDC43A850367E37BE4CAAFB2AA837CD7902C42A43C6DCD2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515108, "uuid": "600cdbdc-0e4e-4f0b-aa41-1bc8642c0e25", "value": "1536:tGnSZPSxRs89tWsPR5x8BR9TQHt/AkI84jzfK:4SZqxRs89oO56BrQN4kdAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691515108, "uuid": "b0b50731-9da5-4797-841a-297fafea446c", "value": 69380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691515108, "uuid": "139477e9-a29d-4855-9122-f4aac2acfc43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691515108, "uuid": "b40246e9-2919-41b9-ae2c-ad6a6b101f1c", "value": "9f2f668854cfc502e26dc41d51538e92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4104eed5-35ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1691478456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478456, "uuid": "b693f462-7ef6-4758-9ad3-e1ce925e10d7", "comment": "Malware payload (Fabookie)", "value": "7cb084c3d181462419cf7216e4a1b922", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478456, "uuid": "41f4a425-4796-46e1-b732-e6179ec6d371", "comment": "Malware payload (Fabookie)", "value": "e9a3f870423d54604c3991b45a0678c8e983cb580c3ba04f8cdefedffeb6f7f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478456, "uuid": "9b18683b-f08b-4570-bb7d-26c167f7f2c4", "comment": "Malware payload (Fabookie)", "value": "8dfb862bedcbd83ae0c033dbe37bccd022fd3e80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478456, "uuid": "17a2a504-9031-47bf-874a-9a93f62245e9", "comment": "Malware payload (Fabookie)", "value": "1a614754ca2ab9ef40150cb4f2887ef6d3867fae8ee22f43ca4eeb9ee0a99528bee09cf79bc2c25344949afeb1c4ff4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478456, "uuid": "2e57930b-1c8c-45b9-a285-bdad1c9d3dc6", "value": "T1AE949ED2E34040E5D577C2B982734B62E7F27C285B214ADF4659B6392F337D28936A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478456, "uuid": "b4bc0a35-a14c-4b85-a618-4e1347431ebd", "value": "d1884757532ce7b0014241f40262c929", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478456, "uuid": "4225c928-8985-4dc7-9f65-6464db2b9d5d", "value": "6144:ul073J3gpJ1K4t1O9rdDW64t0+eoJAbB3T+cbJp:z3Jwp/KMqJU0+5cCIJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478456, "uuid": "c4bbc627-57fa-4bc0-a7d3-002e2a03810d", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478456, "uuid": "94c72f43-59a1-42d1-af39-6b239759a42f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478456, "uuid": "b99dad17-adcc-40f5-9b5f-1bf528b212e6", "value": "7cb084c3d181462419cf7216e4a1b922.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0b599f-358a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1691458102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691458102, "uuid": "f340108c-a266-42c7-9588-f0e26dfb77ab", "comment": "Malware payload (AsyncRAT)", "value": "65c06c0404ce69f08491b0f868e0b635", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691458102, "uuid": "43dd6605-1662-4b41-9197-0ecaded11c76", "comment": "Malware payload (AsyncRAT)", "value": "ea04850fa21b0c32d74e4f6dfd09540efb4674cb64e6836b4842d8a7e6ae587a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691458102, "uuid": "06745fba-d9ee-4cff-ab11-735ef9965b32", "comment": "Malware payload (AsyncRAT)", "value": "1755e9e23b212c625fd2abe28ddd8255417bdc59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691458102, "uuid": "9cfea58d-ea39-4183-a8ba-11b74bfe9d42", "comment": "Malware payload (AsyncRAT)", "value": "8d390a1c25967a0fd4d8fc9f54cec92aa92c8219404d76eb67e585a9778f34bf701815078e94522650e8bdd72166177c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691458102, "uuid": "be2935d4-5488-4d5d-95f4-18cb51478451", "value": "T108232C003BE9823BF2BE4F789DF26145867AF2633602D64A1CC4519B5613FC69A436FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691458102, "uuid": "11d9dd50-7059-4d22-93cf-df819e38e9e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691458102, "uuid": "ba3edbaa-90be-489d-afbb-2ca91c036c52", "value": "768:jujYm1TUET1/WUTQV9mo2qz+8V1vBTcPI1zjbkgX3iKKeS6XGdmLhufvfBDZ/x:jujYm1TU0I2P8VnTh13brXSR+iyGvpdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691458102, "uuid": "1fac46cf-2a12-40c1-b500-486fcde94645", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691458102, "uuid": "78b536c1-c198-4c92-8273-9866d7dbe728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691458102, "uuid": "b3e0472a-1929-4743-919b-faecdc38d1f9", "value": "65c06c0404ce69f08491b0f868e0b635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301a8464-3603-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691509781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509781, "uuid": "fba16283-621d-454e-a89f-e2bf10356e9f", "comment": "Malware payload (RedLineStealer)", "value": "43826336acbeefd0dd225bbc32298ce7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509781, "uuid": "9a603a46-91cf-4cf9-a773-ce4f48cd6d8d", "comment": "Malware payload (RedLineStealer)", "value": "ea65afede1c8f6b3c286f5ea1eb729682ea1fd75ea946756ec422d691148764c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509781, "uuid": "8d1efb37-12bf-4394-94f7-11883cf1c122", "comment": "Malware payload (RedLineStealer)", "value": "f498881bbf27724db11eb92664ad2426b3b3ccd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509781, "uuid": "4cea287f-e30a-4420-99bb-c6e02211abb0", "comment": "Malware payload (RedLineStealer)", "value": "53ae4d54588f5b7245704f3e332e51a0ea4fa19e9bb115a064b5e7da93e108802f2864c0d072486a101a376b11af74b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509781, "uuid": "90a811e9-510f-48a9-b524-eae3fbe0e43a", "value": "T1F8547ED266D4B871E6274B32BE2ACAE42F2EFCA18F1577DB12447E2F09711A1C531712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509781, "uuid": "a647252b-6900-4f29-831d-622285e5cbcf", "value": "e17e424f3eae4a622546f9db266c8f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509781, "uuid": "421a5afc-4bec-4b50-bab2-b899567d8df1", "value": "3072:3Ses/fI4AUsFV+egvVZC7DppgRS8U76eUASwC:C5Q40FYhrCBpXWeG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691509781, "uuid": "fcc7401f-3cf8-44c6-9fec-01e6a42bad7e", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691509781, "uuid": "df783fb5-db4a-4221-8396-23c8634b357b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509781, "uuid": "3271bced-b2ad-4e3f-b34f-aa7d65f9b305", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647833e6-361c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691520606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520606, "uuid": "62283a79-5939-4833-92cc-6f31a847b1a6", "comment": "Malware payload (Mirai)", "value": "10dc8e9d1698ec657278580e182f75dc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520606, "uuid": "95183488-fbe6-4164-9fbc-fa4b0a756e3f", "comment": "Malware payload (Mirai)", "value": "eb6e874cfb4666e6ef0d625eed95fba8ec35b9fb6703560d1de79cd2be57364e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520606, "uuid": "7dfd31fd-8ba5-4816-80d4-1d563494d9f5", "comment": "Malware payload (Mirai)", "value": "937aae88be63c8c944c9162134d5b88da672db38", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691520606, "uuid": "f83e6d2a-7e82-40fd-a6dd-7fab6d55ea1f", "comment": "Malware payload (Mirai)", "value": "5982e24b4f412fd87717cc92ec1091a5d00cc732ac47a6945eaaedafbb41ba8924a67de1417be603e82206269f6fc1cd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520606, "uuid": "255a5020-95a6-4f68-9a5b-71069f58b7e0", "value": "T185F2E0C2C4CECFE8C7AA7430186F7D494800D379DA10965BBF4D25288AD0F29BE6D626", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520606, "uuid": "860722a7-0394-4a77-a207-e0568107b074", "value": "768:DUJKLwg3Yrfg+Q13CjCgJmmdVAJ1wVynbcuyD7Uiyqr:DUcE3sOVGMynouy8Zqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691520606, "uuid": "aee1cff4-a8c6-4446-81da-7546ac957752", "value": 34472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691520606, "uuid": "46fe052a-5ec0-4461-89c3-940de48b2fe0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691520606, "uuid": "cd3c7f1a-8ba4-4e6b-8f7a-bbdb9ca9a0aa", "value": "daehaeng.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8bd394-35ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691500514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500514, "uuid": "d6494e90-6ba6-4429-bd53-9425f6c91cd7", "comment": "Malware payload (AgentTesla)", "value": "68fde124b69e1b15a9584df468f0dbba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500514, "uuid": "ca61f8dc-699c-469d-92de-5ef127ba1455", "comment": "Malware payload (AgentTesla)", "value": "ebb59bef21a675d89a1301eb8494aa1e02a9580cb562d33b5f31ee9053b5f3e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500514, "uuid": "54a84e90-5483-4170-972f-d35499df4c76", "comment": "Malware payload (AgentTesla)", "value": "f153caa495b990aaa5cc797fbe837fdd4f438ade", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500514, "uuid": "eeb17e11-9923-42a7-8086-63504e52ba34", "comment": "Malware payload (AgentTesla)", "value": "c568ff68acd08bdd09952c12a53d090db573523ac887111b955b653138ae78b6ad654745e6cba6ee46c15d7327627330", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500514, "uuid": "9c43b32f-f80b-49a0-8649-3cae2692f3e4", "value": "T1C1D4F1A9B1FA1B63D37983F6556426410B7432A77C27D93C1EDE20C9FA13F5019A8AC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500514, "uuid": "be7fe694-71e1-40d7-9e30-437abb9afcb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500514, "uuid": "75b447fb-b436-4b31-87e9-d7a8e71a5796", "value": "12288:EkysSRZvOA03cPnMqIejgzRpSD6UND5R6orT1uycr6JZIrfpz:M6kMIgiNND5ZrBuyckUfpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500514, "uuid": "7208fba4-19dd-4f3b-9d9e-ce9fd623ed33", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500514, "uuid": "d5d707b0-c96e-4f41-88f4-57a744455b46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500514, "uuid": "d0ba4637-f507-4c5b-a264-f3f5b8dab12a", "value": "ebb59bef21a675d89a1301eb8494aa1e02a9580cb562d33b5f31ee9053b5f3e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b897ca-35c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691482217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691482217, "uuid": "8db54845-7564-4d4c-a3b8-e975177255d1", "comment": "Malware payload (RedLineStealer)", "value": "6979f18e5c21cd842af2d46162d96def", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691482217, "uuid": "041731fc-0bea-48e0-af84-4e13eaf052d4", "comment": "Malware payload (RedLineStealer)", "value": "ed3c455abb23addb14d8f45029a3c5e4e39b4d2a3d3d50e66db88002ce5b3d80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691482217, "uuid": "7334b20d-e34f-46df-b13f-ef90c61c13cd", "comment": "Malware payload (RedLineStealer)", "value": "76c0287bfdd120835625583816513034c1e848e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691482217, "uuid": "f0cb4cdf-70a5-43f4-a83e-4bf292a2cb74", "comment": "Malware payload (RedLineStealer)", "value": "f1dd821eaae62569508eaab57e5b259997d6075048feb7732dd64d4d3eb3231d929684d290819fd9742cf289f80acc5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691482217, "uuid": "ba01c7e4-5aba-47d4-b5cd-16681fc45b5a", "value": "T14C849F12A6DC6B71E5D28A324E2DF6F4AB1EFC91CF1936DB124C7A2F09711A1C176702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691482217, "uuid": "d745c3b3-8f80-436b-a37e-0828a0d1c638", "value": "7574067d27f1e097e97a79381564790b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691482217, "uuid": "9b7d8c48-8e36-4ebd-bff0-64f7a99ef4c2", "value": "6144:YXTvnwBcu4M6Ox23dArvTh4V1ncpxEhV9:YjPwBcuwOxFvd4Xngmr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691482217, "uuid": "d0ea318f-27b0-4353-aa1e-328205f06e41", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691482217, "uuid": "8224ef4a-6d4e-48cb-bcc8-a1e99abc0e79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691482217, "uuid": "2417b6d2-c17f-41b8-9e26-ec10acaa58ce", "value": "6979f18e5c21cd842af2d46162d96def.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a862c358-359e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691466604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691466604, "uuid": "7e0fd783-eeab-4a63-bffa-c0d2bd833fc9", "comment": "Malware payload (Mirai)", "value": "a37efc768f97ae66f2218133f3bac497", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691466604, "uuid": "2ae937bb-ec42-46e9-b3f1-7fb976f5d4db", "comment": "Malware payload (Mirai)", "value": "ee508a13216a15c4f7f65663720748f185823b31105016332c211b364cbde9fb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691466604, "uuid": "8996bcf7-28d4-4417-b044-ed8e1307d439", "comment": "Malware payload (Mirai)", "value": "102d98050cf42877c64c993636b5dcfae17d96e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691466604, "uuid": "50cf915e-7195-4280-b191-52d946533b1e", "comment": "Malware payload (Mirai)", "value": "8c245429fd19310b4b1cba66e799612790f9699c497d9fa2bb48ff17d9eab103e4738e0032ddca088f1abecb00671999", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691466604, "uuid": "60973697-6fb1-462c-b176-1645337081e7", "value": "T179C2F1BFB6AA6A67FA5C1339E435811B0394F11C57AE6B5723800532DA5F81EB132CCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691466604, "uuid": "36a4f4c9-b012-417b-be60-43fa7750b98f", "value": "384:MX1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHePnM44:qMwxdyoEUnDz+Y8tqHWXm+PLays0Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691466604, "uuid": "ca548801-ac99-440b-abf6-4489841357ba", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691466604, "uuid": "600ed3a7-31b5-4048-808c-39eae89adb9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691466604, "uuid": "677d3e85-46c2-4c08-a052-6947b5988e9b", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebee82ae-358d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691459416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691459416, "uuid": "67a951d7-4e18-4593-b7a6-e96c31d8b95d", "comment": "Malware payload (RedLineStealer)", "value": "810f35e91727b324159ac0ef491b4efa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691459416, "uuid": "cc306754-1ef2-4e17-ad60-50a7a6115a72", "comment": "Malware payload (RedLineStealer)", "value": "f038fe75bad539b5de33461024a9c3189ba7e5173d42a95b58fe44a4520fd442", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691459416, "uuid": "53e2b00c-1655-4584-8286-384760b21d22", "comment": "Malware payload (RedLineStealer)", "value": "59ac7ccc52534a0eda8dca3c71ced770a5cddb9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691459416, "uuid": "bb193898-1fa8-4855-a3c4-16bdfb0e630a", "comment": "Malware payload (RedLineStealer)", "value": "67da9939aa9a9d9da9ac44df14d94dbfdc9695d996ff85ffe91971db5902456f36587074b5fb4e3f6fe50a71fce91a0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691459416, "uuid": "efe5b816-0a06-4636-8194-aad84a133047", "value": "T16464E043A2F0EC71D4378A715F2BC7E87A6EF430AD658B6722449B6FC9312A1DA57301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691459416, "uuid": "25b77170-c19d-447c-ba79-3af3ff28cc18", "value": "041d48491af33996afda7a32ee725dc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691459416, "uuid": "58b772a2-06c2-4cec-bdf0-ed9965ceaefa", "value": "6144:OgLL6W+Rr1CuXUjhzlrDwU6b/GfgHnicFIlNyKe:xP+RJshzlRXf6iQI3yz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691459416, "uuid": "3b9f9d60-eae6-4e56-98b8-bd2b51b36e7e", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691459416, "uuid": "6b067097-e522-4b8d-a02e-37956d834588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691459416, "uuid": "1c0d7a88-a914-4315-b806-afe9b7e35663", "value": "810f35e91727b324159ac0ef491b4efa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d0fcc2-3616-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691517928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517928, "uuid": "81723c7f-c0d4-4054-a8f0-1a60ba1cd1b5", "comment": "Malware payload (Mirai)", "value": "1964ebfae74f50c2dfd58b1406ea939c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517928, "uuid": "e1bff62f-f2e7-43ce-8754-e95bdd3792b3", "comment": "Malware payload (Mirai)", "value": "f11e8aa0af15b8baabbfd1e80c8021b4adc1b56ffeb5037fa2e9ee86b04bd2c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517928, "uuid": "d2bfa5a2-be45-4380-bd48-53bdd40fd83a", "comment": "Malware payload (Mirai)", "value": "c9e5f7b86c2828c43e8772ecc00f638adc753089", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691517928, "uuid": "f0b883a9-6db5-4ab6-8da2-09929fdb4da4", "comment": "Malware payload (Mirai)", "value": "07f63795f5dc27303b2a83f9e656f95f1bb7544271f8e45b2ce909523ea74ff8a6ca89bb563a0f5ca107e7ba51c5633a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691517928, "uuid": "e67d3967-a0ae-4c6d-b2dc-7e8da1075b1a", "value": "T1EAA2D025D386AEF4DFEF9CA45681C2C276E547C62786C8E340FEAF012616046B789D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691517928, "uuid": "cdb7a71a-2dc6-422c-b5ae-6970ac7f489e", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5vgbdM4uVcqgw05VxJc:9RxsSVsMD6xiJJE5zRWNuS4uVcqgw09y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691517928, "uuid": "565ef13e-576e-43ee-ab1d-8dfcfdcc5ca2", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691517928, "uuid": "734224aa-9e5b-49d3-b93e-d2ac77b9fc8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691517928, "uuid": "a755115c-4b89-4975-82fd-c797c6984ef6", "value": "1964ebfae74f50c2dfd58b1406ea939c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca538ef-35e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691495119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495119, "uuid": "852366bc-027e-4af0-bf5b-0604a3103060", "comment": "Malware payload (RedLineStealer)", "value": "a54eeb63869d360003d40df887365f00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495119, "uuid": "3e013d96-78b3-4c6f-bc82-b40aefe17256", "comment": "Malware payload (RedLineStealer)", "value": "f155342f5bb62210ca274f42d22e4345fd8ca58a1c4c05d06e1ff86b8888a8cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495119, "uuid": "12c0087a-33e6-4a63-ab86-687028cd9bc1", "comment": "Malware payload (RedLineStealer)", "value": "ea1d8624c635c610e0ab3e0ed75056759f01741d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495119, "uuid": "a7900713-420d-426b-8212-775d644c8cae", "comment": "Malware payload (RedLineStealer)", "value": "aa4753b8c8b08bcd2da77405d5a22469c30413f87701314d19034c2bcbf5e3ccc39eeafdfd25e2e849f1e6ba6ea3b332", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495119, "uuid": "fbe3df99-9989-4c34-a429-eb29fc8216f7", "value": "T1096612F97744329DC01BC8349437EA0BE2B6105F5BA6F5BA73C7B5807F6B7218A01A49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495119, "uuid": "ca671da6-07c8-4d22-b6ab-3c85345ade56", "value": "713f2679b25b10e65da54bb5dd0f93c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495119, "uuid": "ddb959b9-8971-42b8-abe2-23ce4ad4726e", "value": "196608:ffeAKok6DF0u0FmDgeU8k6BME+3FXvk1:ne7J6DeDXeU9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691495119, "uuid": "95125de0-cf6a-4a26-bb21-51b8dfe89b5a", "value": 7076864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691495119, "uuid": "d96692e6-95a3-48d0-b525-25b9671fc55e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495119, "uuid": "2164d495-7a36-4edf-927e-883c56b9454d", "value": "a54eeb63869d360003d40df887365f00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278e2e56-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691478843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478843, "uuid": "3833d847-28b5-4a8e-8956-a5ee08a9a270", "comment": "Malware payload (RemcosRAT)", "value": "c88d4757ee5c295c3ff996dca43e737a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478843, "uuid": "d107bfa1-678b-47ef-9621-cab4cf7ade67", "comment": "Malware payload (RemcosRAT)", "value": "f197a58d2ac9ac937c5d417d0800d4804a80402395cdde0fe42dec0931674da4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478843, "uuid": "80040f13-8521-4e3a-8c21-4e166d3a7884", "comment": "Malware payload (RemcosRAT)", "value": "dc307074db36fefeb99a5c1715b90a1382493d70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478843, "uuid": "1938c25b-404e-4d69-9c7d-469ba548664f", "comment": "Malware payload (RemcosRAT)", "value": "a1cc464847eb091103181576a89f50cb97d1208cfd9ab3bb33b4acc79dab1b7ad1ecf9b6a8ca6e7c56e6c66d2b3c8813", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478843, "uuid": "fbdf5262-bb2c-4980-9e92-b385e2506371", "value": "T1102523339FEC1161E269A3FCA8E601032276D38229EA7F4B44D483754E63F1675D1DAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478843, "uuid": "e12ea7d3-2701-4e4c-9b12-f0cf2dc2d0d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478843, "uuid": "a9e07d56-c1b6-4fc7-98c8-7014cb4f95b4", "value": "12288:x+h7rFnTibJ2tYdG7T+IAmvHfvT2Nxda5vWfco//3HS8meXaI1eIEJJZ3gSeYApt:S6byT+I/vXT2NMWfco//3y8m29MQCyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478843, "uuid": "781c582b-6628-43e5-80e9-e9f7323815c4", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478843, "uuid": "6fd2aa48-253a-447d-8952-8bdc1e5bdf85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478843, "uuid": "b82fea44-49f6-4980-a4ee-7a209ed386ac", "value": "c88d4757ee5c295c3ff996dca43e737a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ce5527-35e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691497892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497892, "uuid": "afbfeb7e-cb37-438b-a399-c846814e49cc", "comment": "Malware payload (Mirai)", "value": "bf6437a040d85540501e82d8ef4b8ed0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497892, "uuid": "8e491d0e-96ed-4486-935d-f2cfdb7cc43e", "comment": "Malware payload (Mirai)", "value": "f1be6229b0b43fcafa35651e4000b06d08ad3b243d3433f3e94165aebace2b4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497892, "uuid": "21b011af-2766-4f2b-a2a6-3cffc8c198e1", "comment": "Malware payload (Mirai)", "value": "bcf75be6d11220a218c7116ecea5ff0bba8a6b2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691497892, "uuid": "03aba07c-911d-4b0e-a0dd-d887a88d0853", "comment": "Malware payload (Mirai)", "value": "633ceafc393d949cb6a926fb7dd20c792096fbcc2c6ed79dd02c01216b62c57582f41d6aecad6e9cd5048a64c3e6817b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497892, "uuid": "c1c3cbde-e68f-44bd-9eb3-2089dfee48f1", "value": "T1CDA2D029D345AEF4DFAF9CA053C1C2C2B6F543C6678AC8E340FEAF026516046B789D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497892, "uuid": "ea2690ed-d740-4c91-8eef-23fc6458bb85", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5/OM4uVcqgw05VxJi:9RxsSVsMD6xiJJE5zRWNT4uVcqgw098", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691497892, "uuid": "39a850c7-a0bc-48da-965d-43edc799e515", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691497892, "uuid": "23c729ca-df96-41e8-8773-9db883369024", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691497892, "uuid": "8659581c-2823-4e34-bf04-77b278fce8e6", "value": "bf6437a040d85540501e82d8ef4b8ed0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fa24cb-35b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691477152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477152, "uuid": "4061ee6a-b0ef-457d-aa06-06538baac107", "comment": "Malware payload (GuLoader)", "value": "4c41a193a8a112c28c778d3250ae34ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477152, "uuid": "0ca468c0-a8a0-41a0-a5b4-18afa167d445", "comment": "Malware payload (GuLoader)", "value": "f207d6c347be657ee166d029d08e30b6ebed5166ead65740a6f6b0a82a443cf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477152, "uuid": "5b053799-246b-4c6b-9ed5-1c73499daa17", "comment": "Malware payload (GuLoader)", "value": "955471e23c3af5cc4776d7b7159942401aadb56a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477152, "uuid": "fd59a19a-43e3-4595-afd2-2e34d6019d0b", "comment": "Malware payload (GuLoader)", "value": "8ddd13c0be0ad6cb381adc9dbfb9812f3b7ca56652f650a9294b8e46bce4ee88e77a415dec9ed61dd2cdce9dd856b34b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477152, "uuid": "88d505c7-832c-4775-8b09-37f94377a94a", "value": "T1CC9633687CA2E816E2C894B2E74AD1BB42B0FD081E51055B35EBBF1F7D7C1909A3835D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477152, "uuid": "c26ba36c-f42f-4ed5-9ec4-65e3776f21a8", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477152, "uuid": "ab340e5f-0a96-47b1-8b25-0e2883a168de", "value": "196608:X39pC/8iQyDLGA8WwlmrddlhvKhI+GrBTxsqcLWdsOP1O4Vo61:X3nC/eq1Dwlm5dl4aZ8NOpou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477152, "uuid": "0027676e-08ff-431a-908c-bc934417c42b", "value": 9160313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477152, "uuid": "2b919d2b-675b-47b3-9402-c20ced91def4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477152, "uuid": "8b6859b9-65ac-4c8e-b688-6c355cecca1c", "value": "4c41a193a8a112c28c778d3250ae34ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3cd284-3608-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.Generic)", "timestamp": 1691511872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511872, "uuid": "1f5e92f9-630b-4012-8ea0-8e172ff91b08", "comment": "Malware payload (Adware.Generic)", "value": "3a1844a86f804c69f5d61676b5499681", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troja", "colour": "#613DE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511872, "uuid": "6946ea00-3d35-468b-a95c-febbc09fd75f", "comment": "Malware payload (Adware.Generic)", "value": "f22452a13635e4651b51c1491312a74891ca1dcd1b5072cbb978c06dc0a560ca", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troja", "colour": "#613DE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511872, "uuid": "4e80a37b-bd8f-402b-a6db-b160004b4469", "comment": "Malware payload (Adware.Generic)", "value": "13ef47d5b5be444392127967345c88f7d0670ea8", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troja", "colour": "#613DE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691511872, "uuid": "4293d34f-6cbe-469f-973a-43fdd06acd91", "comment": "Malware payload (Adware.Generic)", "value": "19f44a393ae2ca037092c6ef1fdec9f998acda31437fda36908485a0c566886ad9961cf76fb34b56ebd17bf3d4f9c3ef", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troja", "colour": "#613DE5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511872, "uuid": "ab1a3931-33ac-4280-b339-1a4ba68168be", "value": "T1A395CF3FF268A13EC56A1B3245B38310997BBA61B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511872, "uuid": "b3610cec-c62e-4e35-91f4-f8ccc1b222f7", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511872, "uuid": "3f272f59-7048-458f-8453-e866a78b040b", "value": "24576:s7FUDowAyrTVE3U5F/pQ6kq+w9cf1TGKic6QL3E2vVsjECUAQT45deRV9Rf:sBuZrEUp1zo1qKIy029s4C1eH95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691511872, "uuid": "c1d27365-8b84-42e8-ac5c-6559c0a60756", "value": 1931242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691511872, "uuid": "aa86d543-895c-4001-bc36-f6582cf4ddcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691511872, "uuid": "6deeddcb-470e-439b-ad78-753f47210a65", "value": "run_206fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475e91e8-35ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1691478467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478467, "uuid": "d7438273-96d8-4dba-8e05-cc5a4342c728", "comment": "Malware payload (DarkTortilla)", "value": "7668552aefbb14e5155d7f08d50c4a94", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478467, "uuid": "567be52d-ed1c-4a5d-a577-25657207d4d7", "comment": "Malware payload (DarkTortilla)", "value": "f26c4299680e5e643be5c6ca968fadbdebd34d9b1454a330db086982a92264b6", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478467, "uuid": "5597b8d2-907e-4919-b118-390f29ab5b95", "comment": "Malware payload (DarkTortilla)", "value": "1a0823c877ecb8c2541c098ff8f5b08986ceaa0e", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478467, "uuid": "68285e3f-3992-404f-a5c6-88146e812fbb", "comment": "Malware payload (DarkTortilla)", "value": "7b33594fe00d57e03f8524825ffa3f352d0a0a1b83bdfae307e48ed672f4ed984fcb52322b04d6a9dfe01eceb8108135", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478467, "uuid": "faddefbb-91b2-4a32-8895-4fbe6af187f9", "value": "T13465E04EFC022F55C331D87B0A8E9A203CAA12BF5F529F1772656987DF805C6B03566B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478467, "uuid": "19d6245d-1152-4d97-809e-33880d222da8", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478467, "uuid": "cc45fa9b-e5a7-46c1-8898-26c73c13b0f0", "value": "24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478467, "uuid": "598b4c9c-68cf-4673-acc9-1ad0ccbb0845", "value": 1442712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478467, "uuid": "a1532560-9914-4b0b-97fe-323306c967bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478467, "uuid": "ce958ac1-4bc2-436c-8256-b135e8d5b297", "value": "7668552aefbb14e5155d7f08d50c4a94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf44f0c-35d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691489457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489457, "uuid": "60499d1a-4c96-4576-b136-fc078043d71b", "comment": "Malware payload (RedLineStealer)", "value": "54ae4618ca14b4128ef095694382b46c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489457, "uuid": "aeef7abe-e9b0-4064-aa88-ca04cb60dbc2", "comment": "Malware payload (RedLineStealer)", "value": "f305a02ef7c36f8fbe4b265588ca32f4a7f191173c6dc0ced8acb753ddb51665", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489457, "uuid": "3c1793ff-7168-4563-92d1-1b8bfb67d1cd", "comment": "Malware payload (RedLineStealer)", "value": "56007b814c80c4b2ecd20dc19fddb63e26873c23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691489457, "uuid": "f5b8f4f0-4ec3-4d2a-a29c-d6c593a1b9c7", "comment": "Malware payload (RedLineStealer)", "value": "3f100904d84113e71030ab92a9aaeab21ed17557e4ca4f2f852715eea54fc4901fe1172939e243a0979fce8e887caac6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489457, "uuid": "82667b39-ad71-4de3-a058-d2cb44d58138", "value": "T11974E153A2E0F871D17146715F1ACBF4772EF2229D786A0A33548B2B0D722A2DE73716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489457, "uuid": "8a4e242b-d561-48db-9cc8-fdc64706a7ea", "value": "041d48491af33996afda7a32ee725dc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489457, "uuid": "530cd5c4-0f1b-4f74-84c7-d8a2ea80322b", "value": "6144:hT4LtFoPnQHx7IDDatr7/7urn+zhtl+mZU5jeI8xTqYoy81ow/jNT:KToPnQHxs+rWrn+lDPU5jhcYyxYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691489457, "uuid": "d182cdbe-8aba-4375-a805-615a101e53d7", "value": 365568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691489457, "uuid": "1625bc42-65c7-4e4d-8cf6-5d83cca39210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691489457, "uuid": "e412cf16-93bd-42ca-b103-09c06c5438e9", "value": "54ae4618ca14b4128ef095694382b46c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d66810-35e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1691495032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495032, "uuid": "a4121258-88a5-43ad-8f7c-38ecdcc84ea6", "comment": "Malware payload (NanoCore)", "value": "b3d8c50b566e88432928f03a9d74ed17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495032, "uuid": "c65c2d5e-2ca8-4a76-a598-675bcb1f6ad4", "comment": "Malware payload (NanoCore)", "value": "f37f8dd8b487fbb2cf025c394d21f7b660cb92500596bd87964f47a6ade89cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495032, "uuid": "101f5e61-b2a3-4df4-a926-05b763696dd7", "comment": "Malware payload (NanoCore)", "value": "38f35e2db9adb6597b1e9730892ad6dcf1518ff6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691495032, "uuid": "295a51db-2852-4d81-b745-f0d5c01951cb", "comment": "Malware payload (NanoCore)", "value": "90f41575afbb4d90e6c3679d847b0389404fc77d56c764fffa4b2ac3a443e791f03ef54a792186a76e2803bd6cf379e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495032, "uuid": "ac6a7676-7031-471d-8281-4f94b92dd58c", "value": "T14AD4121071ACA72BEAB557F81984990107B2FD8B9072E3052ECE71E79B23F1146D1FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495032, "uuid": "e735568e-3304-4a06-a0bd-1bad20439814", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495032, "uuid": "28ca6b02-9e6e-426d-8e2d-f751b3fe3fc7", "value": "12288:if2iN2GULd00Oc4Q7MzziiwDXyXua+Qmq2gxx:if1xULa0QQAzzi5XyXu1Qrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691495032, "uuid": "2129aee4-408d-4d11-b3b3-e4baa86a4022", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691495032, "uuid": "33e416e9-8fe9-4924-a5b5-3c0b743c7164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691495032, "uuid": "67598999-569b-4d4d-93a1-1ff565976705", "value": "f37f8dd8b487fbb2cf025c394d21f7b660cb92500596bd87964f47a6ade89cf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620bd8a5-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691477653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477653, "uuid": "0d9b37b0-8a6e-400c-904f-f81dfeea18b3", "comment": "Malware payload (GuLoader)", "value": "d4afdd3f2aaf0f5b4f49a753f8aa11f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477653, "uuid": "dc9628bd-8c7a-4add-ad2b-5f8e1ffd3f54", "comment": "Malware payload (GuLoader)", "value": "f42c0bd2cfefa75e0d4957d4339bff10fcb03271e3421d80a93c73a1613b1ab8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477653, "uuid": "391afb40-856b-48ab-8a14-91c2a038db7a", "comment": "Malware payload (GuLoader)", "value": "81c872d0491f48f6e313a4224a92f79dd5309ec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477653, "uuid": "a2bc110f-f7ff-4a51-aa4d-d72d588efaea", "comment": "Malware payload (GuLoader)", "value": "c9d5a0e97489f2a3ebf65ca29a1a1743f0ee09483b3ab9033dd98713f240e81f09485c424332700225668a136a30d40a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477653, "uuid": "245c3804-14ee-41e4-9270-a9b108fcee42", "value": "T1CE94BF53FB52C4E7EF3C23F3B49399DB2DE965661E84408E7BA6A7E55000A224F0D528", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477653, "uuid": "94a33402-df82-41f1-a853-296374dde3f3", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477653, "uuid": "ed7ff7e9-b378-4448-9acb-901a86a4507f", "value": "6144:+PX0UPlrkcqMGIJjB9rVLdvzi5Q8/Lj/gLy6GRfcFLwsHDaitR:QlRGIBj7i5VTj426GR0FxfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477653, "uuid": "d78720dc-e017-40c8-bdc1-3dfa24cbacfc", "value": 415888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477653, "uuid": "2b1ae2e0-dc4a-4b15-bfcf-3d60a6447bfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477653, "uuid": "2fbc62d1-0b67-481a-a09d-0469bb24f4e8", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88af21d0-35d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691488455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488455, "uuid": "26f0fa50-fe08-4bc8-b6da-ab5ffee856cc", "comment": "Malware payload (Formbook)", "value": "165b4e943d83e5bf3beda044089131c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488455, "uuid": "4500abb9-c12c-44a2-bdcb-39c2620a0f1d", "comment": "Malware payload (Formbook)", "value": "f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488455, "uuid": "3be4ab08-3c88-4fd9-9c7a-e1f9d04a4760", "comment": "Malware payload (Formbook)", "value": "1e00cd2baa1d26db9a265346b0aa7796f377ae9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691488455, "uuid": "33b46f71-453d-4783-be77-53f869e5518d", "comment": "Malware payload (Formbook)", "value": "8c5cb6bd1f686e4fd27d30cf8e419c4622d9a0ea1f35619fab4b04604d8915ea91d86c3eb64b8a60009edf2949a693d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488455, "uuid": "76ebed76-21a8-4561-b657-c77410e75c83", "value": "T154F401C2E9444796D4712BF180316A70D2BB7EEE647CE24E7CABBD31B9E26475133902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488455, "uuid": "3ab365fb-b918-4d07-91ff-f4ee56dd954c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488455, "uuid": "c40e90d8-aedc-4ee0-9c6a-90d168e399f6", "value": "12288:VhYiIoFwIrG3XCCa4ZSJ8kjNz/PDWzGLrP5tfB7YC3c3JCzclt4i:LHIcTrGCYsJ8kxjPDF5ZB7rcCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691488455, "uuid": "173609f1-98e6-41f4-9324-6dacc999afef", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691488455, "uuid": "ee83f8f0-eb94-4a69-b453-7bdf17c59260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691488455, "uuid": "df2c908b-8aa4-4c70-9c9e-d07d32bd438d", "value": "f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b893fb-35b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691476124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691476124, "uuid": "f3e45b95-edb3-4b82-b521-b64259cb4577", "comment": "Malware payload (DarkCloud)", "value": "49e029cdb711780389850ae7ad0cecdb", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691476124, "uuid": "06333122-9a32-4435-abda-31dadf274980", "comment": "Malware payload (DarkCloud)", "value": "f4e66b28f6a98a76e32c498914c56c8c34293c432338199e461945cb6c69b1ec", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691476124, "uuid": "9fb4d84c-528d-4064-90fe-621e8e744517", "comment": "Malware payload (DarkCloud)", "value": "7bef64cca73fa45c1578a5cd7cdb39f33c2aeb8a", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691476124, "uuid": "53e20ad9-f581-4117-96f8-14af5ec7ec17", "comment": "Malware payload (DarkCloud)", "value": "9f603fe6604970087666d73f444ed4a6078364b1cefc78f9604674ef9af85167eecee5669247ef065d018c7b62d0a1a4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691476124, "uuid": "7f6daa2a-95ba-43fa-8560-9fa56315aad3", "value": "T16225121233786F67E5F5A3F4293920940BF275AE66AADA180DD270DF1A62F104F40F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691476124, "uuid": "91744535-5e82-4485-aafe-67011eb7675a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691476124, "uuid": "61f60992-e181-44cc-8c02-662c02868446", "value": "24576:M0siOmxnksbNhPGARbgNF78LjQ5T091XvMl9t7P:M0siOmxnkyNp27L5T091XUlv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691476124, "uuid": "7dc79009-06db-4157-b63a-2981d7c00a1a", "value": 983040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691476124, "uuid": "7d764d1a-7605-4587-9175-c7841cb5382c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691476124, "uuid": "4acfa05e-b0f5-4b16-999c-769977bc58d1", "value": "SecuriteInfo.com.Win32.RATX-gen.6169.5787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21fe700-35bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691479478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479478, "uuid": "26c93d72-a0e4-40ab-9f6f-6c650ab07954", "comment": "Malware payload (AgentTesla)", "value": "013182a781a413616c9cb9b36fe23fa2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479478, "uuid": "558b14e0-f240-409c-8eeb-a1e45c48d6c5", "comment": "Malware payload (AgentTesla)", "value": "f7428bcecf7bcdf3d3fb1a8eca5b52e15fc8fd4c90077082c538c611d5b7f97d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479478, "uuid": "fa5ca320-67c6-4c72-8a8c-f5e2775b89f2", "comment": "Malware payload (AgentTesla)", "value": "23157c98cd929df942254a33f900607bd4cfebbb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691479478, "uuid": "23b1237e-244a-4bb8-b3ce-49ff01f61a0c", "comment": "Malware payload (AgentTesla)", "value": "a585d31f71505fa999b08c866c04ca60efe47dc75c8db97c4adcb774028153cc016c9a55b1c28b6f07b62693333a2c20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479478, "uuid": "dc7d108b-572b-46f0-ad07-d8c7acfdb7f7", "value": "T16B050281373C6F63E5F5E7F4287A644007F1A45A356AEA6C0CD270DB69B1F108A12FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479478, "uuid": "21fbc5e2-f132-4c19-ae6d-db94895fe0c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479478, "uuid": "3e1d0c20-16d9-4857-9e92-182ebbbc7019", "value": "12288:LseiiF9H/D4ytFUqftDr+AYPk7mqcHbLmguljNf3L4o/OKzflBL41t4awgRuSQ:QeiiPbUOrWM7mNPult4o/pl+t4aBuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691479478, "uuid": "49e4d9f3-e686-446e-96fd-a128d93dd7be", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691479478, "uuid": "679ad2db-14cf-45a2-99ad-9fcedacf630e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691479478, "uuid": "3a5c5af9-2acc-44a8-9254-2233149bafec", "value": "013182a781a413616c9cb9b36fe23fa2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53245415-35b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691477628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477628, "uuid": "d894f14f-08fe-4b44-8aec-5564bb5badf1", "comment": "Malware payload (AgentTesla)", "value": "65c40c15b9c997c8aa7f3b3e417d3b1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477628, "uuid": "f0a394b1-4367-49cb-b4ad-5908f945a21a", "comment": "Malware payload (AgentTesla)", "value": "f85606df4b72e97d27d10edac888f969bd3dc01500a3318100cdd048c6e790e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477628, "uuid": "d4345338-ef15-4ad3-99f9-8b423806a95a", "comment": "Malware payload (AgentTesla)", "value": "9695a4e5d1ffb1fbe1eb31e7370822abfcb660d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477628, "uuid": "e328d37f-45fd-47fb-9ccb-5182bcb35dc8", "comment": "Malware payload (AgentTesla)", "value": "51836dcd56b661a1b898a49f60ba6ce46f0cc5e47ac1586234002e34a3f8edac64a7a00c1b3b3e26a53e4a0bdc29be7d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477628, "uuid": "32e6dd75-c6e0-4e3a-ad67-4fff3b6634a0", "value": "T127258B331E5AAE9DD8A9CFF026AA10220FA1DE15BCB5C55A0C8170C655FCB00779EED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477628, "uuid": "53834137-2b0e-4127-9520-f202d9f0137a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477628, "uuid": "6255b013-5f85-49bb-b300-24e4b505ccb3", "value": "12288:wsv3iF9BgOzsl767yAaUkmhQRGX0ltIOvHlu9Gr840vg3uhshC:tv3iZzzsl7OVyYFIflu9Gsg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477628, "uuid": "9ffcbb29-09b1-40b7-ac31-1bec24692771", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477628, "uuid": "d714da38-0868-4cfe-8d25-a651e3490b21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477628, "uuid": "a54deff1-cf9d-41a9-82d6-5a0c28997514", "value": "Sat\u0131nalma Sipari\u015fi - 44733.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0088d1-35b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691475554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475554, "uuid": "f7b95936-83b5-4c57-aafe-d8ee2dcff37b", "comment": "Malware payload", "value": "08ea604f05ff7b003fe8d3a25153988b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475554, "uuid": "7b2c1480-291d-476f-bb41-8403122c3508", "comment": "Malware payload", "value": "f858ed2e4d44d42258d352aee6dde26a11166e1da5ec6369415f312e918705cb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475554, "uuid": "81de1533-5b15-45a2-8744-907f529183e7", "comment": "Malware payload", "value": "1d21dd01cbd16cd659701893fbac49b211e8f830", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475554, "uuid": "c1187c04-b954-4447-b3b4-b59baddd5766", "comment": "Malware payload", "value": "f6fff4b88661dad3f85e1a99815cee25506878f355ae788819cc48a1c7abdb1e6ac68db44fb7318bb539a6f25626db45", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475554, "uuid": "90f10a47-877e-4d00-bedd-7911574c4439", "value": "T1AB326C6D98D3462ED3CA4177F0D1094453833F2188976B93BEB0E4C99B76AFE974DA04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475554, "uuid": "2ae3e336-5b72-4e74-8ea1-a8810536e7d2", "value": "192:bc1UZXEH3/ialv8vWcrcTEjsv8h9y0MYuAyG7vEAMp:bc1WEPrv8vWecUJuA/7vETp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691475554, "uuid": "e5422b5c-e4cd-4d4c-9499-c1f48fbbb583", "value": 10917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691475554, "uuid": "8a811c6b-d7fb-4bc8-bf00-0c89844d5ad9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475554, "uuid": "d150174c-b807-4ea2-9def-90e0c81fab13", "value": "RFQ.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79be53f5-35d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691491007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491007, "uuid": "1178b1a8-7fe4-4398-9e16-ebb4d3d65290", "comment": "Malware payload", "value": "a5732b1cb868c07c385faece285eff67", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491007, "uuid": "9bb9347c-0158-481c-b697-dc59ed5981a8", "comment": "Malware payload", "value": "f89acc22c624b75318f62f18ddc27a20ffb35eeb90c1f0fd176193c82c6f5718", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491007, "uuid": "a48a5f09-b767-4695-9312-d340fc0cffcf", "comment": "Malware payload", "value": "6160b20d4cbb3708009598df637b6556f1df8ba6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691491007, "uuid": "a4488232-5c0d-4977-9e39-36058d6b2ac4", "comment": "Malware payload", "value": "51442e2afc9e89aadf7f2a1fcc509c40ee438de5b54c394261bedcc1ee1c56488d3ad549bd708614fadd3a2db65a996e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491007, "uuid": "c0319b59-a002-45a3-9c05-4448edb3371d", "value": "T15CB52383DB2A6F22CD69A07CB047F91AC1A6F4908A5A17BC0574B15D92F1014BFCDDFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491007, "uuid": "6e5f9c60-dd70-4aca-978e-ca3c9a4d3976", "value": "d24cbb1e1eff66791f333e2dee6d0919", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491007, "uuid": "02455615-70fd-4f5f-b9bc-4da23bf7e9c8", "value": "49152:ibZdYkpKR7QFsmarl3pAdofzbGyrVDpK9HVVDmJqJ38bS:ibPQisFhWdofzbGAVDpK9HHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691491007, "uuid": "ddbb07dd-8b5f-4986-ac8a-56a79563bb00", "value": 2371584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691491007, "uuid": "b7bcf144-4f69-4549-b146-40f06e68d9a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691491007, "uuid": "50f3af5e-cf0e-4ff9-a29c-b823b4abd180", "value": "SecuriteInfo.com.Win32.DropperX-gen.12083.1499", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20c5106-35b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691476122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691476122, "uuid": "915282f5-e713-43f0-aaed-070b612e2dd8", "comment": "Malware payload (Formbook)", "value": "61db67decb4989c4a5a6649974b2105a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691476122, "uuid": "a0676e99-62a2-4911-8508-0efb99e950f3", "comment": "Malware payload (Formbook)", "value": "fa205475200b1905390d87e73c2eda671794af72b57fa0f5b86eb554c4c2ae72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691476122, "uuid": "9ec96c05-a88b-44d1-af34-19a60c9d9a5b", "comment": "Malware payload (Formbook)", "value": "fc1eba4665ccd5f46d7c138abeb0b757114c08c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691476122, "uuid": "9a9bf9d1-b2ac-456f-98d9-3a6a1dd22276", "comment": "Malware payload (Formbook)", "value": "c02c136d6017842e83cb4b1d1bf7307eedbb2cc19983ecdd07cb4252c35caae03f417a0e53a941b16c8a17d5a0b843ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691476122, "uuid": "ca3a288d-0f59-4073-bbab-214f37e1431e", "value": "T18AF4FE2939AA500DB3729E556BFCB5B6C05EF6F226364C7B0DF7020621129F0DB9C53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691476122, "uuid": "a147232a-3a60-4460-a0b4-d14b1b692275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691476122, "uuid": "ba762606-c36f-47d7-aa33-4bf5fb795f15", "value": "12288:So1kAR4UgNhzAFkSF35yrLfv7vFGrJ9muDmFqYejlJka:SAv9gklnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691476122, "uuid": "ddd1c8bd-42c1-4f61-a491-4b34dcb19a27", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691476122, "uuid": "773cc6e7-3a73-4f53-a8c2-8c8b21f0c189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691476122, "uuid": "c2f90ef0-2e35-4b3a-87a2-b9e096f3d15f", "value": "SecuriteInfo.com.Win32.RATX-gen.20758.31464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8adea2-35b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691474717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474717, "uuid": "e9166eea-63a6-4a80-be90-ac48b6afa67e", "comment": "Malware payload (RedLineStealer)", "value": "b289e58e4bfd1f1577b480dcbd0b00d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474717, "uuid": "013e267b-e9d1-456e-92df-787519393866", "comment": "Malware payload (RedLineStealer)", "value": "fb104405d5f6a628687964d86dc7c6b4d456aa8645d0d618bd91f2102c9c3760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474717, "uuid": "1deed7f1-5422-46d2-a7db-e3770e0be5df", "comment": "Malware payload (RedLineStealer)", "value": "70700a0b417fbbe9285984e7925d88a4091a2aff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691474717, "uuid": "4c725a1b-e97d-48c6-a91f-511297edff0c", "comment": "Malware payload (RedLineStealer)", "value": "8af533ceeff415a241b8c77fdca8e3c8e080c27421122793a34db96d7545c5ecc7b9d952c1d79e439c49bb16d5199728", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474717, "uuid": "21763d83-e15f-486e-bca0-3e27de197792", "value": "T1AC84AF13A69C6B71E1E68A324E2EF6E4671EFC918F0937DB124C7A2F09711A1C576702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474717, "uuid": "d55a5b0b-052a-484f-8279-c22b2947a9f2", "value": "7574067d27f1e097e97a79381564790b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474717, "uuid": "90aeefd7-028e-4895-bb75-d0082440fb5c", "value": "6144:6ziAiPfbfHD4kF4Ncf1N6lGOnF+ZNi9Vwsa:6uhPzfj4kF43T0P2ys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691474717, "uuid": "d52870ef-47ee-499e-a336-37d180508d47", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691474717, "uuid": "5e8f6487-1c89-497a-8c8b-b960a83510b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691474717, "uuid": "827baaa5-b052-4a39-ba69-416bdaa2b57b", "value": "fb104405d5f6a628687964d86dc7c6b4d456aa8645d0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65dfb2a1-3602-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691509442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509442, "uuid": "8b88054c-20e2-4fb2-8b56-13e0b87d60bc", "comment": "Malware payload", "value": "3a7c3e75830129f14439db9b1a5d6304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509442, "uuid": "b395971c-754b-4bf3-8925-2f57d754d9c8", "comment": "Malware payload", "value": "fb5088d43c6a40ba6f1cbc8badf50f4151cb993e835295a6e68527f506e389e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509442, "uuid": "531a3a0f-955e-495b-ba2f-46a93f301fd9", "comment": "Malware payload", "value": "89efdf8ea34f49a2e720e0e13c384f3ad310241a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691509442, "uuid": "3efafbab-ef57-42d5-aeb4-5143f996d8e1", "comment": "Malware payload", "value": "73c2f4f892d0020ff90d3f1d4f80fb86571eee9dd53f765d1378900d19d0c590da91ff6dc84e831a9f35cc07fee929c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509442, "uuid": "79b62ec9-f8a9-455f-9bd0-5f5b90af89d3", "value": "T1C2849ED366907861E6630B32BE6ACAE86F1EFC918F0577DB12447E2F19711E1C632712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509442, "uuid": "795b48af-ca7c-4485-9d42-a3592ef050a0", "value": "52d0e35c520458543d7ae579063fd12a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509442, "uuid": "869a0539-abef-41d5-8702-694bce9b970c", "value": "6144:CKU1lBO8RPMugmPfqeJfR8E2/0AefWM+E/TvRP7:CBzBO8MmnJBJO0tfZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691509442, "uuid": "eafbcfc6-a06d-4cda-9bfa-fc3f1bb4f304", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691509442, "uuid": "3773fbf2-6459-474b-8942-293ac2ee2b9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691509442, "uuid": "d5d50a82-269a-4b3f-88fc-89a5bb24c1db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd37b976-35fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691506206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506206, "uuid": "60f427b0-8459-44e5-bf3f-c6bd6c63bf88", "comment": "Malware payload (Mirai)", "value": "425b917029675ad643df49fd0c3d3593", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506206, "uuid": "51014d00-c3b7-4b72-b2b6-f17023879f50", "comment": "Malware payload (Mirai)", "value": "fc6df441c4a3446d29ed3932043265d94585f02c1bfb95c07743e2c80b035adc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506206, "uuid": "f0641633-4d7c-47e8-a4d8-003601e5e5ec", "comment": "Malware payload (Mirai)", "value": "ec26af9396345985bfaeb674b912f57fbf492bee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691506206, "uuid": "1f04841f-7a75-4adc-a4f3-01c8bcd2021e", "comment": "Malware payload (Mirai)", "value": "4a919c709b9c8e5567a032764193920565f057fb40191cc25d0b8f1047883349d7c720d2a41effc36a240fcb9db37658", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691506206, "uuid": "1370a734-15fb-4ee7-aabc-54886277123c", "value": "T1C013F156514CC681CC3B21790AAFF81EE8C6F24F70C196FBBA502677199DAB8693C3D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691506206, "uuid": "893b8481-9bc7-469b-b290-1c51c069b7c8", "value": "768:hLdS0ca8D+OiVnYlXHLYflVldyD/Hbp+kej5AnIdM9MMUpwnbcuyD7UHQRjzD:Vo/+hUUflVlu/7YkedmwA5Uunouy8Hyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691506206, "uuid": "bbc5d8ba-3752-4550-a39b-fe52869c8409", "value": 43432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691506206, "uuid": "6c4a6e9c-f26b-42ae-9b82-4d51641c1d8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691506206, "uuid": "2bc31b4f-1deb-40c1-ac9f-64a9e6dc1315", "value": "VRx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94aca885-3637-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691532284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532284, "uuid": "8a00fea4-38cc-4ac0-8172-c01f6da6a738", "comment": "Malware payload (Mirai)", "value": "0c25370a69675cd98dcdd0eea02aefe9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532284, "uuid": "86f884f1-98d0-4678-a037-80591d8670ae", "comment": "Malware payload (Mirai)", "value": "fc8122e728e50f9c937a030017d5bc205b40c7d8ab7109368320e0e24ad75d03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532284, "uuid": "ed123f51-c89f-46cc-a642-01afc536cbf8", "comment": "Malware payload (Mirai)", "value": "4867e9217a3e9cc9ff1b86685045820cb17d2f35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691532284, "uuid": "55117eda-53a6-4480-bf25-d9cf168ffa97", "comment": "Malware payload (Mirai)", "value": "1f63ec8ff628b5b053ba328a2f96cc67de41178cbbda93105efad3b7a7c8cb35f5b94ef8e3267a6e3966f9d957c7ab83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532284, "uuid": "a708c0a4-47f2-4cdf-960c-84132a986472", "value": "T1DF82D1A0D55E0CC2EEE77C741D4DABF077A30FAEA3518DE1B1958B614191A5E630C8D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532284, "uuid": "87da597e-c9db-47ec-a46d-08a700dc520e", "value": "384:lbfTH6ROgAWgSbFJPTob5pdwE5vLiqAl/oyuM4uVcqgw05VxJ/:l/H3gAbGJPUb5N5TKlL4uVcqgw09B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691532284, "uuid": "93addd9a-825c-48f6-a74d-6d86c4e537dc", "value": 19216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691532284, "uuid": "43d5d5a8-0f71-4009-93cd-e8f989411506", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691532284, "uuid": "18f8a4d6-fd41-44c2-a215-dc16b6318ada", "value": "0c25370a69675cd98dcdd0eea02aefe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51898999-35e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1691494805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691494805, "uuid": "822d21bb-6590-44c7-be2a-ad6d28893c3d", "comment": "Malware payload (XWorm)", "value": "8bf5bd9484e3c68ad4b53665eaac9a5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691494805, "uuid": "42debeaa-2dd5-4796-a3ca-20d703024e44", "comment": "Malware payload (XWorm)", "value": "fcc542c64184ddc3b22f5654a275323b776303d691989cce659013fe885af3c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691494805, "uuid": "22b7121a-d95a-4a69-aa4a-825c136c8af3", "comment": "Malware payload (XWorm)", "value": "ee35e48192dad69c67dee7c8c8510b680f05d29e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691494805, "uuid": "c91eefcf-6bce-45e4-bcd2-69a0d5f73811", "comment": "Malware payload (XWorm)", "value": "127f5c2dbff805ee6f6051d921f4fb3d646f4135f73a637c627837d66265c75686830fa56bbcef736e431b4a8a161ffb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691494805, "uuid": "67c3ba81-cd55-44e5-a279-371757240b38", "value": "T1D6044C7913DFAC5DC2E7A97CA6691324C6F6E26F003B86BB99770C6ED8213C1BD01194", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691494805, "uuid": "c90cbc8a-a339-4e00-a6f3-7c4587069214", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691494805, "uuid": "c5ba40c3-4608-40f1-a38e-b31e2cc5ac36", "value": "3072:vLIEUX7ZbLw7reOO0Mbc1TKLDb4+M5mk+sx:jUtbU7revbcRCDbhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691494805, "uuid": "8261cf72-175a-4380-8054-59edc8d00760", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691494805, "uuid": "cbc039ad-571f-4f23-8719-311d0ce5094a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691494805, "uuid": "10a7631f-8ef3-4e80-bfae-05e9c153999f", "value": "fcc542c64184ddc3b22f5654a275323b776303d691989cce659013fe885af3c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ceac2b7-35bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691478825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478825, "uuid": "fda7797d-ed8c-4513-afe2-b6f9eab777f8", "comment": "Malware payload (RedLineStealer)", "value": "e144f95b025c2ebdc8ef7f521b6e790b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478825, "uuid": "17c991f5-a200-4d51-ace4-e7477c8766d3", "comment": "Malware payload (RedLineStealer)", "value": "fcde1fb625fe33e4db490e107cb6978cda9af232df732f8d008fca72c9675f1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478825, "uuid": "a1348a64-1e12-4fd5-8f07-a6e315c89028", "comment": "Malware payload (RedLineStealer)", "value": "7dd529db2dfcd1cf207207debdd87495abd56b36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691478825, "uuid": "0ce0fa52-8b0c-4200-aa46-602008c32abe", "comment": "Malware payload (RedLineStealer)", "value": "2c29de3e06b16245d43e7187eefbab3bee603186f55a3edf6fa91fc85de578ef2b1e7fb4777c2a6644809eb1d3b88cc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478825, "uuid": "47f9b0f4-14cc-4f72-9aec-c760b449a67a", "value": "T192C41243B7E84176E9B42B7018F213972B36BCA1A875836F2742694A0DB36C1D97437F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478825, "uuid": "06211bf6-c47c-46ec-967c-78b6437955aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478825, "uuid": "76006c0d-c6c4-42aa-9108-bb67d0ccc4fd", "value": "12288:/Mrfy901R0ZwO08VdTNdtCTh1SCSQ/NHpS17bQAu6jkyaLEG:Ayy2GUwTLDyQr6wya/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691478825, "uuid": "0dd15013-0047-4378-a20f-d7981e0a793a", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691478825, "uuid": "2df5dc2b-7eea-4bf2-9220-6df1b13be441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691478825, "uuid": "42b8ad0a-bef7-4806-821a-6a0d82b873e8", "value": "e144f95b025c2ebdc8ef7f521b6e790b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694b3818-35b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691477235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477235, "uuid": "d0b22170-206b-4c95-89c3-724b69f4e54d", "comment": "Malware payload (Loki)", "value": "bac499bcf911292fb5ee476a765310e2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477235, "uuid": "6b8d9339-bb3f-4262-8081-084a683bf63c", "comment": "Malware payload (Loki)", "value": "fd318c245c9d0412c1f4614a59b381510e6b2373bf0cf66466e9a63e9ee32663", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477235, "uuid": "e3987de3-0238-431d-bf3c-2eeaad68755b", "comment": "Malware payload (Loki)", "value": "3395c26ac273b9a7a8d9aad96fe65be1f4c26449", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691477235, "uuid": "c8b34caf-a428-4bc9-8319-93cb15ee902b", "comment": "Malware payload (Loki)", "value": "ec15189aa2163540edc756beeacf8f071e02b4d33b6914dc434200efa94eed290251251acafcb01760bdbf3c3702f41f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477235, "uuid": "5b37b007-627a-4810-81cd-b1c6ef4682fc", "value": "T15A35E003E900DBC3D41D83F87E530ED91F0AAF19E99569DB04627F9B3A70A72099E52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477235, "uuid": "d157ed49-672d-4a66-8e6d-161f98a5d61b", "value": "24576:hRZyQw6VfZygw6VYjKaWlEzp7aRqdllZbSQA3Qp5EOIwrx:hbQ6VRs6VYjKjOzzdBS/3XOI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691477235, "uuid": "9003e767-a773-4e69-b673-2ddbf887f4b1", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691477235, "uuid": "659c165c-23d9-4e2c-8f16-aa821588f01a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691477235, "uuid": "ad860b2b-2e5f-4340-991e-a5024ada252f", "value": "INV-001D SAEL_20230807_001.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3088d623-362a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691526532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691526532, "uuid": "f7ea552a-b915-47ba-bff3-5d3e9541d952", "comment": "Malware payload", "value": "fb90d2e5e471976376f6738379d7ebf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691526532, "uuid": "0118e630-f07e-45f6-84ad-575c46eca078", "comment": "Malware payload", "value": "fe0d21117697c040a60ed2e1fdfd838ec09330e85a9d8505a820afad480318be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691526532, "uuid": "dffc8645-7adc-4f57-a7df-1abdc85cb191", "comment": "Malware payload", "value": "0a71738b9ba2027eb6a2271163721125d1889ef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691526532, "uuid": "ddeacbc0-3c4a-4722-ba59-60e2974f0483", "comment": "Malware payload", "value": "ee527a99a0fa7472633adfbe4498ef86fc9845fd3ec6b3027deff9709ff5530c661bbe1ba66f7899014f2e82774e17c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691526532, "uuid": "f62b333a-2c0c-451a-8af7-43cae4419a21", "value": "T19E85F95031E49D75F1B31A31BE7E31D04669BD845864820E2083B9FDE5B3B106AF9FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691526532, "uuid": "abe95c67-4626-4999-b69f-f28573b98a21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691526532, "uuid": "6a7b9abe-7145-47cf-abe5-21292f3bdbf5", "value": "24576:isqtDfQK0KSCOx7K73eW8oPBIqbsdvjiSt75bz:isYQK0K+t+3e4Jdbs1jLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691526532, "uuid": "bcf9ff4c-46b7-4164-b506-b2348a6cfd98", "value": 1810352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691526532, "uuid": "9400180a-f96a-471d-a4cb-3ab8c22d92fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691526532, "uuid": "539c13e1-835b-4c17-ae33-e8c95ff2b272", "value": "fe0d21117697c040a60ed2e1fdfd838ec09330e85a9d8505a820afad480318be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb29722-35e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691496008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496008, "uuid": "8dcc7926-9803-4ba3-abdd-f7192b75f7bb", "comment": "Malware payload", "value": "e9e1412d41db517798b3aa851896753e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496008, "uuid": "da406618-77b7-491c-a854-e3136230ba13", "comment": "Malware payload", "value": "feb18437c4368878385c85a2036797e84c783890470338ef07067934b896ac81", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496008, "uuid": "62ce6393-62df-4252-ba3d-0246015475bc", "comment": "Malware payload", "value": "8ad4821440379d44e2638bb6a7eebc9b5822098e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691496008, "uuid": "c9cd7433-1927-4311-a92b-9b368ee3242c", "comment": "Malware payload", "value": "65d8c060b3197a643c1192506b58be82b965c2320676ffe588ac10012d7365f732f522b66e6031b7afbef910b4dda414", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496008, "uuid": "41e613a2-fafa-4582-aba7-b07d548beac4", "value": "T187E2E1B813E950B1A6780EB0D9D4C24B37F345F4C24D6F7176AF06278AC650BE978166", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496008, "uuid": "9e67a43d-721e-4ba3-bba3-bb84f4e65377", "value": "768:nnAaU1k3YCrZsymbhggHHUSR3Fxt0FwM4nyCcabzqLTnr3Uy:nA63YC8tg4ZRVrEdCHenH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691496008, "uuid": "55d630cd-2244-435c-b027-94ae02cf5613", "value": 31868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691496008, "uuid": "9d844cb7-22cf-4180-bd91-0820d3f438b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691496008, "uuid": "fd85b3b3-d7ff-434f-875b-22a37dfe59db", "value": "faecha.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6888add-3603-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691510087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691510087, "uuid": "2ac5f1f8-40e7-495a-aeb1-a9ef39282625", "comment": "Malware payload (Amadey)", "value": "98da5ab5f506878f9e205a4dd88a06c2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691510087, "uuid": "d53fea86-80d0-4f02-812a-abe7a986cd31", "comment": "Malware payload (Amadey)", "value": "ff0dc5ccf84b13f0c2dc6e0f253ea152968a5d01ea215927d690a9603b304b39", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691510087, "uuid": "56e3f049-1b05-475d-bf17-acefa1a554d7", "comment": "Malware payload (Amadey)", "value": "55f012f965d256d5a4fd0b9710d02759d5ff8a1c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691510087, "uuid": "0305a134-c295-4fac-9660-932f08564967", "comment": "Malware payload (Amadey)", "value": "89ede0e641a13a8df33862871ee1444b7e7f2572907e06b6ea73285393392b186b11b3e03c2cd460b37e8c54eeaa087c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691510087, "uuid": "2627f036-e18c-4bbc-8aa1-6aee8d1b55e6", "value": "T117E41203F7E84432E8B427B458FB12831A36BCA54D35C36B274A5E9E1DB3394A53179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691510087, "uuid": "cce121d3-9846-4bae-83ec-f4cd61a30d23", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691510087, "uuid": "3022fe40-811c-44ec-867e-cc6a5b73346f", "value": "12288:JMrMy90RJToJbMkirkKh3QYHWAohbHraOl7ATnNOuhr7g:Fy4JuIkykQAThDmoluNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691510087, "uuid": "34ecb67f-6cec-4a67-849a-21b23db3f173", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691510087, "uuid": "9904fba9-a3ff-46cc-b7aa-333c8909858e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691510087, "uuid": "6dcceedf-9856-45ee-bdd8-0772f8e8d479", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff048baa-35b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691475339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475339, "uuid": "d0eeaef1-cedf-42f6-a5cf-1d8c4a79dd53", "comment": "Malware payload (GuLoader)", "value": "8d1b9a7a8b8432f44917156c2b90601e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475339, "uuid": "c0c61cc2-5a07-44a5-9b51-918f00d8aebd", "comment": "Malware payload (GuLoader)", "value": "ff1731ac0ceea544a04afa1526c83d5d6fa0a41fd1cf845e6e81095c9b373ad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475339, "uuid": "4b975a67-c383-4a07-b74d-2083d975603b", "comment": "Malware payload (GuLoader)", "value": "655a6ba188174e17dccaeb309bd5356560b6b6a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691475339, "uuid": "58a6d45c-1fdf-4dcf-8574-3f53992a81e0", "comment": "Malware payload (GuLoader)", "value": "f4220fd908b1925137ff742e16c88fc7de9123d0ce10216c3f78c4923e248cbfe8826c68e49cdbe10cc882ecc4aa8b9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475339, "uuid": "a698d60c-9a8c-4b72-aa78-e47e0248e4f4", "value": "T14FB40107756C53EFE68E4BB1397942314B68DF234550AD4ABFE5FE2C083260DAD061EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475339, "uuid": "686b0e26-b4e0-4850-b21a-c576d38d348a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475339, "uuid": "ee173010-c1ed-4910-8c26-73375fd66425", "value": "6144:+mOPUV36SmUWwtPU9lg15ux+jN25cVQIvjPTkTke77jKsU4k0+hvzvDlMh/BlU+h:9pWwd0IU5ciGjbmvzTk/5Mh7woD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691475339, "uuid": "0311ef84-a79b-46d9-a7b7-5a5f89812eb5", "value": 497256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691475339, "uuid": "f3e121ba-7531-4e19-aee5-f2e14584f882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691475339, "uuid": "fe36c61c-f02e-4fce-b803-aec4e6868ce9", "value": "Payoffs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af25ed3a-35c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1691481218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691481218, "uuid": "cdafbcd9-bdf6-46fa-a42f-eb4df2c1e37d", "comment": "Malware payload (Tofsee)", "value": "fa665a08d048689f8d764dfaf8fb01ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691481218, "uuid": "2e907844-71fd-4e88-bf19-385d4bc5341b", "comment": "Malware payload (Tofsee)", "value": "ff37adb1bb98fdbf6d73fe934d7966c06cfc287dedbe64b372fe933a68f55d03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691481218, "uuid": "23fa565d-738a-4747-9b7d-71b8cf81bddf", "comment": "Malware payload (Tofsee)", "value": "ae64b1c11983ee1cba96a7df60c415f683c78b86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691481218, "uuid": "57574c1f-312b-4816-b43c-abd7d8db1379", "comment": "Malware payload (Tofsee)", "value": "e8d63e8f81fb84ff7a59b41ee212460fb94f71dfdf98d3bf3ea9c56d6e645c71308584bd19a1a0c3852c92d3ed09269a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691481218, "uuid": "abc650cb-b3de-4d2f-b78d-923990c10b12", "value": "T1B9546D1396DC6B61E5E28A324E2EF6E4671EFC90CF1937DB224C7A2F09711A1C176712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691481218, "uuid": "788b6551-9337-4726-9074-26ab88090f65", "value": "7574067d27f1e097e97a79381564790b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691481218, "uuid": "1bdfb6b7-07e1-4ec4-887c-9abc8d8b1693", "value": "3072:Z2x83xP1ZC5HBeFj8gSHYql+D9RVkHxFsmlCFwQjAdc:kil1gHABSxqRVSxqAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691481218, "uuid": "9c96f007-82d1-4495-8b3c-5f0f4e987f66", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691481218, "uuid": "fec1d16b-dbec-4c62-b8c6-95e0921da410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691481218, "uuid": "d692011f-b7f1-4788-9780-b148e3252558", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fac4c76-35bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691480574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480574, "uuid": "100ddf9d-ed80-4067-b485-65c560d28c62", "comment": "Malware payload (RemcosRAT)", "value": "9401cae794aa2411025fb57b98934922", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480574, "uuid": "4c8096cc-fd6d-411e-9aac-833d76bda17c", "comment": "Malware payload (RemcosRAT)", "value": "ff450b9ba2302dbefa84542c8818a0c233b303c126c2c01aee019c7fbf6340b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480574, "uuid": "92ab21c6-f984-44ca-a678-e5a446ea8c7d", "comment": "Malware payload (RemcosRAT)", "value": "605a8c171b9f8c60d8d2bdcd6f393903e2c49a82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691480574, "uuid": "c51750e1-e989-4851-8e05-2f713a918e85", "comment": "Malware payload (RemcosRAT)", "value": "222b835633bad9315605edc96986da309c2e5f14f78be1e06dd4af55b24ef9528979916ab7273a48991bb5cbf76dd1ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480574, "uuid": "7e321749-892d-424a-aad9-48bdccd0975f", "value": "T17815231056ADCFA4E2BB57F9643C700C0FF3A25A55B1DA285DF438DE1E623224652F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480574, "uuid": "8b1d98fe-dd48-47ea-ac89-5f798bf519e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480574, "uuid": "d8af65d4-1d68-4cb5-bd05-3e8cfbc08422", "value": "24576:Bpni3n7fa3MrOw0bUPYw5L3vA6CgJFfBrvt8tYWbVVd+qpU:PiX7fww975k6CgHprvt8C+VfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691480574, "uuid": "4a539e42-3146-445e-b7a4-eef5c38476fa", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691480574, "uuid": "ca7744a4-09b0-46de-8d2c-19d65a1846da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691480574, "uuid": "f778cc73-086b-42ff-a503-c4fd2896d5f2", "value": "9401cae794aa2411025fb57b98934922.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78d59dd-35ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691500210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500210, "uuid": "e09afca7-5cb8-42bf-b300-e5ac092899f3", "comment": "Malware payload (AgentTesla)", "value": "82a15628b6825c8b98cf398d1a795075", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500210, "uuid": "5f5bd1a6-7bd8-4753-8af3-fe1c7ec3d42b", "comment": "Malware payload (AgentTesla)", "value": "ffbedc1f817daf1887cbc69142ac62edd29c8c7dc08fee263e225a649bbd8c04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500210, "uuid": "7c66314b-29ce-42b0-896c-9a6bc067e879", "comment": "Malware payload (AgentTesla)", "value": "9eeb7ac6eaa677e82d00cfbadada942250342389", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691500210, "uuid": "de7ce310-275c-4020-9da6-9033cea855c2", "comment": "Malware payload (AgentTesla)", "value": "4d2ea16d78e5b3ae3fb310b25128e60555a9f4efe902ff7c5e3639728471d2fc2e5b49dde327f6bed51421eb8f91078a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500210, "uuid": "5797201d-63f2-4165-9bcb-4df82004e583", "value": "T1BA0512493A15638EC81BC972CAEA5D1407F03A9727B7C15BB44B33DE650DBDBEE041A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500210, "uuid": "60f07db7-0ee3-4119-915b-d8ec47e38d51", "value": "12288:sT9lFSmOjKqTF/2UotVBvHzrBxUwMRvIYwBtdrYMk9IBDa4iJwkB4QzEcHLEQOf9:zj5TIDvhsvQdrYjMa7w04QzE22fDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691500210, "uuid": "0b2b27be-045e-4011-b70e-c4952f7dbac2", "value": 797256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691500210, "uuid": "6b5a38cb-f31f-4c3b-9e53-29a65072dd9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691500210, "uuid": "0edfc49c-6d9a-4b41-aeaa-eee1ee4cfbd1", "value": "ffbedc1f817daf1887cbc69142ac62edd29c8c7dc08fee263e225a649bbd8c04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bb8244-358a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1691458117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691458117, "uuid": "c3244293-771f-48cb-b82e-94d24f070799", "comment": "Malware payload (QuasarRAT)", "value": "aad4399dbd35d6aa67335c724fcf91c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691458117, "uuid": "e267cee1-902d-4652-960d-530a998577ff", "comment": "Malware payload (QuasarRAT)", "value": "ffbf3107cf8103f738975e913dbaf5acac850e5c498ec7329ef40d566b9502ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691458117, "uuid": "f63aeb19-00ca-489d-aae3-fca00b2bfb71", "comment": "Malware payload (QuasarRAT)", "value": "7960d76e7074ed8361919138f1aa9c1151d18853", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691458117, "uuid": "0569169d-e11e-4f06-b03c-59bf595794fa", "comment": "Malware payload (QuasarRAT)", "value": "bd50a8eaee9e79cfcda034c494871df38b34b2c54f1f7c13e95cddbde051264afdaffc38130051c1ef3dac9a5ec21987", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691458117, "uuid": "8668db80-da60-4cc0-9d1d-d707e32eba2e", "value": "T179E54A2477F80E27E5BFE67695B1505267F0F82AF363E70B6181627A2C83B5098017B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691458117, "uuid": "b4ebc0e2-eeb5-43ac-9d44-06daa9d31f97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691458117, "uuid": "0a93e718-b317-44bc-85d2-4a0fa1e3556e", "value": "49152:Z+kkbi41X4rCBnhPTBJ5+hQD698qgjeOWWRoG90THHB72eh2NT:Z+JjUCBnhPTBJqQD698f6OWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691458117, "uuid": "783a29ea-810e-4db4-b31e-4dfcf3e1eb90", "value": 3264512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691458117, "uuid": "684d6444-326d-400f-97da-27bc9f3a2c0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691458117, "uuid": "d865f106-b481-400a-bf2b-5b9e2c33447e", "value": "aad4399dbd35d6aa67335c724fcf91c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }