{ "Event": { "published": true, "date": "2023-12-31", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-12-31", "timestamp": 1704067381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "42a14eb8-3cbb-4e45-a6a3-62727b20e683", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c32563-a815-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704052028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052028, "uuid": "0e72ba30-b338-41ac-842a-2e1b87d3332d", "comment": "Malware payload (Socks5Systemz)", "value": "e5979067cd620d401638a07e4230dfed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052028, "uuid": "e4535dbd-ec87-4088-9049-0be004a17b81", "comment": "Malware payload (Socks5Systemz)", "value": "01c790bf626eab9151a29400e7bf5ec1f2f24154ba7bdf605428cd880857caba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052028, "uuid": "fad8da49-5274-4f73-a14d-fe7e379e3b7b", "comment": "Malware payload (Socks5Systemz)", "value": "2364a4fcdef333060671a31476eb9aa55ed87a91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052028, "uuid": "50cc4bc8-1514-4b72-af62-ac9c500749da", "comment": "Malware payload (Socks5Systemz)", "value": "fec04f9adc2c603c83a6e7ebd69c868e2a490ebaa4d96b14330bac1b48dbc72102dc42236733284ca54198f27c1dd3b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052028, "uuid": "dbd5bd64-c208-470f-860b-0b2d71fb54a0", "value": "T1A63633B397A5883CF4D0DC38FDB7972A4C32550B6B398876E16D69FBD9A24C24C19708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052028, "uuid": "317c8e21-494c-455d-8bb0-9b29ae939a0e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052028, "uuid": "b0d6b274-45f7-43f5-99f2-7faddbf2ddee", "value": "98304:QS9IJpIhDL5P9WTZVMbyUOx2P28O0TAvfgCm9reCUo4dm8:wpGDLWcUx2P45m9iCz4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704052028, "uuid": "8d0f0b74-6d76-45f6-86e0-6fec8a1ac1cf", "value": 4876519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704052028, "uuid": "0cef35c7-c75a-45d1-a9ff-9bf67ba75f5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052028, "uuid": "2569079e-f9b0-42a6-b216-e00a42c7bf7b", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.10415.13252", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fed467-a798-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703998259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998259, "uuid": "7ad42496-14ab-4b14-ad72-2b31b3ded0e4", "comment": "Malware payload (LummaStealer)", "value": "94e259f9b6666ebe9df0ae183e80e30e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998259, "uuid": "a83e3a50-7349-4b5b-a374-b11d946ed2d5", "comment": "Malware payload (LummaStealer)", "value": "0ee580f0127b821f4f1e7c032cf76475df9724a9fade2e153a69849f652045f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998259, "uuid": "f50e5106-d70a-4af8-a1bf-1bf73264c3c9", "comment": "Malware payload (LummaStealer)", "value": "381642486fd19a4aa5efaf82b3ef7e2f97073b77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998259, "uuid": "b3d14752-58df-4f22-9170-69300e94ea51", "comment": "Malware payload (LummaStealer)", "value": "21128af770248ff9e0cf235626db0c7bf93955054b66ea99e733da90ef7b8ac1be3e172c2c98537b4bb161f9cab78036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998259, "uuid": "c56a4c9b-5e97-4764-b0e7-e5b6c22afba6", "value": "T1FEC4D0096ABADE22C54D4B35E8C6600AD7F58F43E153E64E76C536D138073E2EA4638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998259, "uuid": "a33627b5-38c4-4f43-a223-73ebe88d72a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998259, "uuid": "b4d99b4d-fce2-4e37-8f7f-87798f2da075", "value": "12288:eP/ZSNVITITwWxINNXAtTfKVsyMDn9SJaIRSi:NVCwFxIOja1MsRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703998259, "uuid": "0160d9e0-a413-4e68-b139-ada3afeb155f", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703998259, "uuid": "5892bd96-427c-4c7c-b565-fcbba4b3abbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998259, "uuid": "5e414ac1-7489-4882-ad78-06f2d3a279b6", "value": "manager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291b7730-a800-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704042913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042913, "uuid": "f5181c43-8f75-4189-876b-a130ca8fc041", "comment": "Malware payload", "value": "af53b6719dbd398d7bf208e466afbebb", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042913, "uuid": "d6a2a02a-296b-4a2d-9284-4c6d30efb7e3", "comment": "Malware payload", "value": "1091606795365874295b781809868693854c02d837475a15e339d1409d0018e3", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042913, "uuid": "98671abe-3300-4e0e-b05d-168cd402c7a6", "comment": "Malware payload", "value": "c45d2fb1cdcf4b54707eb6b61b20a4c8cd448158", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042913, "uuid": "e7f075aa-2599-4323-99b0-863b534d1fd4", "comment": "Malware payload", "value": "d0beea9536eff1d183ade6cd31fccfca42b098efb513dbd478b65b87f509f240ffc834c0857014aa6b812607cc71526a", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042913, "uuid": "f52bda41-16c9-43ac-88eb-8baf568dce9e", "value": "T1C356337667B8BD699E416CFEC76A404C9297E06721F75080761C888B331B3899EFE5E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042913, "uuid": "205d7910-94a5-4ed0-81fa-0d725b2bd469", "value": "98304:AkwVen+ZcQh/42rQ4CHg2R9lR3zW3gp59V/QQeVQqNbOCQGdra/TbTc3Qu1prtcl:J8en+G6CHg2R9lRDWqhQ99ybTcAu1Il", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704042913, "uuid": "e72bcc15-e3e9-43ef-967a-ccb44716510f", "value": 6255996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704042913, "uuid": "99d2afdd-5a3a-4f87-95f5-7a371e9f28c7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042913, "uuid": "5e5779f4-d53a-40f1-bc94-2eddfe422bb5", "value": "VeCom.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0fa912-a7f9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1704040207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704040207, "uuid": "773eeb73-9eb3-4855-8ae3-06bcd30b7ec1", "comment": "Malware payload (RemcosRAT)", "value": "65ae2a6c5538d0dcd50c3c264587bb04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704040207, "uuid": "5a252a30-f13f-4cae-9361-0075c4e6934f", "comment": "Malware payload (RemcosRAT)", "value": "10cae0676fcf60dbbb56266448fff13a2ed236753243fea28d41f3902863e053", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704040207, "uuid": "9edc041b-ca92-4a0a-9cc8-383fc595d346", "comment": "Malware payload (RemcosRAT)", "value": "5be3521c8376b5c32f859c9fc85f4049ccc1c3a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704040207, "uuid": "63b92b35-7078-4d63-9e20-1f37b34b5534", "comment": "Malware payload (RemcosRAT)", "value": "a5c42e6a56e8bdd8d8c0a3b2daa6d9031e689a9bb110612114d4bae197ffcdb7f13e0c8818b569bee3c92cb3d1c74401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704040207, "uuid": "c907aeec-c33b-4574-9f05-ec7a643dd9ed", "value": "T1174733FF0B0E42E2F703A4B868C1B1B9708BD752FA1C9C0946A67DF599F5D528885C93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704040207, "uuid": "cddf9c36-9475-4126-92d4-acd879f49aa3", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704040207, "uuid": "8eb4cffb-c48c-4f9e-ba6d-057245ebab56", "value": "393216:Iq5sSGlBxjWhyw34/3Lk14ygJKYAJqhRUTPgD4djECKEdbFAq2oYCiqe88DN0063:RTGlBdI34/YDZcEPoS4MYCT+N0brJJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704040207, "uuid": "5a36b210-9839-4219-8c3d-029529062c2c", "value": 25426944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704040207, "uuid": "acf468e3-1df4-446e-870e-6bf001293595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704040207, "uuid": "b8ba17be-3100-42b4-87aa-6f44e71993b2", "value": "10cae0676fcf60dbbb56266448fff13a2ed236753243f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15040785-a7ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704007231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007231, "uuid": "af993b6a-6a27-4517-8d81-22df8944ec4a", "comment": "Malware payload (Socks5Systemz)", "value": "08da97557381258e728cd0fa20c47a73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007231, "uuid": "b33f2707-67ce-46e1-8adc-fdcb7f54208e", "comment": "Malware payload (Socks5Systemz)", "value": "10f9cc26e26e53771700e9b3e241bb303b4d07d0337dc72bbc0d8b3646af39b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007231, "uuid": "9c922a27-0707-4fe2-a9be-bdfd9abdce6c", "comment": "Malware payload (Socks5Systemz)", "value": "c54a00e9d82de937ac4fd7cdc022ace02df2d414", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007231, "uuid": "db925d39-2cae-4e1c-ac87-8e99fe4ff575", "comment": "Malware payload (Socks5Systemz)", "value": "46ebe3c97a291f171283605db2d87f7dab669a7e6740bdbe1f143446c2dfb08bbdcb4e5f1ae572f5b25e64d661d6a486", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007231, "uuid": "776efcf8-d7df-4a5c-a01d-f469f0e15e85", "value": "T1112633213ED680B9D220D8B62F651331AB1FB26F8FB0879BF60C155EFBA25D64601395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007231, "uuid": "c6d67562-b89c-4ebe-8b16-28ce448434ea", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007231, "uuid": "5477a0d4-0115-4950-b35c-dad77ae517d4", "value": "98304:QTBS74T4drjXZEJb4Tzd0kGPCO9YfPlPSYvNyhWrgLfu4puq8zV+To4dm8:cMNjZEazrXO9YF1w1lsq85+k4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704007231, "uuid": "90a06d19-e2fe-4a88-87be-3c57b64a9a15", "value": 4790027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704007231, "uuid": "e9dd4a7b-d7bd-4d73-8e39-7bf388a007b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007231, "uuid": "1e8fff4e-feda-48a8-8d32-457bb13be3d9", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.20503.5437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f809d96-a797-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1703997988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703997988, "uuid": "51f29625-a91c-4bf2-ad29-a9e6044139cd", "comment": "Malware payload (AsyncRAT)", "value": "16faa335d843806ac0114060451feedd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703997988, "uuid": "df041da7-3585-4f48-ae76-e3166b48775b", "comment": "Malware payload (AsyncRAT)", "value": "12c2c7628e47cfb5e43c07be1368c954028b5286e9e5cda1bc337e158eb39945", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703997988, "uuid": "db2d63f8-138b-4bdc-8323-82af49fd8a92", "comment": "Malware payload (AsyncRAT)", "value": "5acb1096c12ffe6ebe9d7d154f9f19db45fb5561", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703997988, "uuid": "95a8ad3e-62da-4f1c-8dab-10add2f24a6c", "comment": "Malware payload (AsyncRAT)", "value": "92b6c072e2f42427be0018cf2957e0b741c0ecca4ac3c30b6066790174168a252e375165847c092ebc70a2e392cfc2c1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703997988, "uuid": "8d0e1f3a-9f27-4be5-bf3e-7d7ef471e898", "value": "T173F22B44AB95E737E69C077AA4A353904779D0DB3103DF472D9044EA2A677CF0EA13CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703997988, "uuid": "be8bccb6-3c8c-4e1c-9153-abd9265d466f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703997988, "uuid": "f32b9924-2cbd-4cb4-9dff-4d3bd156933f", "value": "768:kgkUHv6PH4j2Z9d9kqTgwXRF5lPVw9BlVekboql:kndZ9XTFBF5lPVw9hGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703997988, "uuid": "12143ddc-0be6-4c33-8a0b-720d290a1843", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703997988, "uuid": "a89c381e-c155-4f0a-859f-c3693a35a7a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703997988, "uuid": "747a626d-58b6-4824-83eb-68b1fb631cce", "value": "RemoteDesktop.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6123f9-a79a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1703999248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703999248, "uuid": "7cffe629-5b7c-40c7-9110-16e6cf4f096b", "comment": "Malware payload (CoinMiner)", "value": "04c4de86bd37e3c01fab2fb9a7f0abd6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703999248, "uuid": "229534f2-2b10-4c46-9715-23c9fd58f250", "comment": "Malware payload (CoinMiner)", "value": "1724303a1b09856850e4d4adece16e3dab8057c45ece184fd2677c9f045d5b58", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703999248, "uuid": "921d7267-e3f3-484b-9000-c25f47c90627", "comment": "Malware payload (CoinMiner)", "value": "e3445e134fd7e70175ec992a7b9c1b5ce2cfd251", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703999248, "uuid": "cb072cde-cd7b-451d-aba4-be6601503571", "comment": "Malware payload (CoinMiner)", "value": "50f44e4ac7cefb08f06918725cb5f1c28382cd0c471259f82d22c41db0b1aa81a71af5f1c9c8edef886fac04ea8dd795", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703999248, "uuid": "abb6d063-4f30-4c1f-819b-11478c6bdea6", "value": "T10BA5D02DF7B014A5E29B8079E505494BFBB07CB80361DA8B638246DE7E036C3E565B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703999248, "uuid": "024a0597-a7dd-4e8f-8c2e-cebe761733ed", "value": "c782987849999c5ae345a5deafbd73fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703999248, "uuid": "c108a7f7-464f-4a05-95d9-8319db72e0cf", "value": "49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+AjEG7uA8eLLh:BemTLkNdfE0pZrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703999248, "uuid": "8342272f-e26b-491a-bb7d-52bd6208d19a", "value": 2092964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703999248, "uuid": "598ac399-650d-4e91-b0c7-b2459aa0718d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703999248, "uuid": "71d82b8a-3d35-44e8-808c-943080ec5605", "value": "BCL1-64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758ff3d1-a7cc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704020708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704020708, "uuid": "34207a9c-99d8-4670-8d87-1ce8a6193a07", "comment": "Malware payload (RedLineStealer)", "value": "c227489296d9f2e702a05fa43b6f403a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704020708, "uuid": "e498a735-18fb-48c3-a44a-ddbaa6d6936d", "comment": "Malware payload (RedLineStealer)", "value": "1be9af1bd7978fa221966db9b2a77f5016997fe0071a5869cb17bfa53e638ad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704020708, "uuid": "ede785f3-c130-4e35-b5f1-a754b8f49c06", "comment": "Malware payload (RedLineStealer)", "value": "d88336e13f360eb14b794a751dd8459e314723e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704020708, "uuid": "df395c4f-b2f3-48dd-ae53-de04cc2ced50", "comment": "Malware payload (RedLineStealer)", "value": "ded11334b5644046a637fd23c751a0cdca95c7df7361f5aa2b062494a544ed0901161cfef0017ee2e6df5318b1ba733b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704020708, "uuid": "3a32e647-4494-4e21-90e1-b786331dff78", "value": "T18A564AD7FC9104E4C0AAE73589669293BA717C480F2127D72BA0FF282E76BD0AD75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704020708, "uuid": "47d42baf-f354-4061-8932-ea967c536e17", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704020708, "uuid": "5a45671b-f7b0-411c-b391-7e25a2535790", "value": "98304:Ny47Wfl/dlmED4/+/+MaSAFHeKqqqxdhhhvhXvvvhvBoDLTY8GUkavb4Di4vbYI/:N8l/TDD4/+/+MaSAFHeKqqqxdhhhvhX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704020708, "uuid": "6ee95c7f-2f96-4349-b82c-ed0392467215", "value": 6079488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704020708, "uuid": "90d3d40c-65b1-4426-b117-2ef5e1b24e28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704020708, "uuid": "364325a0-06ea-4ec9-913b-566a640b2eee", "value": "c227489296d9f2e702a05fa43b6f403a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf4a322-a799-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1703998762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998762, "uuid": "44ba7ef4-1e6b-4578-9ba8-7fc44aac3004", "comment": "Malware payload (CobaltStrike)", "value": "d39d5a6b43483bdc6ee210bff5ba2223", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998762, "uuid": "93919ac3-f82b-48fd-a84d-7fa3c5523333", "comment": "Malware payload (CobaltStrike)", "value": "1c35a4393c40fefbf378f11647341d5ad30b3d8c2f9d9c0d8f2902a9c297e45b", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998762, "uuid": "4a6e8bef-c017-4a4e-9ad1-ea2b30b28f32", "comment": "Malware payload (CobaltStrike)", "value": "defeefb8a3bb27678e3b8f0508582588ea203ff4", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998762, "uuid": "2e6d8c4e-5a9d-4cbd-a37f-f95fbb930ed5", "comment": "Malware payload (CobaltStrike)", "value": "6813aa1d860791fe013a8e58a6980427d51a0c10b7b224936267856b25ef6511aedd3a3cec65b0c8069200b88b5f1461", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998762, "uuid": "4ffc55cc-4466-4f98-8fc9-3c1e1641b97a", "value": "T1B744BF023B713F99FE47E8348DDA28166FE522E75B95DB1112E1041A5C8FB89E9CCD23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998762, "uuid": "cd1abbd1-7f35-466a-ab0b-1c658dc01fb0", "value": "6144:ZEG8cIDtrGtpDjr4OVMvvOJJMmGMmw9IAPgBqH/:+QIDtrCZjr1VMvv4JMJMPIAPgBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703998762, "uuid": "bb5301d8-2917-4bd0-b9ef-c2c70b4fc55a", "value": 265716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703998762, "uuid": "6b7c19f7-d8f4-4436-8c20-e471396bc565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998762, "uuid": "55e5be03-976e-4525-b597-d9e892eb6557", "value": "marte1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a1f897-a800-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Meterpreter)", "timestamp": 1704042901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042901, "uuid": "dd7820b1-c942-47b3-bbb4-d856751bac75", "comment": "Malware payload (Meterpreter)", "value": "1360ee30cee0ecec2edb5a648249e6df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042901, "uuid": "fa6e59de-ff9e-49ea-b48b-ff3ee30d1229", "comment": "Malware payload (Meterpreter)", "value": "1c6e6fe2ff53f3ff41503ed6dbe81bfcad46149dd991c7e36ea36d4b77ae3ab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042901, "uuid": "52a5ac60-9e9c-43fc-a8d2-97f7733db00e", "comment": "Malware payload (Meterpreter)", "value": "d01a7864b9fa9e2036d78ba08fbb8758bd77c7c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042901, "uuid": "f221828a-d7fa-4eee-afd3-e5b2624d8e03", "comment": "Malware payload (Meterpreter)", "value": "93da4c425bfb5970db937df4bfcb21b143dd7b1f48225692f0a8ffe9ab209ef4e9f9031914e5cf15a1c1395bb6248231", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042901, "uuid": "6e1d75af-b279-4168-b8e3-3fcb61e68356", "value": "T19873BF82D9C41976C1A9123E6B793A755970F1FA7205C19A7A4CCCE5EBC2CB0A623387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042901, "uuid": "bfc95a14-9762-4a85-aa83-686d1bcb49c1", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042901, "uuid": "cd9f6c94-122c-4f83-83e3-65da8d82f778", "value": "1536:IbMZgVMFzA4G24nS38ibeFvfMb+KR0Nc8QsJq39:fCyM4ySjbeFvfe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704042901, "uuid": "3f632ca7-c674-447d-b1ea-e62710068fd5", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704042901, "uuid": "1d6efa2d-9deb-47d0-8905-9e6b3a383200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042901, "uuid": "a4298455-17e3-4cff-9bbc-47b685f77006", "value": "ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e662e2-a834-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704065408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704065408, "uuid": "f8add0c3-3343-48d7-a54c-be3d89eb12a3", "comment": "Malware payload (RedLineStealer)", "value": "0fcc733c3a10aaf775566295637f6777", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704065408, "uuid": "d3907834-7720-43b0-b076-095f0cb145f0", "comment": "Malware payload (RedLineStealer)", "value": "20f5112314033bc2cd42337ef85390363777bbfb22eab40d7fa934ce34bf71cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704065408, "uuid": "261233a1-daa7-4f27-b83e-5bb3425cac98", "comment": "Malware payload (RedLineStealer)", "value": "f4cd095b9e4b1e0f7c504d701644c725aa4cd3e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704065408, "uuid": "bc8337d7-565d-426f-a8c4-5468dc443e9f", "comment": "Malware payload (RedLineStealer)", "value": "f5acff027f858fb0fa889ef3bbbbd4926bb65100e4d523510f6695c9ddeaea1902f6ec4aa8ef3e64c57b1ebbd020fb8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704065408, "uuid": "bc583fc7-7f11-4a9b-a0c0-d3241593c5f0", "value": "T117046B826846F437C502D431D4B4B2B7ABAE734E43E887876B79CA657BF4350267E1C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704065408, "uuid": "73733420-ee25-4f63-87b4-83e46a8c0864", "value": "59737f231ef329f299654331c80b5130", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704065408, "uuid": "8b539129-460d-49fc-8d3d-879af7da8241", "value": "3072:RpstNA9HtE6y58o7retfdu+8a/qBYkIlkcCfADy1/0mm3E7c:Rp0A9Ht2dP3e/8YkICcCfB1/0mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704065408, "uuid": "ebb50875-6504-4efe-a2e8-192fb9a50e1b", "value": 175944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704065408, "uuid": "0dd5b8c2-44ab-4623-b5b1-2b2f1f3e59ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704065408, "uuid": "68a7fad3-efd2-41d4-8407-4564d30221e9", "value": "0fcc733c3a10aaf775566295637f6777.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d474dd9-a7df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704028935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028935, "uuid": "3df154ef-fa19-4a54-91f7-7b4d6f229dec", "comment": "Malware payload (Socks5Systemz)", "value": "caa49af2a02c39e469db7c1a2531c80c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028935, "uuid": "fbe024b9-02f3-4986-83a8-355c59b95d59", "comment": "Malware payload (Socks5Systemz)", "value": "21d5983266ef2badb1e1557ff238a60f411780f4098907674212ee2d2df95e70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028935, "uuid": "0c021915-9779-4e64-ba7f-ab0ae07c37ee", "comment": "Malware payload (Socks5Systemz)", "value": "e1684024d8cd79ff00e5a84869e4818a2ab96d29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028935, "uuid": "171a08ce-caeb-4a97-acc5-424b23c31a56", "comment": "Malware payload (Socks5Systemz)", "value": "0b13e8f892f5c9563ebe0d75f37fe82e8dbb47f6293897b1c2985b931d77a01e0131a565938225b2a3b801bf325fe9b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028935, "uuid": "4eaddefa-a6d3-4a0e-b650-56779073e7ab", "value": "T1392633D455D60DB4FE52673A07B9242E5D1B7E0ED8B432007E9F9F896FA32229C312E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028935, "uuid": "35ce04ee-3fee-41ef-9a7b-2bbcb47bc83d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028935, "uuid": "ad6a0487-592a-42bc-9fe8-20a609a0e827", "value": "98304:QKn6L43T8s1U3Q+Aaa6LMHguxS+dTUF+Yfa4dm8:1M43T8sp9aZMHguxPq+j4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704028935, "uuid": "dcb01a8c-883e-4a8f-8d09-75be7f4612b3", "value": 4788719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704028935, "uuid": "82b37485-55ef-4f1e-a8af-02277ca4bb04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028935, "uuid": "ca54f16e-69d4-4150-a1e3-57065eaa0655", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.8452.26658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ce966e-a799-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1703998782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998782, "uuid": "4305438b-7486-442d-8201-176fb34de9cc", "comment": "Malware payload (Arechclient2)", "value": "51394a98af283b4c887a6b24f7c0c2ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998782, "uuid": "f0e22c9a-dccf-4b33-89ac-388f4281e6bd", "comment": "Malware payload (Arechclient2)", "value": "224e524958bb45d638403cc92f1f165ff8af5d8eff004663a542eddf25c03ddf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998782, "uuid": "83aa36fa-914e-4457-adb6-85ff87cd0f44", "comment": "Malware payload (Arechclient2)", "value": "96eef86677a6f6a3c94486df4abf62b2dbc1fbb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998782, "uuid": "f7aadc75-50b3-4e45-bc4f-d78acc71bdec", "comment": "Malware payload (Arechclient2)", "value": "3f10590592ad818e9d3813a62e3f515c4e7683bb920db72ccc9463f2ad5c6330b0e1fbd3d7f23f3ba323fbd4390f0795", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998782, "uuid": "d8eeb3e2-1fa9-4410-a028-74fb140e1a21", "value": "T13F46BF503885DD41E16963B7CFCB806C87ADA8527266DF1B7B9B32EA51013E34C06ADF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998782, "uuid": "5e42ec5e-bc66-4b57-b2be-14517b5bff2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998782, "uuid": "bfd89a62-a25c-4f6f-b313-6730641e1d0d", "value": "98304:Nm8puaHIkZOGV7sIUjcG96j/q9WQuX9EI5gqO80z0AAgHjxpaXU:HHdZOGV7jUjcG96w09tgqTe0ABlpaXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703998782, "uuid": "74f12b3c-f4de-49b1-82eb-4d13aa60efe3", "value": 5349304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703998782, "uuid": "fcabe025-eee6-4051-9be7-062182ddf3d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998782, "uuid": "ee61bda7-c384-4b7d-93fd-547ab06f8488", "value": "51394a98af283b4c887a6b24f7c0c2ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b0f9d2-a7df-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704028929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028929, "uuid": "8edea85b-84e1-45cc-a807-1cc784f93d73", "comment": "Malware payload", "value": "168694a401def3f2a2e8fa067f3bdab2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028929, "uuid": "73c6c277-0b75-4225-8cb7-2bbd2b88251d", "comment": "Malware payload", "value": "231bf1b8cd69c671fa2714abe5194655bf5544d5be4af35eff295803b9866291", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028929, "uuid": "681aad22-fcc4-487f-a383-b0280b83e51b", "comment": "Malware payload", "value": "7341f179f6c0e5dfa9de6b318ae6ebb3242891f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028929, "uuid": "a8de119c-78bc-4c7d-a4dc-c322b6671359", "comment": "Malware payload", "value": "cac509a12af1ca19d5da9156d564160c5130b791db8a3e1dcd15d2b7af3a0e8fc4cdf32c87631d09f6889ac664c3ff26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028929, "uuid": "2be3568e-616b-4c0a-8998-f8947e8cb2f5", "value": "T1E073F74776001560D9C398F07F2D28B297B7FF8B7260516FCED444AC6B9288A8F7A5B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028929, "uuid": "125662df-fe3e-495c-95d1-a3275b24eced", "value": "768:OZ8b+vk6XgSynwQBISByAJeQ0F1+WFKmzoLTkqTamTM0XKU1h9hD:OZ8b+v7XgSynwN/W01+W5mMep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704028929, "uuid": "29ae473c-962a-4b7d-8615-ed04c2978ed0", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704028929, "uuid": "04acecdb-2a11-4aa7-91cb-9c72d1eb18fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028929, "uuid": "de8f25f5-70ec-4129-a29d-1f7ea8b9eeff", "value": "SecuriteInfo.com.Win32.Evo-gen.18154.9433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc67ea0-a783-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703989231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703989231, "uuid": "1651f1c3-ee50-44e7-b56c-c2ffc1d3c70d", "comment": "Malware payload (Socks5Systemz)", "value": "da76a9e90eaa92b29c3305e866c97a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703989231, "uuid": "26332523-956f-4d32-bd23-ab09678ebc74", "comment": "Malware payload (Socks5Systemz)", "value": "24556757732587ed3ac1c2e77866a7581dd5ee6e61d6c515f310752c47751920", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703989231, "uuid": "cf1a45f0-52d2-4160-9106-e2efc6f47c13", "comment": "Malware payload (Socks5Systemz)", "value": "0233a324e76d17adbd9b099d1233c2b39d70d537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703989231, "uuid": "9fa19743-91aa-4321-b23e-1a8c6012d8c1", "comment": "Malware payload (Socks5Systemz)", "value": "b1bee43a58fd7a71c58a16beed0145b896ac0c10e59ca06f688e640e9c9f1c5ed28bda5b16729ff5b1aa1b122aff4074", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703989231, "uuid": "6617c4da-d098-48d9-89ae-044195773c39", "value": "T1DD3633636672D0A6E064C7FC6C32634D8D5A8AB19F72EFA66DC5141EEB7342106073CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703989231, "uuid": "165b0d08-a8c5-4fe1-baec-81448b48c518", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703989231, "uuid": "daf7f301-8416-42d9-80ee-e3620ba70147", "value": "98304:QuLGz+t0EYAJCkrwHiTZcS6k3zlH+nJunllOgp4dm8:vLJqEZjr8Yc7KzllOY4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703989231, "uuid": "689f2f1f-0af9-43ae-9fb9-e524e8c40996", "value": 4913157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703989231, "uuid": "3a379203-7fa8-41f6-9d11-e6ce0c1fae00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703989231, "uuid": "f0ecaf6f-c708-49b2-93ac-a55952be1f9c", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.20070.7145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132155da-a7ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704007228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007228, "uuid": "d04a3404-cd5a-4eac-94b7-00940d23c66a", "comment": "Malware payload (Socks5Systemz)", "value": "47e63e711ddb21439b96db38ca858f08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007228, "uuid": "1f17dca0-e078-4ab7-a0cc-4d00c41b0867", "comment": "Malware payload (Socks5Systemz)", "value": "2c8c9c8c5552c9fc5bfa636ecd82d17833cee77237c487ec27e230fa779b2a63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007228, "uuid": "c5cab40e-6abb-4647-ae2f-2a5a31059449", "comment": "Malware payload (Socks5Systemz)", "value": "8d5c7235492254d8a824a2714c743ae893a8aaef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007228, "uuid": "4e0997f6-3823-4c29-8b20-12210d6c1b11", "comment": "Malware payload (Socks5Systemz)", "value": "5a7f27a5859886f2067f1fc7b5a63ecb2b5a2548c4945c09726c7155b152dc4eaf78599a6da153726046455ce769ed59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007228, "uuid": "e5aedf48-167e-4d6e-ac88-1b9fadf88549", "value": "T1F22633539592586FE0121BBA4CC623962D3378E25DB91B89526CC8FFBD336D0F1863C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007228, "uuid": "0f4ea5a0-d17d-4c50-9fff-07a2fc4408a5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007228, "uuid": "86b94466-2477-4fac-92f6-56ba20f61296", "value": "98304:QYGZpDMXAFBCgTjSoHP/BdSUCnwLTULcoRXzGhHMZjJp84dm8:ufMXAFkgfSoHLSUCn2UgAXixO24dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704007228, "uuid": "a3207664-5950-49a5-a2db-f84778146a7d", "value": 4795343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704007228, "uuid": "e22cdac3-2e8d-4300-9ae7-a05908bee754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007228, "uuid": "22e9cb1d-afd5-4b54-8d77-5504d8e5378b", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.12993.20364", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e0f340-a7df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704028922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028922, "uuid": "89bfa7a5-3620-4fff-82d7-dbf8b84a7710", "comment": "Malware payload (Socks5Systemz)", "value": "9619feb4d540f3ab7ca5c49c92f4a11b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028922, "uuid": "d4cb5ff4-30ab-43c0-81d5-52ae9a9be7ca", "comment": "Malware payload (Socks5Systemz)", "value": "2dc41322935b6a8560d895568f12a1b12b85506f5048868a5455204c818306e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028922, "uuid": "17d49673-e5f0-4db4-af28-ffa67111ef6d", "comment": "Malware payload (Socks5Systemz)", "value": "06c4c8330f4b4b9d3456c6c8f5f53c89161a9b80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028922, "uuid": "2aec0db0-993f-4841-b407-73d35f0a3954", "comment": "Malware payload (Socks5Systemz)", "value": "71240d0b695215362c4717a630ead034ee897703376252606a23b82e14f43cf14e59d21f67a8da301e7b7cd984cb87ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028922, "uuid": "8bc52607-3e70-43e5-914a-997c639b187b", "value": "T188263337EAE50CB6F044D2327DDB88249E81790367B56411374E9CAB4F7B0B4968B78B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028922, "uuid": "0fca2c88-471d-4958-abe1-138df5c9e357", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028922, "uuid": "b90f47be-b35e-47d8-8dbe-763b1f08774e", "value": "98304:Q9QYHvn1EJ5KOoRw6Yp+OIstMYsbRbOTWcGs6hHUkzT02QImlC4dm8:mbfOJ8OvdfI+eRSqc5kzY2F4C4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704028922, "uuid": "1d308fd1-647d-48c4-bab5-f09681d8526a", "value": 4793577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704028922, "uuid": "768a566c-1388-4814-8435-318ed909fa0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028922, "uuid": "259f3fbe-b20d-4367-9e66-a7a02b753400", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.14650.13439", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7da3b4-a7df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704028932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028932, "uuid": "911de155-3c03-4f2a-9a0e-10434a3af767", "comment": "Malware payload (Socks5Systemz)", "value": "8e77d835ff082165c2de8e94c131587e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028932, "uuid": "534cad45-d250-4f34-a817-e7d85fdacda7", "comment": "Malware payload (Socks5Systemz)", "value": "2fdc4c2698bb27b5123709314702ade5ba324dae00c1b45dcb5f521810a40849", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028932, "uuid": "0784a696-b4cb-4bdf-b875-270cad232326", "comment": "Malware payload (Socks5Systemz)", "value": "5d8f0435ebe5bddbae45829818c22ad5af712776", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028932, "uuid": "ad23883d-fc1d-48bc-ab70-67c23253d069", "comment": "Malware payload (Socks5Systemz)", "value": "3bcbca70cde702c1bb3db0d9a60843dc70d275248181954b84668147fd9db3d5fad7be049ace96d378be8d94e1f52141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028932, "uuid": "d321359a-ad40-4665-a9f2-ac15107136b6", "value": "T18B2633DA2E1A46B8C4F1973499BF6F183A7247049CF0899CAA5DDC0CCF66045E71937B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028932, "uuid": "e8fb521c-7643-4a1d-a6b6-0000923a6ce4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028932, "uuid": "a2b3d980-6b71-4b63-bd1d-4dc2bb74d613", "value": "98304:QkBlcXZwQcHIQVF+/x24ujgWD4W8m0d/mwpnh1Qy8c1YDatp4dm8:3EZ7c7+/Vre4nm2hT8UYGtp4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704028932, "uuid": "24b5a848-8d52-4927-ae62-c449b2f9bc0a", "value": 4793439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704028932, "uuid": "3eca9a09-873c-42e3-8376-2c8ed07079a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028932, "uuid": "74a90dd5-23fa-4f5b-b5b3-6d7928bafe4a", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.9252.18757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c9ecef-a79a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1703999341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703999341, "uuid": "1adca806-a0ea-410c-9a24-8affe7fab7b7", "comment": "Malware payload (CoinMiner)", "value": "0681f3250a64bee738e1825e8aa96428", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703999341, "uuid": "d0e40fff-d0aa-46be-8001-720432f08bcb", "comment": "Malware payload (CoinMiner)", "value": "31e0d6d22dfc5be3462632370bbd39762ebdcb394692c0bf52cb3c16ea36d68c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703999341, "uuid": "16a578b2-0a59-445c-a94c-0c93ea32ecad", "comment": "Malware payload (CoinMiner)", "value": "5c9e3bb0a90d8002fe222c41f6787077cb35589d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703999341, "uuid": "219427da-1bfc-4e41-a011-a987ed309b97", "comment": "Malware payload (CoinMiner)", "value": "07d6bd247b8ff6135cc2325bf1cd156cf0ab55987fda1be815f8374f8a0163fe6bd07917e1a5fe9160c7883ccd02215e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703999341, "uuid": "3c659ecf-ceea-40c7-bd93-3277dc052ff8", "value": "T1F885D02DB6B154E5D5EB8078D40A4A0BF7F138E90360D64B53D116EE2F136C2E92AF36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703999341, "uuid": "8e43b5cb-771d-473e-9da7-48be910afeac", "value": "c782987849999c5ae345a5deafbd73fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703999341, "uuid": "1f82adcf-fa1d-4b1c-bc43-76348eaf47c0", "value": "49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdp2Pw7:BemTLkNdfE0pZrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703999341, "uuid": "05807abb-2e1c-4baf-bac1-a64aef1d6a9e", "value": 1849354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703999341, "uuid": "0bdf0791-1d78-49a7-b1d0-101703e9ad0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703999341, "uuid": "99b4826c-c2ab-4efe-880b-e34e6bd5a0e1", "value": "31DCV-64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5097c6bc-a7c6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704018069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704018069, "uuid": "0329bab0-bf46-4406-964e-bc2ad791a1c0", "comment": "Malware payload", "value": "fb2d424fecdeebb63d2dce8216483daa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704018069, "uuid": "fca2b51e-a7cc-4b7b-b45d-a12643512759", "comment": "Malware payload", "value": "32e6c3947e4d8cf30e3f26d06bdcf4ff43193733842fef243fa8c2d59ff71d35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704018069, "uuid": "6d7f097e-ff1a-457e-a384-d1ff4da35eb6", "comment": "Malware payload", "value": "6cd56e8ff41c5da0d540b4248d710fbf60c76ec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704018069, "uuid": "541cd747-d2c1-4c84-a308-2a807c76debe", "comment": "Malware payload", "value": "97b626a24ba0bed202ae13e15044bfd29bb603f1f0a8fc730663f3a76717a3cc045cbc5354117fc2f19c61283855c66e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704018069, "uuid": "1cb9a244-8744-44f6-837b-e84773ed1483", "value": "T13813B728B3FC5715F1BB8B75BCF240928937B5136E66C78D3959034D0A35680CAA2B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704018069, "uuid": "0e18fddb-4a47-403c-9648-e25dba86c1c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704018069, "uuid": "822075f6-eaf3-41e3-a034-9f60949e0319", "value": "384:YzwXIBnXeDatG90f4kOTMfm4La6CHBXQBqfjG7qMHbIqlFtmE1HUqC2g6ihJSxUT:sJDOMYHBgcMHb5UqC2FRJRaoVuw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704018069, "uuid": "4e08c684-4dee-40b4-9420-20db5e4cac48", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704018069, "uuid": "983477e1-8eb5-4286-8231-2528d7c0f068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704018069, "uuid": "319962f9-fe74-425e-bde9-f5014732e5fa", "value": "SecuriteInfo.com.Heur.8412.1863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f08294-a7ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704007233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007233, "uuid": "35b5fa6d-f7db-478f-a17e-8d1addf63625", "comment": "Malware payload (Socks5Systemz)", "value": "bb8dd921a1d08f46ce501c40d3fb40a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007233, "uuid": "a296c9ee-be72-4e54-8ac4-4494d8a81342", "comment": "Malware payload (Socks5Systemz)", "value": "34f40290d4ccf49383fc7870f5f2637171effa41f7770ae5bb9cc0f48f61a6d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007233, "uuid": "1d992ddb-1628-43e8-b2ca-5dc9342ac34e", "comment": "Malware payload (Socks5Systemz)", "value": "e2974f45b85aba463d964fe57f743f19076aa5c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007233, "uuid": "83917e61-6993-4881-a4f0-f6428eca8c42", "comment": "Malware payload (Socks5Systemz)", "value": "e73ac813abe560b4b1effe14373355bbcc7a595c99e6e2618e57e1f8e7857c3c9272d8cecf227506845830f758f2bf59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007233, "uuid": "fbb37d15-eecb-4507-b90c-ab944e05b68a", "value": "T136263352CF116830E466C6B43FF6E824F9625C32AA72485CD27815CD6FBB8F612163CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007233, "uuid": "7439f18a-71dc-4778-a81c-4d86be4f823f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007233, "uuid": "5fa28930-f728-4445-8424-a8693778d704", "value": "98304:Q+CKjW9RXhzbG+NB2BxeHawH9z1cevf6rE687v7L4dm8:l419bGeBZ9dvf487v7L4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704007233, "uuid": "83199582-8575-4f67-8fad-7828e86b2ad8", "value": 4792405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704007233, "uuid": "e23af27e-9a50-4dc1-8895-b29630f365b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007233, "uuid": "d13304ca-5eed-4b59-bd53-7e261780ebe6", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.135.1594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc9fcb2-a819-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1704054008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704054008, "uuid": "d19e934e-0ea7-4834-a9a3-7b7b74d3ca01", "comment": "Malware payload (RecordBreaker)", "value": "0cf5248f76f6e1b9d4763637912ec294", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704054008, "uuid": "a7529739-4364-4760-a540-53df6bd5ec45", "comment": "Malware payload (RecordBreaker)", "value": "35bac5ac8372c7cd7303ae2aebcd4f5eb4f93fc6e32f176880dbaf39103cea76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704054008, "uuid": "bec78a43-19a5-437d-a9f1-286b50f83daa", "comment": "Malware payload (RecordBreaker)", "value": "704d60826304fd84bcd9c6409b331924dccdd221", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704054008, "uuid": "5d135092-6794-4a31-bcc9-7d7e9062fea1", "comment": "Malware payload (RecordBreaker)", "value": "94dda1cd0595c0562b20008e6e96f6dd284213aba1cc7d1796d22a5e6a35bed824a5e8f6d45ce7a7977dc1a8bf51cb5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704054008, "uuid": "52d319fe-7373-4c1a-a028-d931cee72cfb", "value": "T1B2A3D6D34278A302EB94187316D3EE737A59DC3E1D25BED3AE51CA5381EE45009DA2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704054008, "uuid": "877eac5b-a6ca-45d2-b9d0-63fd59c69294", "value": "0fcb7632c48018563e5af2f63681ece5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704054008, "uuid": "debc9477-6368-4f79-be19-5e342bf09b67", "value": "3072:VANfQKMuflyKX9FBFya6mob2lSL6RJ//5O:60O9FBn6pb+VRJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704054008, "uuid": "bf69a22d-5321-4a72-9d55-94beec15ef05", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704054008, "uuid": "4e059664-825c-4d36-99c8-7e450f2c37fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704054008, "uuid": "71900acc-0be7-4fa1-91fb-a8d78ff62912", "value": "0cf5248f76f6e1b9d4763637912ec294.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf7c160-a798-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703998304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998304, "uuid": "51f26612-0053-46c9-8cbf-28e9171ebb0a", "comment": "Malware payload", "value": "2cf99d282caf6a2aa2362857f58b55f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998304, "uuid": "a3a96101-58a8-479b-9f5b-f212cad51188", "comment": "Malware payload", "value": "38519d02c228d600a680bade553c2554577ba50cbde88811db7d276a7971de58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998304, "uuid": "23935b1f-518f-4465-b2ce-8970ba5a92cc", "comment": "Malware payload", "value": "3c0f1ff074528accb778cf1ce0089afcc54a30f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998304, "uuid": "6ee8902b-1576-4241-9510-07e1af211cff", "comment": "Malware payload", "value": "ba29f8f1f76263d30065c4cbfe77246a2ab90d6b8a494daf69dc0cb16ba808a871027d69befc67819af55b7cb89f1d38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998304, "uuid": "12061a24-d50a-492e-a642-32fa0b3d8422", "value": "T10E64BF01BEC195B2D6721D325939AB20693D7D201F24CEEFA3D46A5DDA301C0EB35BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998304, "uuid": "e3e48f00-873b-4159-8977-39c04aa68533", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998304, "uuid": "5a179a6e-9004-4de4-acd8-b73ec7918708", "value": "6144:ajT5Zh17eWxoG/+ov/2OIQ4wW3OBsCeAW32X+t4RbD:aRZ+IoG/n9IQxW3OBsee2X+t4RbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703998304, "uuid": "5a23625f-bf45-498c-b6e1-c43a9fc1da24", "value": 316914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703998304, "uuid": "55b2abfe-ea91-47d3-8488-4b214e46f0b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998304, "uuid": "b04d4ef1-38e0-4945-b8f9-f4291574fe77", "value": "archiverar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da42655-a80c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704048182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704048182, "uuid": "8a7f15fb-69a0-48c1-a564-363e10544be6", "comment": "Malware payload (Socks5Systemz)", "value": "43537b2bc12e34d46c2d5d79ff42e4aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704048182, "uuid": "fc657ee6-c1e4-4c2f-89f8-e4d6a337e419", "comment": "Malware payload (Socks5Systemz)", "value": "3d7ea367f39fac4f0b7b8992f909dd54a423335ad384850d302a6367c6d52c04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704048182, "uuid": "6212c92d-b576-4db5-88c1-b4c36e0d8fe8", "comment": "Malware payload (Socks5Systemz)", "value": "0a88b391ffef2e6039bce252b024b78ae82a67dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704048182, "uuid": "b2826c14-3ea0-4729-a3d1-8b0c600e36b7", "comment": "Malware payload (Socks5Systemz)", "value": "29d30880ccb882f29fa5e985dc01b7a7e73a417e1eb6bdd1aa781c7f4804bdd69ffcf7fdc640bf13114f4aa63958e9a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704048182, "uuid": "ceb01dc4-04e8-4e2e-882a-18b5196c8eb9", "value": "T17E3633020BA4113FF497EEBD1F3E4128C55FDE212A7070DCB66D11A94D4B8D3EAA2766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704048182, "uuid": "9d52310c-449d-4f7c-891b-bfc7d0447d30", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704048182, "uuid": "bc4d274e-9625-4c79-9360-8e55e72271e2", "value": "98304:QB7g7FQ251hCx0URk2o9xkLxd9Bk0Z+Lj2CmVUj0ZsDwFFcCKFsDsJD6wo/m4dm8:MWFV51RURPjbfk0sLayhZCGsDslK+4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704048182, "uuid": "c3677b3a-5891-4078-80dc-d9d47bff7e52", "value": 4875718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704048182, "uuid": "e6a24fd7-ad74-4d22-b8a4-1da916c764b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704048182, "uuid": "d5f8855f-7b03-4df1-b2b5-40edcb681717", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.18975.25923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6c50da-a81d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704055614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704055614, "uuid": "9c5eb147-34c8-4ea1-bfd5-8f4921c8927f", "comment": "Malware payload (Socks5Systemz)", "value": "82334b9d4c6e06bbdab33416f89e6780", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704055614, "uuid": "fa0cf1f2-3a0f-410e-874e-670677bad12f", "comment": "Malware payload (Socks5Systemz)", "value": "3e71b12f758658108da7efa53051a57e72c39bf8e955e9dcbfde3ad55789927c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704055614, "uuid": "98287292-8d56-4163-9aeb-47c1e40cb8c2", "comment": "Malware payload (Socks5Systemz)", "value": "39c1a4c7cc65d3619e60a990d58892f7ee2dd68b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704055614, "uuid": "5b3c0f25-decd-484a-b542-630c1d3aa201", "comment": "Malware payload (Socks5Systemz)", "value": "b7b78fe312a2a12c1b4a5e55a5a5250b610b2cc9402278cb25f52b59ed91ad8adde412433bd4f40ab8249d85c766a1f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704055614, "uuid": "9a1852ff-77f3-4eec-928d-c82d082eb64d", "value": "T181363357E4DF0273D01A893139D5BA68EB7B36A4A451E124B5CF8A7E8B63D80FE0C45C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704055614, "uuid": "4e3b5f2c-0400-4dd6-bc48-3d24054dcfc1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704055614, "uuid": "a84c46b9-2c64-4b70-81c1-78ec43dec43e", "value": "98304:QOih9hVHftHcjDWuin+rzuD7dILocHdmHRaIS+1Xd9gfn+9ci4dm8:y9hV1HkVin+XulYocHyHS+1HUn+yi4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704055614, "uuid": "31a6d362-eb83-4673-ac06-b42e75034690", "value": 4874164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704055614, "uuid": "cff61cc9-d23b-4dfd-9435-ffedd74a26ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704055614, "uuid": "ae6f0c93-0207-4aeb-a821-e38615b738c2", "value": "SecuriteInfo.com.FileRepMalware.30895.23071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b54f019-a819-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1704053708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704053708, "uuid": "1a878704-ca25-4901-bd89-d49526ee34e0", "comment": "Malware payload (DCRat)", "value": "b44707ad7ffb26212ab87d889824f799", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704053708, "uuid": "ad415da2-268e-431f-991e-2208b3da1040", "comment": "Malware payload (DCRat)", "value": "41d48506b34544abf99aa361f0068bc75ef723088dc319270b4ad0cf0d97fd65", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704053708, "uuid": "e28dfb67-8856-4527-80a2-ed90f7a6c53d", "comment": "Malware payload (DCRat)", "value": "126765dcf3feb120ca3112e533a2aa079c3e1d80", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704053708, "uuid": "45f15971-c330-45fe-88bf-56eab918fa75", "comment": "Malware payload (DCRat)", "value": "48e7986c5211d90a03d80d09aa345733be89eb8278ffe7b806911621737d8dc114aa8b59352104c4409fa3f6de3fc62a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704053708, "uuid": "d1af6ece-dd26-4d3c-a3ba-92381a531b22", "value": "T1E4C5D046A5528E33C264BF3184D71A2E42B4D73275B2EF1B3A6F19D96C063319E523B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704053708, "uuid": "e3e49735-0855-49db-9aa1-2a80fa33487e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704053708, "uuid": "65eb275a-f677-44db-9734-134a9e85202e", "value": "49152:sqL9RqZCTCUc3I2Z/f5iz+29U0IGBC0x18bhK:saoUc3I0/BiKwrkW+hK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704053708, "uuid": "d91e9b76-36f3-4c58-abcc-4ad0e76bebe3", "value": 2661888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704053708, "uuid": "9943f99c-b627-4bba-a3b2-c1348fb962fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704053708, "uuid": "85366904-1758-428e-b836-01804c1c4906", "value": "b44707ad7ffb26212ab87d889824f799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f55342-a7f1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704036816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704036816, "uuid": "d7042823-caf8-4a97-8eef-748e4fa6a9e4", "comment": "Malware payload (Socks5Systemz)", "value": "c9755ea38fb687849df50a71d004ee84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704036816, "uuid": "49642c90-811b-42e8-a137-7a7f784c1d26", "comment": "Malware payload (Socks5Systemz)", "value": "427ba60b57aaf0c74bb4c81fe38139ded7087a55f486d104554bea60ef9adbc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704036816, "uuid": "b1c794ca-a41e-4f3a-9ae6-19c59c4adf8e", "comment": "Malware payload (Socks5Systemz)", "value": "2bd8a449e1010e6154122e2c4df2b1cfec5b1042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704036816, "uuid": "1b0c6447-3ead-4eeb-a0d8-c628cf2bd733", "comment": "Malware payload (Socks5Systemz)", "value": "bf2825e90930ce3892fb40b33976bacfec60090aa24ae41d63c039b3013baf752bdd60187790e942e2292d968c04a209", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704036816, "uuid": "9a2e7ec7-d483-45b7-a9ad-ca22b36da684", "value": "T16D2633A7E8B62071E863D17498E9C95F87227C622175295EF51EC0CC7FB0C7873863A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704036816, "uuid": "a844e0eb-a774-46b4-8706-b2e40c05ada6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704036816, "uuid": "044f4876-712f-4088-9619-2e97c472b1f0", "value": "98304:QvI9e0tZZpA9v9cvW1XNMuH6Z/dPdWMQ6++UripmDsToq4dm8:2z0VpAaW1XSuaZFPd93+rlsTp4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704036816, "uuid": "27abd88b-ef33-44bc-ad6c-e6b9a5864b38", "value": 4791751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704036816, "uuid": "2b814173-e7b4-4581-b0ce-f4ed31b8fa4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704036816, "uuid": "c7aa72ba-21eb-4afe-9c54-aeec03b61964", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.20351.10542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6f8df4-a7df-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704028930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028930, "uuid": "f446f1e1-8712-439c-b26e-49d17ce72e2c", "comment": "Malware payload", "value": "6d122c97b5d5480e9d9adfdca81667a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028930, "uuid": "70d89aaf-cddf-4c11-8419-f73884eb60be", "comment": "Malware payload", "value": "472d6c67645c5c79538c1186377ff11e47770e3fe25fe3175277294674bde638", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028930, "uuid": "5f570261-98da-4c80-909b-42b228b1ec46", "comment": "Malware payload", "value": "4c7f0245b45deddab8bfb0390a3ecefc7ca1a33c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028930, "uuid": "101ffea6-f784-407a-8cbc-30736a663f8a", "comment": "Malware payload", "value": "ade1ad919c530d6e12243829da0777f7ab89d16dbeb6e5bc2f065b02145989959ba9a2553f0e328ba309a6b71870601e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028930, "uuid": "38079208-5c31-4395-bd65-13317bbc754c", "value": "T1B483F743B10020A0D61384F3CE5D17EDE3A2DA29D676EAEBC5D042683F73DBB49B6254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028930, "uuid": "ae1023a5-a77d-49a7-b4a3-3fe9055740af", "value": "1536:fZOw9SHRa9RJPQ8PlQH1W/dvByRBL/y4eLf+:JZRJPQ8PlQ0/d5yRBL/yVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704028930, "uuid": "549f2b6b-f83a-4e8d-b6cb-6bf15b854767", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704028930, "uuid": "3d5ffddd-47de-4a35-84d7-004b4690c3c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028930, "uuid": "41826898-4d41-482b-a564-8f9f3c587aba", "value": "SecuriteInfo.com.Win32.Evo-gen.3350.11909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e11feb-a803-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704044357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704044357, "uuid": "fe12855d-eff5-4155-a90b-70e79edd2064", "comment": "Malware payload", "value": "926bfcae73a57c4287faee038933f986", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704044357, "uuid": "1bcf230a-fa09-4298-9eb0-d264a2b03ab3", "comment": "Malware payload", "value": "4789a1649b1069ca606cf6450422a3eaabf77a7469355a8a8fe552a2d10fe390", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704044357, "uuid": "9a1ed3c1-1792-47f0-a4c1-0e6759b177b1", "comment": "Malware payload", "value": "2a593855dc33055a943fbc157c723089e5ab9308", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704044357, "uuid": "6be3324c-80d3-4a23-8583-20390645c7b6", "comment": "Malware payload", "value": "8ee711e2ce16127eecefd4aefaee4d1222ec32b218ceb334a059b11b1e310070b885b2d0f0612784f19cb6a6742fb97b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704044357, "uuid": "00ca22ad-90b2-43de-8a6d-209b5c8aceb5", "value": "T1DC710C0697E84262F0B64730AEB347172BB0F8808F738B6A09C4421D7DB17242E75FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704044357, "uuid": "65504a50-7244-4036-b50a-858090ef193d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704044357, "uuid": "1a04a3af-45da-492b-87a6-badbd32d91cc", "value": "48:6Z/zxpQLXK1tgu0OVgJJ79nb1ulfa3jq:um8XtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704044357, "uuid": "b7eec751-a655-4d89-8ae5-31926fdbbc44", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704044357, "uuid": "d55027a7-02a9-4c0c-92bf-c2ec169a4673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704044357, "uuid": "71cb0218-d34d-44b5-8248-d536ca077290", "value": "xar2vrcs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3226d79a-a800-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704042928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042928, "uuid": "f86d2ab4-1de1-4a75-81a4-014f0f7ddb2c", "comment": "Malware payload", "value": "9f316e32914acaf2904f690e06606974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042928, "uuid": "a293897e-a381-4c7a-b73f-d7d54c909131", "comment": "Malware payload", "value": "49b408d8fcf504c8acc8a7fff45585ea8be96b4b68f6615ed7fe4495820ccf8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042928, "uuid": "f4fd333f-d694-4514-b604-c0f50099bec8", "comment": "Malware payload", "value": "61efc92c7617541f7c41631720d8ced6ec78aa19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042928, "uuid": "04e37560-82eb-4648-b3f4-4518a8eab5c4", "comment": "Malware payload", "value": "c0f24d2b2d664acb68a57dc11cd7dbc12a60db2c4c6dbc67a8555206f71ce91853361d551468701d1ca3e4412a9d879e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042928, "uuid": "c12b9967-c6dd-45f6-acb2-e598c16d16e0", "value": "T14D86239551C89BBCC0C2463C754202A970E0BD9985FDD814BBD7AC23BF21DBD11AA7EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042928, "uuid": "625e8320-6117-44a5-b11a-9e3b30ff28f3", "value": "c269743ebbb3816fe656e57159e214ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042928, "uuid": "d089e79e-3cec-4c34-ac21-c2e9eeba789d", "value": "196608:J3nJLovsDgzFQPu145/kO+FI/bvdIXG6/8PScsVtGZq:RnXgzCK45/kOsI/hI26/8Pt0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704042928, "uuid": "722c7246-294b-4ed5-b989-9001103a3a2e", "value": 8522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704042928, "uuid": "368d3873-de0d-40fd-a6ba-1aec1648a489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042928, "uuid": "f5046baa-af43-413e-9b7d-e83b532946d5", "value": "6dikvpvuo8jfalcq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66190603-a803-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704044304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704044304, "uuid": "f1030e26-b189-4c8c-998f-4738f27a7df0", "comment": "Malware payload", "value": "b0e763f1ef96fc4b3190961fead53937", "object_relation": "md5", "Tag": [ { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704044304, "uuid": "2f7ca560-2505-4a86-bd97-e30b7d5bb17a", "comment": "Malware payload", "value": "540290022c86e2dbc150f727533485de68975f41de75d26e0438696fd9dc95a6", "object_relation": "sha256", "Tag": [ { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704044304, "uuid": "87395952-0005-4f1c-b3f7-54a6a8583546", "comment": "Malware payload", "value": "5c1a0b2928ea75563d114206e9f3a642433eaadf", "object_relation": "sha1", "Tag": [ { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704044304, "uuid": "a942637f-c16f-4f69-b968-28253ca5fb6c", "comment": "Malware payload", "value": "792d440a10b070cdce9bc4139460abf45f4faae407b71f48cc4a80bf17ad91c2d8ff95e9aaafd1a416797349ea136624", "object_relation": "sha3-384", "Tag": [ { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704044304, "uuid": "c817d949-3143-43cd-8b8f-c9f28245e5c3", "value": "T190339130F3EBE7CA2B8B6A5DC43E3C73174182D442E90133452B5D46A5A8F7A5A479BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704044304, "uuid": "f51dd43d-bf9c-4bbb-a7f1-7d3608ba0785", "value": "384:8C/5555555558F67cdOr9wavSN/Bi36livN7:8C/555555555+KhGwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704044304, "uuid": "5e84bafb-b138-4581-baf0-d4f0202b5bf4", "value": 53124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704044304, "uuid": "039feb8a-64b9-41f1-bd3b-d432edec318a", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704044304, "uuid": "2be642aa-5da0-4c8f-82e9-16a28ff52e63", "value": "540290022c86e2dbc150f727533485de68975f41de75d26e0438696fd9dc95a6.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a052f8-a815-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704052033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052033, "uuid": "9f23db32-f038-42a9-a567-a3bfdf437843", "comment": "Malware payload (Socks5Systemz)", "value": "1be09a7b5dac69c58bac8282051f7314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052033, "uuid": "3ee49dcd-6e4b-4c7c-80ff-761444551b56", "comment": "Malware payload (Socks5Systemz)", "value": "5ae54d9c70e156a2cc2f6ea46d9265c75e4e299132b24946e054a88458cd2d65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052033, "uuid": "0fe7516e-8533-4ac8-b5cd-c42d0c3282f4", "comment": "Malware payload (Socks5Systemz)", "value": "bc3130baba868fd282da33cfca959c2741757331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052033, "uuid": "21566ffd-e974-4e8b-93f4-e8afb25cc6b5", "comment": "Malware payload (Socks5Systemz)", "value": "80ee1434b32db2cb50ff1644555d89616d4cc51f31ebfc47de336ed2f4da1259817b87761171f47e681b70a8e2efbcf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052033, "uuid": "830e5441-882d-4509-a49a-12442804df30", "value": "T147363355B2D641FCF230D9707F46DA928621742A8678B26E78CC855ECFEE863D10FB09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052033, "uuid": "19250e1e-d904-4846-bb5f-00a644582b61", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052033, "uuid": "afacb320-cf7c-4871-bf90-3a36fd367aaf", "value": "98304:Q8o+EFLNT6em9r+zQxvKByIT5B0syDOaWxZNJzKo14s4dm8:jo+EFLMem9r+0cBPDWI68h4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704052033, "uuid": "5a72fee7-d919-49bc-b99f-67d5faab01f7", "value": 4874596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704052033, "uuid": "8dd33d3e-7419-4c9d-81c3-fb6822ed497d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052033, "uuid": "385bda99-fcb8-434d-80fb-cc7905ad3073", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.20630.27649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c097fe-a81f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704056321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704056321, "uuid": "0044612c-19fc-4561-abcc-59d67478a639", "comment": "Malware payload", "value": "be8cdde4842fd762856c98114130651e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704056321, "uuid": "2c2bb998-53e5-43d6-8dbd-1bebf6e0771a", "comment": "Malware payload", "value": "5c946bc51595505a29eb5d16ed410aef05c8b09a1b7ddc8a261835ad2b935a77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704056321, "uuid": "e8b158fb-1ef0-4de8-a2bf-210d566a4305", "comment": "Malware payload", "value": "23269d6db8186872f6d31e6f50daaffdd43c28a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704056321, "uuid": "71016635-ba15-4370-a368-04bc2381daf9", "comment": "Malware payload", "value": "60b5f4670f56893ae2f3212ea3dc308531bd2733ec41e0432024da19e500e9ce7281a82d4e4dd54018f422b87dd65b00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704056321, "uuid": "27fe23d1-e6b2-4c14-bc03-8c0678ffb1ea", "value": "T1B8850102B3F71474F8F71A34987541601E22BDA8B8F1D87E1DB1E54E28B4A929D72B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704056321, "uuid": "fc4a91a2-7644-4fc1-87fc-73f494268678", "value": "c9e69a467fe3fbd2ec5e5d1eec0d6e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704056321, "uuid": "8f8def0e-39a5-4bf0-9485-d3c00b21b2f6", "value": "24576:09Qv76UpurjnWc0641KTW1qoVmv/cGrZiH/K1+oeZZt0HnZYRUN:HDpMWj51sWPGcGrYH/K1neZZGHqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704056321, "uuid": "e20ae272-e3a0-4810-8be6-7124ba8bf9df", "value": 1799359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704056321, "uuid": "66eaaf2d-a642-49df-ae6e-dbb7d87437ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704056321, "uuid": "fbc60a3c-f5ec-4b3e-a08c-11a4917539f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec77d56-a7e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704032561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704032561, "uuid": "c5f6d70f-1f62-4430-8e42-3e2f11a12f69", "comment": "Malware payload (Socks5Systemz)", "value": "619e5365c04444ec983fd8bf3aabf68e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704032561, "uuid": "258c6dcc-4252-4949-9a34-b7adb3170026", "comment": "Malware payload (Socks5Systemz)", "value": "5ebac4ea7a4cf0ae9572f14dbab813c62272c3a2c8d85d846177e1e0fb794438", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704032561, "uuid": "61875738-2344-44d7-b3b2-bc8878f32f1b", "comment": "Malware payload (Socks5Systemz)", "value": "be9a9338a71f3709eaab7c066e21f86228bf5ffd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704032561, "uuid": "fb31a2f5-e9c5-4595-a92e-0fbd199edee2", "comment": "Malware payload (Socks5Systemz)", "value": "1c04a324ef9cad7975ac36870559e3d5c169a0f38f83d6e02a3fab01517c93d8316391ad540a913d749bd6ef8faab9fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704032561, "uuid": "77ab63b8-6616-4541-9d71-d868a11e938e", "value": "T1992633C1689F1036D4317272A986C6B86C269E6D8C6D1C1FA11D89835FC31617BCFFEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704032561, "uuid": "0309d640-9bb7-46bf-a1a9-d90312f65868", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704032561, "uuid": "273085a8-27db-4491-8669-8ee8227ae5a3", "value": "98304:QrmkSq9WKXy1Wx6DuOuLi+Tl5ECaGefFTN4+b6ZuD/SXyGKEviq9Nc6/RIzpAzfY:5zenx6aOL+TO7Tnb6MDKXyGKPOz/RIzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704032561, "uuid": "2851c309-b137-466e-b71d-4d3b021eda09", "value": 4794460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704032561, "uuid": "c8f75d2a-c999-4427-ad4a-b7a14004473d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704032561, "uuid": "830ea2df-c9c5-4c9e-8aa0-e599f1695154", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.6519.13797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3756a79e-a799-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703998699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998699, "uuid": "674545bb-bbc7-4de3-a303-928c94898798", "comment": "Malware payload", "value": "7bc10c484f879c3af3413e709fdb363a", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998699, "uuid": "c3be0fe3-15b9-45cd-9fbf-cc3f3c2bdd90", "comment": "Malware payload", "value": "62c9732bb11e65efa0becd8b45536fdab6cd247af0e500e703d4987d6b32e9c3", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998699, "uuid": "23f70d84-f6bb-49bc-8b1c-7f3604c178a5", "comment": "Malware payload", "value": "a1b036866ec98407973c9ab2103f019b3e9672f1", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998699, "uuid": "b4ac1826-6ad9-4797-8f6d-1fe492ec7e10", "comment": "Malware payload", "value": "78e01890990f371aaa8237669799efaf9ac604afa37ea07250b7112a4bcbdfb925083cfd14fc2009f71b81c80a519519", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998699, "uuid": "18675fa6-a964-4fbf-b6a7-f6dab051f337", "value": "T12234E0A80A33397541A69AD4F313C50FDB7826F38078E781935856E1FF2790B4F9AD68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998699, "uuid": "2a346fa0-298b-4772-b911-2e38fa81bba6", "value": "6144:3QZaa8WzkEcNpnkpit4SWTVoxypPL7FE8m:AZaa8T/pneiWSfxypPL7Fnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703998699, "uuid": "e5413706-f4a6-4608-bc6c-d6fd91f5c7b2", "value": 247879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703998699, "uuid": "784ceed0-fb58-45ef-a03f-bf9c53ed7045", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998699, "uuid": "4faed3cd-b125-40e5-90d4-f9815dc7389d", "value": "xor.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98942f51-a836-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704066293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704066293, "uuid": "1e7464e5-0be2-4c37-8066-f5d793a281e2", "comment": "Malware payload", "value": "bb47e86745b64c55c469e2ad17516b47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704066293, "uuid": "83e32625-1a7e-488e-b066-8ae667d7939c", "comment": "Malware payload", "value": "6413b46b839e53cd7eca27f925f7439321f5c7b50d204528b00546b9cf4eb837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704066293, "uuid": "26c5ba49-2dd0-4898-b925-a1e12b1fdd54", "comment": "Malware payload", "value": "b8661185e0af4569c881362fc0a10567c361f9b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704066293, "uuid": "8a84231a-130d-466c-ba7b-7a004d630411", "comment": "Malware payload", "value": "aa6bdc2c06b11f48bb100e30096d7a03b06113031d68e4941138660f304bd0025796f0f6dd9e51d336370d05e33a12bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704066293, "uuid": "59ad437c-355c-4f06-a626-51f187eaae8a", "value": "T105E55A1437F85E33E56BD673D5B05026A3F0F82AB763EB1B229167BE1C53B4448026A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704066293, "uuid": "dd3538de-4a94-4463-bf9c-89c2ee37f407", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704066293, "uuid": "f3225c47-0c86-4c56-a8be-e9a5093af4d3", "value": "49152:uvKY52fyaSZOrPWluWBuGG5g5h/0Ha95bQDk/mLoGdzSTHHB72eh2NT:uv/52fyaSZOrPWluWBDG5g5hEaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704066293, "uuid": "74d1825a-1ee3-46df-81f3-8a4f3146e2a2", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704066293, "uuid": "f19a66d0-2e6f-4e1d-bcb1-06fb6964caa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704066293, "uuid": "befe7b29-256a-4518-ba9f-29d65321b751", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704d1621-a773-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703982474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703982474, "uuid": "b391dd59-c512-4d71-b898-7fd4345f9431", "comment": "Malware payload (Socks5Systemz)", "value": "6798129c4b662b590f7c9dc1ef1db39c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703982474, "uuid": "8d8c73cb-0e48-4d20-9c91-d7a5483d8ecd", "comment": "Malware payload (Socks5Systemz)", "value": "67926c17aede849c4eaaf09eb88631c6dea6f9303a275ef3ad8d1c59f7b0f322", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703982474, "uuid": "cae4c8cc-81a7-4e2d-9b69-eaa23d89d6c9", "comment": "Malware payload (Socks5Systemz)", "value": "e9384df60ec6a4fec56ab264151b149be8328d19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703982474, "uuid": "a4e2190a-4ae0-4489-a27a-c43a9475f47a", "comment": "Malware payload (Socks5Systemz)", "value": "2e912c2cda104a988ec797c454b7166ab374f8b0357034a1a6bec31c34baa5d716fbd38cf0dcea733a4afc7da8754fbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703982474, "uuid": "01e4dcb9-fded-4677-beff-367335f5e0bd", "value": "T1723633D254841831F9B2DCF69C7794688B1E371E06A6854E3BE8FF0EEF5B018990A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703982474, "uuid": "f6612244-9e28-4861-87a2-1eb125edbac2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703982474, "uuid": "6aa26256-3ccc-4dd7-bea9-e7f5f174ade8", "value": "98304:QJUXQC3jwZLemYujvzssTCpHGH8Dc3xLGK72HXdWeujTxxP7Up4dm8:+tC30ZLemFQgCRi3xL/7qyjTvw4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703982474, "uuid": "dfe7cd7d-7548-4c79-960d-e7f4c78963e0", "value": 4914061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703982474, "uuid": "3034e7d0-e870-44a6-8cd1-ffb6cc08fc2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703982474, "uuid": "f10a9c96-279b-4f19-974f-7d82bfeda090", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.20671.7433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdb792f-a797-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1703997908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703997908, "uuid": "66179d53-6655-48da-a93c-4aac1238ba60", "comment": "Malware payload (RemcosRAT)", "value": "b350317fc7b6fe50771a1d4ddc7f7c13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703997908, "uuid": "01620d78-5f8d-48db-a236-46edecc2a74a", "comment": "Malware payload (RemcosRAT)", "value": "69bab8311a083c22ecc3fe16d1fd9c563ae103649011e4337e6044c2b8c5b689", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703997908, "uuid": "8453ba40-7bb4-4493-b503-ddf3b767625d", "comment": "Malware payload (RemcosRAT)", "value": "a662ddea03be2f49e8d9161324b014a52a4c1f27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703997908, "uuid": "9c118b4d-51a7-4422-8729-51b56b7cd6a0", "comment": "Malware payload (RemcosRAT)", "value": "b3b7690caa777518ca5634df0e5ba7ae0b5d67d23e5b0f3a43317fd661aceaca5a7e592f5b8cc034ca59117382e1a1fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703997908, "uuid": "dc5bfea6-8775-4750-8f40-490cb767ab4d", "value": "T149A4AE02BAD2C072D57161344D2AE735DABDBC212835997BB3E61D5BFD30180A73A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703997908, "uuid": "7a6f8eb6-c70e-483f-95da-89d88d50ed17", "value": "5d354883fe6f15fcf48045037a99fb7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703997908, "uuid": "f717fcff-896f-4497-9b1a-1e86d3faea7e", "value": "12288:omnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSWn9:YiLJbpI7I2WhQqZ7W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703997908, "uuid": "b0ee2f80-acd5-4945-bf30-fbed0b56c5a5", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703997908, "uuid": "837dc1ea-8169-470b-8405-489d6d0c175a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703997908, "uuid": "0819c0f4-7c53-4319-9d31-d7e16927eebf", "value": "b350317fc7b6fe50771a1d4ddc7f7c13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c307f026-a7c7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1704018690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704018690, "uuid": "821362a2-02f2-4bdd-b2ca-0ad0aac3813e", "comment": "Malware payload (Gh0stRAT)", "value": "91a9d68680c61a4a2aa0db3d55e32d98", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704018690, "uuid": "71391e3d-378e-42e8-bd77-d9435ff01111", "comment": "Malware payload (Gh0stRAT)", "value": "74b42aa2c8dd8fdb51b93c6f736567be4545b3422f159a1afdcccdfd0870e708", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704018690, "uuid": "57a715e4-54e8-41a0-9ee1-22cf2914b169", "comment": "Malware payload (Gh0stRAT)", "value": "9ee334fbd16899a658ac5e6a02d537706e753e11", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704018690, "uuid": "a4dfd192-363a-409d-b728-f2fa1d77ef66", "comment": "Malware payload (Gh0stRAT)", "value": "bb0f2944d40785f626d543700fecea20be7574b06d875a054e0a8570c1db88295dcbd6483b30e812ef892ddffcff1584", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704018690, "uuid": "630d2733-ff4b-4a81-8601-b2bc10846a79", "value": "T14D333902DD8D88F5E141177039AA77B7953ABCE07A8526634F63DE69C87B330F42D286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704018690, "uuid": "4681673d-9c61-476c-9b10-28495abcc286", "value": "4847c8aea5b26a115e9f4b1fffee02d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704018690, "uuid": "528acb05-7667-4b47-8ee1-3a205d519ffb", "value": "1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5q1JYH:W5ReWjTrW9rNPgYoSJYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704018690, "uuid": "4071d2e1-6aa7-43ae-b14c-a0de9a3c319c", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704018690, "uuid": "eb4dfa07-b6db-421e-9106-226577423375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704018690, "uuid": "99141af7-3725-4eb2-ac5c-35526a60f229", "value": "freeeim", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b3e64f-a815-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704052029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052029, "uuid": "35b9b99e-be66-4137-b8ee-392217780f6a", "comment": "Malware payload (Socks5Systemz)", "value": "0dd9b31c21f6d83a5b09bd77b21a0ff3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052029, "uuid": "da1b3095-990d-4693-8597-dfae4f40ed0e", "comment": "Malware payload (Socks5Systemz)", "value": "7586634ee7e23a8d92506e71af95699d690548c64b40a30f24ce671e6dce38eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052029, "uuid": "725a9de3-c53e-4aca-a91e-69bcadfa8600", "comment": "Malware payload (Socks5Systemz)", "value": "f6b9e748ebd891b36bb5293231359afab4851675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052029, "uuid": "807d25ea-7768-4e6f-b8b3-a6c97c58726b", "comment": "Malware payload (Socks5Systemz)", "value": "92db19c38539b7a3311598601047b225c3eed0c2d7bac8f20b3eb860d3fae27974f477d247ef8ab6bcaa3bb944e928ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052029, "uuid": "3bac74d9-f446-4401-9c45-b224a007ce4c", "value": "T1A3363342C36B4DFFE1B98B35757218287A62EFC453E4534FB9142D889FAAE64C207345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052029, "uuid": "b6b89a16-fd83-46fa-89f4-a7f636c4155a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052029, "uuid": "b6110b0e-0f10-41ad-907b-a3a33cc3f11f", "value": "98304:Qt3qWqnyofIm/xiVLGY0ZblwqAshYBvCf5I+iULq+GST9C/c4dm8:+3qWqnyofI8EVLGY4JwnsytCffiU7BC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704052029, "uuid": "a7352420-5f38-4cbd-96ec-3d26ba50c357", "value": 4875282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704052029, "uuid": "bce0fa4b-227f-47e0-9b93-646f455dc6e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052029, "uuid": "d30888b7-caa8-44fd-9147-19bd6b76ed74", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.20643.30237", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c674c0c-a783-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703989232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703989232, "uuid": "cbdcf841-a296-4166-99f7-53ce98a022da", "comment": "Malware payload (Mirai)", "value": "d61404fe7eaca294ff8eb12a474ec29f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703989232, "uuid": "a63a5d5a-c435-4c4b-8fb3-b08075e215b2", "comment": "Malware payload (Mirai)", "value": "766624688e95333ff3ccb3312d04d8e3e9fb3c552630ee9ccf11d86e87ca588a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703989232, "uuid": "64c2fa5d-f2a5-4bcd-ae2a-d10299827ee4", "comment": "Malware payload (Mirai)", "value": "a9cc3ce8cf50746e10a8da2c1bab7cb5757632b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703989232, "uuid": "83a54727-0b8b-4436-b466-4e9714b12361", "comment": "Malware payload (Mirai)", "value": "a768602b40b60e846ce9bee0a403c0fbda1d2115c41054e978437765eb9ca962a75a37f7c14bcf3f058cf95ef37c0b4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703989232, "uuid": "8e664839-23bf-4826-bfd7-d146660fb49f", "value": "T1DAB2E19113922159C362CA7C37A9740FC1282553729A1D402D90A69EED1BB249CF8FFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703989232, "uuid": "c3e487e6-6f89-49b6-90b1-674f26f0ba98", "value": "384:yb2eX3zAKuiNPZRwwqdvrrduMXbCAk6Y5VvCYxy0kJX+:/kAKuobq1rduMGAXSEYEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703989232, "uuid": "a37c3417-3960-49e9-b2c5-6887e753c97e", "value": 24820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703989232, "uuid": "c43342ac-2e4e-4176-8dc0-9fc807134001", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703989232, "uuid": "28d60bb6-cd00-4ee9-8e03-2137ad3fd0df", "value": "SecuriteInfo.com.Linux.Mirai.6523.16512.32511", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dda2f94-a7d8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704025795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704025795, "uuid": "f9654f10-7d11-46b4-b7c5-f201a459b86f", "comment": "Malware payload (Socks5Systemz)", "value": "a7e264f8b8f16826d715d0257e2c9c27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704025795, "uuid": "0fc73849-5fcd-42a4-9443-ec7d4dbcdd8d", "comment": "Malware payload (Socks5Systemz)", "value": "7a8854c8c29c00d77650a35a11b77cb471b04032bf22b02ab4dfdaba375e1544", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704025795, "uuid": "affec6fa-daf4-400a-87e8-0f8d35b56f5f", "comment": "Malware payload (Socks5Systemz)", "value": "cd079db634bd4518bd589339f263978393ef84a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704025795, "uuid": "3d89ccc4-146e-460f-8436-264d3cd33937", "comment": "Malware payload (Socks5Systemz)", "value": "733e31c17dd851c7ace97d6ed98b4e23c439a2358e68e9ee5c61eeb673d64451a7b9ba3a0d7a19ab2d562130cba4aa1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704025795, "uuid": "34445667-f051-4941-b4d5-5aa97ea8ecb7", "value": "T12A2633A3C5E95C37D0A108F5BDACCA9719138D587BAD600A1A5E097C8FAF9D1730938F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704025795, "uuid": "59fb1d95-fef6-432d-80cd-173249f7d6aa", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704025795, "uuid": "ee174325-340b-40c4-af28-11c18d773a9d", "value": "98304:QlljqpolKWL4bb3r4AFqAen96V+oyXpLiVm8BXKQzAe2RIH7lblmj/Xpv4dm8:Elj+qKWL4b3Cpn96VQRNWUYpE54dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704025795, "uuid": "34514628-ffe0-4d55-8ec0-8cf4742edf42", "value": 4792727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704025795, "uuid": "65b8e3c0-446e-46e0-8107-ecd9749758b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704025795, "uuid": "c151f040-b70c-44bd-90b6-cdbf30e2786a", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.543.21201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ef5108-a7fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Hydra)", "timestamp": 1704042368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042368, "uuid": "fd5a157f-d32d-4596-a7d8-393cc2b92f6f", "comment": "Malware payload (Hydra)", "value": "6966dead3e5307bee1ba7a5ead34a63c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042368, "uuid": "ae5b5f50-4c23-43a6-aa35-a95ffe738653", "comment": "Malware payload (Hydra)", "value": "7e7ee5b11fe1ca56f0f8416638964bec68b9ef90b25426f06d1330222b1dcf3d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042368, "uuid": "bc8e30af-d96e-416a-89d1-b9a98642fda3", "comment": "Malware payload (Hydra)", "value": "49117815e82f8e8f5ee979e2db0924ebbb5699b8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042368, "uuid": "dea61bcb-a619-4df6-be71-51544187a817", "comment": "Malware payload (Hydra)", "value": "f0667523b7f5dd16fb37116c7d40511d4349cc8f0987400a69a652a8b8c3bab458855f1c9b909fcb3d669455c0b77012", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042368, "uuid": "7087fba9-23d0-4013-bf10-7227d22b6674", "value": "T196163384F1AE9789EC798B341C78C59081B82E99EF2102173549371E09F77C9DB79B2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042368, "uuid": "6f96f609-eea8-4dcb-ac5c-3c63a86e057e", "value": "98304:E0VWaHzRXEjLWQo+KuHQPyYYGsMvCuSjgxekJbeBVv:E0VWkzRUfMJkYyYYN+CpKekwVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704042368, "uuid": "ec5e951a-0fce-4f44-813f-b6e67e2aad7d", "value": 4415340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704042368, "uuid": "f18fcb1c-7cd8-4741-afdd-e31d6e63fc82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042368, "uuid": "fad684bf-874d-4ea2-ba15-5146fc381150", "value": "Play_Store.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122362b1-a7ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704007227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007227, "uuid": "e73fc190-0c82-457a-afb8-ae9da56333e6", "comment": "Malware payload (Socks5Systemz)", "value": "8ef8edadd33ba0272ad79987637e0b0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007227, "uuid": "34f4da1a-e9c7-41e0-935d-a3b0bdeefe6a", "comment": "Malware payload (Socks5Systemz)", "value": "811341ecc410990e471254f7fb3cb7ee35ee2e973d27962348625812533e35eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007227, "uuid": "ceef85e3-25c2-4286-b6d1-bc942da6393f", "comment": "Malware payload (Socks5Systemz)", "value": "868aabfcb216f8780f24ce87a47c7374f5744eaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007227, "uuid": "d0729b01-4c18-44c4-b52a-41d69976f368", "comment": "Malware payload (Socks5Systemz)", "value": "763a0ffbc507c5ac1c7b86af2ae2f1a5ac0f47264801c2bad0233f5cb4211c22dfc7b61bc3eb2a57c7b073c302d1c239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007227, "uuid": "7846c0a9-8313-48a4-a199-0c263361bfbe", "value": "T1F52633F29E5287B0D0326A3B366491289A97F0393CB47614D60CDD46DDE79E4FE70B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007227, "uuid": "06ebc313-cc8b-4c6e-a5bf-1337885ad94f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007227, "uuid": "97c7a8ee-b2f8-4712-a540-b519eab0cc5c", "value": "98304:QDaPq9dkdfskAlOrD6tKwW7CoqrVYImH67QcctouoKxro74dm8:6kdkkim6K6rVYImHuB+o74dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704007227, "uuid": "05950c13-edb0-4ad0-979b-8eb40ebf894d", "value": 4792963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704007227, "uuid": "3644e486-051a-4046-8446-04bb506cb0ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007227, "uuid": "085a09e7-c2ea-4e72-bd20-56ee4f3a51b4", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.26191.27194", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c419d3d-a7df-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704028933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028933, "uuid": "42c7c8d4-281d-4ba3-9289-745c083d0a26", "comment": "Malware payload", "value": "eccdd616e9819123a000292c2773b4c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028933, "uuid": "54958e27-0a74-4f50-9c14-7d56b65de6cf", "comment": "Malware payload", "value": "82e847d02b0e7e995e2f4c22863ee2e7d45cb75b0b99bfb74be8967b80b141ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028933, "uuid": "0cebe813-904b-45d1-be2f-b7d33e7d7cc9", "comment": "Malware payload", "value": "8257257fce447859cfcfb4f1abd4df5fb292a3dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028933, "uuid": "65e58e77-6603-4c12-bf68-92ad084f88e8", "comment": "Malware payload", "value": "edde469cfda1fa3f9fd2d802b0d09d80006490775eded3ddc220d5955e044461f0a1897e3e9f9c8a1dc0130d3fe54174", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028933, "uuid": "ab813235-2176-48ab-ad14-9283d3b95f5a", "value": "T10C358D1732A15033D67279368A2B429AC92AFE261D79345A2BF51D087E30643FB75FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028933, "uuid": "b8e1a7aa-254d-4930-a5b8-2be62aacd10a", "value": "12288:a0obRdMRlUvB7+mJJ/IYaQ+subM9U9+7JwgfpaAYLB1QamKwDOYf+po3N3O4OdR:atVelUvXJDrVi9+VlcLBVwDf+pod3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704028933, "uuid": "f5479ada-7a87-4f98-a34c-ba3cc7f4c00c", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704028933, "uuid": "fb89eac7-a07b-4f65-a839-7fef97eb496b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028933, "uuid": "e8368731-1ba2-4b69-a142-83a025c6eb9a", "value": "SecuriteInfo.com.Win32.TrojanX-gen.28719.13350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2158f486-a7d5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1704024432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704024432, "uuid": "33ceb2d0-f477-42af-968e-fc2f1b6798e2", "comment": "Malware payload (Gh0stRAT)", "value": "623d28815c85957bafdd79395e2227c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704024432, "uuid": "38a415b2-7930-4979-9ced-35e0d439a3d9", "comment": "Malware payload (Gh0stRAT)", "value": "83395fe7f111fad16d1a69edf49dd0a52b34009930f5746631b1f240dc54e4f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704024432, "uuid": "ab918869-465e-4fbf-97b0-4a4f08cc1847", "comment": "Malware payload (Gh0stRAT)", "value": "a7f391b7209f6159349a33348816d638e7809ee0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704024432, "uuid": "ded68f20-ac7c-417a-aa15-20f97771aebb", "comment": "Malware payload (Gh0stRAT)", "value": "b34094995922c29d2d3d29cfe99c726986678337c22b6ca5f2fe419ee9da84a49fdd9043a48ed2d5178fa881d7422243", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704024432, "uuid": "cae747e0-df7e-4d77-8d4c-66764af361af", "value": "T18A4559691BAB4256DB553BB9C8B6929409190F531F28C4B16E310D1EBD2724FFC23EBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704024432, "uuid": "90563bec-a158-4bd2-bdc8-f2ecc843ef87", "value": "de6942886ea1706308de6a5dc748b51c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704024432, "uuid": "ce01438d-5ce6-4728-a615-8ac5e6874728", "value": "12288:zcWl26g/UBlRn5DzZ3TTP+5WkOVHK/H7sx117ksgSh20RUTMkzVSleJHcT/rBMSb:gWgHN8kSszVSlMHcTDBMGr9chBMuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704024432, "uuid": "1a4adc61-57a9-42ec-b86c-24706aa7ed11", "value": 1242112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704024432, "uuid": "6064e296-9654-439d-8442-f869459607d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704024432, "uuid": "1f886e96-3a47-442d-82cf-b0e79ddf39a8", "value": "623d28815c85957bafdd79395e2227c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24248d2-a7bd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704014421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704014421, "uuid": "c242d9f9-ece3-464e-9fec-cb9fb187a9c2", "comment": "Malware payload (Socks5Systemz)", "value": "198530bc03d3caadf191f3582fe600c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704014421, "uuid": "12c64051-b681-4ba4-bac7-5a9d207eee4d", "comment": "Malware payload (Socks5Systemz)", "value": "83eaf65e818f6596f8f3877812110afbc87719322590f589c1d459e057e469c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704014421, "uuid": "5d67fce0-791a-4e38-bd0c-7ec6e1e27723", "comment": "Malware payload (Socks5Systemz)", "value": "278010be999ff208578dba3a67edb994c4fbdfca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704014421, "uuid": "8a43a277-6fa1-4ec6-9113-b92492c1b6db", "comment": "Malware payload (Socks5Systemz)", "value": "1fb1a70391e7fff350c5c3b6f4b2f4588949e2b168e50f0814ea9eb272805981885d99f49fa783df64c5cd0303506fad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704014421, "uuid": "92885331-4622-4c15-afcf-2d593f137228", "value": "T1B72633DFDCD7447AE56085304F83946058239B23EBB43756A9AE3CE9DA11C30972BB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704014421, "uuid": "76c98583-e6fc-45a5-acea-ced2fa675a91", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704014421, "uuid": "3cf8f022-523d-4d32-97ef-8b1c00763b4e", "value": "98304:QDNtB1TYw2yJpEmOqI1iVoWMbVpidq94uhIdHO44dm8:IXl2bZsQc894umdv4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704014421, "uuid": "67072041-93ba-451a-8ef9-18d46c609edd", "value": 4793762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704014421, "uuid": "5380fbd0-5166-485f-b1eb-1b929b90cebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704014421, "uuid": "a43cdeb9-3d96-42d7-b6c6-47692f299753", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.14526.30404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14127a13-a7ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704007230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007230, "uuid": "e265b5f2-f5ac-4482-b6b2-f31ed0cb754a", "comment": "Malware payload (Socks5Systemz)", "value": "93d60e50f2ee0e760c68835a1fbc11c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007230, "uuid": "ad8b3bfa-0b21-4fcf-be70-cb50561893b7", "comment": "Malware payload (Socks5Systemz)", "value": "881158cd16af17b390cf22fb6a87d1e3f23476418b670544365210ba9f63b47d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007230, "uuid": "9bf56b89-39e8-450d-a929-6a8d61d8e6d7", "comment": "Malware payload (Socks5Systemz)", "value": "d33ef1487e7b7281ac4e70ffd3557d4bdd0b1761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007230, "uuid": "92156420-a060-4d59-865d-8c3a208a5c0f", "comment": "Malware payload (Socks5Systemz)", "value": "295392a78ddf6cde8c06279ca02361d72c8414c1dff1234014c650708c45291d77b1e51620ad9e607fee85dabbf9b576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007230, "uuid": "32703c92-6c8a-49b2-98ae-dfd3a2afc101", "value": "T17A2633E3D6A25536E076A2300C93AC0562563323BC3D5A222F79155D4B33A6DC39BF9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007230, "uuid": "4aa7d411-d5fa-459a-92af-542a34d4244a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007230, "uuid": "1100a3ec-47fe-4efb-a9ac-d4b2b543d8bf", "value": "98304:QiT4SqCrL8DDQ1ovb9lRkLB+saL9+mnl+3NO++aBFWzPZxIH4dm8:54SqCP3mlRkgJp+3D+arWzPPIH4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704007230, "uuid": "0b091d91-a19b-464c-9964-b87a8f204bea", "value": 4791590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704007230, "uuid": "dabbc0a5-a08f-4008-bf0b-5ac618dbbcd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007230, "uuid": "28156496-a0fb-42e9-835a-ed157096071a", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.23848.5285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d38e0e-a7c5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1704017707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704017707, "uuid": "e431cb1c-5770-4de5-b57b-a5e4131d65fd", "comment": "Malware payload (njrat)", "value": "c019c992ea8539b01b08acf9648d46af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704017707, "uuid": "863918e1-c8f8-4fef-9272-c5557fab1a18", "comment": "Malware payload (njrat)", "value": "8a06ddbe5bd6bb0e047a3025afec922c8424ede9fdc26b2874a902643f73192f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704017707, "uuid": "4f28e3e0-0c98-41b7-91b1-0d7ddaba4e90", "comment": "Malware payload (njrat)", "value": "fc77c99ce39a0b1dd39b906b218b1f3c1abc50ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704017707, "uuid": "e5faac77-fa0d-403d-ac28-9e3b552e5c30", "comment": "Malware payload (njrat)", "value": "e70089e22028ffe233f0e85fa5af49df10e0382c286e73c0703636b4b80edde8821103fe07fb4a73aad7347fbf240693", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704017707, "uuid": "ee264fc1-9c83-4fde-90ec-5574318d2f44", "value": "T16FA3C609A740CB38C4FD38F9785E872ACFB0DE260522851D9D95BC656B3EB740A4BDB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704017707, "uuid": "706c3090-51b4-4ced-b182-7b8c50165b6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704017707, "uuid": "ae1a04cc-4cf9-4315-9e84-343303e444f5", "value": "768:7ZTJ95M+296qalGorM+rMRa8NuHJtltr9HZlJCznzySQ/:75J9OQqaIz+gRJNg7R5lkTzZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704017707, "uuid": "05065d0d-30a0-4984-8e9a-fba387c7bd5e", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704017707, "uuid": "6654070b-381f-4bec-a8fe-1dbcb911799d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704017707, "uuid": "1f782af5-e9a6-49de-9e5b-45778d7cff85", "value": "c019c992ea8539b01b08acf9648d46af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f3254e-a78b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703992763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703992763, "uuid": "f5937fd2-71e6-42a2-9d9d-cc1e49ee4950", "comment": "Malware payload (Socks5Systemz)", "value": "8d28010627a4b1d9135a58c76fae8403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703992763, "uuid": "0b05dc5e-23d3-4180-8fb3-c321ba360117", "comment": "Malware payload (Socks5Systemz)", "value": "954e838e8f5b220253b75049646ecc1354a18fc1815d2631676a5b3b640ae04e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703992763, "uuid": "353b0d33-3a34-44fc-96d8-35ce8c5a96b0", "comment": "Malware payload (Socks5Systemz)", "value": "291f782cec0b4c848cdbcc2434c54ba2c2b580c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703992763, "uuid": "12e31f8d-3687-413e-8270-c2f6dcd4cb3f", "comment": "Malware payload (Socks5Systemz)", "value": "66b7dd745b91a75524629bdcaa6b03ffda8b451bf01a8c145ac9c7e45bd5863749dccc80822c94993127f1f9163b5329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703992763, "uuid": "b42e8334-e732-48ea-85a8-5433de663c2f", "value": "T1AC363336CCD70C7AE491CE3075BF506A4713D9352C703C7A9A5DAF807B6ACA1A8152AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703992763, "uuid": "d913efcf-602c-423e-a2a2-385cd2445781", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703992763, "uuid": "2a5471ed-e2dc-44dc-b34f-3969fd74d383", "value": "98304:Qg2pUvDo4iVk6IGLJD0YJYtviHPvVG+EmITP54sGoLqQM5hjhuzsK1V8Nk3xZQ0c:2UvU66ImJ0YuvqUxTPzlujKs/NkU1449", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703992763, "uuid": "f2de9a5e-a7ff-4ea1-8bbd-679b524b64ea", "value": 4913419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703992763, "uuid": "ca86f4c7-4084-433c-982d-eb3ea4126819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703992763, "uuid": "b7634fb7-cda5-45cc-b31e-efbe2f33d4c8", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.8008.21054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44be0f6d-a770-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1703981112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703981112, "uuid": "6acbe735-d562-4401-af2d-731fc2679551", "comment": "Malware payload (CobaltStrike)", "value": "ae1812a5f838f9fb0dd0b1d990633b5a", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703981112, "uuid": "1baa52f1-4512-43f3-aed7-13b73681d372", "comment": "Malware payload (CobaltStrike)", "value": "95f2e8d7515e86b998bf92e1f0f84593e2b32e87522c2e855f8d8fa4c8a3786a", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703981112, "uuid": "1c4c461c-5ffe-40d7-9265-f2625d466c8d", "comment": "Malware payload (CobaltStrike)", "value": "68c107f56ef737ec362ff9c748b5a4b9194d10bd", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703981112, "uuid": "10976590-a20c-497d-8426-e46976b7a285", "comment": "Malware payload (CobaltStrike)", "value": "5b7a92d42f7262f1eb4bc2bffda2bb79371eb1cd9e78602cdcd3a02596a7c5920e0aac35619bf291fe13b7203db8eeb0", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703981112, "uuid": "2dc6bf03-cbc1-42c7-b189-bba430af2619", "value": "T1A7251246F39912ECC6BBE73DC616232FDF7035866114474B12A55A223F1B3B95B2E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703981112, "uuid": "595f7d95-323a-44fb-8aad-88299155d903", "value": "5d94a6bbf22dd39fe767d40a2ba64311", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703981112, "uuid": "3e5e68f2-2d55-4a8f-b7e1-45c32de07db1", "value": "12288:22s0DT/Oeg6ijDEUeXpTRSu/aJ1ZnIJ74HZhuj1TCPlM7VF3UodxA//eje3xd466:22s0APibaJ1BIhHilIF3UGuR466", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703981112, "uuid": "0e6b79a0-6ca4-4519-a9ae-539fdbc7778d", "value": 1058008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703981112, "uuid": "71cb3805-004a-4a11-8215-65184ef48858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703981112, "uuid": "52b4d491-6f0b-4d4f-a62d-b6c88a6b3b8f", "value": "ae1812a5f838f9fb0dd0b1d990633b5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96586062-a7b5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704010884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704010884, "uuid": "c1906e14-e534-418e-bd0b-084be6b415c9", "comment": "Malware payload (Socks5Systemz)", "value": "83ba96a367cd9317b48e0962c626966e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704010884, "uuid": "dfa7c52c-3c05-4ec8-b4aa-e454464bee64", "comment": "Malware payload (Socks5Systemz)", "value": "9c6485edb10d0150212a8fe11b97a472f86e881acc8249c7a686f14f3aa82b36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704010884, "uuid": "f6d62432-17ce-4611-8339-6c9a981f117a", "comment": "Malware payload (Socks5Systemz)", "value": "e15bfb0880c2eb22a71608adf26498c956031a57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704010884, "uuid": "db7a17f4-9bfe-417f-8fbd-35b11b71df32", "comment": "Malware payload (Socks5Systemz)", "value": "2cb7207a54ec3dc80c14cfe4c77a2da1d1f14003bb1a77e200a10a7eb247fc185671e1c63058d37d5824f994e9575844", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704010884, "uuid": "d4c1cdff-1b03-42c6-944a-7a070875c1b5", "value": "T12B2633C2D06588F4F1E24FBE6B7F9A537A0753301830489E798CB88BE77E56141927E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704010884, "uuid": "bebf0275-834e-43bd-a48e-8672bdf2f143", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704010884, "uuid": "f5cdfa1c-387b-4908-9b41-c3fd3f6d08e3", "value": "98304:QLq+ngvMl0BQzeqf/Uc1Cq0vgqgCT07/TdVTIpOS7f52qCpfIXiq/TNZMSNJM+V4:URgFQSTc1bugBCT0/3Ip9DnC5I3/BmVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704010884, "uuid": "ddec3f4d-a3e1-4dfa-85c9-c3a38e15d385", "value": 4795213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704010884, "uuid": "e8a4d4f6-84c1-498f-ae6c-848610582ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704010884, "uuid": "46bd9c60-1dd1-4247-a4c7-24adbc5fd1e9", "value": "SecuriteInfo.com.FileRepMalware.3284.8090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99025c17-a7df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704028928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028928, "uuid": "397d2602-4508-4116-95f5-c3c4217ca584", "comment": "Malware payload (Socks5Systemz)", "value": "bf799945205e77e8f1b635dd513feeac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028928, "uuid": "8006e596-549f-436c-a848-af2ee1883403", "comment": "Malware payload (Socks5Systemz)", "value": "a38ef175d861f392f7788d28f34aa310c6a0aab36073bee8331184b775f22088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028928, "uuid": "163ebcb9-b675-4d08-9836-c32127357173", "comment": "Malware payload (Socks5Systemz)", "value": "31d40fd5d2b3959284a27574f80e0cb2906bada0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028928, "uuid": "890a68ae-7bf2-4cac-b3dd-660b72c67e5b", "comment": "Malware payload (Socks5Systemz)", "value": "426998612effdc7cc75bdd361a56f04fc02f5e3d1d324f3cc8745a8bae85c79f521dcdce32b91eeb7ce13387206ce939", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028928, "uuid": "b76ef136-0cfb-4c77-ae50-472504c91b39", "value": "T129263361377608B6F191DF38CDF6997228AB76A0AAF2331DA399174C47F19C1E42134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028928, "uuid": "8dc8bcf2-89a8-4a46-9137-99c55fb004d9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028928, "uuid": "3452aed6-5cf8-41f1-a505-b810ba86ef79", "value": "98304:QtuxrEm7K6KBIrADAqOwVG9nI6lz6C4dm8:POErADAqLgy6J4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704028928, "uuid": "10e182f0-dab7-4fe8-a5a0-9d23d6e21bf7", "value": 4795299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704028928, "uuid": "ca01c943-df54-4f75-a207-d2c28d1792c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028928, "uuid": "3bba058b-b0a3-46bc-b03d-9d023a5827df", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.17313.12142", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfdc720b-a793-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703996351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703996351, "uuid": "8370e89f-b571-459a-bc06-a509db427a0a", "comment": "Malware payload (Socks5Systemz)", "value": "a55518c7c3b7e5144e9d96f530d60ea9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703996351, "uuid": "8f2fa602-f5ed-48e8-8013-df52f77b37c2", "comment": "Malware payload (Socks5Systemz)", "value": "a512ac9d8fccbaf44d52478ae2e544f27ce317fe895580534512451b6b386999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703996351, "uuid": "babe78a2-6aa8-4c58-8dd0-f814a8c0bf91", "comment": "Malware payload (Socks5Systemz)", "value": "127ffb0f9343ccd54b4658b4df43ba3fb6632904", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703996351, "uuid": "7f0710e5-dc90-4caf-9441-21aadcaa805c", "comment": "Malware payload (Socks5Systemz)", "value": "3a5391eff7ec653f5bea8b6f92d840601e4854f465e7f4e5eaf0f7995f4305c60c907888ca921cbe72a263f0d267ae21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703996351, "uuid": "91645cb4-b467-4a04-825e-b1c8e22ed89a", "value": "T16736339AEDE998F8E5F0CE708C9B02B18D37B4A4C6F50F506A4D6E1DCF568A4607D390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703996351, "uuid": "4db94198-d89d-4e63-9598-9319b61fbfeb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703996351, "uuid": "b6822af5-2b83-42d5-8fb4-f6baa68b693e", "value": "98304:QdPuCepxnzUPXzNm105uL1r0Qvt0KbX0CCamK7t7y7CfWV4dm8:4nep0Xps04RrdFYh0WaWV4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703996351, "uuid": "5ea3ad50-6714-446a-8474-98062e5dd255", "value": 4915267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703996351, "uuid": "3f73cd82-7ea6-49f6-9f8f-f1ba4ee1e9aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703996351, "uuid": "3606ba15-888d-454f-9357-df5678ee1c23", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.28873.19172", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b74a12-a78d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1703993750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703993750, "uuid": "3f4353ab-7646-4adc-a350-72b2c7d4c807", "comment": "Malware payload (DarkTortilla)", "value": "fd385d3d91fabeea2aad69a220cf5a1b", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703993750, "uuid": "e86d7bde-b37d-4952-a222-cf642dbe4588", "comment": "Malware payload (DarkTortilla)", "value": "ab88782dc6c55b7ad16a2f49215158e57d08f8f040be63f4fe0d0c42fcdd8473", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703993750, "uuid": "82e22bf1-877d-4a22-9442-2b3bcf180884", "comment": "Malware payload (DarkTortilla)", "value": "46c0db1a152cbfd1a5a3eb7254a9b73b4c0be2ef", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703993750, "uuid": "b39ae134-d3f5-4bc5-8894-cbf139c39269", "comment": "Malware payload (DarkTortilla)", "value": "92c68ccd4d04cffcbdd16cb862d153538a01426e896f082b196444f7f42f044f59c854bc6fcd8e847cbcb05af9a79736", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703993750, "uuid": "536cfa3f-a347-49e6-b57d-371072c4be7b", "value": "T1D1A5127E7F697864D11D3E768822FA4063E48E135272F79E5CC834E829B244D6E7E0C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703993750, "uuid": "43a1df7e-0bdc-4cd0-ab03-2d9ddfe48543", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703993750, "uuid": "7a9cf557-d305-49ee-80f3-73d3f9b5d1dd", "value": "24576:BgTi13EKoSjKfgRJVUmcDrEsOm2hseEJvaAe8pMiIoEcE9DtrPkSjO2ncforkv7B:D0KX+6WmcDf2h/4a18pMSE9ZLkSjgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703993750, "uuid": "4e8c6750-42ab-42b9-a418-e88f25db027e", "value": 2207744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703993750, "uuid": "d88d5976-7b04-4b9c-99fe-c318f30e1daf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703993750, "uuid": "76da374d-dd49-4095-9358-a0d945f5aac4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32588671-a7f9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704039922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704039922, "uuid": "329b35d3-b10e-422a-b2a8-d6380bdc97aa", "comment": "Malware payload (Socks5Systemz)", "value": "8c6f565bd87d69244e121681b11f83a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704039922, "uuid": "22667d52-a0c9-4bf9-b408-ae51c3fd6cce", "comment": "Malware payload (Socks5Systemz)", "value": "ad84add303a674170d171ac6fa15068f68364bac20c8e9bb1ff4d43f46855a7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704039922, "uuid": "24f82ceb-2f18-4a7a-8f92-3d6257097f82", "comment": "Malware payload (Socks5Systemz)", "value": "0e143d45f7bc953319500537407429e4c2371a65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704039922, "uuid": "33f41435-82c5-41ac-b97e-28b47cfc3202", "comment": "Malware payload (Socks5Systemz)", "value": "c7bafbb3454e83f19a2499a805efbade2f0a60f85f7e1c10bd0f10aabdc9b8a7a1c626165ea9c79fb085698780a392a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704039922, "uuid": "af06dcf5-e7ca-43e6-bfac-92bbfa77fdae", "value": "T1042633612E43AB33F51B49B02A5DE6605EB7BF47CA7836042A5FCE09F7FA96044111CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704039922, "uuid": "c1092608-6f35-435c-babf-deed0855c5fd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704039922, "uuid": "b6f64f06-0969-45b6-af10-9ad552cd92d0", "value": "98304:Q4qQnB6iI2b2A7qiOEDlRjD6NEkOI9acHloLncfVls62cOdI9kjw+DMAzy/4dm8:hVnxIv21RjDVkPHl+ncd2xcUVtDMAzya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704039922, "uuid": "9532a2e5-3457-4b97-a108-7efe2d4f3cb6", "value": 4794048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704039922, "uuid": "7be7271f-ea03-4f32-80d2-41d54557038e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704039922, "uuid": "35e6a910-c3de-44a6-a5da-f53d8b2e1c5a", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.28344.8313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5dff7d-a799-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1703998926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998926, "uuid": "48ea7f10-3f9e-496b-8627-3a6e6f5bfd77", "comment": "Malware payload (Cobalt Strike)", "value": "2e8d0d6bc7bd696413bfca10df1d9310", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998926, "uuid": "e30905dd-0eb9-4382-9fa9-0408a98fda83", "comment": "Malware payload (Cobalt Strike)", "value": "aee7112c389e7e3ba6e472ea3e3eccdb61d1fa6711163f1bef48683ea7ea563e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998926, "uuid": "b46ddaae-f56c-48ca-9a58-bc3dccf35c80", "comment": "Malware payload (Cobalt Strike)", "value": "e2a40208a75745cfde8ea5e70b26f9fbed6aa606", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998926, "uuid": "b4ce070d-0473-4c23-b050-44a7acce1766", "comment": "Malware payload (Cobalt Strike)", "value": "272fbba9996e039bf7eb6c9a5ad59cb88540746df2808b052ca0b5284eb7c66214188463931563323c8d9071388843ec", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998926, "uuid": "9ab4d43b-a2d5-48f4-90f8-70f239470c72", "value": "T1CA547B1FC54B050CD8407D76279991E67BB98EEECAD86BB3023C915A96FE3F420E7940", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998926, "uuid": "ad380ef9-92b6-46e1-90b5-fd977c368078", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998926, "uuid": "aca4484a-7650-4340-a6e9-0a78ecd5b6c9", "value": "6144:w3VPzSRFThtZRElJBN5/1ql3U6H6qz1i0/j/I:wlbSbDcJBN3U3pH3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703998926, "uuid": "90498660-1569-49b9-be95-f9e83f7c1e08", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703998926, "uuid": "0acabdd1-2aa7-40e0-bd60-3a66b37573e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998926, "uuid": "ff32fbc1-dc8b-4c3e-bfc8-3e68f66f3609", "value": "CBL1-64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a05998-a813-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704051172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704051172, "uuid": "fed441de-63f0-4cf4-9025-18db66e166ac", "comment": "Malware payload", "value": "8107084c344cde543355c1e9b155539c", "object_relation": "md5", "Tag": [ { "name": "Epsilon", "colour": "#CF6CD9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704051172, "uuid": "7322bbf0-9a7c-4e2e-9f31-7ac858f86dc4", "comment": "Malware payload", "value": "b090507ee1bc9373000d6abfa9798aceac64bdf426eedba6f6a0aab49fb30ecd", "object_relation": "sha256", "Tag": [ { "name": "Epsilon", "colour": "#CF6CD9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704051172, "uuid": "14a16eee-bc23-459b-a4f6-217142bb3272", "comment": "Malware payload", "value": "50b76038900a81519081652cbc151ab3f279a48c", "object_relation": "sha1", "Tag": [ { "name": "Epsilon", "colour": "#CF6CD9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704051172, "uuid": "8be6bb7f-ead8-40fa-a619-c6b2858ed30e", "comment": "Malware payload", "value": "223ddfdad753c58da2b2da21deca52c93cc26d1849f8814d134f27a212f6ed4dce8c818fba7b5319918479bff406aa33", "object_relation": "sha3-384", "Tag": [ { "name": "Epsilon", "colour": "#CF6CD9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704051172, "uuid": "8c33f348-fb9e-449d-ae25-e1367f19b453", "value": "T178E7332EF9C8AD67DDE53D331C2A73DB68C483D26B45CF475B78DB56E9010804A18AAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704051172, "uuid": "dd6630fc-d536-4240-bc0b-25b83b65291c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704051172, "uuid": "7cc7e419-ef6f-4114-b81c-49a20ec05a74", "value": "1572864:Qm6aqUITM8HlbjRyigjXaXiymm4QOGfponLlagiJ:j6avITJHlJyi21QOGxKlagiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704051172, "uuid": "e0d5891c-f27d-406f-bcec-a2502e88657a", "value": 65172062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704051172, "uuid": "ebcd6dc7-f518-4f6f-b2db-d5a3c411f89f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704051172, "uuid": "cc14270b-fe83-433c-a0e7-f4bf462d7206", "value": "JackAdventureSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b600c6-a7c6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704018071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704018071, "uuid": "dde9dde8-ed61-4ec5-af92-745127ad0067", "comment": "Malware payload (Socks5Systemz)", "value": "d166f79a78d2b85899aaa9e2dfef11f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704018071, "uuid": "47f25696-476d-4cea-bb59-7f7cdfe32f9b", "comment": "Malware payload (Socks5Systemz)", "value": "b76c38f9b0503db183a96f06cdf97c1297752c91f7a0f62e60285b39e6c07e9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704018071, "uuid": "d400b79a-e1be-4df0-8b9f-3974cc300f48", "comment": "Malware payload (Socks5Systemz)", "value": "2f0a2fbaf266da0096c630bba3f214493243e1f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704018071, "uuid": "7880cf14-9a59-4655-94c2-9811bceb6059", "comment": "Malware payload (Socks5Systemz)", "value": "bb1c5abc22a14339ab188e18f18d9945d8d401c92e9d1d04e62686febce403883ae5f2ca57bc0afc13b53adb5ddab65a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704018071, "uuid": "eef0dd11-3667-41a9-8601-405a6df34544", "value": "T13926334A6C59BDB2E086B5B083C68040F9A7794E8A311B4E53DE6A7742FF4C1E3C43D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704018071, "uuid": "a96c9f28-c569-428b-9b94-17326569dc41", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704018071, "uuid": "cb28d689-0b63-4c7d-a492-ed5c309de4c7", "value": "98304:Q3Um5Mneoc7JXFYzsNJmYmHuJgi7EKthRsHI/ZgHvoa929ovcpV8H8HfgCKrH4dD:oUcQlc7J1YzWJmYhgXKthmoxIBFkpV84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704018071, "uuid": "2a197bd0-bf5c-4d11-8675-ad6ee6f80c1e", "value": 4791531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704018071, "uuid": "0ed0d1ec-1e62-4df3-b1c3-44de8c360547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704018071, "uuid": "10225fb3-aace-4c29-b425-2233ba9a3a10", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.18875.2417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34e1278-a796-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703997699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703997699, "uuid": "60283029-8a2d-47ba-8c44-3259b5992278", "comment": "Malware payload (RedLineStealer)", "value": "b86c688c83ea1a7fd4f3c0030ea16dd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703997699, "uuid": "c6f5464b-70eb-4d08-a18f-5813eaa2b1bf", "comment": "Malware payload (RedLineStealer)", "value": "bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703997699, "uuid": "1d58b2cb-2445-40e5-a4e8-77c6cf7e3802", "comment": "Malware payload (RedLineStealer)", "value": "f3f0c529bff95b9d8eab4b3b34255d056cac6952", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703997699, "uuid": "dbf1c417-106b-4b0a-89c4-d2cbc75d5fd9", "comment": "Malware payload (RedLineStealer)", "value": "d75dff296b66873eb5ff132402cb24607a59888edc429ea27d0c3441b192eb3058b520facb50cb0e4d3d5add7b858f94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703997699, "uuid": "d4d29769-2765-4c51-a9fa-120f5af53f82", "value": "T15CB41256FBC59073DAB10BB118F713531A7ABCA14D75036B3349A89B08B2BC4A57273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703997699, "uuid": "ef796168-7133-4bd8-9bf4-b94a656bf076", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703997699, "uuid": "d36c0d0c-6230-4ca3-9fb1-43fe21cbae81", "value": "12288:3MrZy90oLn5mW+xggEhkbXsbF8QqVUbx3KE:+yL5mRxgGzKynVex3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703997699, "uuid": "e5c9f59d-5a5e-4f3e-81a5-415403640d8e", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703997699, "uuid": "2dcf05fa-8791-49a5-b8cd-13448a4f8cef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703997699, "uuid": "3c46b0d5-aa1c-4c53-89e2-1ad8f8c168ca", "value": "WEXTRACT.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad92da0a-a799-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1703998897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998897, "uuid": "036b400d-e218-4fd4-bae5-8edd190499ba", "comment": "Malware payload (CoinMiner)", "value": "03e37ab1e9b5f17ce8527852bf1b8ab6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998897, "uuid": "e4160b70-6f55-443b-b2af-02fff95060af", "comment": "Malware payload (CoinMiner)", "value": "bf0b37c6af17e3e12700a5ac15ef9a27d77698cd450a35bd94b3d1e60d9373c3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998897, "uuid": "4a859ffa-0065-417e-9fdd-58965d2eaadf", "comment": "Malware payload (CoinMiner)", "value": "3a7d63521a9592c3a017584688e97028985ff963", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703998897, "uuid": "dcb99ce6-85a6-4235-82b1-1b88656ff141", "comment": "Malware payload (CoinMiner)", "value": "90a4cccf6ad9382486090027241856a0eb54c725cd207a45048c2e8c571acbecf5655ad2a2dc67e071ccd914f7e9c62a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998897, "uuid": "288424f1-2bc3-4ef4-95d8-a3dbd531af1a", "value": "T1DCC5F11EB6B154E5D5EF807C941A4A0BF7F038E50360D58B93D116AF6F13282E92AF36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998897, "uuid": "c2b03c46-444c-4ec6-a4e9-6366751b6f1d", "value": "c782987849999c5ae345a5deafbd73fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998897, "uuid": "ffccfa15-d9a1-4aea-931d-c234bbd1c5ab", "value": "49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6IPko:BemTLkNdfE0pZrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703998897, "uuid": "368bc6f0-7b7d-4e45-9477-c0aa3577498c", "value": 2534225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703998897, "uuid": "8eb94d8b-a96d-41e6-b8e0-78ad151659ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703998897, "uuid": "9065a7b3-663b-4c0e-b563-5be89f4217e3", "value": "test64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc67926-a79b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1703999834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703999834, "uuid": "12d6fe1b-0411-4874-b6c3-d51c2243ed7d", "comment": "Malware payload (CoinMiner)", "value": "07d4da401aa0271472c1a68a78140e74", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703999834, "uuid": "9a269a78-c673-4e3a-bd41-40671efb909d", "comment": "Malware payload (CoinMiner)", "value": "c985357cd60af490af52faae88866288f01c7c8bc706d8f1d7455ac725bc9199", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703999834, "uuid": "57db3f14-8d68-4535-b685-51a9296c9e30", "comment": "Malware payload (CoinMiner)", "value": "7963528420a4dec91d8e9e4bbcb586c1ec1fe9b3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703999834, "uuid": "46a75d93-457c-443d-8a35-c92ea44f74f4", "comment": "Malware payload (CoinMiner)", "value": "7b97ee1b642d8ea0d0f4f3cf61cf78c3fae41a3e8b1eb41cecbb6edcfadd145c9d4dba054745c9171c3352bf4bc39038", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703999834, "uuid": "aa952867-f48d-4631-ba98-0936b4c215d2", "value": "T1BB95CF2DF7B114B1E29B8479E5054A4BFBB17CB90361DA4B938206CE7E036C3E525B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703999834, "uuid": "3d7b4404-b8d8-4891-a9b1-2062f91c645f", "value": "c782987849999c5ae345a5deafbd73fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703999834, "uuid": "2fba7738-a966-4558-a4f5-6c3876ede6aa", "value": "49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+Agr6StVEn0ky:BemTLkNdfE0pZrww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703999834, "uuid": "a0ab04b6-583d-4e6a-9b9f-d29cadff5f66", "value": 1895807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703999834, "uuid": "a6057cc0-bee8-44d6-9f34-57aaeb8d30f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703999834, "uuid": "a3fcdb63-0147-4b3a-9b01-4290c3f8d641", "value": "CJDJ-64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53078582-a7c6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1704018073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704018073, "uuid": "7f89eae5-2519-43fc-90be-518a6c80856f", "comment": "Malware payload (Arechclient2)", "value": "dbb649ecc0a5e3244f35970c2d7fffc7", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704018073, "uuid": "48f2175d-54b3-4a81-91b8-e5011f60d45d", "comment": "Malware payload (Arechclient2)", "value": "ccf9b6883d9d9e834a8ab8a466ab2f8ff954ef4f5c6c3987b40cda8762462fe3", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704018073, "uuid": "d0b3c54f-9ed9-4987-a757-cf5fb34afde3", "comment": "Malware payload (Arechclient2)", "value": "8b07d32bdb9abcd5373d763035dc84b25f7dc3cc", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704018073, "uuid": "fa97a830-895e-4748-9a5c-ce028748b7a4", "comment": "Malware payload (Arechclient2)", "value": "a8e80c152974735ee90a5c73ac84f3cd314846bc9a83a78f4c52ee00dc996a8a1364a90f635be9f5e0efcd128f547a41", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704018073, "uuid": "c1858130-a81f-4501-b8b9-2f94256d5f74", "value": "T14746BF02BA99DE01D1BD3733C6D3942803B5E9829366E70F3AD6136645033AB5D4EBDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704018073, "uuid": "e423a6c2-f89a-491b-a8d7-a37b38d83361", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704018073, "uuid": "3b0cce00-f89c-4bbf-99c8-e3b492771861", "value": "98304:otRhl5d36ljph7qMpgxAfMUKH0+qEH/mA:OlnejH7NSxAfMUO0+qEfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704018073, "uuid": "9c13afc6-3171-42fa-8f35-245f2632648c", "value": 5637248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704018073, "uuid": "9d3a7631-6cbd-4026-a2df-e712fef61f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704018073, "uuid": "f8c898ab-eb48-4d73-8602-4215ce0ee8a2", "value": "SecuriteInfo.com.FileRepMalware.31572.26968", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf127a61-a77a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703985612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703985612, "uuid": "c2d45158-0eaa-457f-8c88-e2b17f16b293", "comment": "Malware payload (Socks5Systemz)", "value": "7db918e235c3f239b6d99e68e8dac93c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703985612, "uuid": "dc18323f-544e-489d-8b80-441071d7485d", "comment": "Malware payload (Socks5Systemz)", "value": "cd7f3e7bc9f55c0018b0db329c5fdaf13e2e295cf10eee13c8b580f47e871e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703985612, "uuid": "59fd69ab-8c2d-44a0-854b-2ecd73312505", "comment": "Malware payload (Socks5Systemz)", "value": "e6f607d356166edf3f044afd340845f5bf255d4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703985612, "uuid": "4b0d6b4a-5b54-4d85-af6b-406bbcbc38f6", "comment": "Malware payload (Socks5Systemz)", "value": "ebcb8e795de6a87d0276b4c3d467c5b291a46c3993fe7f28171e64ede499b77520849c00f285e6516cb2f2f6e24f2d15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703985612, "uuid": "a982ab64-e2b2-4348-80dc-2b546e434f78", "value": "T1DD363331C6686975E0F392B348754B7F11036AFFDE710958632F0C4BEB4658ACF06AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703985612, "uuid": "7df68a1c-1b09-44d7-836e-38599eedacbc", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703985612, "uuid": "01f3e94d-54ac-45c0-8558-dafdc52c724f", "value": "98304:Q529odJEHJswzNf9edrWiAz7CTfE8LnOI07AViGY23+w482mjgWcH8o4dm8:AduH3f98C5vqy7lBg4Nmjg1H8o4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703985612, "uuid": "afe7d4dc-536a-4faf-8299-51bb20b24d90", "value": 4914481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703985612, "uuid": "ce68cf7a-95bd-42e5-95ff-36c11db7a50e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703985612, "uuid": "55be8fdd-71b5-4c91-82b9-2d4d176337a1", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.12415.23003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ef10c9-a7df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704028924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028924, "uuid": "51a06044-b269-4733-ac7e-453077d3f47c", "comment": "Malware payload (Socks5Systemz)", "value": "930b29d33de964a9f6a86a24ded5c39b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028924, "uuid": "dfa17b8e-5c0c-4d36-b7aa-b6ae7ac736f8", "comment": "Malware payload (Socks5Systemz)", "value": "d8b6e420fd0e3b02617c088ca249eb95d1bd3c1e4b5dbecd76bf60bdb0b22c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028924, "uuid": "6bc6e049-638f-44b5-8ee2-428f76ba7c4e", "comment": "Malware payload (Socks5Systemz)", "value": "c0cd027aee3f2b29b63751e0d342e9866b15e313", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028924, "uuid": "48b87dbb-3457-4506-85eb-a33721821cad", "comment": "Malware payload (Socks5Systemz)", "value": "a880a8c0f8ce21baae993ba6b4f4a0289504c42c70a41303526bf10de7f85e400cbbcd945792272fde32387517f65a56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028924, "uuid": "cac4a334-a6ad-4b4f-bdb0-60014193eb35", "value": "T1E9263397D0B3A6F2D0B8497625778120795D8D960EA25703A20FB8E7B1E30F0479BF9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028924, "uuid": "a72ea9c8-64df-46c0-ac2c-954fd0c1d3ad", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028924, "uuid": "8dc3075c-324b-44f7-b01e-c7477c2530a9", "value": "98304:QQrrkhkp+Jv6fxjQFoegdQunt4RQSbi5Y4dm8:xHkqQJv6fypc4RQBm4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704028924, "uuid": "7e8bb279-0fc8-46ae-a561-146eacd68e52", "value": 4791929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704028924, "uuid": "5c40ae42-cfea-46a5-a93b-8be601515c50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028924, "uuid": "eb54ffaa-02a6-4a83-a13a-9dfcd07832da", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.28678.2092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506b1637-a820-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704056723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704056723, "uuid": "2e5b667e-f31e-4716-bd94-c078d12a8795", "comment": "Malware payload (AgentTesla)", "value": "5f0a4c12f2668141edd133feb8db51c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704056723, "uuid": "bf1b17e7-9adc-424d-b8b8-1094e2e8e15c", "comment": "Malware payload (AgentTesla)", "value": "d96321f12956a37ff51b938d125b9e1d62b8999887688878c75cec546059ada8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704056723, "uuid": "2ab934e2-1253-4294-95fc-52ebaee6d15f", "comment": "Malware payload (AgentTesla)", "value": "025c424c5c03aba4c5b7ff6f14b05f05724dcc35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704056723, "uuid": "ac652e91-604c-4524-b1a0-e9f07f99cf63", "comment": "Malware payload (AgentTesla)", "value": "12c8be1f31a433849bb99f51e1e26b2616848c569925540292151d91d3f79425bf3cdf54ce8bf644d3ee436f0e3c9ab3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704056723, "uuid": "f42615c2-4853-4869-a97a-5f8cf330b3ef", "value": "T120D42341A64B6244BA305E230774781466548A62FF4FF0FFFE1455E8EABADB13E30386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704056723, "uuid": "e3292f2c-d3b0-4850-858f-09c6fd1fd4ae", "value": "12288:8LLhNytJWm0FuuCiJxYujcavQrLl9NOVP8HYs7pf:+WtJW/FoiJxYupYrLNgmdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704056723, "uuid": "75ec4d4c-2da4-4e97-927d-60fbdda11bc8", "value": 604387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704056723, "uuid": "79e91f13-8200-43e6-b80f-fd38023d879d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704056723, "uuid": "c9e385f0-f16b-4bec-887a-ea704ab8605e", "value": "952109.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60cfa504-a815-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704052026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052026, "uuid": "06de9e3a-085f-4204-ad15-4fa722085ff0", "comment": "Malware payload (Socks5Systemz)", "value": "8969960e75c99b57f1018fc582989c16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052026, "uuid": "4c606bbd-863a-4f5f-a548-5d50e823d633", "comment": "Malware payload (Socks5Systemz)", "value": "dab7b9c704c4834fa6f123f4acff79dc70cb6e6c505430c5e6751b4923d7c7ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052026, "uuid": "759abe3f-c9f4-4493-977c-c670b0422b72", "comment": "Malware payload (Socks5Systemz)", "value": "5bfefeb8708557ed35f6593ee428a25148f5c363", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052026, "uuid": "d5f4ecca-6979-4b93-b7f7-6208f25fe6c6", "comment": "Malware payload (Socks5Systemz)", "value": "24325d9ffb9d956b2cccff6421d43756ae1b117a8c51fb1fdee133486ce0ea2675d0e5b4161882e10675b327ff43aea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052026, "uuid": "10a18f1f-c1d6-4b03-a8a0-b1fd6ac802d1", "value": "T17A363353AA2E8C7EF0019B34862A4CA90D5B9E371BFA056FE74E04F97B1357CE511326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052026, "uuid": "9aa7080c-11fe-4d11-8b7e-d1a93dc1a3ff", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052026, "uuid": "70f4fe3d-0b9c-47b6-898a-ffc9c4d6fafb", "value": "98304:QwjKv+jvqThrYbQT5khZdNyCYCzsoiYR1CnRWZg9n65NcfT1hW+V4dm8:VjKv+jvqThrYRLJnRwRwMf/W+V4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704052026, "uuid": "20d32606-ee38-46f9-8224-05a65667d601", "value": 4875007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704052026, "uuid": "c643baf5-261c-4d0b-8593-b1184eeb3d9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052026, "uuid": "e8a3cfef-9ced-4f44-8b8f-92a7bef1b5ed", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.25852.24720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4549641-a807-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1704046207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704046207, "uuid": "585eac6c-fe44-4b3e-88e4-15b82ea863e2", "comment": "Malware payload (njrat)", "value": "00e97b0247faa03e0efec490ee36432b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704046207, "uuid": "35952376-a2f2-4e0e-aea9-fd758e847f90", "comment": "Malware payload (njrat)", "value": "dbc40fd63f5795e2b29d66c3a41d6e35ace81d843d35d9a1563ebcbd9daf3f01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704046207, "uuid": "20dcf8ca-3d4d-4cb3-a147-e5d02b98b4e0", "comment": "Malware payload (njrat)", "value": "26c63ef075852b7f5c66d06223f9c6e3324c945f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704046207, "uuid": "1e828797-1374-4786-ae1c-ea88fb5eed96", "comment": "Malware payload (njrat)", "value": "b55884d08353d66c01fda3fc8c0f01cf481778173c28601ce6d6bc3713078dc9f463da35b7d6cb4b1af154b743f5bea2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704046207, "uuid": "ff906b2d-58d5-47d7-9296-ed3ad1f404ff", "value": "T12393D74977E52524E4BF56F79472F2004E34B44B1602E39E49F259EA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704046207, "uuid": "9f7422c1-f55b-4229-beee-748f3faeb6c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704046207, "uuid": "c51a05fc-0483-4f6a-acd0-376aec27a09c", "value": "1536:kCwC+xhUa9urgOBPmNvM4jEwzGi1dD5DBgS:kCmUa9urgOkdGi1dl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704046207, "uuid": "63d878af-1d38-4ca1-8598-398c06c3d3ff", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704046207, "uuid": "51ed9d08-c3de-4476-8ba0-6f0eaa21991f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704046207, "uuid": "a627e357-f2f3-4fed-a281-81f597a1090b", "value": "00e97b0247faa03e0efec490ee36432b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6f2aee-a7ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BadBazaar)", "timestamp": 1704006811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704006811, "uuid": "17699371-68d6-484d-b6de-846e538bd58f", "comment": "Malware payload (BadBazaar)", "value": "7be42b9bec689488e5f4994ce43ebc51", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704006811, "uuid": "dec5db40-e65f-4af5-97e8-3c4bbc52d279", "comment": "Malware payload (BadBazaar)", "value": "e181aa2a682e7cac2b13bafeaa71d1dd43f284e6a269a19beedf05d57e219745", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704006811, "uuid": "7f37f615-2c4c-4dae-94cb-82b3bdf91f1b", "comment": "Malware payload (BadBazaar)", "value": "80dd40d95cb94444a043abbf1da900113804de69", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704006811, "uuid": "cde88cd3-f0e7-4d41-8f37-b1b32c28a7c9", "comment": "Malware payload (BadBazaar)", "value": "bd745328206d2ffff011bdafc043c6dffa84bb8065aab7fb9a8a1ff4caf57d2afaf54fc575c6ec20bde11302713eac62", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704006811, "uuid": "1f06eaa7-565f-4b9d-839b-38a77dc5f3e1", "value": "T184F723E3F718AC24E0F3473793B25097F62A4D905323E5255A41F3B46BB7AD08981EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704006811, "uuid": "22b9d6d0-172a-4281-81d0-8df5796ccbb2", "value": "1572864:pa1iyU+LIkP4ruwpslKWCkE8JTfaI3B2aQV7p8VWDSUOo:pwiVoIkwrVeraYkN8VWDSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704006811, "uuid": "214759dc-20bc-4820-ab43-29775c061341", "value": 70527868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704006811, "uuid": "3ceef2d8-cbfd-4dd2-85b8-8d96b731855e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704006811, "uuid": "d8eb29a5-e8b8-4363-8c19-17540094ea9f", "value": "telegram.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107015d6-a7ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704007224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007224, "uuid": "25b8946f-646d-4626-b496-f9cb0ca90699", "comment": "Malware payload (Socks5Systemz)", "value": "e894d817bac93a4ac0e9afc5a0f31ba9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007224, "uuid": "e37e4a62-eefc-4d76-a688-2cc23c04cd69", "comment": "Malware payload (Socks5Systemz)", "value": "e3e2d8e98bd58b040e4259e3e750e9ea438d20923ea803450821808c37a33c4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007224, "uuid": "d20227f8-0d69-4397-bc0f-e110178e13b7", "comment": "Malware payload (Socks5Systemz)", "value": "12fda7808837ec2ee445a651fd58607ca4f977f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704007224, "uuid": "a1ae9af3-44ec-4eb9-9d4b-8816316f74ab", "comment": "Malware payload (Socks5Systemz)", "value": "abfaf196d03d27a046c3da0b1a86db8bd59be1020243ea48361d0e405361632fc8116619643c0a7188d99bb7e243234a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007224, "uuid": "41e71903-bb86-407e-8d9c-30aec676395a", "value": "T15026330417D94D38E5A2CEB0286F60AD67AB779C092082EC63DC6C6A5FD21B4F6143F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007224, "uuid": "eab8d6c5-8d0a-44f8-9c15-2c7dfc04fff4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007224, "uuid": "920adcad-658b-4f50-9307-a2d371ccf6d2", "value": "98304:QFWEqWm7ECLHhyXRz51YOMdf+qWGADK1h+kuQPpJSFqBfsj4dm8:ZEoTly/GOtPGADyh+ku6uFCUj4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704007224, "uuid": "14bcfaba-2fdb-4c7b-8d86-a6a334ae9608", "value": 4795641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704007224, "uuid": "870cee91-c5a3-4a1a-8d98-58e713486848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704007224, "uuid": "95e56d71-92fb-432c-9ec0-5fa754d180c3", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.30881.15779", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a9c2db-a815-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704052031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052031, "uuid": "fbc99a9a-f812-4d82-b4c7-78fb4db2fce2", "comment": "Malware payload (Socks5Systemz)", "value": "6ece6c22334065383bf45ce7233a07a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052031, "uuid": "d3c25178-e011-455a-8b21-f9a82312b927", "comment": "Malware payload (Socks5Systemz)", "value": "e418a0611daac492e3fc343edd1a01dec44f490d14a15a4e708ef17f913f6b03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052031, "uuid": "898cbc16-6ee1-48ec-b382-a983187b0053", "comment": "Malware payload (Socks5Systemz)", "value": "eb1adf8328122fa52c60b88b651b40a2d7f7c7af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704052031, "uuid": "a6faf0f3-ff03-432d-8248-d8025685a4db", "comment": "Malware payload (Socks5Systemz)", "value": "56f14ad28e9bfd7b629cdf63799d166004608f7c00a5431c0a6afd9cd910188be2ac7ce030e9b22a397d806fe94347d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052031, "uuid": "b10e87f7-8e53-430e-b13d-763471a768a9", "value": "T1F8363387D5734073E1360679F868D94309137F26D53AD7F8BFAA8806A7A209987583F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052031, "uuid": "44cca3c4-5ae2-470f-a3ec-fb8285af87cd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052031, "uuid": "aeb4e2e9-cb92-4dcf-b04f-6981feebb4f5", "value": "98304:Q9/tn6W6pbc1k9WIpPcPRjylb8XGLhKiMt9tVaJnKERPr/Ac7btGCI4dm8:+nqwKJcZjHXyz6/V4nvlzdnG4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704052031, "uuid": "c2b5f636-0b38-4068-b4d5-2a3baba7716a", "value": 4875887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704052031, "uuid": "96813063-e749-40f7-b5ac-1fb68e184f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704052031, "uuid": "3b799c59-0dc0-4997-8789-f5fc2d29438e", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.27.17480", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d31b4ee-a838-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704067160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704067160, "uuid": "47c1e9ca-ff9e-47e8-b232-1447b7530b60", "comment": "Malware payload", "value": "7aad7c8ad75a96d9dd0f32ae5b51aca7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704067160, "uuid": "ff2e4c29-e0f2-472e-81bf-5719ef2d38ac", "comment": "Malware payload", "value": "eaa840e393c8f8a3bdcd865ea6eff59f586e14bd9c3518d88098062056964281", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704067160, "uuid": "0f08ae4a-af4b-4818-9639-871285675de1", "comment": "Malware payload", "value": "834d5d05d7361412dada35950e98fbedef66d7e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704067160, "uuid": "b7d38506-1a87-4cea-b11a-efbca7518531", "comment": "Malware payload", "value": "ec3596970cbe58bd419812e2c58526baaa7ad1cad484628708a035471b2c24d588cb68efbad51019718c6ffd7408d5cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704067160, "uuid": "208b02b9-8ee8-4601-85e4-9b0856df732c", "value": "T1B94559691BAB4256DB553BB9C8B6929409190F531F28C4B16E310D1EBD2724FFC23EBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704067160, "uuid": "af021b66-ab89-41df-989e-83e9793b785c", "value": "de6942886ea1706308de6a5dc748b51c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704067160, "uuid": "193bb2fd-db6d-4700-8660-1c46e38f3f13", "value": "12288:zcWl26g/UBlRn5DzZ3TTP+5WkOVHK/H7sx117ksgSh20RUTMkzVSleJHcT/rBMSi:gWgHN8kSszVSlMHcTDBMGr9chBMNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704067160, "uuid": "5d851483-6206-4d55-8a4b-f12315270108", "value": 1242112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704067160, "uuid": "327d13ca-623c-46c2-8c25-3ac0af6b5e4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704067160, "uuid": "7e0afa98-7870-45f4-933d-24fa19932dc9", "value": "7aad7c8ad75a96d9dd0f32ae5b51aca7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d39f2d8-a819-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1704053711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704053711, "uuid": "a1292a1a-7987-4424-abe1-49e399d8d3ba", "comment": "Malware payload (DCRat)", "value": "14e5e75bcfd0b3255960f90ac19d71f3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704053711, "uuid": "556cfaea-805a-4ecc-9bb9-e326143d0157", "comment": "Malware payload (DCRat)", "value": "eeb173614b06d5819dbb914b09c8c57b79b58ba7229904968f6dc7a6859e62c7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704053711, "uuid": "76d55e58-f9bd-4f23-9103-dc328d6bd579", "comment": "Malware payload (DCRat)", "value": "d4083c4db4a3bceae5083f8407a1969106d6f4be", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704053711, "uuid": "5ef3dbc8-55e6-4382-9eb0-9ef54b6be582", "comment": "Malware payload (DCRat)", "value": "7fd8686d94dfab19260d9e4324c2a91cc8b641560d780c27c3c87775bc24161c29a193f62a6dd74e7d293dbbc147b81c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704053711, "uuid": "f5b20b30-d9df-43a7-9987-a70271fbd6ec", "value": "T1B9E5F14D74CAC5A6E3D42777EED8AD029373A2637267831F3A0C47502A837BF5C45A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704053711, "uuid": "655d8317-e04a-45ea-bf78-922ad28ad86a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704053711, "uuid": "f7e944f9-b8e4-4ffa-91a0-0779469bb3b5", "value": "49152:F3PXfPj7bYgjkn6SBN5ryPxNLr67b1t4FuBAIZ29QEtN:dHjHC6+eZfQaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704053711, "uuid": "71ba7a9f-f0f0-44ed-887e-fb02de5e47a6", "value": 3093504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704053711, "uuid": "0f69ddc9-b6b9-442c-8904-68ef3903108d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704053711, "uuid": "573c3187-13af-49da-9e45-7dd23eb9fc65", "value": "14e5e75bcfd0b3255960f90ac19d71f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfdf7b6-a7cf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704022010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704022010, "uuid": "68aff57a-b471-412d-8ed4-e374daa4bb0a", "comment": "Malware payload (Socks5Systemz)", "value": "3b69c472315a2bb104bb3a6bfbb8b12e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704022010, "uuid": "f3fc7c33-11ce-4865-8a27-174dbb897031", "comment": "Malware payload (Socks5Systemz)", "value": "f3827e0ae5a632a660d26a0551352b8e8332ae8097cfa76fcde8db7eaf7063fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704022010, "uuid": "d16513dd-09b5-4447-829a-784e09a0f3ad", "comment": "Malware payload (Socks5Systemz)", "value": "551fd4a89de8faca9641c91b587a6d757615ecb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704022010, "uuid": "1559b69e-19b8-4ac4-90c7-e5707e20fc62", "comment": "Malware payload (Socks5Systemz)", "value": "132bb18e3d1d24e8d730c9a250dc59d6f32f6ad290450757a676f237e89a85c782bb19218606e978404e2c49635a211e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704022010, "uuid": "466f7fc0-07ce-451c-b920-0e87f7e0d070", "value": "T17226331356610A31C091DE356E17BE184B3356671C73EB22352EE0A6FB3AF62D6221FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704022010, "uuid": "798501fe-5daf-4f72-83e1-a999571d77bc", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704022010, "uuid": "80fdc47b-30be-4206-a113-d8f6c3421e97", "value": "98304:Q3OjVNfrIvC6wO1l7tAljU65pwOXmxhEwonfXE4dm8:JfUvC6wstcNSemxhFQfU4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704022010, "uuid": "56c06afa-9935-4a4b-9159-1f05f1589a37", "value": 4793921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704022010, "uuid": "9c965747-5916-4231-b9c3-deaca6b3ee19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704022010, "uuid": "dce95d51-8c9c-4375-9e5c-36de18041572", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.24788.5627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181a1a8f-a800-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704042885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042885, "uuid": "2e2ed22a-9a06-4a76-8096-7c37720cd5d9", "comment": "Malware payload", "value": "20ebf8447ba412eed206f85cc6a454d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042885, "uuid": "ad07ff01-0e40-449e-8848-2a7b5a9c2f13", "comment": "Malware payload", "value": "f6270514cfe5ba69828ae3bb50a293f02e27407d2e848c69dd09aa67e7b400c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042885, "uuid": "2eb0f009-a75a-412c-b7ee-65a29e26dbe2", "comment": "Malware payload", "value": "6322cc4abb99d5a18af65db1ad62d66fa089379e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704042885, "uuid": "1c35d0e0-90c0-4c14-a594-d2b65eacaeb1", "comment": "Malware payload", "value": "6e68a001219907210ada02c72d26d7488e639a3cd348cddd639c1e8df22ac4f91383bd00d2ecfbf291530cbd254451fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042885, "uuid": "994acd11-432c-4eb8-8c5a-5eb5ad2b8120", "value": "T12686239551C89BBCC0C2463C754202A970E0BD9985FDD814BBD7AC23BF21DBD11AA7EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042885, "uuid": "bbda83ea-88e9-4ac5-ab88-533f64f784a9", "value": "c269743ebbb3816fe656e57159e214ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042885, "uuid": "1ee1ea0c-e98d-42d6-984d-9c11bd70df8e", "value": "196608:O3nJLovsDgzFQPu145/kO+FI/bvdIXG6/8PScsVtGZq:InXgzCK45/kOsI/hI26/8Pt0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704042885, "uuid": "2caba922-3845-4f75-acfd-c94d5028d173", "value": 8522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704042885, "uuid": "8664a984-2394-4f35-a621-c725021cc7f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704042885, "uuid": "ea626ffe-7b5b-47e5-8b38-ede8a7e9d8ee", "value": "xhyfrt8y8xet2k1k.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97fe281-a820-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704056953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704056953, "uuid": "f34f9f5a-d3e3-46de-8091-841dbf0dad54", "comment": "Malware payload (AgentTesla)", "value": "b02a2c727669042df1cc5703c5d42be0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704056953, "uuid": "87920d7e-3191-478f-b1de-42e315236f03", "comment": "Malware payload (AgentTesla)", "value": "f7e5bc980e9a7659ba8aedcb0e5ec208b13d807657ceaeb276db2f5ddeb0b2cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704056953, "uuid": "80409f22-43dd-46c2-b7b8-1131ccbdaff1", "comment": "Malware payload (AgentTesla)", "value": "be9e1b34956555ff2629028dd9a452c903c058ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704056953, "uuid": "952f1b58-86ed-4f2f-9340-56c16b261afe", "comment": "Malware payload (AgentTesla)", "value": "06d856d87d94f6cb964bd6ac382bf5a4059e0acfeea631a5fd1e5fa217190c5b22348d2ab8f969d5bbfc0727f9bd0eca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704056953, "uuid": "45c575ad-398b-4639-a958-ab8b87a86fc1", "value": "T156D42358925D1B17C9781D7B11B00C4A03F8C072BB96E7EFACE160FE15EAFD159A0A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704056953, "uuid": "b3e137b9-01f5-4e66-962f-7321f3eb72e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704056953, "uuid": "34e1f6e6-4ef2-4926-81e1-8fe35d7501ac", "value": "12288:t+atNytJqm0jvktQJavoD8sKz0jNQVP2SY6gd5q:0aStJq/rktQ4IKz0jNC2z/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704056953, "uuid": "63e3a554-09ac-4f73-9368-5a034d61fa9a", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704056953, "uuid": "ffbb4e1b-df5c-4183-9266-47d1280ed3ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704056953, "uuid": "28d99aec-7d4d-4db5-a9f3-8cd7d789f17e", "value": "952109.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ed0009-a836-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704066441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704066441, "uuid": "7123a9ae-1427-407f-8b63-d235e668af0e", "comment": "Malware payload", "value": "9e282c69a25055463e8481edbbaf3d14", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704066441, "uuid": "3750abcb-61dc-43a9-8994-74f3db8e4c2d", "comment": "Malware payload", "value": "fbe69d8e1fa5390e1627f2c7713c456c69e0be031e2df0faace32d439a412fe9", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704066441, "uuid": "a7ceb094-0738-4f62-8214-47c0df4f50fb", "comment": "Malware payload", "value": "2c867ddfe529f664bc6234fd9c1244bd4d6c7a6c", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704066441, "uuid": "e33f68b5-e46a-4fcb-bff9-73c4d11e14bf", "comment": "Malware payload", "value": "f1a2214db20222f58063ab614ae54fb2619b9171a47d7a5b6f75963a61320b83d56f499c7d06ec27497d3228638ba187", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704066441, "uuid": "7f07fbd1-c58c-4ba1-95f9-49a99a69f11d", "value": "T188E533D07A9074AADE38FAF8C7965460AD21D9063E763FCCC1AF1649EC8571203B5B4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704066441, "uuid": "ddd077ca-8434-4e1b-b063-0bdba97cdae2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704066441, "uuid": "71c06f78-66e5-421c-bbd5-03a9cc1df57e", "value": "49152:cwBDoDZjiLWI2DEJd0XiUcyGPOJndAmh6aI6XP11dmnJ1BG0HyuEao/7XO:NBcDRiL4ETNUcBmJndQZwt1KjBG0Hyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704066441, "uuid": "8e288a3c-8521-4c40-b2d6-f32815395268", "value": 3282944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704066441, "uuid": "51dd5a3d-0409-431e-9f0a-230e52f88d61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704066441, "uuid": "f9b9117e-251f-40b3-ac60-d91ec663813e", "value": "eee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9800cbbd-a7df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704028926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028926, "uuid": "9394380d-bde1-4e43-8de6-7e3a4b9029f5", "comment": "Malware payload (Socks5Systemz)", "value": "1311aa7895f46a039af8f407c088a205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028926, "uuid": "f04e2e01-594c-4522-bec0-1a97ede136a4", "comment": "Malware payload (Socks5Systemz)", "value": "fd9f84df12e525770db0b9b0a0c9d0e9346ad9baee91be658122acd4704a8e85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028926, "uuid": "abc56b05-64a8-4b42-86f8-127c52eb1ddc", "comment": "Malware payload (Socks5Systemz)", "value": "1ee79376985fb2bb6eeb056499fc507b947a101c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704028926, "uuid": "e77786f4-2778-43c3-acf0-398db9a56fc6", "comment": "Malware payload (Socks5Systemz)", "value": "808b82dc4b779bc092382cfac44491b99958f93f8cfbc8165d2fa9ee3e1ad9ebabc445483f7d5d5b1c542a8337b716d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028926, "uuid": "7289a171-5b70-4ba8-8cb3-f0eebf45fb19", "value": "T1762633D9DECB843BD4B26C3562589816C493BC42B8F0241BB71F98484FF74DC9B4A39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028926, "uuid": "948ead51-1223-494b-8002-61c4487a0358", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028926, "uuid": "a557ceb1-5adc-4cfa-a3fc-908b26038656", "value": "98304:QuLx9+RszZVHb+KS+hKjrW/8LeUCATH/P51Nv0FmboaaYmys4dm8:Dl3He+hCro8flH51j5ts4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704028926, "uuid": "2498f637-daeb-4eb7-9555-36c2cab94c72", "value": 4791884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704028926, "uuid": "6fecf3e6-1ecd-45ab-a3d1-abfa2e269a5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704028926, "uuid": "52dbb3d7-1d7d-4887-8d96-f0487f25dbd3", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.14846.12417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991db8e5-a812-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704050832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704050832, "uuid": "551fb7dc-cd97-443e-ae36-a386d857c519", "comment": "Malware payload", "value": "6fca49b85aa38ee016e39e14b9f9d6d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704050832, "uuid": "8f461fa2-f85d-4a40-a5bc-4ac4a74b1892", "comment": "Malware payload", "value": "fedd609a16c717db9bea3072bed41e79b564c4bc97f959208bfa52fb3c9fa814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704050832, "uuid": "3274b215-7bc8-47a2-a490-d55f38206e57", "comment": "Malware payload", "value": "b0d689c70e91d5600ccc2a4e533ff89bf4ca388b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704050832, "uuid": "c444316f-1b1e-4730-833f-5bf16736d3e3", "comment": "Malware payload", "value": "ba77907d981bfbc6fd41df0f28e68cb03fbeecdb712224efbc78823e6628ec3b377e1d04d148e89136e4fba313d45aed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704050832, "uuid": "a5a3e21f-36f8-4c8e-a69e-367abd4b933e", "value": "T1CA536B153A55D033D9420D3015B8D3B28E7B796256B9C49F7FA803BA5FE13D06A2837A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704050832, "uuid": "4597ce80-251e-453d-a646-0882285e8031", "value": "99c0cd957fc7334714fefa3daa61a6ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704050832, "uuid": "35f0bf7c-df1c-45fc-bb39-ac197d5b2725", "value": "1536:Tf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQhiK:D6f7cjJ4U4I1jFqy92hiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704050832, "uuid": "5853337f-6b90-449f-af33-4a1d591bd8f6", "value": 63864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704050832, "uuid": "1f7f8ed5-d8cf-408b-b9b2-21d5f64ecf3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704050832, "uuid": "3837f47d-0856-4f1d-989f-29f07794fd20", "value": "remcmdstub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }