{ "Event": { "published": true, "date": "2023-06-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-06-19", "timestamp": 1687219382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4597b704-4691-4cf0-a248-5ff518ba9328", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8296f5-0e79-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162567, "uuid": "cb2b2757-89a8-4a37-a8a5-598f80daf37c", "comment": "Malware payload (Mirai)", "value": "66ad49228543b41715c89587309306ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162567, "uuid": "b97f2deb-612b-48f0-9f14-807af567ac46", "comment": "Malware payload (Mirai)", "value": "001b26c16bdc642bd958d1de96908370246462c6f0334258f69dad14c531b945", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162567, "uuid": "812b0618-061b-4afe-a0c7-6d3be8b8a853", "comment": "Malware payload (Mirai)", "value": "75b11d3e6ab33cad0b8cce8c57aac82e1f2d7ab8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162567, "uuid": "fa6d3333-2523-4e78-808d-cc7775e07d8e", "comment": "Malware payload (Mirai)", "value": "e902ede2745e04ce9e3f7fed99453aadc949093e4bcc6f4b9b9d4b8a4a9ab46ff08d507fc41adadbadfec7902a691d47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162567, "uuid": "5acdb6d3-f031-4429-bd0d-c8e82d4c123b", "value": "T13B63D759BF610FB7E8AFCC3705A91B41288C955B22A53F35B970D418B64F24F19E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162567, "uuid": "018f6497-edb2-4044-a118-741e3cf20bbf", "value": "1536:FDTxZkvEYxEospE3eHTX7/07HkZm0Fmaxb+10Wu2:FHxZkvGpEt7ktxen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162567, "uuid": "7be5c530-647b-4c48-ab0a-789aadf599c3", "value": 73304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162567, "uuid": "1471829c-bdb9-4985-910d-b4dab0aabb14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162567, "uuid": "4a45393f-3829-46ba-be95-7e90245a465f", "value": "66ad49228543b41715c89587309306ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deddf170-0ea4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687181177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181177, "uuid": "73cc440f-3e82-45c1-9e18-5d0aa3670bc7", "comment": "Malware payload", "value": "594cfe112c2c4f8bd2939e6a80fd0d25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181177, "uuid": "4d1f7d1f-2d85-4d6e-bfb9-e40a7a66a062", "comment": "Malware payload", "value": "0091d94da34bbecdb0f0f772f6a89758b283b7b3b2219cc13f6a29ae0d907f72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181177, "uuid": "26177c39-6384-4f2e-b245-fca953cbd687", "comment": "Malware payload", "value": "9e9c8305239fbf9194a2f240ecea0b5931dbceaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181177, "uuid": "77b23bff-bb7f-41d2-8a53-9ed8da38c422", "comment": "Malware payload", "value": "04eb3d3acb03e7ba1870511168902ea0a07e22990bed9fc4df6751de14761b502d6572d7be67e47e9eaa159c4cf814b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181177, "uuid": "21201712-fc68-4261-a513-012fc97e11e6", "value": "T19357333FB1A8A53FC9AB0B7245B3A29049777652781ACC1E03F4094CDFB68701D7BA95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181177, "uuid": "fd84dbf8-55e9-4492-8147-8e7b0bce7077", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181177, "uuid": "23dd0de2-fd70-4828-ae43-f1ed04fb1f18", "value": "786432:zuAUOY1MBNAbhJlCCu0hnl/tmrQNlKCTZDDC7JNIw6Ydh:aAUOYRhJlwul/tmrfJNf6Ydh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687181177, "uuid": "18745e4c-255b-45ff-88e0-c6e873380976", "value": 28153223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687181177, "uuid": "746c891a-16df-4060-9442-0d2d3fb0cbaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181177, "uuid": "ae778b13-c7b4-4b7a-9cd0-a579d9b6397f", "value": "PotatoInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea48d6d-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165365, "uuid": "d98079a8-20bb-4ebf-86ea-e9cd421f6fff", "comment": "Malware payload (Mirai)", "value": "d0cdfeb288b089161e7eaf52c3cdad38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165365, "uuid": "ad4c5719-5fd5-4780-a459-8030cf6b6d45", "comment": "Malware payload (Mirai)", "value": "01b46f5899ada2ac99f0e93f2401eea5988fd3fa2caad31b2fa56124a33ab8eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165365, "uuid": "db454942-a398-4837-b202-4bf89b452ced", "comment": "Malware payload (Mirai)", "value": "7ce4e5d9de7cf04a70e432ff56237c7683849515", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165365, "uuid": "4d2bbbe1-d659-4cf9-9a12-2423adf97040", "comment": "Malware payload (Mirai)", "value": "526fc9f8aa9315b0aade195f5e7e80c8951dc80a10d22ce215d96dac70386a1788373007c15afe2702b6ae9ac33b3339", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165365, "uuid": "09f54c63-229c-4fc1-b034-3a9ecd65c262", "value": "T15D53B519BF610FB7EC6BCD3709A81B0538CC644A22A87B367934D468F64B25B59F3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165365, "uuid": "08093363-dcc6-4683-9d63-54415c0f9589", "value": "768:iAVWeuUxAYGMmnoKw5BheiTebiQ2ZFVyXiSA7mWzkCw:iAVWVscNwxjTIitZFVbmao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165365, "uuid": "96aa2e38-576f-4df8-8138-4bdf0bd020c2", "value": 61080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165365, "uuid": "ecf3b482-e1be-4ad0-8dd8-db33dd4a103a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165365, "uuid": "cd97699a-ce95-4bf9-9de9-ce8091a0e608", "value": "d0cdfeb288b089161e7eaf52c3cdad38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc421980-0eab-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687184232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687184232, "uuid": "60062acf-2201-483e-82f6-66c375851977", "comment": "Malware payload (AgentTesla)", "value": "179376f3975968a43baaabd506a0835c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687184232, "uuid": "0ea1e6ed-912a-4932-b2e4-6e3d846c17b0", "comment": "Malware payload (AgentTesla)", "value": "02094b7e703e771b2837b93696f998aaf57f09b0d44aa4059cb3c4c691f786b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687184232, "uuid": "437b7282-8e63-42f5-906b-13bcf1304204", "comment": "Malware payload (AgentTesla)", "value": "a197fccfdd0b27e6b5a678db7f0d8d74f1fefc1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687184232, "uuid": "3cc5b182-41de-4411-8822-cb2dada0f5b5", "comment": "Malware payload (AgentTesla)", "value": "bc4864492403f61a9e67e488acb4e3007f8be5cb422e7b1bd2982f924b876819d793fca1f0e3d7017a7b52467f3f0fe9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687184232, "uuid": "1a8ae756-b70d-488f-ae25-df181e63328a", "value": "T10405D080327A2967EABDCBF50255627087F62E1E615EF7E84CC6B0DB56F4F804640E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687184232, "uuid": "e1f93146-f2f1-4652-8c67-3539a4305e61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687184232, "uuid": "51648442-45d3-467a-a47f-9329627c4ada", "value": "24576:pH4qXdV6ynSB0nzCH9S0EGU77dDz7fzj:54qXuySOWH9zUFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687184232, "uuid": "03f0df20-ad5b-499b-89ac-ff2a83a1c76e", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687184232, "uuid": "0f900a97-8335-4ad6-9180-abd09f5133ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687184232, "uuid": "c07ac68e-9d79-4e88-a48b-190c266be703", "value": "PO-230102_80h5jPCosKeiz8t.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98957166-0e60-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687151853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151853, "uuid": "4720630b-8df4-4cca-ba56-d4233902432f", "comment": "Malware payload (AgentTesla)", "value": "2a0c9340f643c0b2dd470c540e671965", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151853, "uuid": "828c7ce9-d809-4ecb-9136-6a4e6d2c9d87", "comment": "Malware payload (AgentTesla)", "value": "025436d8633fc813f7fb95d92159e231c6f71af9f64ad37867164143c61d036f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151853, "uuid": "bf27028b-f20a-44e9-aba8-2be0d969bb85", "comment": "Malware payload (AgentTesla)", "value": "2875d6ddd52c5927f65a4eec2f01b0507dd295ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151853, "uuid": "c424b181-77a0-4d55-998e-50d0f1549e0e", "comment": "Malware payload (AgentTesla)", "value": "d259012ff67c66cf5327e09ccd6036911ecd0e6a4eda483ab9a940c147c7aa3e0ca730025faa53c4ccd9c5ec2184be5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151853, "uuid": "1de2febc-864b-4fc2-8308-73bc492dadc9", "value": "T155D422D5629E9B16D0A707F688303630437E93D4B82BFA736ED7F1EEDA527640211E06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151853, "uuid": "888e4703-99fa-45c4-850a-f271f44008dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151853, "uuid": "97c914e7-a78c-474c-bb97-34a82d710537", "value": "12288:S5LbzIu9+r9+26vWcZe2QeCHl9ECEKQYg8oLgaoaULHzFW8ZsEPVKa:S5LA9+2gW2keCHYCtgxCbLT88+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687151853, "uuid": "7c311079-4ebe-4e96-ad45-72ce24ebf3fc", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687151853, "uuid": "fdf5f9b4-e886-4676-b9ae-00b3262c8659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151853, "uuid": "871fe6f9-4cce-4016-8508-9fb0dd0abaec", "value": "L SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44319c2-0e67-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687154933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154933, "uuid": "d0229036-8800-437f-9298-0971dce2a092", "comment": "Malware payload (AveMariaRAT)", "value": "eb83e98d69690e9ae4f3df87a068d902", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154933, "uuid": "fb62707d-9787-45e0-8e9e-385313963d9a", "comment": "Malware payload (AveMariaRAT)", "value": "025bdd3ae4db37d4ba960080c4c385c8aed76c9f807b51a450119508b5eaed3b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154933, "uuid": "a9866bd4-f9a7-4b75-91c1-4b3f08783750", "comment": "Malware payload (AveMariaRAT)", "value": "01ef712a72d24a4846ddbe80ba407515d353bc0d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154933, "uuid": "f044ac98-d5cf-4f2d-b135-f9f0e6d4e4b1", "comment": "Malware payload (AveMariaRAT)", "value": "5f87b1625516ff70f311f055f1feb99414e3b1dadec0e1b94589c85cb5627ffa866ed59e12b2931a842a3eb458775b3e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154933, "uuid": "e0f29a9c-6ce4-4b0e-916d-b2b5fda71187", "value": "T1E2B39E13F7E54835F3B201B01ABD7E7ACBEDF9700628C49FA394858A2D31946E925397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154933, "uuid": "79b65cb6-c970-4309-8219-74ff66e5589c", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154933, "uuid": "015b9ffd-25cf-4e25-8b8c-e0545e5623b6", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687154933, "uuid": "8726d310-8f22-4ffa-94b8-a75685b15e9c", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687154933, "uuid": "28d77759-6813-40b8-a8ff-585ba94cea63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154933, "uuid": "81d8c29b-0f98-4cf8-b314-891ba4bc3d95", "value": "Purchase Order 8432PO23.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69adb4e7-0e65-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687153922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153922, "uuid": "6259fe1f-a1e6-4dda-834a-e937f6ce06eb", "comment": "Malware payload (Mirai)", "value": "18b5e3126e484b7ba69ac96c600b39dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153922, "uuid": "6b383e04-b5d1-4fe1-9ed7-2134d4bbefc3", "comment": "Malware payload (Mirai)", "value": "0301d2edb366cad6581fc6454ff1d5e5bcb6723c4d0f24ce93cbaa02c3338c20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153922, "uuid": "554c12b7-86fe-4f5b-aff5-6923c64d4b2d", "comment": "Malware payload (Mirai)", "value": "b1983bf57a388f9a80aa64750940626e7e088082", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153922, "uuid": "f1b2415a-df9e-421c-a100-662a0b38c948", "comment": "Malware payload (Mirai)", "value": "2368c379f32dc72500c754c9c12f8af4808743bf8ab14cda018b7890980558280fcf5656dede9609f2a887740c33fd43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153922, "uuid": "c037c5ed-1060-43d7-9186-a3ba30fa0004", "value": "T189B2F161E1863E62D770313AB97CCA0057AB47F8E0EA72713524B7AC4BD2C47547814F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153922, "uuid": "6295821e-d3c4-426c-8cfe-546b14e7faf2", "value": "384:5ZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdohymdGUop5hKX:UX1De9kONQG5xD+jHMDzuos3UozYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687153922, "uuid": "fde8a34d-20d2-41ac-aa3c-1d613d30205c", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687153922, "uuid": "298f06c4-b9bc-40a9-991d-d13e4c546df1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153922, "uuid": "646d456f-3c2f-46aa-bfe5-ebc6523c7a99", "value": "18b5e3126e484b7ba69ac96c600b39dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b55b61-0ea2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Nymaim)", "timestamp": 1687180113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180113, "uuid": "a6f42b19-bc43-47c9-8c49-567515b4ce5a", "comment": "Malware payload (Nymaim)", "value": "83e921d6368baade50bb2a1031efd6bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180113, "uuid": "73183a13-0cb6-4d6a-85c4-2a014866833e", "comment": "Malware payload (Nymaim)", "value": "036a1add9895a7554cefaeb07d48cd9e2af856aaf42c5901ba99f45717008f34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180113, "uuid": "2e386c70-7a1e-4f48-98e7-c2c206ed624a", "comment": "Malware payload (Nymaim)", "value": "42956010017a96a0745f5cf8aaf4a9359e6528d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180113, "uuid": "141bebca-d05c-441e-a3f7-37da7e36a592", "comment": "Malware payload (Nymaim)", "value": "a8464067977a404020ff5a656c4c83f6c632f58456a293f47cfc58588b70d603b11077bfaeaedd555139c6d33c1246bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180113, "uuid": "c2647f37-0e4b-4928-8ab6-e9c7a5c18876", "value": "T1BF85CF3FF268A13EC56A1B3245738320997BBA51B81A8C1E47FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180113, "uuid": "b2954004-75db-4c17-861e-d7892ca3b26f", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180113, "uuid": "90908b68-e2c9-453c-a07a-ff6824e24f07", "value": "24576:s7FUDowAyrTVE3U5F/N1lOR/IRKic6QL3E2vVsjECUAQT45deRV9RJ:sBuZrEU7q/IRKIy029s4C1eH9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687180113, "uuid": "c1207ba2-625a-4fb5-96c9-06c7b579446a", "value": 1795364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687180113, "uuid": "e7d2ebe5-4919-4401-8fba-f30e2301c269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180113, "uuid": "f55ff447-7222-45b6-acfa-39ef9729a9cf", "value": "83e921d6368baade50bb2a1031efd6bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccab00b5-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687168261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168261, "uuid": "1f04e495-3b08-44ea-9915-a6c4a37148dd", "comment": "Malware payload (Mirai)", "value": "f994bd28ec401269f8d0218e08527d58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168261, "uuid": "0400952f-83cc-47c4-beca-03bb9f3df504", "comment": "Malware payload (Mirai)", "value": "0384d4d174bf01d0d6544f005f680105e40bf00201f5c2d0ea0eaa912661723e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168261, "uuid": "0c358a4f-8b69-4dc6-95e1-0bfd590362d7", "comment": "Malware payload (Mirai)", "value": "828382f1f75f102fb02cbb8d0173be8905bc3494", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168261, "uuid": "6c5881f8-0eb4-43b7-8be3-5ee0b914ed0f", "comment": "Malware payload (Mirai)", "value": "5d356a70adefe08c1168fe0ee22a3a6264e77cb6c6abc0a173bdf4808f9c0fc2765404929ec008d7f6a6a15406a6df81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168261, "uuid": "b26defe4-de72-4c3e-9019-ff718eab7dee", "value": "T1DB63B416BF610FFBECAFCD3749A91B05258C640A21A83B767934D818F64B24F59E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168261, "uuid": "639a926f-2d94-4300-a886-f99ed2fa1d1c", "value": "1536:XN1FyOKY4dVA94IJ+no3ILvTc9+B6Zwnz4ag:X/FyOKY4dVK4u+o+Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168261, "uuid": "4630dd05-432a-4994-ac27-63ba425c471e", "value": 68976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168261, "uuid": "99ff75e9-7dfa-45b0-99ab-7f0a09fe935f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168261, "uuid": "d297085c-61d6-462a-8c67-2f4b2902c7c5", "value": "f994bd28ec401269f8d0218e08527d58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9325d1dc-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687168165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168165, "uuid": "76d03f9b-7681-42bf-88a1-daea37e91c11", "comment": "Malware payload", "value": "43541310eb935331d0608ac98720f948", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168165, "uuid": "2c29046b-1175-4377-82a4-de1801ba593f", "comment": "Malware payload", "value": "046fc9f92ac2bb066805121cc137d718f1b830eb17d1c892bd99318427a0d7db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168165, "uuid": "dba54e48-d367-481f-9eb8-43211da6241d", "comment": "Malware payload", "value": "12c2bb58e0c65d6abe5982e3edd7e2b2b72f042b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168165, "uuid": "1074a386-ec89-40de-a711-941b2f2fa68b", "comment": "Malware payload", "value": "6431855ab132204cf691bfde58ee5743d1d4342a3f17c5550bed35019f792b9e6a34a8b7c3644d37429587c4cedaf98d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168165, "uuid": "22a2577c-3084-41eb-9bd6-097796d26b75", "value": "T1C096E117ADA8CC6CD5A384331092C397D20AE14DAE0DDB9F13B11945CEF49AB5B12BED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168165, "uuid": "802d4075-7518-4105-afa4-9f553a35bdc1", "value": "1f2702872592229d2f4cb1162cfbc55b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168165, "uuid": "1a394b13-cbc2-4ef2-bd65-630f4a3003c3", "value": "196608:RvXqYGazRpON38opvp0bkVbuDV6RfhhvizcjcryowfR5elO:RvaVa1YNrRFVbuDwRZOUcryoBlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168165, "uuid": "ba25363b-9189-49ec-88b0-20ca965bc829", "value": 9247001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168165, "uuid": "2a79fb5c-7edb-421b-8783-e280f154c675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168165, "uuid": "fcdf58cc-89d2-4e1f-9284-916126a4b30c", "value": "43541310eb935331d0608ac98720f948.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ca73c8-0e58-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687148500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148500, "uuid": "33403167-a36b-44c6-9863-6f68fa794470", "comment": "Malware payload (Mirai)", "value": "d6c5df07ff23f2e45a82804534f858bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148500, "uuid": "7aaad8c0-2a4f-4b59-8cee-adca8cafddea", "comment": "Malware payload (Mirai)", "value": "04a641a19d7d287aa76cba1005a0b847d47971f32456cd9d61e3fbb4d9dad208", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148500, "uuid": "34fc3f92-94b1-4384-af07-8429396925f8", "comment": "Malware payload (Mirai)", "value": "2312a297bbdaea93f3307b1c6cb8cc240aece2fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148500, "uuid": "6567cece-ec8a-480e-a3ff-d78df0812cdc", "comment": "Malware payload (Mirai)", "value": "509ff2489197ce33ecd1972bdd94d1c0e6f3194769795c549c9d7c6859daa980006fb4562fe73bb3f0b09967ae7f787f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148500, "uuid": "52590ff8-d12f-4d12-9094-ab2b17dff7e4", "value": "T1D0D2D0766A8996A6CBE40DB5F478AC40772B4F3C70A6723021058E3D74C5871BBF889A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148500, "uuid": "392eda80-0ea8-4d76-a21f-625362c3c7be", "value": "768:UwI0BSe1SvgNyQX8HAvuiMaj5aL6zS+J3EBxDbuCxdFd3UQel:UkBSWS4NsAvzh8Ln+J3qDbFdJel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687148500, "uuid": "2c53ed69-151b-4b7b-b718-68df91241f15", "value": 28828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687148500, "uuid": "da7db634-711c-4203-9b40-b142b8e5d448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148500, "uuid": "3e270ad5-5c77-4853-9aea-8dc01aa07a91", "value": "d6c5df07ff23f2e45a82804534f858bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9135f20f-0ec0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687193072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193072, "uuid": "cd9cb1dd-b6c5-41d9-b256-f7e8f54855a8", "comment": "Malware payload", "value": "306d4b637d41fec3e7e07cc51f2bb1f5", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193072, "uuid": "0c0bd50f-a731-4cfd-a6dd-56401955f444", "comment": "Malware payload", "value": "04edd0287f7a02ad2c98c9764fe778996dc9afee182577f7c4a97507322c9d70", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193072, "uuid": "438f1c0a-2872-4c77-b394-937b567c49fb", "comment": "Malware payload", "value": "7c964d470e9ab10109f06d7f3a34ec697bceaf61", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193072, "uuid": "60782f5b-904a-4206-ac09-955ab76bc07a", "comment": "Malware payload", "value": "6839784ca4e66ae8d3a4563646db6ebec7d133ad3daca22458c91cc4638f410fab7cf740a9af3b471403ba5742299028", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193072, "uuid": "6cecc845-cf17-46eb-af69-d65221159849", "value": "T1F67422B7AD3E2CDBC6B82A6C36CD2F4347905D20CCCC686B36C9D883F5952836A67545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193072, "uuid": "fe708154-2c42-47f3-aba2-819587d934b4", "value": "6144:NRzyCi4l005ClgPSGpJrjOkNwInZhaHjfp4pYecDbXFzkpfU72D50VTaYqYydgVc:NROp0HFzwk4h4pbcj72F0VlG2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193072, "uuid": "29ac77f3-bd99-4656-8478-992f48d96b0a", "value": 355039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193072, "uuid": "3efc7278-dbb8-4f35-96cf-a5fb50e8d6fd", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193072, "uuid": "6817bdb0-5f38-43ab-afa9-c78bd256f532", "value": "Amadey_SC.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f25b48f-0eae-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687185338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687185338, "uuid": "c28aea4e-4c2e-44a1-ac9b-b82bb2c9dd36", "comment": "Malware payload (Formbook)", "value": "8b33f18c5cabd4dbe1bc6c98aefe44f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687185338, "uuid": "7ad040db-eba2-4639-b667-83eb15bbe73b", "comment": "Malware payload (Formbook)", "value": "055d1353e090b0ca79f1cada52c20eea97a86f452af07d9300fdc2d906dde98e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687185338, "uuid": "f2c4598c-a680-42a9-910a-f32c43fd976c", "comment": "Malware payload (Formbook)", "value": "b878eb37ce31406434528e4dc342058d651c9e7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687185338, "uuid": "8aaa876f-1d9a-45a2-b1fe-2c4c34829e43", "comment": "Malware payload (Formbook)", "value": "3b8c855dc64a09297ec89b0729ee885c3e2a63facf8c2be42d9d8e6fc6976618895bcd66bb727ed18d902a371a36fd66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687185338, "uuid": "27743cdc-e97e-4be3-b641-9a641e0e3fdc", "value": "T1B705024809E41A0FD5A737F09BA0B779673AAE416626D32A5CB0B4D36D32717CE8133D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687185338, "uuid": "97cc9bc0-8fa4-441c-8c77-9663e8615f6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687185338, "uuid": "97cb8d82-c256-47aa-924d-0dd0dc42c59f", "value": "24576:dhIMny0cLgoybZmQKvY0ljZjhwYqtm8OqKK:dhy0YylCvY0ljZju+8OU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687185338, "uuid": "f944b25d-0ebe-4d9f-9bec-c31dea522aef", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687185338, "uuid": "96de7ccd-09f2-4c12-b5c1-b7ee5b89d859", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687185338, "uuid": "7c699893-1d70-4e54-9b7c-568eb4894dc6", "value": "SecuriteInfo.com.Variant.Strictor.262459.11501.11584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c96a33-0e7e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687164633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164633, "uuid": "0e5ce641-73fd-42d2-8049-5c46b19b423f", "comment": "Malware payload (Formbook)", "value": "e511e6fed2ffad169d80a64d7b4cb532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164633, "uuid": "0b1e2014-6c48-4117-802c-36bbd7cd04e8", "comment": "Malware payload (Formbook)", "value": "059d5f6ce17550f0aad80205593ff14cd81bcacf6e2b3bbc1cee716f9669aa64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164633, "uuid": "dc7bef22-0ac8-4257-8efb-b8db3086789c", "comment": "Malware payload (Formbook)", "value": "6d68736293379eeeb0a64a4544234079e53a7e9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164633, "uuid": "dd446c29-7613-416b-8f53-b3a0337ba66e", "comment": "Malware payload (Formbook)", "value": "a0ae909d28da46feb11da135680fa0205e4b44a9de0de50ca1c6fb82b51adb06d71b26377ffc7b5f56dd7189c352606a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164633, "uuid": "072e2787-cee0-4b75-8a69-7243827a9a7d", "value": "T131F422893825AA43D56D47BC45D477B0277F6FB67D26E2E89C92B1E4FDA6F020600383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164633, "uuid": "000751f0-8814-4acb-9067-72c848123f5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164633, "uuid": "3cd53e3f-b203-4688-92ed-334b03798b5b", "value": "12288:DPtYq7J3At5iHOq+ZQu0vdGAdu5ls8uJt6d7Zi6OOf8H6idwZTytuP9Nu:D1Yqtm8OqKeVn4s3O1OscdMmtulE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687164633, "uuid": "d01f197b-c615-4cd9-962d-848321df11d2", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687164633, "uuid": "76a02f9f-43d9-4819-bd89-f1e7ed7f13e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164633, "uuid": "191daf7a-f956-40ec-83f1-42ec4d6c2c10", "value": "Quotation RF181-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba1066b-0ecd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687198834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198834, "uuid": "febf8eaa-7783-45e3-aa25-7a47931f3580", "comment": "Malware payload (Amadey)", "value": "d8e6783f3facfe80c2ff0a7283a0856a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198834, "uuid": "a48a72bf-607c-43ef-802e-2c79bd5e04d1", "comment": "Malware payload (Amadey)", "value": "06666a077d5a01da2820b42fdfa3544e2eb88199e757554f2f7c5065849f64a0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198834, "uuid": "ef89147d-4895-40c0-9af0-a226044e55a3", "comment": "Malware payload (Amadey)", "value": "c139cab66ea73f7cbc02bfbd419f46479becb2b9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198834, "uuid": "67c90217-de89-432d-a1e2-7e0e317523b9", "comment": "Malware payload (Amadey)", "value": "7afc78e22830335d89db5e49e146c00e59817dafaeb25fd43d7aa011d6c54e34946a452b384274e3e45542da42c490e4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198834, "uuid": "d99bc585-a909-4b04-a93b-4aaa1f3363eb", "value": "T1990522537FE89073EDB42B758CF503831F77BC611C6803AB3295595B48B26D4A5323AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198834, "uuid": "1b01d41e-0596-4d19-a3e0-3af3b070f63c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198834, "uuid": "44872b03-98bc-4e44-97a7-379f20a6ae4a", "value": "12288:EMrIy90MQPb0xEm2VRH5QNls3TuCCY6QQBJvihHLhI/eOycIgasofWTpCbplvz:kyy4/2nHmNpCCY6CLYZIgaso+dCbfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198834, "uuid": "55389901-9cf2-43ba-aa8d-2b482003eee7", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198834, "uuid": "20f8defb-db0c-400d-8720-a53757e956c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198834, "uuid": "15728f7b-1640-4ef6-a862-43df33ce178b", "value": "d8e6783f3facfe80c2ff0a7283a0856a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c708e0-0e6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1687157410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157410, "uuid": "b7612667-1949-4905-b19a-a94fc7dae1b2", "comment": "Malware payload (NanoCore)", "value": "a1958300c7f20374fafbdb4c69e8c4b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157410, "uuid": "5e68b3c7-3e06-4bc7-9756-9211ed4c7d55", "comment": "Malware payload (NanoCore)", "value": "069ced19d871f274f17ef17c0a6c973b12d9eb54a8d86c07c35b5cd33848c043", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157410, "uuid": "d52e6368-b0b2-4a68-9c2d-2822c58bd412", "comment": "Malware payload (NanoCore)", "value": "4378d8d10762144188c1aed1a32b5d3eead2e6e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157410, "uuid": "fe386676-d98a-408e-8988-b0c3abc1d1a6", "comment": "Malware payload (NanoCore)", "value": "82a2563eed4dd31e725a0978cb2eca9ca5fd06ddce56c7c107672866f6a2b8c4d3c077f31cf062d92b0731cdefebd631", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157410, "uuid": "5abde9a2-d344-4474-ab2a-09d724b2d78d", "value": "T1B004BF1677E94A3FE2DE86B9602212529378C2E399C3F3DE18D451B79F267E10A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157410, "uuid": "a698775a-ffde-4aa6-897a-b739049347e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157410, "uuid": "f7e35b6d-0635-4049-ae1c-d6f1a9adad64", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIgpkfLIJX01wKldvWpHcp7z6KH:MLV6Bta6dtJmakIM5E0JAw2d+pk6KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687157410, "uuid": "e035bac7-8446-42e2-8659-6e69e28d7dcb", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687157410, "uuid": "a4d1838a-458e-4199-a7ad-9e0165580b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157410, "uuid": "27dc51d7-e951-459d-8f62-e5c62c94fe60", "value": "a1958300c7f20374fafbdb4c69e8c4b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55952ca3-0eb1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687186530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186530, "uuid": "b2f5d6a4-2c71-4678-9f42-15852c85f969", "comment": "Malware payload (Amadey)", "value": "e03e6d50d9020a334a302c2b303dbf57", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186530, "uuid": "ff0dad0a-ba4b-4648-b271-fa3c438ffd4e", "comment": "Malware payload (Amadey)", "value": "07087ebf2f3a9c3376a5e5eae1e17fdd69cd63b8a1a1cfdc74d4c035114cceed", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186530, "uuid": "eecb13ba-73a0-4b98-81f2-e519da6f7eca", "comment": "Malware payload (Amadey)", "value": "a4c76bcf855ebdc29fda60d27b1fe00e89733fe1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186530, "uuid": "e36da57a-2f41-4aea-bfa4-e83a17da4568", "comment": "Malware payload (Amadey)", "value": "75eaec6897ced65699501d7ef7d47be705668c154522f4862d069257338bbf9137024f640e3d7036af2c36c38fc3da16", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186530, "uuid": "65dac90a-369c-494c-a4c7-365e8084e445", "value": "T137E41253ABE84472D9B5277148F603830B3579605D7C93AF379ABA4E0D3328494763AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186530, "uuid": "3d08902f-6dc4-4ce3-94ce-f4b9c5565141", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186530, "uuid": "cdd39a48-3263-43dd-b343-f5a86f643a81", "value": "12288:cMr7y902hvzIZSQZyy8NpVXlyftUGY0srpcHY3BEbYrHLkdaxvv:nyQMQky8uly2bYru8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687186530, "uuid": "5f10eedf-1d58-4301-9c05-ec3af6288ea4", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687186530, "uuid": "e1060fdf-06ed-47fe-b8ea-1b22208e1921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186530, "uuid": "96ef4d60-69c5-42b6-9324-7ee24d6570d3", "value": "e03e6d50d9020a334a302c2b303dbf57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c62c4a0-0e7e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687164610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164610, "uuid": "2c94b62d-feaf-4817-a91a-8638aaac9f90", "comment": "Malware payload (GuLoader)", "value": "0288040b40365cfb7479cb4966002047", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164610, "uuid": "28e41c08-1d15-4147-9d3e-3affa4b5d823", "comment": "Malware payload (GuLoader)", "value": "082ead540795250ef882233885c922e3e2a0cb9b148ee849b31c346e21d63e4c", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164610, "uuid": "3a8a9c1c-cd49-471e-94ad-095b9f10a774", "comment": "Malware payload (GuLoader)", "value": "5e832c7dcba65ee2fa2fab7194545f7c5585473a", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164610, "uuid": "8692f83a-8748-4fcd-9235-36bddddea2be", "comment": "Malware payload (GuLoader)", "value": "8b5f41829b0f14bf13f9df9461fe31428fee2f5066b00b0fdc444de6cc5b04088b839eadd0257fe1016fd4fadda32825", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164610, "uuid": "9bc223bd-997b-4684-b640-e26e940fa716", "value": "T111C4232139AF1B4F439A1C862CF303AFAB1A4E5335ECA049D4BCB552547B3EF7A69114", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164610, "uuid": "c988152a-2960-473d-afb6-aeb6e3a5a9b4", "value": "12288:wLRQavux0wwW50Pu46XPmk3x/eV3f9/gP2XFbIQMnN6jtoWgAMmqzVfSfuN:w9Qax0um46Xn3x/M1nFbL46jGm2fPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687164610, "uuid": "9438754b-bf70-48cc-b43c-c068b2183615", "value": 593310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687164610, "uuid": "36d1fa2b-154c-4bd2-aac3-5974ed098fbd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164610, "uuid": "f48eb12e-592a-41d0-93ff-c9a62715f4e1", "value": "NEW_INQUIRY#8375_A2023_QUOTE_MATEX_VIETNAM_LIMITED_1.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010a1cfd-0ea5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687181234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181234, "uuid": "5c4060ee-1823-4e48-b72c-d0a36d6dc920", "comment": "Malware payload", "value": "1b645bc9886b9c951526bc54f4e4413a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181234, "uuid": "489f9ee8-2c2b-463e-b833-ac63555b36b0", "comment": "Malware payload", "value": "08fa137f149258d31819045b72485175dc30fcd575a3764a419944acba067821", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181234, "uuid": "c7aec04c-786e-40f8-82d4-2ae028ac69a7", "comment": "Malware payload", "value": "d69749ce9c9dd292162fa24d8960f4c7e2cf9830", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181234, "uuid": "b34aff82-bd38-4c1f-ad1d-d55d9194900e", "comment": "Malware payload", "value": "65d61852053beb0d6162ec0e49d56d22402bbbc52e66673525bdaaa2d2d7ceeac973dd26f6157482c740feb50d1bd5d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181234, "uuid": "d10fbb86-3f01-46b3-b9a8-4121a9e51fa2", "value": "T1FC4633DE49892B52F03459F3D163895B1EC21D1EEE6D9351D80CA283EC92AED3F481F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181234, "uuid": "6a096ba4-abab-439e-b70f-4d7eb1af7d9c", "value": "241551fab32d0a78f6265cd7357575df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181234, "uuid": "24d9c22f-cac3-44a1-a856-2f04e61bc2d3", "value": "98304:7RXNSlpjNcFmhQY6lnoins8eRySW5iaTTWE3m3EHEeZFO247GkIgREz9bSc:lYcIhpUoi39iaHr4AEOt4yUI9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687181234, "uuid": "057456f0-8bb4-4a81-a92e-638f96b9540a", "value": 5595648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687181234, "uuid": "45ea5b23-73c8-4fb4-b838-7d14c3320886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181234, "uuid": "68a3316f-32de-4b55-a78d-7c93e606b84f", "value": "\u70b9\u51fb\u6b64\u5904-\u5b89\u88c5\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01c4d0a-0ec6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687195782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195782, "uuid": "f3e11bd2-256e-4bf2-91b2-22cd6f806419", "comment": "Malware payload (RedLineStealer)", "value": "a97d2a887eb6d38fce468d7f2cffbfdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195782, "uuid": "40158838-cf6b-4f3e-8033-ed908b2e5bdf", "comment": "Malware payload (RedLineStealer)", "value": "0995e5bcab63116a29fdd780273af52de99af8539d859ace9cb301f6deff5d59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195782, "uuid": "a13210a9-f707-4235-94f7-428fc1777ed3", "comment": "Malware payload (RedLineStealer)", "value": "85dde9df56fef010287124882f6f36d5a6d74bfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195782, "uuid": "9fc2bfc4-e8f4-4f15-a171-3fb764ba8ca0", "comment": "Malware payload (RedLineStealer)", "value": "dfaddb4a820297a7e2a8f0f785680a93baccf4f2db63eb8f83a06ae8627ddfa7c05a585b5133ad454582bf6776f885a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195782, "uuid": "78b7f6f1-2df5-466b-a8c3-a72691494d21", "value": "T1485633EB8385AD93C8DCB5FEE7292091338081E54CB352F61397545F6B1AADEC1CB660", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195782, "uuid": "ba5b5d2a-479f-4b5f-99b5-246043db3b32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195782, "uuid": "892d9933-2b71-4c0d-a022-42ed868870e8", "value": "196608:wJRXDiipc2qBYLeU7ZRG1Lx8rVyFyiFTwl:g57rqBK7ZRGR2MFLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687195782, "uuid": "76f58210-fdb9-4547-9968-10388028242f", "value": 6317568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687195782, "uuid": "c2230811-bc6c-406a-a2d0-34e391f7bb51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195782, "uuid": "96661879-e7ed-42af-8621-b8abcd1f61bf", "value": "SecuriteInfo.com.Win32.RATX-gen.25362.5895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0482e6ec-0ece-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687198849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198849, "uuid": "fbdb65bb-30ff-4550-b5de-98caee59a3a0", "comment": "Malware payload (RedLineStealer)", "value": "cbf9f1a5a4e4979f0d6dc879fab60026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198849, "uuid": "fa6baaf1-2405-475e-a98c-d4eae57d90ce", "comment": "Malware payload (RedLineStealer)", "value": "0a5b874c927048ad194cd1150972f130aa2fa789de76f93e822408a291dc5f77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198849, "uuid": "22bab29b-c70e-4c7f-aec8-cf7c854cb2ec", "comment": "Malware payload (RedLineStealer)", "value": "96220a5a7c3cc069cd0f6f4e7a0f3b44973ba1dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198849, "uuid": "8c89e062-ccfd-409b-b8a7-0440641087f8", "comment": "Malware payload (RedLineStealer)", "value": "bc0b4b66201e20a88357c6a7b88f26189954fd84378638dc1d9484fcd4f75f6688b7d603665298d9c5ac6b0271edf45f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198849, "uuid": "827838b2-1d4e-438b-aed0-683e8a8deeb3", "value": "T1D3E41247EBEA9475D8B01BB048F703871A327CA15E38835A27495D8F0CB2B95A97137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198849, "uuid": "44a1aed8-88b3-403e-915b-21caaaaa4a64", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198849, "uuid": "c3b71293-6dbc-40b6-a945-a1428e901a4f", "value": "12288:fMrxy902Hy3x6Hbqxj0KS7iuHF4V9WxKQ824BAcP8EapRFM:ay/SB4sjnQiulSWxKQEtkE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198849, "uuid": "02fd12d0-3401-4a6d-9bb6-52de4b0adbf3", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198849, "uuid": "65b8df14-7c57-43d6-83ec-cd188d0ae663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198849, "uuid": "43c2ee7f-ea3d-47b9-ba61-acf94a1c9044", "value": "cbf9f1a5a4e4979f0d6dc879fab60026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e0aa3e-0ea9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687183208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183208, "uuid": "31bc099f-8a00-498c-a7cb-1d2d5400f195", "comment": "Malware payload (GuLoader)", "value": "4a33f25a652337594c295c293d14d9c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183208, "uuid": "3aff1a69-4748-4c33-954c-f60aa5334292", "comment": "Malware payload (GuLoader)", "value": "0a5dc64f78625224deb5f4bcc2b740a657a8ddc2314b1f4961bdbb0cfeb3f10a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183208, "uuid": "1251dfe4-f9ba-4107-b21a-175610c042ad", "comment": "Malware payload (GuLoader)", "value": "12d5a7fc9588b585ccacc3ef8f0b1f292c423f37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183208, "uuid": "b40bad3c-f2d3-4477-8f49-4d31089e19a2", "comment": "Malware payload (GuLoader)", "value": "4b0891131c98c0da1bba3bd4e83012d48b33ba47679b6b0b7f6bb3bfc47cd4666b89810e15369d814de8772094408196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183208, "uuid": "9a982d3e-9218-4f08-b86a-5c5db611f3d8", "value": "T15084DFD2B954C8DAFCA717F10C7A992021727D5C54E0960EB2A67E177DF330320AB99E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183208, "uuid": "918559f2-0ab4-48e7-a3af-972e28db098c", "value": "003a54a0fe3c2a4dbf64143004ff22d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183208, "uuid": "850ca2d5-2b07-4c37-87f4-6c08a6e0eff0", "value": "6144:01wM7XZEpgculsw3PPglqmv3kH3IjTyqbgegq9vRgEml5RyQyU7d2qA8OMhKp0L8:01nWlw3PPXmsHCtbg3qV+GQP2w1nZu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687183208, "uuid": "87752ded-1af0-46f8-a8cc-5b0d510c1a0e", "value": 390450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687183208, "uuid": "fed022d0-929a-4094-9ebe-e4e411393cd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183208, "uuid": "bcdf8e8d-fbba-4e86-9609-042e8d957c61", "value": "RFQ TWM 459077.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ee9cb0-0e58-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687148461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148461, "uuid": "e44054b4-196e-481c-9813-ebd181309c15", "comment": "Malware payload (Mirai)", "value": "1f41a86e53e6ec9c27054fda71589d5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148461, "uuid": "d00a4302-5b0e-4940-ba38-9344e44452e3", "comment": "Malware payload (Mirai)", "value": "0b6bb3a844b4483098a25c5afaf188d5c4120a801943f2158dac595d3147ad20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148461, "uuid": "85d8c747-6b5e-40b4-b5a1-07e82d10752b", "comment": "Malware payload (Mirai)", "value": "d489f8454a2226046452745b46293a008f114d07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148461, "uuid": "33453b38-4d05-4437-990c-985d42bbf988", "comment": "Malware payload (Mirai)", "value": "8468009af4865da80f2f1121dee8ba76ed0daabd66a12b273c456a3c3f6f2c23effe6be6b328f4896ae74bdd179b157d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148461, "uuid": "86b4f607-dcbf-4b73-9f0b-10918bc5b7a7", "value": "T1DE33024C66151F4B82E04AB98469C362168715B139FEB02B5B2FD9E470CE43B07F92B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148461, "uuid": "bf811f3d-af32-467a-bb83-ac1f5de620bf", "value": "1536:O2onYHnzGk4j9G5pWNUue8s4iOAKQ9h1dh54jv00r2e1T:OmnzEG58s6AP9hwOaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687148461, "uuid": "69f98ce7-3e76-4320-b793-09ce0c959573", "value": 54304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687148461, "uuid": "d2fbd36b-a1ce-4bc9-834b-5451b438cc99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148461, "uuid": "7eebfcad-08f8-48f5-b7a6-c694e6dbd877", "value": "1f41a86e53e6ec9c27054fda71589d5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4ad3d2-0ebb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1687190809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687190809, "uuid": "94f2113c-d191-48bc-bc8d-a0a875266e9d", "comment": "Malware payload (Glupteba)", "value": "94516556bb1c18df471daa662b0d21e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687190809, "uuid": "25eb1846-2f7c-490b-9392-83914dfb0a3b", "comment": "Malware payload (Glupteba)", "value": "0b869f4897f673d5d3df998fbe8a185cc7c9ee2b5d0228ed5ce5e46f125a7c22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687190809, "uuid": "2efc4832-d849-40f3-b33f-608a56967cc5", "comment": "Malware payload (Glupteba)", "value": "3a5143b5d85d06bd9e8428798cce2fdef6fb5e8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687190809, "uuid": "bbf0767f-24fc-489f-8581-8d624e6302b2", "comment": "Malware payload (Glupteba)", "value": "a0d9969fdb5078f5055e86b1ca764a48f59fded8648ef2423dc0d759af098192aa22a015faf1499c25cf62152bd68e61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687190809, "uuid": "baea33af-f117-4d70-a2ba-63dfbad95b61", "value": "T1CF16330079E2F070EBA34734CD71D77531A2785364AAD59A72C4BF6B6A703C29FAA341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687190809, "uuid": "8427e516-26ed-4d08-af60-edf749e0349b", "value": "b3c0aa56121c87bf3d30d2624a2be74c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687190809, "uuid": "0d5733cc-f368-4441-b053-2ca2af21f3c7", "value": "98304:z5gvbkQzx+togQWJvOnwZoVSyEekafUQXA4R:z5gDk5HvfZfyEEjXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687190809, "uuid": "356a7973-cb8f-4213-ae0a-23d3b3514af6", "value": 4293000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687190809, "uuid": "9fc37abd-2044-43ff-9bf5-0b8012c72df0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687190809, "uuid": "ecbb3fd2-1d02-4a89-92c5-e7d6488d5222", "value": "94516556bb1c18df471daa662b0d21e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656ea3dd-0e6e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687157780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157780, "uuid": "75f73948-4b70-4a2f-94cf-a118621f5fbb", "comment": "Malware payload (AgentTesla)", "value": "a849a44398007851a3287e0930f7dda2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157780, "uuid": "5c6fa3b0-60c9-419a-adf6-4ba75d1eaef5", "comment": "Malware payload (AgentTesla)", "value": "0ccbe63218e5a43e86e4cc0d27b9847e4bbeeb9b4e7f3216a0efb01f7ffaca02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157780, "uuid": "2a4043f9-96b3-4506-a103-fc45d342e67b", "comment": "Malware payload (AgentTesla)", "value": "49a1496f9113481b117bac55eaf743f555463c3e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157780, "uuid": "abd150fe-245b-41f5-bc3b-f8dfdc8cb6d6", "comment": "Malware payload (AgentTesla)", "value": "6b414ce383bbef363b7c0dadbffd53a2fe5eb28dd8b070f4514049898119bf2dea6620a59342d4ff3a513bbfb4fabbc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157780, "uuid": "0bba4bd3-7401-4925-ad4d-dc54f39e9e06", "value": "T150E4230F3856F17EA1EA6A53220ABA4403AC53FD84A210BD739B4A564F587FFD2D4346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157780, "uuid": "5ac8261d-9130-45d3-a4bd-6524d55bcce1", "value": "12288:DEGcVkYqpFei9XT2EunW8zKZevc6yFtOqc+YgkyXfpRes9lw85XLoY5f:0VQxXZmW8U56y++YXyvpoB85XEyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687157780, "uuid": "1c4dad93-317a-425a-8723-ee8caa3f583c", "value": 670974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687157780, "uuid": "84fd0598-d2cf-495e-9cba-358bfa399e38", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157780, "uuid": "ae64970d-547b-454a-9f50-3137d71dea61", "value": "New Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d059b310-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687160536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160536, "uuid": "319d870b-4677-41c7-b1b2-c11ad32c2909", "comment": "Malware payload (Formbook)", "value": "db38d69e18e49ae2f8531abe8988561f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160536, "uuid": "99d2bf16-210a-4a86-be5b-0f1e9931e93a", "comment": "Malware payload (Formbook)", "value": "0e6c0733d148ade8f3987be02052408cfc3b98308ca4b2995f32ce7bae06b2a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160536, "uuid": "b5f3d7d9-cc9f-41c8-b3fe-eef70df27a62", "comment": "Malware payload (Formbook)", "value": "7269760183b1238433857cb7b6f96b1817f5daf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160536, "uuid": "7ce9693c-bb55-4e27-82d3-008eb9d3a236", "comment": "Malware payload (Formbook)", "value": "d0399052c0869adbed85917c9b71ea5dee8e1e64b81323807c46c60b26c63c6e9a39847492626a9695aa5f0a98b5e1cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160536, "uuid": "284b22ce-142e-4ba3-bfe7-5c9f364c634c", "value": "T19C142361438D881FD02A2278562EB4ACB3955FC364FA5315C03F07ACAB6F6A5C421F7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160536, "uuid": "001bf2fa-de40-4965-8328-ab04abca2fc6", "value": "3072:xWoiYbXycDYqzcvxDbZdLNDy2v9/tL34duyZlMIVaHfEgUYcJlcpV0U6tJwg:c0Xt8qzc57htT4dgeaHfEgUYcJlc763N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160536, "uuid": "3c021f26-a012-42cc-98e7-089264291040", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160536, "uuid": "71c4c29c-8371-44ef-b1bf-e635ee5b41f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160536, "uuid": "a959faf4-4796-45ec-ab69-d1015f4ad1cc", "value": "0e6c0733d148ade8f3987be02052408cfc3b98308ca4b2995f32ce7bae06b2a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590129e5-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687175369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175369, "uuid": "be9645a6-fc23-48fa-9b15-e8e6525ce703", "comment": "Malware payload (Fabookie)", "value": "f359a8151aeaa3975a95de6b68475b2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175369, "uuid": "97b0045f-3393-4f2e-9245-2bf089d2022f", "comment": "Malware payload (Fabookie)", "value": "0e7da96e1208b0798bfdb246d614faa9a48d8a955bb3a96b3878b6882749928d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175369, "uuid": "ccdeabb2-86fd-43d8-bea9-d37c64042d2c", "comment": "Malware payload (Fabookie)", "value": "44f9636614211a7eb71c90d3e12505873d3b3df3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175369, "uuid": "1ad849b5-7df1-4f19-b42b-f64808422c26", "comment": "Malware payload (Fabookie)", "value": "85f02da6e638e927e2f88932ab9cd204762a9321bd3695eabc2e896afe4dfa830a0a299e00952c497a8a16d2a41026bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175369, "uuid": "0eb5cdd8-1fab-4085-b95b-4125cd154da9", "value": "T168941849FB7408B5D096C531CDBE8376E272BC831B25930B8641FF5E2FF362169A9681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175369, "uuid": "cb8ec075-d9e0-4ecd-ad00-7f3d94dee4c4", "value": "ff082fef3d15cdd142534440e54d6a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175369, "uuid": "0c0d3c85-ea3a-4319-afec-d2ac4973b51b", "value": "6144:iy9R7sQLwcYHMooiT4MKBz3ImJmGerEhgVIXFML:i+ZUcOTVrKiAZerLIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175369, "uuid": "67fa031c-8e6c-4ccb-bbe9-76951a495e02", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175369, "uuid": "ab894425-b770-423a-bdc3-4fff465ffe38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175369, "uuid": "02f8dfab-d305-4c87-88f6-c757d1bcd485", "value": "f359a8151aeaa3975a95de6b68475b2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d16c60c-0eb1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687186569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186569, "uuid": "439a8ac8-5266-429a-886a-9e69981187e6", "comment": "Malware payload (RemcosRAT)", "value": "b247d3fc55429ccc58d284033ba79f7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186569, "uuid": "81dc1dcc-182c-4b74-928b-6c1f770659bc", "comment": "Malware payload (RemcosRAT)", "value": "0f528143fdfebee5cce0397910269972a5ed33b314f5a91db93bc23c967be73f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186569, "uuid": "b07752f6-a9fd-4ddf-8638-7182d2adbed3", "comment": "Malware payload (RemcosRAT)", "value": "ba34c18493d30d3914db3a448fbaf2d7dc58e273", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186569, "uuid": "60769d4a-d0ce-4407-b710-fca4aaced783", "comment": "Malware payload (RemcosRAT)", "value": "6ac534ec3a76d515dec1a96fac787365bc397f670cfa0b25c47b69bd48008a6b156fb3de1512a2dded2b64fd849bf799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186569, "uuid": "9ece39d0-5d56-41a2-bd5e-ace6e26c0d89", "value": "T1EBF49E16E6E06033D3171A39CC5F87942C26BE601FAB795A2BEC3E6C5F39145291D23B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186569, "uuid": "e17be1db-49bd-4828-b151-39e0751ca760", "value": "c5ddd70a2f2ce9f4b9e5f4b86e781216", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186569, "uuid": "4c5632e7-ec9f-4f0c-ab58-276a62081614", "value": "12288:D4iyBJSbLJfaMAhJVNRdfNl6lFqZLDZGqtVEZE:D3ykf9AJ5vcADHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687186569, "uuid": "087a20f7-9103-4797-8399-b96fea482370", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687186569, "uuid": "cd3b2d24-3332-4deb-a482-b50beb7fc051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186569, "uuid": "8884ba2e-094a-466a-bd8f-9736d92e27ae", "value": "IMAGESCANDOCUMENTSFILES001028200SHSW001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e46440-0e7e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687164621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164621, "uuid": "300fd615-edc6-4767-ab28-15b445aee9b3", "comment": "Malware payload (AgentTesla)", "value": "37d142f82fad929c8df10ebc2159d8e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164621, "uuid": "6b9f0c49-8725-4e87-8b25-c43d9c6b8e96", "comment": "Malware payload (AgentTesla)", "value": "0f9668c1aeead48b7e5e2b89df2e0b917a478e67da9f6a562e77b42f533c45ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164621, "uuid": "e7657f93-456f-4c0c-a1df-de77ceca23fc", "comment": "Malware payload (AgentTesla)", "value": "4f9c525a088f4b3b63ff8f1d3533a07184502839", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164621, "uuid": "153e93d2-57de-4dd5-a8aa-d4cae4e4ce0c", "comment": "Malware payload (AgentTesla)", "value": "9229947af22e0578267fc83b89f7c7dfbf6fcd44be5731577325f391da4021e565ae72d1ccab9e35f0846f7fc4305828", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164621, "uuid": "f48ee557-12ef-4b7c-a2fa-c28e222734c1", "value": "T12605F19222595A9BFC2E137254360DFC07765E3AE5B0AC1D189FF5A6977330B2212C2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164621, "uuid": "05eea9d9-eed9-456e-bc58-e86e871f79ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164621, "uuid": "424b2f4e-c466-4746-bd19-e667ec0a92af", "value": "12288:Q5LbzIu9+r9t2WuZNnU+LSW/UgiUNHXEvy0ZI0ICP7dYudY:Q5LA9t2WmnU+LSW/UgzHXwBZI01Cue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687164621, "uuid": "faa8ae4e-708b-4b45-b584-c881c08826e2", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687164621, "uuid": "ae6c5a00-bead-4bd1-9f47-fc4365ca6c9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164621, "uuid": "7aeb4ce4-e553-46b1-ab4e-cdeeda4f5cca", "value": "New_order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc33a55-0eb9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687190139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687190139, "uuid": "811f03b1-00e4-40b5-9cc2-945605bb889b", "comment": "Malware payload (AveMariaRAT)", "value": "4d8c7047eec36248587e13ea9dd8428a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687190139, "uuid": "e0cf6b2a-a532-4d4c-9c5c-1c9866871926", "comment": "Malware payload (AveMariaRAT)", "value": "0fc4e8bc095e372eb8c97ab5d2100515df8675558f12e41a9b8a522b395f2a23", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687190139, "uuid": "2420971e-2615-4025-a77c-64ea8f81966d", "comment": "Malware payload (AveMariaRAT)", "value": "72dce2ee00a0a131d601e5b117ad81a95858804b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687190139, "uuid": "958f6a3a-b63a-4cbd-a158-55ad4da170a8", "comment": "Malware payload (AveMariaRAT)", "value": "8f92206e17910f31c58bb13dfe33c1880ff62ac936284d5d89a5ba62352a494884e805202e643faa43be281e1d6fabef", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687190139, "uuid": "5dabccba-b035-4400-98f5-31c3c7592df7", "value": "T1A334CF1B25708F66D76A0E34DBA94AFBAE93DF01F7E14EC716131A0935232D9B50432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687190139, "uuid": "2a9f8892-382a-46d4-8eaf-aad0dbf6ca74", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687190139, "uuid": "75892133-50fb-4f5d-bbb2-6abb706375bd", "value": "3072:FMQwWTgwiv46u8uydG2KOubswyd4CcpoaXzItYcanXw0n7Vs+0kqfOxcpGnSyJCz:ep+gg+6sw8fcVjGnIw8s+0Rf0nSyJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687190139, "uuid": "14eaefe0-ab7f-4345-9d8b-942da0a5c398", "value": 244069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687190139, "uuid": "2655e006-7c22-4834-820b-a513427f2d38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687190139, "uuid": "18daf6f3-06c3-4b53-ab92-e78b93b0109d", "value": "HUAHE Updated CATALOGUE_PDF.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12f548d-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687160538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160538, "uuid": "a4267179-1d8b-4b4d-af72-13fb2e58f1ac", "comment": "Malware payload (Formbook)", "value": "8bbda5ac4de4f6f3ea62c14cf2935159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160538, "uuid": "44d24dd9-4d93-4325-a515-7491e8d9783d", "comment": "Malware payload (Formbook)", "value": "0fe7d130b66d582570a52724fe1d178bd1cbe3157fbb4cbd9013dc64a55e18a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160538, "uuid": "b412f675-3faf-457a-90da-b51daf3cb492", "comment": "Malware payload (Formbook)", "value": "61e06832a9fbf48e51b6851882f57a4b4e2b3aa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160538, "uuid": "44e7c3e0-24be-43bb-a995-3645973d92b6", "comment": "Malware payload (Formbook)", "value": "3d8b7316bc139bf6d66ed62e1ab6f2d481ae44e2a47c0ccde3eda70b7125c61d8d2f837d58e4460d52edba37c61aa622", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160538, "uuid": "654f181a-2dd7-42b3-b777-f2aedeb13161", "value": "T1A605F12D63AA9B4EC47A7BFC4C256A34C3F8AD553173E30A0ED334EA9C65B1448D1693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160538, "uuid": "7cb256a9-e308-42a1-b668-b1aae9f88e8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160538, "uuid": "d530a0ef-e378-4f80-a28d-ddd1e001484d", "value": "12288:Efj52iNoOe42KMu/N3mWhQmwmJCMpUjOaqYjiL0Flv2m+WOX30pZNAEWUROCN5TX:QF1mOV/NOakO6nN2mDCYYzUL4Kmmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160538, "uuid": "05696295-f378-4444-9b60-b21c86fdddf3", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160538, "uuid": "514dac54-a386-459d-9333-864165f7f6f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160538, "uuid": "222bbfd0-a285-4097-9180-abaffb4b80bf", "value": "18sMi7jNxv5cTlx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5b6ff0-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687160557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160557, "uuid": "3dcbe11a-d77f-4705-aa42-3463521a1bb8", "comment": "Malware payload (AgentTesla)", "value": "19d46263205d6e74815716d81e75c41f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160557, "uuid": "917ecaee-6c4a-4550-99de-648a4c39494f", "comment": "Malware payload (AgentTesla)", "value": "10024cd05d15044b458ceb3c79f3081b264b84d444f2eddae4081ca5cfe5c536", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160557, "uuid": "df59c141-bbb8-488d-8c1e-d85034489697", "comment": "Malware payload (AgentTesla)", "value": "b02345594880ce9cfc2f09dd5668958dc0f399ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160557, "uuid": "ac188156-bb47-4b20-a9ce-887cfbb703a9", "comment": "Malware payload (AgentTesla)", "value": "87338e081a5c8d566b12f0e0d85ab2f168a5125e737131d6b8f049f01e0365978fef430e5cb86b974cd785dca4916394", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160557, "uuid": "f7257ae5-7e3f-4afa-aaa5-41f94eb12422", "value": "T11E05234AB7C40702E5896634C0E7053003F69A8BB674E39E3D8940DE5D66FE5ACC7BE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160557, "uuid": "f6301b9f-99a8-4c15-8913-158536013937", "value": "12288:fJBEpQJeWGoHNGd8mN+P4jRRcrfA6KF8Qj2cCJaZBzGKBAHModUk5PNSpdw:fPEpQJbGCod8mNfjbcrY6EucYKpoSkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160557, "uuid": "5712504b-a858-465d-bd95-0e973a3c9e0f", "value": 844800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160557, "uuid": "16b9bc20-4c78-4dad-9451-846f8e5eb35a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160557, "uuid": "400380ee-7913-43ed-9a67-eb6502ec25a8", "value": "Order Metak_WJO-001,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c39a45-0ec8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687196440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196440, "uuid": "276feea1-c0e7-4a0d-8a26-d209ff4ef0ff", "comment": "Malware payload (Mirai)", "value": "0a6038d0af5abbf96e16938f747e262a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196440, "uuid": "6536d1b7-e4aa-49df-98a3-57606e230bcb", "comment": "Malware payload (Mirai)", "value": "10148ba53178fb786230ab5b38cf0efcc56bc7a2c8e32c2d0ef66ff144886b68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196440, "uuid": "2a06bcfe-8c7d-4825-ac0e-ce7b5d0312b2", "comment": "Malware payload (Mirai)", "value": "56f767996907afca052c7b508b1097565cb9d677", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196440, "uuid": "51caac97-ab1a-412c-a539-51fbe5139b3f", "comment": "Malware payload (Mirai)", "value": "e65f50aabbfb790dda9c72ea2b595792581c40a5c6c1b5cc3945437c092fe01f011bfedc29a0b00e078e178687fdc4b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196440, "uuid": "dbce7615-4793-4244-acb9-12dca5b2dbf7", "value": "T1DFA2E114E286B518DA322273C77D7BAB2190D95D735E26408B3BB6C9BDB582112ACCB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196440, "uuid": "f66d704c-6576-4780-ac39-0f3350673c50", "value": "384:MUWjVFtXEy16hd+J29ErFNtgFwmEMYW9ucRMZzciCAyRpubGK8:EVFhV2d+J29En2FwJMxMHeRpuCK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687196440, "uuid": "6025ce2c-e6cd-4612-9990-8aea9b976b41", "value": 21856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687196440, "uuid": "7d8ef868-c9a4-4bff-aa9b-5859dad0c25e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196440, "uuid": "21e804fc-145d-40c3-9352-7c36a99924d0", "value": "0a6038d0af5abbf96e16938f747e262a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41009020-0e38-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687134526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134526, "uuid": "df674ee9-5311-4a70-9a32-87476e4fdbce", "comment": "Malware payload (Amadey)", "value": "0ea95a2e64a3c5d99a9828f8f9501783", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134526, "uuid": "03ad88dd-0a6a-414c-aca5-bc08116ddbe5", "comment": "Malware payload (Amadey)", "value": "1029144103e01d08d09652cebd15fa71806db5bfb44db9e2bf9a30f234bd2cca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134526, "uuid": "98b6a725-8214-40a9-905f-89cdaf06b0dd", "comment": "Malware payload (Amadey)", "value": "0955c8f7d010d97d17a130dbfc7a44da0a9708e3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134526, "uuid": "cef0f45b-b490-47df-b78a-980c6932a96b", "comment": "Malware payload (Amadey)", "value": "841719dc40feaee6d6b7b771ce724f03147ec3bf4fdd20e91b878aa08eaf440e1249af5b17970721cb37e3d847059e85", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134526, "uuid": "d890f2a2-4290-4749-bbaf-b229971b9d93", "value": "T10B546E125CAEF7E0F406D83E654AC107E97699717E7486C22F820EF2057AF845FBC9A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134526, "uuid": "3f341764-85c7-4d35-973d-cd9603f9b160", "value": "b88ff38d8a9dd531263365f3574a285e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134526, "uuid": "0ad77a0c-88bf-4647-9127-6d1c26baea9f", "value": "6144:IGYZatOVBV44zWAdPPzLqsGLWA/DwtDq:I0tOfV446AdPPnGCA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687134526, "uuid": "2fc2f283-9be9-403b-a0ff-c7d304028d8b", "value": 291841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687134526, "uuid": "7c2e35a5-99a1-4531-a7be-799f85e84c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134526, "uuid": "92f0c376-a6c3-41d4-be93-73eaa0e4b5da", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b783bf6-0e72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1687159562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159562, "uuid": "6f8ff07a-0810-43be-8b80-5075ff5e7e94", "comment": "Malware payload (Rhadamanthys)", "value": "34f92eaca99ae8adec0b139711394194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159562, "uuid": "759a5a3d-379b-4395-9c9f-9bcd5654d19f", "comment": "Malware payload (Rhadamanthys)", "value": "10d04df986b44dfcad282313d4b1054e2133093c9a5f1f227a77f6a2bd5cb5fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159562, "uuid": "fb29046a-8dcb-44ab-a218-bffa5a553427", "comment": "Malware payload (Rhadamanthys)", "value": "880b2dfd96204947e25c587d7bd7c035c2fc09a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159562, "uuid": "6496b5b1-98b2-486c-bad3-17647a11bcfe", "comment": "Malware payload (Rhadamanthys)", "value": "9c69d4b9fa09fe620b147d026a11e4e062c974b3a5ea9354244445bc80ef3859bc805af6fdb22ef3bba55b0666bb57a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159562, "uuid": "8df3441f-060e-441c-9ea1-e2f8d9ab3d6d", "value": "T169E5E4F3D8D3C0B52BE76935E08B181FA875BDB091CF79262B480C71C0D358DE9A599A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159562, "uuid": "acf13f39-91f5-4727-93ac-37969fe21348", "value": "0a19259cbb0aeac352b1b9ad3ac97bf5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159562, "uuid": "f40e8996-c450-4601-9328-552de19c2c40", "value": "98304:rz9yylj4QWtmjf8hIdHh/C2n8LjhacVpwMIxJTjY:PWtmjddHh/ChasIXTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687159562, "uuid": "cf8db171-e2ec-4895-aca3-46f1ee2ad7b1", "value": 3232768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687159562, "uuid": "a104d3f0-f82d-42c3-a401-371176b3db35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159562, "uuid": "7a68270e-0e8c-4342-8d19-55b162a0572d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1676271-0ef5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1687215943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687215943, "uuid": "25c1d8ca-d5b6-4273-8d95-d25e54f0a328", "comment": "Malware payload (NanoCore)", "value": "b008d3a61e3a603f19ecaadf98812733", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687215943, "uuid": "77526738-92f0-4dc3-bf52-7854800133f6", "comment": "Malware payload (NanoCore)", "value": "11a884c36894498b304875a391970c61ab0baae74b2555e040dc117de0a8a17d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687215943, "uuid": "4de1fef0-4076-41f2-a5c4-6c1e09343486", "comment": "Malware payload (NanoCore)", "value": "3df2dbfdabb2a60e59d1a39c2a59c2b90c51f19a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687215943, "uuid": "26dacdc7-46da-4ffb-a483-aae09a3f8900", "comment": "Malware payload (NanoCore)", "value": "477e8a651ef069e122fa8a5cb1a8a8a1aa5055263f206b05c50e348bb400bfba9fc18618d38695af3bfa7f367a2dd757", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687215943, "uuid": "b82affc4-b395-40bd-b785-4a8aee3c4749", "value": "T1C4F4026813FD039BD6B763B246B546340B7FFE597631E30B1E46B18A6E61B018A20773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687215943, "uuid": "8b59daca-d607-4286-9118-36531f27c6b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687215943, "uuid": "de6f81fa-16e9-458e-b092-69888c79aadd", "value": "12288:bsIdu22iNfmFx2iqNhujGjUUQIO2+dbaQ1A960S+APUjohtaxenVjDCuX4LENH2U:bsIdu21lmFxUVOBIDjAsjejjDCuouWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687215943, "uuid": "c539ca0b-5cfe-45a3-a896-19c3bc5c3661", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687215943, "uuid": "f0f9a135-e854-4716-8184-468aca2bfb1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687215943, "uuid": "d3db22f9-f67a-4f7d-980f-552108e9e9b1", "value": "b008d3a61e3a603f19ecaadf98812733.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecbc5ed-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687174197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174197, "uuid": "af5db3c8-25f5-4995-8f3a-09f139ba3906", "comment": "Malware payload (AgentTesla)", "value": "5886b871debbae376c10cd963531f197", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174197, "uuid": "fa6aecc1-9242-4928-b31d-83d400bd52f9", "comment": "Malware payload (AgentTesla)", "value": "12cc0dc47a3e1da140c6c945157128e373c29360d5a2759e64f9ccc28e4240fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174197, "uuid": "dc7af4ec-529d-4926-ba9b-217cb16056f3", "comment": "Malware payload (AgentTesla)", "value": "6fc951f4e04605edff87fa94eed40d95d8be474b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174197, "uuid": "cc76aaca-cbc5-4fc9-8964-fb9d9c4ce10c", "comment": "Malware payload (AgentTesla)", "value": "697ab0e67789b5e74bfdcfe6a616755805dd536a3b1f31f6157e33432d6b9a2803061b9fee5ccfb80e822e6466808b29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174197, "uuid": "e517ed26-a679-4ee0-b585-d419641f6cf9", "value": "T1C684DD117EDF504C73B33E559BFEA0BD8E2BB7465A7A819E504C080F1B93D418EA1B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174197, "uuid": "7e77557f-824e-4d77-ab8b-850eb3bc4b43", "value": "1536:aQvgYcpa5U+ogsUJW4Wrle/PhG+/kery+bGNTShtj8Dq206/pLdkV7PLOfgcbo15:9gYcpl+og0S7rtjF2kSlprZqem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174197, "uuid": "b5588787-46b0-4525-9093-d3b6feb52c81", "value": 402216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174197, "uuid": "3e794c03-8398-438a-8343-ca291d04544e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174197, "uuid": "f453d2f7-1c9b-47ed-917c-5f728fe3da31", "value": "Company Profile.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44521d41-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165455, "uuid": "f73f4850-87ca-4695-97ee-687de31d4f8f", "comment": "Malware payload (Mirai)", "value": "782c5cdd7f7933938035d9b1b89c6cd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165455, "uuid": "e80a0ad5-99f5-449a-9b61-73b3bc97fcfc", "comment": "Malware payload (Mirai)", "value": "1308413644397e17abdd9eb6810703cd166c344e42d6c00f6f63239fbc857256", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165455, "uuid": "de09cf92-c944-461a-a24e-b4f78a0fc07b", "comment": "Malware payload (Mirai)", "value": "440e059a9ef923a0ff79d8b4ae9fe79fa61a629b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165455, "uuid": "0dc0f93b-6db9-44c9-8b62-21789a31c506", "comment": "Malware payload (Mirai)", "value": "6d4504064d831095a3d663e7c2a3ec3cf0f0689337102a5c4b570629744988686542247dd426b63bfd93bbe324d708ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165455, "uuid": "3ef33e32-b33d-46e2-837c-f64ad71457e5", "value": "T1D433025253BEF4D2A0A1A73BED33B8627F4A6EAC69CB30544050F1586753D360EB17C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165455, "uuid": "aad11fc3-0d44-4804-9e97-4535acc12021", "value": "1536:L9O/WaevMxSjfG+0qs42DqPLcPqF1aBexo4opKZbc:L9O/BevM0jf5PLGqFUFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165455, "uuid": "c49a4c07-452f-413a-9f42-e02126295b7e", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165455, "uuid": "b6171194-ae85-4c84-ac81-0a0d84117073", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165455, "uuid": "23533fa6-efe7-4de6-aabd-931e142a652b", "value": "782c5cdd7f7933938035d9b1b89c6cd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99556bc6-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687174188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174188, "uuid": "9f1ace13-c343-472a-8167-bc6159ac6a78", "comment": "Malware payload", "value": "6c1b6ad600a5b7e974855105b22e14f7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174188, "uuid": "90aaae67-5328-4f2b-aabb-98f020617235", "comment": "Malware payload", "value": "1345f434954dfbda3d0a089c0f4cf1da502e4551638ef7926d2cc06f7f6d5092", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174188, "uuid": "7cef8f7c-4b74-496d-9b1b-6911fc0806bb", "comment": "Malware payload", "value": "a323567b50e3655ba3adb3355eb52fa4b37536e9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174188, "uuid": "b82e2271-63e0-4d6c-bd89-d3ccc446a0f1", "comment": "Malware payload", "value": "3867d66fba5d730b0f2864e9b42150cc78069fc1f2d5693ffd3f3f9acfe940efe4342243a2f6a459f22a6a998698152d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174188, "uuid": "a0141c19-b010-4229-9315-a69dcc3c976a", "value": "T1985422C1CC5C8CDB3A5CC9284851B43AE09D445E548E6B287FFC946F9236ACC9B5EDC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174188, "uuid": "999a4689-1937-4b5c-a16a-22d4f260497a", "value": "6144:RsWwOUqRqNpgwaLSW9wfaWU+TCOrEsD+Wcx0GmLp:OWwOqNpgwaLSW9UNGM/Sml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174188, "uuid": "0642d64a-22c1-438a-a67b-5a9b55ed45ee", "value": 293240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174188, "uuid": "5b177247-3d7b-4f49-8319-8df2547ecfca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174188, "uuid": "d44f6b11-ed0e-4e26-9856-fbe32623ad06", "value": "Remittance HN00715.JAR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5f7ce5-0ec0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687192953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192953, "uuid": "a8d2b68d-28f0-45ea-9269-26cf49cd0db1", "comment": "Malware payload", "value": "54c9a4eb41248f7280822eee5c61e65a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192953, "uuid": "60d0affd-92bf-4888-aa8b-754c3717c1ec", "comment": "Malware payload", "value": "13993a109f4064a70ae87d660099352109c6115065444c46e5cb4854496ce6da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192953, "uuid": "19346385-9c45-4552-8b03-56a0744ea33c", "comment": "Malware payload", "value": "8fe0fa66b9d3aba79de813f3121f9bceac0c3f4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192953, "uuid": "20aa44d4-84bb-49fc-9a37-ccb8ff9cdb9c", "comment": "Malware payload", "value": "734b86de23c43d10f0d32a1593c6bb338328405464e4bc0ba911c1c36bd9e1b12140e236037f074e3db1e03cfb3f163e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192953, "uuid": "cf80e818-877e-4105-bb8d-a7750252c15f", "value": "T15BD4233787241B9CC3A495F2DDE5A05C53EA67468B06A2EB94E620C51F33EC858361FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192953, "uuid": "e2c756ac-f854-41dc-8767-2fb445d90275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192953, "uuid": "ff707f4e-45e9-46da-8b0b-5fa60d8b2821", "value": "12288:YiQIM/QIpht01nYDKOfB2egt0t4L02csbvYCz2S6:Y/LNuwWiCnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687192953, "uuid": "7c0e8af0-5cab-49c9-9e2a-64b4dfc7845e", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687192953, "uuid": "78a9eb4a-75c5-4455-9ebf-cceecbb91fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192953, "uuid": "8c846165-94dd-478b-a4e7-525f28c83e07", "value": "Hceea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b150c9a2-0ece-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687199139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199139, "uuid": "9daaf3c0-b604-42ae-af48-c6ecff4d60d2", "comment": "Malware payload (RedLineStealer)", "value": "0b9ff85f05c28bcf230b096dfe6e6c77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199139, "uuid": "fedfc12a-f6f1-4c6a-b0bd-41eae0c03f04", "comment": "Malware payload (RedLineStealer)", "value": "13bd233a9efff1d755172c4548e3d1b78a881f0c911ab25129c38d8c47034a40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199139, "uuid": "74922e7f-62b8-41d4-9c58-d0e309351bf0", "comment": "Malware payload (RedLineStealer)", "value": "14ef9268694a096ad76c995f715e4b73ec2c1497", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199139, "uuid": "b8c34a7a-f9f9-4aa6-a646-62c484ac84b1", "comment": "Malware payload (RedLineStealer)", "value": "2d4d8d0439ec9607a43b0ad7a9a0f613c1581ec1062402757561d329e2e4c195a70ea211659fb904d47b237ecb0a7489", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199139, "uuid": "c6e0eb31-b538-4551-bd6b-38c0ec35a097", "value": "T18C544B0FB6C50336E471103D27B02956EDEDBC910D34EDB73A6CC329156ABE2A9690DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199139, "uuid": "2723f85d-c8c0-4a47-9437-7ae650b9dd88", "value": "d91fa928c738702455bfa66ac3685503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199139, "uuid": "d22a7eed-c2f2-496e-9086-344d6481a06e", "value": "6144:FtjmeeX2vBQ0FKHgKNRBH13TLxNP9T0x+SRMh:FEeegQzgMLxNFYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687199139, "uuid": "373f4421-f839-42bc-8688-0ab20063860a", "value": 279561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687199139, "uuid": "7d814c19-aa3a-438e-b4cb-fd6ef5f823f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199139, "uuid": "c3c264b3-ffc4-4972-adb0-f286426f13ea", "value": "0b9ff85f05c28bcf230b096dfe6e6c77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d91c1f8-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687174115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174115, "uuid": "f485fbde-9cb2-428a-94e8-7bcd7c3940de", "comment": "Malware payload (GCleaner)", "value": "851fe2fd4692da0d39a69ff18f91e2ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174115, "uuid": "11089dbb-4a49-48fd-bd60-1220ef1a40a4", "comment": "Malware payload (GCleaner)", "value": "13cb91350d3dbbb3a647e84ec450bf3c5e068a30ee6801bc8b94c136d47f52de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174115, "uuid": "af1bd5b3-1933-4d30-ab71-85f02628ab5a", "comment": "Malware payload (GCleaner)", "value": "a0afa9f6c34224d52a04a50d18468c08953486e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174115, "uuid": "91293643-9bb2-482e-8660-639e84c92c57", "comment": "Malware payload (GCleaner)", "value": "ef22666c837163afa8dc048217711807c42794813a6dde736935a00aac7197acd6fd5ceef925e13c07505f2a39cb502e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174115, "uuid": "206a48ec-2869-4e90-8e75-14b0867c7bf9", "value": "T15964C0D27190EC31E52517728D6EEAF56A6EFD418F282787E2187E2F1D7C2A0C572312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174115, "uuid": "4a088158-94a8-4974-82d7-1bc6ea4e319d", "value": "e22f6bb2be4e12044608fc1a03b29b46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174115, "uuid": "48fc1ff9-f6b4-4bd4-b83e-0daabe36082e", "value": "6144:pAac0OqKzT0rMUtvFx8ufNmzjvluVCQ7+sQm:pAtjqiqTtYufYzLlj2+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174115, "uuid": "607fee28-1a46-4e4c-9ccd-015772a27e9d", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174115, "uuid": "f88da212-8689-44bc-b8b8-4dcfdae88e1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174115, "uuid": "752eafc9-3fd3-4f1c-9233-a52e000b17bf", "value": "851fe2fd4692da0d39a69ff18f91e2ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96be2a9-0e9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687176846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176846, "uuid": "f4e7754d-a93e-4132-b615-4c4099b16b5a", "comment": "Malware payload (Mirai)", "value": "ef79163efe01949171ef27ef126520e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176846, "uuid": "e1215a85-0b00-4a57-b3fe-f64174315bee", "comment": "Malware payload (Mirai)", "value": "13d916e9ff364c3e8961c765be6c818c4b4bee51da517fa2b6f4bb121520da16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176846, "uuid": "62b41665-fdf3-4ef3-996c-e29774eb6a48", "comment": "Malware payload (Mirai)", "value": "e8af580ca685beb79ae70bc67f03036195b1dfd1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176846, "uuid": "57d95c2b-8cf5-4a3d-9186-fa097f5ad3b1", "comment": "Malware payload (Mirai)", "value": "31d0b9e5602d3c43fc009498335732d30febb2f1c8fca86652a4e54f21f0113f15894d2a8e1140f6a24a85a87a2411d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176846, "uuid": "f0b5d555-17b3-4089-9af1-0f7ea4d4ef5b", "value": "T1B7033B02721C0A57D5A35AB0693F16E083BFBAA020E4F5C8255F9B9AC675F371186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176846, "uuid": "7bc69b39-05ed-4542-b9cc-4033dd5a11f9", "value": "768:PYuze0F7xAjRznO2/vbBsY0Nk89WtMSHMA2If:3e0/GJ/vbSY0/9YMSHa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176846, "uuid": "efaa52c5-a37c-4cad-81b8-906e7490980b", "value": 37876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176846, "uuid": "27568fad-035f-4c3d-96de-0981e2dfcd35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176846, "uuid": "93e49e01-215f-4956-9176-1b4bc8c56a35", "value": "ef79163efe01949171ef27ef126520e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3fe100-0e79-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162543, "uuid": "6a27a7dc-9009-4c96-89ed-a3f4cd93ab29", "comment": "Malware payload (Mirai)", "value": "9655d955246c6e1f3eadf13479d131ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162543, "uuid": "0cf2ab0a-2fe7-48ec-91ce-d899c44155de", "comment": "Malware payload (Mirai)", "value": "13e208874d68145519b88d4082d952f54d703256d9b5578d1a860f63496c432d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162543, "uuid": "c6e60fff-4777-481e-8ecb-bc1a0db2c5ca", "comment": "Malware payload (Mirai)", "value": "5807f6929fb1282169d4aa55b8ac423641adc699", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162543, "uuid": "30fb39d8-c5aa-4cba-b1fe-cc65e9f9ecc9", "comment": "Malware payload (Mirai)", "value": "bde4f2cfd835c867b79c420437cf850a76c70c3561867fc19bfe16719dcc5d7b5c0a431f37b92241b7521af582a071bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162543, "uuid": "e0f25968-d7d9-40f8-80df-e9f3d83ee6b4", "value": "T152631856F8818F11C4D502BAFE1E154E371757E8E2DFB2139E206F603B8A56B0E2BD16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162543, "uuid": "11dc42e8-be27-4e3c-abd7-efc53d6a0f2e", "value": "1536:1/nO1aCTYOgTBo3cuozK+MaEjTQtMJiiV5l3VmOb+10mi:Aa0Y5togW+BWV5l3VmOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162543, "uuid": "fe085166-fd5f-4869-8cf1-ec9192324712", "value": 68284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162543, "uuid": "257bd82e-5faf-4d68-b49e-38c17485cb82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162543, "uuid": "18d9c326-1242-44a5-8c90-746648c835d9", "value": "9655d955246c6e1f3eadf13479d131ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea50c24-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687168291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168291, "uuid": "431fc1c9-92f9-470a-a5db-86104e06ce7c", "comment": "Malware payload", "value": "13a20f0a47d74c3ffcf208d32a5bc59f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168291, "uuid": "a43b1236-2456-4c19-b176-4a62505ba073", "comment": "Malware payload", "value": "14c95bdc78c6fea25b507ea826c8c91f7010aec84484d873a7c46e28877e0f02", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168291, "uuid": "40614a4a-acda-4a89-bc27-1ccd0405f7f7", "comment": "Malware payload", "value": "4e81db959c51107c5134a814434cff6eddff66f8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168291, "uuid": "cec6216c-f451-4030-b0aa-2c092e01902d", "comment": "Malware payload", "value": "6ab23cd5fe5992c2125339ccc72e10d96dfff0bbe478dd8337a8b28c218cbfab4fc74b231a8c8908eca81f58023a226b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168291, "uuid": "fc07d8d1-f40d-4fb7-9894-376872cb7713", "value": "T1E577337CC0A1279A1D7B6831B5F1B0DBC86681B18E535E2792ADA633DBCF3D1917808D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168291, "uuid": "6ea6291f-3f95-4ff8-a4cc-b62066aafee1", "value": "786432:wtfTPmBTW7E0YaoUO/pGXW9twEva/+B8qeOhvYS96tgnJS:KCTqzYRUm3B8pUYqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168291, "uuid": "366976ea-15cf-4cd2-92c7-a3f7e52de47e", "value": 33233661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168291, "uuid": "e9d12c45-4010-4f10-841a-4dc90d9d7ab4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168291, "uuid": "0571f467-7367-4ac7-8a09-2b51830608ee", "value": "13a20f0a47d74c3ffcf208d32a5bc59f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971d17bf-0eb6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687188787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188787, "uuid": "97e3ee0e-8c08-455a-be99-fd233f8ce249", "comment": "Malware payload (GuLoader)", "value": "62ee57101f0b00549c0396a9968f15f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188787, "uuid": "8b594ae6-3103-474e-8727-3cfe936a5f62", "comment": "Malware payload (GuLoader)", "value": "152acaebcc2ede3d62e20ff008beb789c05490dff5af71854d98bb55ffbcea73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188787, "uuid": "5f3f3bd4-2ed2-4961-ae0c-5cba94558ada", "comment": "Malware payload (GuLoader)", "value": "dc3366bd76bf958057ef9ba42679a9be14b958b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188787, "uuid": "835fedcb-e110-4806-8ba2-e57eb22d6782", "comment": "Malware payload (GuLoader)", "value": "81ba1687c0e2abbea2d7a22dd9a4c26b028c47f4607841be02fe5c2df4ebf3bcc98fc82f912082b7c017490db71c3e34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188787, "uuid": "ef222b4d-4df4-4a62-b25e-3aa7f2639d2d", "value": "T1B794AED1E95488D6EDE717F10C6E9A2020B36D5E90E4920E71E67E177AB3383206BD4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188787, "uuid": "245da576-6f93-41c9-9179-7244a747d0d0", "value": "66fcdd6338ffed276966867e7cf86116", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188787, "uuid": "f3c62860-384d-42af-87c0-5a9360f81ce1", "value": "6144:G0xJt5VE93zhGpt5dC9WjcXtdpgwaL8WnwfaWUkTCOrEGD+W8x0GmMw:G0Z493ot5dCDtdpgwaL8WnUFGMF+m7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687188787, "uuid": "61509af9-4d37-4a84-85d0-667bdf65352e", "value": 418319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687188787, "uuid": "837e0ed7-ef58-4202-97cc-1f9010827f8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188787, "uuid": "01696144-ec2a-49d6-925f-c0e741f9e73a", "value": "SecuriteInfo.com.Win32.MalwareX-gen.27188.31274", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47ea9d9-0e72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687159711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159711, "uuid": "306ad2a3-d9ec-4fa6-8434-62d75d664fef", "comment": "Malware payload (SnakeKeylogger)", "value": "14ee0c9e2ab6e6418cb312b1d7e34db4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159711, "uuid": "c1743f0b-d23b-4c4f-bc45-8282af90cada", "comment": "Malware payload (SnakeKeylogger)", "value": "153d7d4dc8a4fe27256b5b320469d9bd41272cb698e600b041a23e58180f0618", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159711, "uuid": "8574f7ad-eca2-4099-b70f-eb0999ddbc49", "comment": "Malware payload (SnakeKeylogger)", "value": "0a8a2adc4187e1a8210194167f259543c06a8ac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159711, "uuid": "a8054f24-510d-49ec-b731-763626cf2e38", "comment": "Malware payload (SnakeKeylogger)", "value": "fc6543cf4207978bd428ff535de9af9fd7d8d6f747b8fc13fd3fc32e3cae778917f1bea766f357c59b2eb4b402d3c6f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159711, "uuid": "2efe45aa-54ee-449d-a42f-92ad8b9be130", "value": "T187457D123A45C912C15D36F6D297603053778D82277AE309A9FA33A61E337EFDC1968E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159711, "uuid": "16e0f784-3600-4c6b-8cd1-459d5388a446", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159711, "uuid": "8630d1f1-94b6-49ec-9b56-451a2c548382", "value": "24576:xEZZl/OW/Id6lcv9VAo4iyI7qKwWA706DnxED:rW/Id6avYo43KwWA706bxED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687159711, "uuid": "4e3e46f3-7b3b-487a-8888-e6e152acdc14", "value": 1222656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687159711, "uuid": "77e3f90c-5866-45d7-8e81-05dc1cbffd8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159711, "uuid": "c4394e0b-629b-421d-9e00-fa16cfa773de", "value": "4520007393 FOR TRADE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ba2c1b-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687160566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160566, "uuid": "7ee0bee8-2af2-4cf4-93d5-615f70df3c01", "comment": "Malware payload (AgentTesla)", "value": "50a179c7f4ad0fe9315d6d1b8bfcd2f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160566, "uuid": "6860a393-91f7-4920-a3f3-b6f9c6d57d5c", "comment": "Malware payload (AgentTesla)", "value": "1618aa50bbf45960a438a5db2b1fe136a2c12932df7428c1bf1db3babd475804", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160566, "uuid": "bb19740d-b6ca-40f0-9a9b-f705411028f1", "comment": "Malware payload (AgentTesla)", "value": "cde48bab551e59ac3b5c7ef23ab5bba8893ac989", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160566, "uuid": "4abbdcc4-9cd5-49d2-982c-ff0f7095daec", "comment": "Malware payload (AgentTesla)", "value": "ce3b2e99700ca4a381e05aad4461abe53e3042a03faf0fd2bdcd35fe8d6cd86e2b19983246ddae45ebe4042214257ff3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160566, "uuid": "82844bc4-87b8-40f4-8de1-10fce5d647be", "value": "T10FD4F03826A98B29C93E47F90175022447F93E1B3546DA1E9ED138DF5F72B820627E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160566, "uuid": "583ee150-353b-47e0-b80d-6ca8bf20560b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160566, "uuid": "78cca1e3-d82d-4901-95d0-55249910c9d0", "value": "12288:W96SYF759msNLmUPBvBc7Es5SCHKz5EhHo36DfFLEhDanmKExzcaQ:kti75PN5Px1s7Ke+KDdWDanHEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160566, "uuid": "887220ce-4be2-4a4c-944c-84d198aebbe1", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160566, "uuid": "b3ad430f-1889-4bb1-973c-8dc25462ed6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160566, "uuid": "319684c6-3c6c-448b-ae30-75d2076d7159", "value": "Scan-Documents.......pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6694fd-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687167989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167989, "uuid": "0ed4b432-f265-4e08-bd40-8549ae179ab3", "comment": "Malware payload", "value": "eb219d286103a06c95429a5ff6325b78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167989, "uuid": "ecee4b5d-8895-4280-8493-0aa9a2592a8f", "comment": "Malware payload", "value": "16aba7ba7fb7cc062963d9c5630b4c80e7d5a28e1a1dee5a374a5aad51c1e129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167989, "uuid": "b3b6a5cf-59cd-4edc-b616-18896ab655da", "comment": "Malware payload", "value": "ae19118678185f3debdb9aefc812fcedfec72b21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167989, "uuid": "256e4e12-88c3-4759-8a61-00d71d5a9270", "comment": "Malware payload", "value": "53931c9f38f6f01a73ee9eb63007b87e31883af260a250f0116e4cba5d16b0b7fc378c040bc5fd0bf416c9c08cb399f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167989, "uuid": "7edbdf66-8a7b-451f-a4a1-7a034a0d46c1", "value": "T1FA85CF3FF268A13EC46A1B3245739320997BBA51B81A8C1E47FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167989, "uuid": "113a0e6f-65d9-4a6b-9940-418ca0405c7b", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167989, "uuid": "d6692ec5-105e-4eb0-844c-7beb7293fbd5", "value": "24576:s7FUDowAyrTVE3U5F/+1lOR8YBKic6QL3E2vVsjECUAQT45deRV9RN:sBuZrEUsq8YBKIy029s4C1eH9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687167989, "uuid": "4d639b09-854e-4fac-8c99-ae77437d16fd", "value": 1794656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687167989, "uuid": "252b1ecc-c10b-4921-b557-dd0e60a630ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167989, "uuid": "3a3ce846-063f-4e74-a58a-1b08e2a514f5", "value": "eb219d286103a06c95429a5ff6325b78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264bf5a5-0eaa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687183444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183444, "uuid": "e4e0fafd-93ca-4f8a-863e-4297168cc5bb", "comment": "Malware payload (Formbook)", "value": "b1a1aadda80c975783c6c8df2a8586ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183444, "uuid": "c00424bf-9ac6-45f2-a995-19a4c5a5fb0f", "comment": "Malware payload (Formbook)", "value": "16ef953132f6f51c904ccd3e04c933c20110c1dcbab443059df7218392291d5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183444, "uuid": "fb8d04e4-81f8-4908-8d16-950dee7e69f8", "comment": "Malware payload (Formbook)", "value": "98d6daf4a0f1955c2a6d3b016d63d2214f103309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183444, "uuid": "1029b362-1cf0-4e95-a3af-9f6e36c4776c", "comment": "Malware payload (Formbook)", "value": "b098a58cc3659c28b5e30369f114093d31a8a8e4182e21bf510263f436aee7285588f4635e4d637b8ca8b7863a48ba05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183444, "uuid": "43706577-791f-4207-ba5d-2fc38e985dd8", "value": "T12E05025168A60F53D676B3F90F0032B033FE6EDE3826E39A1DC6F1E99561F491A4190B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183444, "uuid": "875fc7c2-5d56-474b-9c18-e150a2890099", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183444, "uuid": "f41e772a-65aa-4a4d-a535-550276e815a1", "value": "12288:YicvG73htU7/2eQ1x96p/TXH0HRGVkqTEKV2ooB9qMsvFWSKDLzbD:NgG1tCueiI/T30xniErv9qjvYp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687183444, "uuid": "355aa5ee-f001-43de-a7fe-25ffd097733e", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687183444, "uuid": "e797491b-e934-4494-9091-25b59c4e1a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183444, "uuid": "7b31e6a5-cad5-4426-8c32-285ef436254b", "value": "RFQ 6000066536 - PR 10023150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77239dfd-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687175419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175419, "uuid": "a9d090bb-e104-4653-8b75-44f211fb8432", "comment": "Malware payload (RedLineStealer)", "value": "93aac72c6c20785f6fcd84f0c7bdb6ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175419, "uuid": "3a20ad58-1caa-41db-b5e7-a40df7e2e557", "comment": "Malware payload (RedLineStealer)", "value": "173dab5f308f27a0e91706ba7cca550ad73d6d4806480099692f4f498a8b2b4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175419, "uuid": "f7b3db89-cc19-4aa5-9ce1-c6533cc46e36", "comment": "Malware payload (RedLineStealer)", "value": "0cc44ab40b79312e85a9670d52eb0be6aecc84ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175419, "uuid": "a4da5993-73d8-482d-acb4-d53f3d86936f", "comment": "Malware payload (RedLineStealer)", "value": "495ca9767c1582af880ccbb797c84b428d89a186617dc87bb7e87603c16077580e73ac54a012fb628cf4ca1f151bde6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175419, "uuid": "7c8ffd20-3339-4db6-88e2-691bca72f217", "value": "T15ED41212ABD89572DDB52B7098F702C30E36BCA25974535B2391988E0D73BD0A93377B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175419, "uuid": "65cde4db-68ef-4089-a98f-88bcfcff3797", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175419, "uuid": "39bcc413-07d0-4561-a96b-b2190ef000fb", "value": "12288:hMrDy90AqVRVSLfiffKf08Aryv+aVyuyFQIgUIvC:myJqVewKf08AevAxFQISvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175419, "uuid": "5d7d5c20-5965-4e49-8540-8fb5a62818a2", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175419, "uuid": "dc335601-c531-4cd3-a77a-574faa088212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175419, "uuid": "8f5dbc28-4c6d-4656-9a74-94357d0c6686", "value": "93aac72c6c20785f6fcd84f0c7bdb6ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14bff0ae-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687175254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175254, "uuid": "cd476ddf-2af4-483a-9a49-0c31c3b12548", "comment": "Malware payload (GCleaner)", "value": "5ca89cef7c47234fd511289a7a2509ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175254, "uuid": "df4a7db2-9ab6-4f88-8510-9ba86e9b54b6", "comment": "Malware payload (GCleaner)", "value": "1793cad04147480c4cbe70e6046e8ae0403320927b54e5efd276f7f6efc40bd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175254, "uuid": "70164439-0079-4c5b-85f1-c8ae4cd3f823", "comment": "Malware payload (GCleaner)", "value": "e755c822d6e27ce1eadb0425946b3bb3b55fe9d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175254, "uuid": "f15ac52e-751e-424b-8c36-55f7fc696514", "comment": "Malware payload (GCleaner)", "value": "dbfd2b43fb6c8d9d313f129bc16c8eba91c9d5bfb42bad2a529bb9471a75b30a4d766baaf9185884ab7390a29723976d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175254, "uuid": "5be777b9-d1e1-4cbb-bf3f-aa5d84d64cd4", "value": "T1BC64C0D262A0EC71D12627728D3EE6F92B5DFD518E286697E2183A1F19BC2D0C572313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175254, "uuid": "876069f9-9f0c-4683-b3b4-bf7c74790285", "value": "e22f6bb2be4e12044608fc1a03b29b46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175254, "uuid": "93d6ffbe-8cf9-4bf8-b865-fccbdc9b4179", "value": "6144:F0cOWOh+dimydOPkMD23piIdMwywA7ChRfxm:F0lVhAVqi1F/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175254, "uuid": "af581d7d-835d-41f0-8db8-c153ada65917", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175254, "uuid": "816b0c19-a74e-4235-bf7a-787f760ae7ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175254, "uuid": "5d00b908-893a-4db2-93e9-6c20bb576008", "value": "5ca89cef7c47234fd511289a7a2509ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef0170b-0ece-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687199135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199135, "uuid": "f16f61d3-d9ef-493f-9c53-33eb3858a88b", "comment": "Malware payload (RedLineStealer)", "value": "066c1bcd9820d3f878488c2c9153afba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199135, "uuid": "e9bcda92-9de0-4841-a2f9-1dbdc44c0cad", "comment": "Malware payload (RedLineStealer)", "value": "1864b758286146998d8cee8145f71eb2206839bb5bce240cf84fad01eaf9bff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199135, "uuid": "1563998b-7fc0-4e5e-92d2-3c16a04b2b90", "comment": "Malware payload (RedLineStealer)", "value": "244a8c19a9b5bd688b1cc7608515cfd225c6a93f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199135, "uuid": "2e1783c3-1f1d-4bed-8812-4651498ae222", "comment": "Malware payload (RedLineStealer)", "value": "90d96f595016646456f6238bd6c1a000de0a5de439af84b0afbe51cecb4e7078c9b05878748dafae46f3c9212728e1c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199135, "uuid": "0fd02066-96c2-4561-becb-49f57347c76c", "value": "T146543B0FB5C50336E471103D2BB02956ECEDBC910D34EDB73A6CC369156ABE2A9690DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199135, "uuid": "0c61f923-02f6-4df3-8005-e6e12faba2f6", "value": "d91fa928c738702455bfa66ac3685503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199135, "uuid": "51fb4122-02c8-49ce-a323-7d7f4a75bf2a", "value": "6144:aZWz02lKQ0FKHgKNRBH13TLxNP9T0x+SRM1:rz8QzgMLxNFYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687199135, "uuid": "965eb187-1226-474d-8bab-97ee381ba718", "value": 279557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687199135, "uuid": "ad160e41-cdb8-497f-9399-e4bee0048266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199135, "uuid": "5bd9f9cf-9c45-48ce-a0dd-dbd92113c5a7", "value": "066c1bcd9820d3f878488c2c9153afba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de5f025-0ec0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687192986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192986, "uuid": "82228ec4-0ac1-452d-b30b-7852c1e8e249", "comment": "Malware payload", "value": "d1fbd19d28e0545cc756ab6c61f775be", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192986, "uuid": "74549f17-58a2-432f-886a-bb1235fae08b", "comment": "Malware payload", "value": "1876cdf7ae380d878a12a7dda624b40f74bf470592410665103b7bd998477959", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192986, "uuid": "9566f27f-2c2c-4736-9609-24aecaa21436", "comment": "Malware payload", "value": "a03034dc9402e2a418b5e5472b373b5402863fb6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192986, "uuid": "4adb96b5-ad58-4ea9-8932-a27faec3765c", "comment": "Malware payload", "value": "656cc23154c11850229dcef3bf11eb2840d69982b5bba901022884ab764b3e0eb468c3502f6e106478515d0c30836e42", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192986, "uuid": "d795f47c-cee1-40a7-af69-02ecee89490b", "value": "T1B82633529BFE9E694AA4433C242F3F5E06900FD1D02C79DF13B1A95B065FB4444ABF2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192986, "uuid": "a28a6026-30d4-4735-8778-13df86cd7629", "value": "49152:RlCMws8aK4plIA14mWk9oaOwWyuNKNkVwCJnbhZuwlyzo44CcW2jjgpcj:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687192986, "uuid": "64093d46-8681-4ace-bb52-c5b8e5b23bae", "value": 4439049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687192986, "uuid": "c5aeeb28-cb10-45fb-9711-1194df06b5f6", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192986, "uuid": "0016015b-ce8a-4b73-aba3-3d0d85204ae8", "value": "kkk_SC.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "576d7cfc-0e7e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687164629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164629, "uuid": "dc91fa49-281e-467e-92ad-44ba2008208b", "comment": "Malware payload (AgentTesla)", "value": "ff299c50133d9216bb3d2ba1f2a65613", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164629, "uuid": "059bea0f-b31b-46da-96e0-27fba3ea92b4", "comment": "Malware payload (AgentTesla)", "value": "195a877d8f10d39afa27ba613d5a965b3e1d35664ade4af341a0602c1b7ed141", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164629, "uuid": "9fe855f7-219a-4f3a-b051-7dfd5eba4840", "comment": "Malware payload (AgentTesla)", "value": "ee700d8034642a6644421199ef45ae8739e6dacd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164629, "uuid": "e4c49446-a26e-4000-bf27-78f0308aca2c", "comment": "Malware payload (AgentTesla)", "value": "281e29edda8f64913d3d37d710a3afe7865bc2f0a7e87be3cf3a41c02ed283f32a4fca3297464ef651a12a510796dfce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164629, "uuid": "7872ad85-9d88-4619-be2c-676cc4e37bec", "value": "T19D1412C927E4EB156AAE394DAADDC17FA3B32F070AF1044F5DC40D2BD8229651EEC112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164629, "uuid": "fda71eb4-8391-4e22-b406-0ad06484d749", "value": "3072:UpegBJVsnIFYbY7k99Zdmg2R/GqhyFMQEbKRmT8zdh8cGymvYrsXx3eI2FZL69gL:rLSYbYg99ZdUJbKRmSw2sh46yYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687164629, "uuid": "dfd7290b-7892-4096-9df9-5d406d477b78", "value": 206859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687164629, "uuid": "3d4c4cf3-a879-4cc8-b322-8b1911a5c47a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164629, "uuid": "617b39ec-2e38-4fd4-8440-8a2dbbf08d22", "value": "PURCHASE ORDER #762812_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58d2057-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687160545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160545, "uuid": "dcbe18cf-876d-4c52-af29-6cba4a9ba295", "comment": "Malware payload (Formbook)", "value": "76f4c4658c33ab43c606f90461a50079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160545, "uuid": "0ae5c429-8f9d-411a-97e6-d2a7cc5e5fd0", "comment": "Malware payload (Formbook)", "value": "19b7dd8cf8e16f966af27f7b3e03dd581b22c1553840f1c4d256c790bc86b1ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160545, "uuid": "259bfea9-d72c-45a7-91d6-64fdaa791706", "comment": "Malware payload (Formbook)", "value": "dd5779730046287dd3b8713d782f0e3efe09a020", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160545, "uuid": "846668f1-7732-48e4-a1ad-59f697f21f61", "comment": "Malware payload (Formbook)", "value": "cbf906bf94a4f675077d17fe7d9e2bed2651f316cbc0b4b46ae035a664ac6728647c9565ba2e77c2906afa5c2955bb9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160545, "uuid": "1e6e6a0e-32b0-4586-8c06-e83ff8fa96e7", "value": "T16754F183F56CC39EE0258B70787D96B56BE89F371124499B37CACE6DBA6310849093F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160545, "uuid": "67c93037-11d9-4621-a35f-e879f5aa5037", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160545, "uuid": "ba224d51-6d1a-4a2b-b94f-253a215543a2", "value": "6144:0Ya6ybLPr+9aMu/w3oUmxCXt+45QjjXLo24ggqtDZeXkypUA91HzJ06qSX:0YmLa4MlX92tt1KkypUA91TkSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160545, "uuid": "f9f457c5-ffb7-4b18-9822-a44a47d7698b", "value": 293966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160545, "uuid": "ebdb431f-cd61-4db9-af00-40fde619909b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160545, "uuid": "79d927ec-0682-455c-addd-7add300f63e3", "value": "Booking.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39d2c15-0ece-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687199143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199143, "uuid": "99dee3b6-3ef6-48f0-8a4f-b47c9fbe7e08", "comment": "Malware payload (Amadey)", "value": "e1956fd788ba381ad9022fcb78044f7e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199143, "uuid": "e3a7341c-69c7-4e7a-a340-42192e65b28d", "comment": "Malware payload (Amadey)", "value": "19e8083ff0290480e03d8907de6652320ec08f22ab1439ba65bebcca2c3daa19", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199143, "uuid": "d91bd494-c4cd-4e84-87f9-cbda192cee5d", "comment": "Malware payload (Amadey)", "value": "3d64f2bc8685887d2e5f82f55209b5f77d658cd8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199143, "uuid": "cd27d05c-2f2c-450b-bc3c-796b5cd8398e", "comment": "Malware payload (Amadey)", "value": "26756cb73d72042b6c497a1729a350bd051bdbb72c16837b6ff1481a70b2e0efbbd1a3fe62acbe89523b7dd0897a5f8e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199143, "uuid": "53e12e63-2b63-4f24-b68a-326ee1d0af9d", "value": "T135F40241B4C4B539D9350531BC9ABA42797EF8E14E60D86F3F98330D8BB14E0B9B462E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199143, "uuid": "3f3c2c7f-13d6-42d1-b9b0-977e7aaee87c", "value": "d91fa928c738702455bfa66ac3685503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199143, "uuid": "db18093f-e45c-478f-a9d9-cad4f0ba60ff", "value": "12288:76QpGR6v7fWlu+T/pWZYRK9EfaBPBJeYiag2peu3lex68Miywl:7wRC7fIu+WOA9EfapuQxVelMUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687199143, "uuid": "0f2fc63b-5fa2-43b6-82f7-09bb4891352c", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687199143, "uuid": "af7fee9a-add9-4d5e-9d2f-f25d1b876712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199143, "uuid": "9795a07c-e6f7-4444-a857-82d7b2abf6e0", "value": "e1956fd788ba381ad9022fcb78044f7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a840b6c-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687168150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168150, "uuid": "a7c7eb4b-8b3a-45e0-bb48-82d0067b0fa3", "comment": "Malware payload", "value": "23f882e1b782d7d237cb5f6b3e06b4ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168150, "uuid": "ee671f30-e41a-4f0e-99f0-e6861da8cf08", "comment": "Malware payload", "value": "1a086ba27ef60e2eb67f273f7d73fe5ad59914be5b856b82581a838bd4eca8e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168150, "uuid": "b2d1e546-3223-4d5c-ab1d-4de3e4e70710", "comment": "Malware payload", "value": "a4c66f27a21dc2bc069d38eba04ab962dae77c27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168150, "uuid": "0248d355-d3f4-4c5a-adff-db9f3e6ac28c", "comment": "Malware payload", "value": "564dd79db7897695a4640bda269854b27d3fd480bc175782f7e1da11ed163dc9410cf2910907773cb7b9baf1dedfddbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168150, "uuid": "de7b5db9-b2cd-40cd-b358-e06dbf82c2bf", "value": "T19CA39D1270E0C473C856C97498B4CAB56ABDB9721B9191B3336C067E7F302D1A77A37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168150, "uuid": "116ce13c-01cd-4da3-80dd-cf5824c40097", "value": "8b20c0aa1a6b70c064e1b0a2222ddac4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168150, "uuid": "4fa2e6ed-af79-4105-9fc4-730cb69ae041", "value": "1536:YRogGx9CyGvWKhnIgIk4kW1nd9vl0y+EZGdnAWXxk0LQAt7SyyPxu:GHD3QpnPCynjWnLQAt0xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168150, "uuid": "322bc99e-52df-476f-b8b3-88e872a83b91", "value": 104720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168150, "uuid": "ef2d1ac6-ab26-4cfc-9f27-2d68bee87ebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168150, "uuid": "02846549-0631-4c9b-a1cc-0039eb518a49", "value": "23f882e1b782d7d237cb5f6b3e06b4ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83bb1afa-0ea4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687181024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181024, "uuid": "2437b35a-2ad2-47e8-b646-42011185a593", "comment": "Malware payload (AgentTesla)", "value": "5e1b8eb2898fb6cf7c420dc40b0af271", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181024, "uuid": "89cd6f88-9aef-4f0f-95ef-fd480375188c", "comment": "Malware payload (AgentTesla)", "value": "1a93d940feb9bb92a8da4888790203aa8212815ee5b331f7e20d44f9210aa7df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181024, "uuid": "41795447-db8b-4eb8-87f2-8e5fb3bc3ad9", "comment": "Malware payload (AgentTesla)", "value": "b436dcb2358c5d295e92b3d11643ea1e84727200", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181024, "uuid": "bffaccad-f465-4f5f-9c6b-586f7e11aedd", "comment": "Malware payload (AgentTesla)", "value": "edb1f0f2cf4ee2788d3871a1ebed25d0efc29c4d7f05a587a3c64175d16a6f4af02fd4177a179f25e57058821fd8d869", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181024, "uuid": "5e13af66-e15f-49e1-8624-bc44df26536a", "value": "T12F6412685694C467E9370FB0BD36181954ABAD39ACB4B78B0B8A33697F373C5A40D313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181024, "uuid": "d711cebe-5ad9-4255-ab2b-788a0cec53f8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181024, "uuid": "d32d043a-a6e8-4543-b61e-9fed65601ec8", "value": "6144:OYa6s0NEzHbXq6v+ORPASJVveL97n/SIItySlHXmuJ4nt+:OYG0+na2+OldAB/SIOySRmt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687181024, "uuid": "b1d18f41-51fb-46fb-b360-7276cd998bbd", "value": 322453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687181024, "uuid": "95454753-3c0c-41f2-b01e-7272af2a1364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181024, "uuid": "2d3142c4-4021-45ea-ab02-6d3eb37f8fbc", "value": "PO-230102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052a3cdc-0eb5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687188113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188113, "uuid": "73c45eb1-5c0e-4774-aff3-9a2bc1bf5bca", "comment": "Malware payload (RedLineStealer)", "value": "69b5ee47c35bc66a01aee23d50674cfb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188113, "uuid": "1729a241-cacb-455b-bb32-434c93d70efa", "comment": "Malware payload (RedLineStealer)", "value": "1b13df7970dd431fb6ffded3d14c2d2874d4296f2be5e802b119e2dbf128dff0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188113, "uuid": "a7d5bb06-d4fe-4c16-8060-f2a7bce97a0e", "comment": "Malware payload (RedLineStealer)", "value": "58555c4545b3b6b6b6b2ebdd324539b58e82a34d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188113, "uuid": "f280e3f0-0e0c-40b2-80f2-b000130db783", "comment": "Malware payload (RedLineStealer)", "value": "095da767df7f9bf147cf6a09922feff8074d98cb545dbd6e7e83e6f6ca9ddcd2927386b435a21e4260a8de1932368ac8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188113, "uuid": "f9518cfc-3e0f-451f-9862-bf4f9a7b8a6c", "value": "T1D1D41203ABE99037E8F41B7094F7038317367CA11EB9436B3755A84E19B2A84A47777B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188113, "uuid": "29c947b2-0951-40c0-9a24-3e021e845158", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188113, "uuid": "02efcef6-7707-4fa3-bd87-c7fb484eafa5", "value": "12288:+Mrhy90luPjdz+HFeuk0RpQIKct1FOCJbuaYqNyrtZtCLI3P7SzSoH:PyPd+HFeAMI1t1Fd6azyJpP7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687188113, "uuid": "e3fa684d-55d6-4899-b0ba-c4a2322ca3ec", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687188113, "uuid": "9e11b002-fe92-4724-bd4d-6ec21b0ef504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188113, "uuid": "5dce2b0d-36d3-416e-9963-7b6c1aa54a75", "value": "69b5ee47c35bc66a01aee23d50674cfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7d7a88-0e49-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687142119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687142119, "uuid": "8eea20b2-8b94-4efe-bad0-23fc3a43d8e3", "comment": "Malware payload (RedLineStealer)", "value": "f58435839d22fb4d4f309ff31435369b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687142119, "uuid": "ad1babc6-a490-4fcd-9d8c-9d5b20573d66", "comment": "Malware payload (RedLineStealer)", "value": "1b17a7d9e11eba0178b3070e35fc0a6a02ff70a05cabba2fb82ac7d6d48e78c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687142119, "uuid": "3df5d684-6bf6-4449-8b4a-4f747972285b", "comment": "Malware payload (RedLineStealer)", "value": "8666c532dd77757c2cec8737953d553b432314df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687142119, "uuid": "ee95b374-3f49-4e85-8de6-6d4ee6f04529", "comment": "Malware payload (RedLineStealer)", "value": "aeae7e208df3b6bb039272105a21bab31ba89f2f70a2f69f6ef3ecf09ea67d159443b941d08eb53c990bdef753630ca5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687142119, "uuid": "f6cd438e-98f1-40cb-8601-5bb3ee808bd6", "value": "T1D1051203A6E4D173F8F51BB098FA02830E32BC715D6443AA265BDD6D4C732C4A675B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687142119, "uuid": "87e9ad34-17a6-4894-831d-7cbe9d62baec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687142119, "uuid": "7314d483-4469-4bdf-9a5a-877211e04313", "value": "12288:sMrmy90IFF7n7mflyWNR92rnooXyISLXSYJGZwblBk+iqRwnZPD6kkGDwTv05:iyvFdqTNiooiI6CLwpOxFkIwTv05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687142119, "uuid": "0a6532ed-d8a8-4abf-84f1-0966bb683998", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687142119, "uuid": "0992c536-196c-45c9-8e50-f452964c933e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687142119, "uuid": "48b4a563-cf86-400d-b34e-cb4998270eca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2a4059-0e6e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687157788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157788, "uuid": "d4f7608c-c6a6-4368-a487-1f80a9a0bdff", "comment": "Malware payload (AgentTesla)", "value": "e2ce73e75981a001cb91ac855e697432", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157788, "uuid": "a379847f-cd71-4f00-8536-16e80ae64b6a", "comment": "Malware payload (AgentTesla)", "value": "1c834a9e0b395b4544646c67f8a12972256500cbabb5b71a7433548e8b558920", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157788, "uuid": "b79868e5-5cc2-425a-aaca-d0ac315697c1", "comment": "Malware payload (AgentTesla)", "value": "5001cf822b0f2b9dd39eda2d780afac8722fd4ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157788, "uuid": "e3e733e0-e9c0-4dcb-b797-501e8ce03475", "comment": "Malware payload (AgentTesla)", "value": "8d086f96c62f584ba4853d385bd4057f5bc2f27f10c72760b597006b42895e3b0c4e7324f943f316a44ccee918121cea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157788, "uuid": "f25d91a1-51a1-45da-8303-0f1d74dd725b", "value": "T18F35F63D1CBD463781B4D6A6DFC5D421F550D1AB32229E3A62C385864A0FA832DCBD7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157788, "uuid": "73ab4c26-6573-434e-adf7-4f6f23fa9ae6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157788, "uuid": "310e054c-23b3-4965-88ff-ef6bbe2c6aee", "value": "12288:mt/vwGOwJ7gzplJelPS/z///n/a/v/j/I/h/9/c/s/QT/OI/C/1i/lh/bn/mG/Gm:mUJelqMglmwvi8JY7ad2XoDVYyjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687157788, "uuid": "60090e13-93cb-4199-90a9-16ef23a5c33e", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687157788, "uuid": "efa53469-33ee-44ae-8e4d-c7d5bbc1bcd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157788, "uuid": "bd4a7d09-c0bc-483a-b0b9-b1e3eac10bb1", "value": "Order 6189.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "748e223e-0e9e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687178421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687178421, "uuid": "01a3f17a-ec44-4d8d-b7be-5fb8ecfb54cb", "comment": "Malware payload (RedLineStealer)", "value": "dfb6fdd0c1271a3ee9edc042d420a928", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687178421, "uuid": "0a20e67b-297f-4d22-8ab0-8ef72ae5a059", "comment": "Malware payload (RedLineStealer)", "value": "1ca91eaf63056917103fcdaa2fe1051a7357247881a7fea5d918ca2e189cab8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687178421, "uuid": "2eec1479-1548-48f1-937c-e52c140c8122", "comment": "Malware payload (RedLineStealer)", "value": "40ab57ec6885382de923506c908bc69b21015521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687178421, "uuid": "bce972da-5527-4f5c-9884-41b1a8c3b449", "comment": "Malware payload (RedLineStealer)", "value": "31d7e73db57c503bfe8931a3feb74b64943b3abbd0bfd8001a1d5297f50840e64a1db8927d9e941d44ea60df47f671ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687178421, "uuid": "43024e83-0bd8-4098-a355-08d869efe35d", "value": "T1C70523135EE48832DDB5A7B818FB43970A3A7D945E3483BF67916C2A09737D0A17132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687178421, "uuid": "377359b3-3723-48ba-9b93-9280d8b5e2e9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687178421, "uuid": "caa5db9d-1658-48ea-8b66-fef42d442b9d", "value": "12288:zMr0y90XFO6UHafctld2QThZAR4zZQGKjQOwiMxj4hvDSRqrgOP39ZIm6ym:ny/P1tlUQThZARgEESIjYrbrgOPUm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687178421, "uuid": "20971633-23ed-4173-bf2b-2a0eae117621", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687178421, "uuid": "17dfc7c5-d93f-4699-ba68-12a58956e2c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687178421, "uuid": "0ece8406-8fd9-4df1-a80f-942bebccf2b7", "value": "dfb6fdd0c1271a3ee9edc042d420a928.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fec4cf7-0e79-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162522, "uuid": "c43771a5-ae94-417d-a3e0-74cfc546fc15", "comment": "Malware payload (Mirai)", "value": "f8265d87130a802e47dbdcec1e66a248", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162522, "uuid": "81eba2c6-5d32-493d-aaad-b67ae676dd99", "comment": "Malware payload (Mirai)", "value": "1cc9a6e62558efe9e05e169c8010227a017fa7822bf61d30b0571a22226ce63e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162522, "uuid": "4dff44b0-c863-42e6-8db6-5d7d1ca7406d", "comment": "Malware payload (Mirai)", "value": "8b0b1cfee1a95d85ab335b898477d07fcd36af09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162522, "uuid": "1e1d862d-6fd9-42f4-a2be-beacd3457598", "comment": "Malware payload (Mirai)", "value": "84a38b6ababf0dd0c9401449cdc3d9330333af08cc58bf3c313da22f79772c7f9d96dc26fd6a161add927a0b5968bd4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162522, "uuid": "3b7e5442-9c57-4c8b-98e7-57ad4f6d8ede", "value": "T17123F1328806AAE1C520347CEE8A459371616736C69FB13357144AFC3B89F4B678EF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162522, "uuid": "8b2611e2-9582-421d-a459-29af0be6e157", "value": "768:g/TYCoIxdE3guzYJRfp244qqRYu52CBpqOXMJFw9q3UELbUXfi6nVMQHI4vcGpvD:gECFKgukfp5A52CBXMJvLRQZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162522, "uuid": "ff52a0a1-dfe1-443d-834e-02518063f9e0", "value": 46632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162522, "uuid": "330350af-1ac0-436b-89c8-917544fca4c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162522, "uuid": "d1814646-3d61-4fb0-a1e0-7a716e15aecb", "value": "f8265d87130a802e47dbdcec1e66a248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2547d28-0eb4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687188081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188081, "uuid": "425d558e-3a30-411c-94f2-970f12aaa7b0", "comment": "Malware payload (Mirai)", "value": "c07ffa12d9ac6595a05af489e6d3e140", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188081, "uuid": "fcbb8d51-485d-41e2-9c1c-938def5c3a11", "comment": "Malware payload (Mirai)", "value": "1d09d91bf3fe8f1cb072f94e57d689b005431e0444e3af06520c96b79c2ee7ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188081, "uuid": "bce98bc5-36c9-4922-b986-06159e1d4272", "comment": "Malware payload (Mirai)", "value": "a65da947cf19f1ea43ff0eac4f900536a32ac540", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188081, "uuid": "1307c54a-d5b9-4af4-a747-6eda532ca023", "comment": "Malware payload (Mirai)", "value": "f6c1896f97fc7c4e3a98ab77699fc961ca63993fa056876ede70b34ac7c56c563b20200f5e5213b005a6482930a1e802", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188081, "uuid": "409d4448-23bb-4891-9135-483675e54ba3", "value": "T12EC34B366E762D27C1D6647A02F70371B1F2138934B8CA2DBEB40E4EFF59660311766A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188081, "uuid": "ab007601-1e87-4ce2-9595-f31954d9905b", "value": "1536:2P4aUMjXY5aSbvPVAHQ419lK1QSqRg4UwVNL4M/v42lk5WRvtkXVVfgy1b/j:2galrY5Z8KeSqpX42lUyGYyl/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687188081, "uuid": "a8d19cb1-7ce3-4655-830f-468178c3af8f", "value": 129288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687188081, "uuid": "d6a668dd-12de-4ba5-8158-dabfad0b59e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188081, "uuid": "89a2cd43-c616-46e7-9450-3d3966bb29b9", "value": "c07ffa12d9ac6595a05af489e6d3e140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec60c04-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165768, "uuid": "d19d553b-afc5-47ce-824b-ad1e07734612", "comment": "Malware payload (Mirai)", "value": "9418673e6d1b70195c4c5f8c3cd09487", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165768, "uuid": "dbc0f3a3-a00d-4ef1-a0d8-a2e553d32d75", "comment": "Malware payload (Mirai)", "value": "1ee7a8a7a0e6ecf548dd3d9e877ff9e03723a34eec427b1c1697fdbe1450cedb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165768, "uuid": "f7083bbf-e9c8-4947-877f-0eb27828414e", "comment": "Malware payload (Mirai)", "value": "467b893324cf27fa2d805a84f40688265fb119d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165768, "uuid": "9128408e-b24b-49c4-8d22-58c21ac307d2", "comment": "Malware payload (Mirai)", "value": "51527becd9ff172ff94384f04ecc4dc59d771a26895ae6c43d2297eaf95b00c4d23ab0643357bc05a37db9aa8ae615f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165768, "uuid": "28fd0314-7685-475b-8f6d-8da963448d8d", "value": "T1F8B2D16547D9B532CB305839B1BDCF935B2B42E8D2BB38267554A63DCB8048B32789C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165768, "uuid": "80afaccb-17b3-45b0-b6fb-3501d2510441", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYV0Y0NCPVwD3nF4TGBbtbRzx4MInBKk9hymdGUoU:4GaKQFH0rs3z20NCPaWsRbRt3kf9s3U7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165768, "uuid": "b6a4baaf-5be1-4d33-940b-e9af15283fd6", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165768, "uuid": "baa5fc34-1cc1-478f-a743-bef7ef457a70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165768, "uuid": "b917a40b-5f45-45a3-b7d9-270a8d7e3949", "value": "9418673e6d1b70195c4c5f8c3cd09487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f36f8f-0e95-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687174395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174395, "uuid": "e23b8572-9b25-42f6-a22c-24bcf4ee5010", "comment": "Malware payload (AgentTesla)", "value": "9451c422b20b482ac8d7eabbc6ab8f60", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174395, "uuid": "706e2382-58a7-4734-80a1-35c8c1cf7e31", "comment": "Malware payload (AgentTesla)", "value": "1f1987c42f73ffac95703d0f7c9445819e46f1471eb6049a51b66e0c7e730804", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174395, "uuid": "974a2d5b-e113-49c4-850b-bab370fbace9", "comment": "Malware payload (AgentTesla)", "value": "3eab9eb3821126aff70399c80dc1a0a98aad2205", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174395, "uuid": "539a1cf6-285f-4f94-8af7-8bd1b7f2bdcf", "comment": "Malware payload (AgentTesla)", "value": "2c0579a71fc27702cd463294fa86d6792ba8e872977f910620ba96affd31f571b0e7440a187dfbcf15f100890d3cfa14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174395, "uuid": "f9dccb0f-8a4f-41cf-a3d6-8b754bec6f06", "value": "T1C015E06436B90B53E07D97F90442A63117FAAA6A743ED3194ED7F0DB2A92F400E91F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174395, "uuid": "003e2ff9-f225-46f7-a515-fe43ed863651", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174395, "uuid": "3b26d39e-f18a-4417-b81e-39fb45afabbf", "value": "24576:YQYqtm8OqKp8+BaTwUqgYU8Fg2Ci9nJ7Ydx6iA:Z+8On8+ETw88FSi9J8dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174395, "uuid": "22434f2b-7024-478f-aab3-6bc2832132a5", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174395, "uuid": "92a6e763-3cb7-4100-be67-f6d503483902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174395, "uuid": "62c01101-8359-42a1-bb6f-8f9812a3b709", "value": "image001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba621e5c-0ea5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687181545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181545, "uuid": "6b45bf83-3add-42b6-88fa-ccbaa60cc676", "comment": "Malware payload (AgentTesla)", "value": "ed087632b05f6d8e4832934458bf50f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181545, "uuid": "bf526b60-6c64-4023-b440-a29e4c30b2c1", "comment": "Malware payload (AgentTesla)", "value": "1ff43333678832208f4ec23ff31d65b84a5fec7df5f921467302c591c97a1955", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181545, "uuid": "00e2f8bf-c8bd-442e-a694-957e937e626e", "comment": "Malware payload (AgentTesla)", "value": "e0d0a978ea868ccad30629ba1bd3b19da00adf4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181545, "uuid": "b6825848-5629-48dd-b94d-ce12fb7e6c36", "comment": "Malware payload (AgentTesla)", "value": "35b74aaae7768f3384cc86c619d805d348f799f9e268ff949d2890000f64b5c09844093c359387de5ddc497061b452db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181545, "uuid": "62e79c6e-48bf-41fa-8084-cfd981565627", "value": "T1B805011833FA451FC0AF3FBD1C216134C3F4B2567863D79B2E5669DCAD82B558AA1283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181545, "uuid": "4c00d807-ee10-45e3-a876-c1b1828978c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181545, "uuid": "cab5eb5f-3d1d-4db2-9028-bc8aa63c72e6", "value": "24576:1iOV/NOa/QAWIb9fa3lUvqOcxALbUK6ZzrTUJBz:1iOV/NOa23lyqOGALj4zrTUJBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687181545, "uuid": "c68df7bb-6f7d-4318-b88f-1685bd10bece", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687181545, "uuid": "3934ca93-5e3d-4668-9a6a-c36a60e402d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181545, "uuid": "ac41e56f-3174-40ea-a70e-f4ef420cabbd", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f966cc-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687174134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174134, "uuid": "084f53c7-d36a-4ed0-9caf-db8216df48c2", "comment": "Malware payload (AgentTesla)", "value": "115e4f477137a6665e08bb5c579e0d60", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174134, "uuid": "d6cbd07b-05f9-4177-8246-959309baf769", "comment": "Malware payload (AgentTesla)", "value": "200f389a854aaa4ebf864f3ad70f7eb4ee2526cd0e0cc0d5991b019c55a0085c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174134, "uuid": "64b8853c-9373-4dc6-9363-1e8a2e7fa9ef", "comment": "Malware payload (AgentTesla)", "value": "efc49432f11f2bb051477b12d52ea70fd02a49b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174134, "uuid": "40a98b7e-a6f9-40e0-ae32-f02c56dbc076", "comment": "Malware payload (AgentTesla)", "value": "420611f96975e5d265fed11991a489c9725cbf15eb30f485303c4e16338f77771f2c8af7a3e10e7f0f2016d455c9b81e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174134, "uuid": "cbad7acb-9c57-449c-9242-351671f1e438", "value": "T14B048120BA47DC67E621463437A5F26202426D637D59CE562ED3B20E03F7B407DB9E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174134, "uuid": "09fe8590-c8eb-4899-bc52-86c4a1c3bbec", "value": "3072:E9kZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAkXN2AO3rg75pfj+NtQJI1qMFq:ECZ+RwPONXoRjDhIcp0fDlavx+W26nAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174134, "uuid": "c910158c-446f-4397-bcd8-73d72df24275", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174134, "uuid": "89857233-5065-45e9-b53e-f5d08093f636", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174134, "uuid": "7354b8ba-339d-489b-9868-dd710a5753ce", "value": "VAV_PO_2023-24_345.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71e10ae-0e68-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687155313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155313, "uuid": "2aac2689-aa9d-4567-b506-6ea08116c882", "comment": "Malware payload (AveMariaRAT)", "value": "c1433f347509f14b87d33cd9c0d00f08", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155313, "uuid": "e4baa4bb-1035-4989-b26d-4f53a9b2dca8", "comment": "Malware payload (AveMariaRAT)", "value": "20bb50c3fad7fc5d672a0fe6ea23608a8e4454dc89dc065029259a98e4b3ad9c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155313, "uuid": "740e9d68-84c6-4c0d-a64f-75861f4fc177", "comment": "Malware payload (AveMariaRAT)", "value": "e332dd9227c969faaadc6b5afbea8b5ba8b8badc", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155313, "uuid": "426a75cd-7859-4800-a444-e2a86b29d877", "comment": "Malware payload (AveMariaRAT)", "value": "20516c6ac20e7c8fccd41a23bccde5c6f3b80adcf41c493d2b1623b452cba35db7644c843a52fc4a68c1bb0acfac7a98", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155313, "uuid": "d84344b4-b5dc-45b2-9466-9ae02fd9817e", "value": "T19FE423081518D42BF4E309F10D7B36D53FF96E260093275763B0AF89FAA3945E86B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155313, "uuid": "b45ecbdf-49bd-40a0-8e7b-7199ae5254a6", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155313, "uuid": "0701e94c-e80d-41f7-9552-c17b8f8e13a1", "value": "12288:gMwRrFNtAvPzSLs8c7uL2O0oVkFY3iOCm/l8v/Tw0xopxF:gMwRrFNtAvWwn79O0QkFYJJmv/TwvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687155313, "uuid": "a741b204-e33a-4e83-8517-8c8b7239636b", "value": 683469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687155313, "uuid": "768deb05-8efc-456e-89a5-eaf2f7c037b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155313, "uuid": "3fc23c90-bfdb-42b8-a95c-07ac8d35823a", "value": "PAG JPComp-Dlight.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744a678b-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687174126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174126, "uuid": "73eb8cf2-3802-45b8-8447-74dbc1e31185", "comment": "Malware payload (Formbook)", "value": "503eaa825d4f4f28b4c51cdf6159acb3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174126, "uuid": "9ef25be3-f8b6-4460-b0b0-61efbcb65a20", "comment": "Malware payload (Formbook)", "value": "20c6f18dcd705dd885b8583561523a3731d07bdd2a8025faea96c2e136b1790d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174126, "uuid": "560ce21d-ddde-4954-9866-44dba62ff91d", "comment": "Malware payload (Formbook)", "value": "577dc7af87f60d7ff3de02922adbddd10a2800be", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174126, "uuid": "8d6a1761-7064-4558-9b69-bd97449bc4c0", "comment": "Malware payload (Formbook)", "value": "498f9d43f7a6e01288f7f727c07a185a35d0bdd5c913d2091ec50e1dfea8c8b7b00a5055360be11db78c0b76d8c5b3ee", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174126, "uuid": "685c78be-b9f0-4467-8c2f-c8f578346906", "value": "T17EE2825AE78B02754F5112B6571E0EC99A7DB12EB35055B238AC833433EDC2E0676AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174126, "uuid": "c8d09724-947a-4bc2-a358-1cd28054dba1", "value": "768:sFx0XaIsnPRIa4fwJMkvMh3HXQtH1sV0ml2LgbxyiOE:sf0Xvx3EMkvMh33QE00bQiOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174126, "uuid": "c56e61b6-44e8-4b6a-a605-b61ebd966f1f", "value": 32408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174126, "uuid": "f9c3118e-0dfd-4c94-88bd-8394fe0d5830", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174126, "uuid": "7116e4cf-48d9-47f1-bb11-0a6803c10602", "value": "IOBAN2315855138.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6358e94f-0ea2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687180110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180110, "uuid": "d9599772-834e-4f17-87ee-b8b1b260f5b4", "comment": "Malware payload (SnakeKeylogger)", "value": "aa2a3761fc5481210139fbc01d54df95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180110, "uuid": "92a73b5e-ebe9-4e40-b891-6984b7c8fd7f", "comment": "Malware payload (SnakeKeylogger)", "value": "217deeacbfd0b0a0b448fd35c2dc00797077e43f7fc2383b6e1fb86029eccc52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180110, "uuid": "0643ebe8-ee3d-431d-8e89-3919c958b74c", "comment": "Malware payload (SnakeKeylogger)", "value": "c5cf5a078488bcd52b9372a58a3e95a9bf74cc06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180110, "uuid": "6951e3e9-5ca9-421e-86d2-daa87e493f8e", "comment": "Malware payload (SnakeKeylogger)", "value": "ce79ff3a720cd8738b57a4988ab979620ffe828641934d80f4f9fcea5a43710c9b50896ad8bd367fffd7853a0d490269", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180110, "uuid": "d874f74b-9353-4205-92d4-a0355182c7d2", "value": "T114F4124C5AE8A20FD6675B789B51B7B8472FEE81AE33D32B2D10B0C7AD157154B02372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180110, "uuid": "97df98ae-d241-4b00-ab73-4bbb0454c232", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180110, "uuid": "8c2b79bb-cd6d-4bcb-a96e-2a8501788579", "value": "12288:nMCEngRq3ecmgQ1YQmfFWiML2lEnXBVii0yfStYq7J3At5iHOq+ZQ:nM4cOR1YQpSlExeyfqYqtm8OqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687180110, "uuid": "d6f58dd2-c5bd-4be0-acfb-1a22372642ee", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687180110, "uuid": "76c94f5c-a7ca-4647-b1e2-7deb277d7439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180110, "uuid": "99932af5-7cea-4e4b-bef1-608348c88e10", "value": "Transfer -Invoice compressed documents MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a690e430-0e8f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687172063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172063, "uuid": "c124b84a-4129-4cc3-8aad-e71caec94db9", "comment": "Malware payload", "value": "e93b175a4dd53322cfdcbe56d1210946", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172063, "uuid": "0feab265-cb22-4a7a-8f0f-587741c212b2", "comment": "Malware payload", "value": "21a5476cb403d244cf4c3133d70357b6fdfc42bed9f0a7cf3b765efdcda3db02", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172063, "uuid": "039d338a-7c4a-43a1-a955-ff7e736dd5bd", "comment": "Malware payload", "value": "86a4ce05109efe533c05c46e18bce0e5617fa313", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172063, "uuid": "4b6f0bc8-94db-4aa2-af0c-0401db9c230b", "comment": "Malware payload", "value": "b6921acf602279b737d1c1f80a9d1021b5bb9bc2a3fdbbd14314150a11bdec20a76eafe100c2270f097b3c2cfd353544", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172063, "uuid": "c53bf853-3377-4795-97bf-a998666ba47a", "value": "T173B58D217687C032D56E0273A968EE5A153CBE730B7145EBB7E83A6E5DB08C15339B13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172063, "uuid": "217216ef-dec2-46a3-8c40-4903356ff35e", "value": "49152:Ilds9hwJrEBZfSYs9UGHO4XR15aGO1NhZDB8pDESD30TimgS5VW5a851wfM/3F:oELUHO2iZ1ZTimn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687172063, "uuid": "67110866-1047-4311-85a7-f366a0679939", "value": 2416640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687172063, "uuid": "841861eb-bf47-47d7-a535-abebfd005197", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172063, "uuid": "ca7e6867-6467-437f-b31b-1e6dbad179c0", "value": "GoogleAI Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73512009-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1687168111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168111, "uuid": "1dfa1428-856e-48fb-943e-42d6169717c1", "comment": "Malware payload (RustyStealer)", "value": "8b12c3733b73e9974fa0148aa3963dc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168111, "uuid": "f9eeabe2-fd5f-45e4-a340-19698b3e76b7", "comment": "Malware payload (RustyStealer)", "value": "21d3d0e58b5b8a056b5117b272c76dd12259c2e4ff6ae6e8465294c325631b67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168111, "uuid": "ab75272e-1955-4c71-8604-a98937e9f749", "comment": "Malware payload (RustyStealer)", "value": "8ce3c47ded630aa76ae803076ee4de22f1e89f8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168111, "uuid": "903a47cf-eb76-4f47-abbe-3162d5b478c5", "comment": "Malware payload (RustyStealer)", "value": "5513980c1e2ad26710a163e1294684cfafa187f4556571fb08ce7d9d7eabbb0c9cb71aeb8969aa85647456e596822d26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168111, "uuid": "9108114a-ff80-43a9-b84b-a5485fdb9b34", "value": "T1956623BD62503729C42ACC785233A946F2B5561F22BCC56FF2EF76403BAB421D956F08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168111, "uuid": "e1d65b93-b382-4976-a6aa-2b0286d1b031", "value": "e72881703e5c79a186fa6644689dc217", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168111, "uuid": "869951ce-e204-43aa-9882-12a9e1c04063", "value": "196608:b1pKJENuTibBLY5VqRpzAbXXyUSC7iQov13d+mk4G338bx+:RpzNSQ/ziXXbx7KCT3s0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168111, "uuid": "dee1bfb2-2e42-4bca-a6dc-01ad11238ad0", "value": 6485504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168111, "uuid": "0efeed5a-a5e9-4ae0-8a14-268ab616fa5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168111, "uuid": "a432eae8-8854-422e-9716-5cef53982add", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d5f7f1-0e93-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687173840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173840, "uuid": "4a1847ba-d5ee-4525-8743-3839efcd2a1d", "comment": "Malware payload (Formbook)", "value": "aa0bf88f08fb6d4ab0286244020d6518", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173840, "uuid": "d31b42b0-d7d1-462c-8cbe-063edc7d7699", "comment": "Malware payload (Formbook)", "value": "22e9913895987cd95d1bc1a32a2175f9a734399ce4c62e70a31c11ae4d2f051a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173840, "uuid": "8aed5046-d0d2-40a1-9a45-5b47c55874ab", "comment": "Malware payload (Formbook)", "value": "52fcfbd031e83d80cc70a22e1a1d68c4b4d042d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173840, "uuid": "1d9919fe-54a9-43c1-9e00-d941acbcf04e", "comment": "Malware payload (Formbook)", "value": "f9930d3d946f696e70dc733a201cbd328b07533026ba0c0192dd764a81f6cf8bccc5a3a836c23757c300767e022d032b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173840, "uuid": "d80ddfa5-16f5-436f-9293-937487f0e683", "value": "T1BF5412247190C4FBF8A35AB01A3D46956AF4CD1324244B4B4794AFEE3BBE7D2E90D781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173840, "uuid": "fe297cf8-901b-46cd-8b02-183a60d462d1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173840, "uuid": "a0372d4b-f7d5-466d-a872-a8afa2fed2ad", "value": "6144:/Ya6qvFo/wOQGfQUzsaYZWHrStBsR59+JvPXT:/YMvy3xfDaSjR59+JvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687173840, "uuid": "1a58380d-222a-42b8-8190-fb38468a27cf", "value": 291922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687173840, "uuid": "6920954e-48cf-488d-8216-f4fb26db3cc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173840, "uuid": "5ebb55e8-c246-4f51-a3cb-9fb37e57d47a", "value": "aa0bf88f08fb6d4ab0286244020d6518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15608dfc-0e88-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687168813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168813, "uuid": "b6a8e9ec-8877-49d5-acf0-a568c0eaee4c", "comment": "Malware payload (RedLineStealer)", "value": "7bbba13cfe698309a499eb6b1ea5a8a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168813, "uuid": "14c170ed-8a53-4ca1-a18f-0784ef3d4985", "comment": "Malware payload (RedLineStealer)", "value": "23ed929b0a898ba1ed493bf06f9463f36ef98ae443dce8b0c35f061abcbc6637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168813, "uuid": "44a92297-d316-4d5c-abf2-f3315bfb14eb", "comment": "Malware payload (RedLineStealer)", "value": "880de949297bd14b4dd8ff239000b7d93f98df8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168813, "uuid": "2cf8a77f-4def-48c7-b91e-4a749fe5e7e0", "comment": "Malware payload (RedLineStealer)", "value": "b885f2874d8b18e670282d8144eaa04aa54b055914f53e4c4dcf2af2c48750fe70eadf4b85d4971fd21a5d6fd4c534d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168813, "uuid": "3c1901a2-05c1-44e4-8879-6b2db7866449", "value": "T110051213BBD84032DC6897B44CFA02470F327DA35DB88A6F27A5995E1CB25D0A93477B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168813, "uuid": "3648386a-a39e-408b-9728-b4669f1fbfee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168813, "uuid": "a6c232fd-5e8f-4695-bb0d-a70d25d4a6a9", "value": "12288:QMrMy90sNpuWfPkBJiQISM2/FgB/ygOzYxyYlCx4tHtM6Y24C0V3tkmaQ:MypHuyTs/wytMW4Btr0qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168813, "uuid": "335de9b9-282e-4a8b-985c-34a24fb53e7f", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168813, "uuid": "fdb61bf2-67c2-4d6b-a082-747891c0a17d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168813, "uuid": "c178e6f4-fa07-4020-84ab-73251133e04f", "value": "7bbba13cfe698309a499eb6b1ea5a8a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0399f086-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687167924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167924, "uuid": "a08cc52e-6c22-46a8-bb4b-51bee2934e9f", "comment": "Malware payload (AgentTesla)", "value": "6f54be808b1f6da4e22c4a0fb464282d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167924, "uuid": "4b1fb74d-c1fd-4b14-977d-889e16032aaa", "comment": "Malware payload (AgentTesla)", "value": "2483ac94503684a84de889ec8e1340463d13251b4a13b341fbc9b047df251821", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167924, "uuid": "6b60bef1-f5d3-4577-9ee1-809c207f70e7", "comment": "Malware payload (AgentTesla)", "value": "0700c5ca83b5868d607e4262e0bf3f93d47454de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167924, "uuid": "3fa6b863-9571-4c95-9359-13d999b37388", "comment": "Malware payload (AgentTesla)", "value": "93ba622827b2398862eec66c3437e6dea882c3183afa62ca920ea4797f1bc32a2b9f0102ea6d9c38fcdbdf4ab72bcf51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167924, "uuid": "6f75ded0-167f-4189-9fb7-c595d6e1901b", "value": "T1FD047021FA47CC66FA2146343795F16202426D637D59CE562EC3B20E03F7B506CBAE9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167924, "uuid": "0a30c0aa-47e4-41a2-a81a-d3505f082151", "value": "3072:vQfZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAjXN2rLlxNli9hjfqwaKhGRkG:vUZ+RwPONXoRjDhIcp0fDlavx+W26nAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687167924, "uuid": "3206a338-9de2-4725-85d7-8b886bbc8b13", "value": 173568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687167924, "uuid": "7b00ca05-1157-4137-ba4f-0e80a6a4e68f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167924, "uuid": "4df212f0-2d7f-4a91-b417-d9ebfacb3e06", "value": "Pending invoice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7735355-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687160548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160548, "uuid": "ecfa6b98-893b-4190-b30d-a05c9b15d471", "comment": "Malware payload (AgentTesla)", "value": "09453e476f3391ba939de2aea23e781f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160548, "uuid": "03c404cd-8aa2-474b-9b6c-3f412283e94e", "comment": "Malware payload (AgentTesla)", "value": "25f7744745213c2cc84c92f9182be6b47ed7abbfcf26311a92515f58babcbc40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160548, "uuid": "701d636f-05e4-4da7-aba1-3fbd2cd84039", "comment": "Malware payload (AgentTesla)", "value": "cf81d658e033712ac85b0d3f24d63ed709deb7a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160548, "uuid": "2209f066-d872-4037-b747-0ca4a4a5bde7", "comment": "Malware payload (AgentTesla)", "value": "07f302d9bf63c16dd42d8b9d70d232fb0a09d5fd77db5bd609869ed13764006bc9517cbed610b7cec2ba2ebcb07d3a65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160548, "uuid": "0ab55827-c5f8-4db5-b089-3293d145b627", "value": "T1A9D4239C074A6B27E0770BB52C2028B0633F67E67436D3572DE372DBDA81F952684A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160548, "uuid": "49dc67de-2954-4068-9474-50a5a7b48246", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160548, "uuid": "bbaa1ef1-eceb-4667-b74e-240dae3a8369", "value": "12288:15LbzIu9+r9lZWcrCvkji9p1kGU0er/gKnIVhqafkPNtT7C6a2xuhu:15LA9ivkO9oGU0e7gXqfPNhJxuhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160548, "uuid": "2ae99552-2c9b-46fd-8a66-241a1a0a3125", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160548, "uuid": "3135b965-72ed-430a-8030-c1bf4418fdc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160548, "uuid": "813c6558-b131-4402-a45e-3f664d82cc3f", "value": "DOCUMENTs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8740396e-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687174158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174158, "uuid": "8a3fdafb-5b53-4970-8d24-1e294ada77ee", "comment": "Malware payload (Loki)", "value": "3b9ea0ce8c00a84ab63a1425a575e75e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174158, "uuid": "4580f943-5d26-4cb4-9f4a-d87f89a48eec", "comment": "Malware payload (Loki)", "value": "25fcbdb67d14b109af5408df8c9b78305c41afeb8ad3707147c7c350a0535330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174158, "uuid": "b1ca79f2-fc7b-4610-ae1f-b33066c99fc1", "comment": "Malware payload (Loki)", "value": "12fc0b1592d39dcd674e8183429346c04b184aec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174158, "uuid": "bb9a8dd0-ef1b-490f-a116-ea80eb02f4ec", "comment": "Malware payload (Loki)", "value": "12ebac3b5e6b09c2518406c139e26e33af60fb5afb3c5c26b2b3fec69e0d84fd63648fd07fceccb0522c991adeeb6657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174158, "uuid": "4755b5be-f146-4170-a9ff-a3a7c07e0759", "value": "T106D4124868A89B53E4670BFC45A03375277E5BF93D22F71A1EE2B5D8A839F424D10783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174158, "uuid": "9cbb7f2c-3e34-4ed8-871b-3e69b5c6c508", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174158, "uuid": "8ac81a97-06de-4f67-8bb5-2b63e9883da9", "value": "12288:01tYq7J3At5iHOq+ZQ/uqqtC6TmxB7BPqhmDhmng50me:0zYqtm8OqKmubufg20ngp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174158, "uuid": "5fcacf97-7809-4aad-a75e-ff67506dcca3", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174158, "uuid": "43933706-dfa5-475a-bd70-fda6a860a242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174158, "uuid": "ce8f6161-0696-49a8-8475-649ec67f2596", "value": "FedEx Receipt_AWB#725323204643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5f9fb3-0e51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687145336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145336, "uuid": "fd41583c-ef46-4d5e-b3cb-30b04ab30036", "comment": "Malware payload (Gafgyt)", "value": "8be19d8eb75037d5a1a2b69095c0c010", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145336, "uuid": "58c45eba-a9e6-4465-80c2-81141b51f848", "comment": "Malware payload (Gafgyt)", "value": "28b4654ac2500b4e77654c56acdc81e7565c7ec197d95fc807bf9bc463058448", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145336, "uuid": "a48c5259-a87e-4cc6-a845-ebbc80a9c8f7", "comment": "Malware payload (Gafgyt)", "value": "80d52960bce9d9f3a4d914c2e9bdb1de82046a7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145336, "uuid": "8c0c08c6-ef0d-4a09-a05e-7e4e585cb109", "comment": "Malware payload (Gafgyt)", "value": "b91da7460d73ba3eac574f31c324ca68c75ced83c9058e26e807ce772731e7b1d9e6dd36516b0571c7ebc178446149c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145336, "uuid": "9ed35122-262f-4fe8-81e8-e0997275a12c", "value": "T189B30893B900EFB6F40EE77604D34B257630BF624E531662721B3DA7AE362D42826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145336, "uuid": "66461845-70d6-423a-b014-2cd2eb2553a6", "value": "3072:e8HN8OaXy/Hp92j6D9yGuJa+tf9uN6zzmp/kuCLRlXYcNb:eCUC/H7269yGjIANump/kuCLRlXYcNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687145336, "uuid": "3495417a-3e7e-4e48-b564-67270d851cff", "value": 113822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687145336, "uuid": "5c0cb4f9-a95f-4e06-9e4d-983f50b7527a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145336, "uuid": "0c3dfc77-8eea-485a-9e91-ff3e65b38f77", "value": "8be19d8eb75037d5a1a2b69095c0c010", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89287dd0-0eae-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687185328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687185328, "uuid": "63feffe8-5470-4ff8-98e3-7fb4bb9bdeb1", "comment": "Malware payload (RedLineStealer)", "value": "6643d306d19d7c216431d2f1961bed20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687185328, "uuid": "1985abe0-36b2-4959-bdab-681332349ef8", "comment": "Malware payload (RedLineStealer)", "value": "28b54683c8db0b3edeb068646b0aa206b84363c38d62597597bd9a8e5dac9dc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687185328, "uuid": "1f65fce6-9e2e-48df-8024-a4fac7f56838", "comment": "Malware payload (RedLineStealer)", "value": "6ae1dd6eda67a977aac64add730323e8d5ffd86d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687185328, "uuid": "b824d9a7-7106-4bd9-8b8b-78f6be1cc81f", "comment": "Malware payload (RedLineStealer)", "value": "76c41a040a562e59abedd0d68aa6b61c965f0a547900c2207fb35051d90676c92ac848d7cda02f6da03e0d47bf0f89ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687185328, "uuid": "03258221-09fd-4b2f-bb46-2a826810545d", "value": "T1CAD41212B7DD9073D5B1277059F723872F37FCE24868832B278A595E5CB2680A932376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687185328, "uuid": "c8b15b42-3dc3-43ab-b031-7324f3d5992b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687185328, "uuid": "9a29d43f-58bb-4764-8dd6-45744f835278", "value": "12288:pMrYy90F0nVLvDrjmbk9kzO6qYTmzlAaQJ7TqJ8kjjaEl3r/d:xyNVTi+kzlqYTmzaa2qjaEd/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687185328, "uuid": "dc6a51c4-ee23-430f-b25a-02daad673478", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687185328, "uuid": "f1a8d305-7c42-435e-8090-172229fe3ddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687185328, "uuid": "b094c5bf-a7c6-447a-bf8b-02b6666055eb", "value": "6643d306d19d7c216431d2f1961bed20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25717fa2-0e6c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687156814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687156814, "uuid": "758b6d03-ac4f-486f-8cc4-54bf33c1f427", "comment": "Malware payload (Formbook)", "value": "06f6f50ba73ed99075acfad2e0c13a1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687156814, "uuid": "9a9194f8-bf1d-4374-bde2-fd50e23b53f4", "comment": "Malware payload (Formbook)", "value": "2968df5307f5f87cf57d3f470edea04d1fad9b3a60426e59bbaccd5ab0b0a543", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687156814, "uuid": "bf99a94e-5b7d-42cc-a385-6d1483bedf6a", "comment": "Malware payload (Formbook)", "value": "35b12b56c5ad8a488f61a770452b6ddac045d7f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687156814, "uuid": "116b1525-4252-4001-90bd-65df547e77a2", "comment": "Malware payload (Formbook)", "value": "87df302a02463f95e535cdef4fcbdf8d91e44a648e22efdde1b79c6a73cf467afd1c388e0de424441cce01c713775a02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687156814, "uuid": "65f8360a-7ac4-4a64-b564-b246430b9129", "value": "T1F905011917FB552AD96B3FBC0D644171D3FD8AA6B027C7039E9BA988EF13B1049906C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687156814, "uuid": "c1edb673-8ab0-4c19-899c-5369fe7f8edb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687156814, "uuid": "6516b311-b6c3-4859-a1c1-f82e28283495", "value": "24576:tG0biRoSErVxIE5qm2dOWDA3YH7bm1YqMdTv8:sy4oRrjIw72csbhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687156814, "uuid": "bdedf1c5-6aa6-462b-b95d-0bfe79aa8c73", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687156814, "uuid": "7975aead-dfd2-4c33-b2d6-77ec225c0c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687156814, "uuid": "75b29935-ca50-4f81-b423-70aeec330555", "value": "06f6f50ba73ed99075acfad2e0c13a1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58dc870f-0e7e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687164631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164631, "uuid": "84a34980-9372-49af-ba69-7ffec37fd958", "comment": "Malware payload (Formbook)", "value": "06f7fc2c1326c5fcf63f3d5876f97eee", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164631, "uuid": "17c0f6dd-69b0-40c9-a898-ff84f5f236f1", "comment": "Malware payload (Formbook)", "value": "2a35f64577b3890e7b53408aeeb8afd0e75f94fcaaf9548311d95c434c673493", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164631, "uuid": "ee7509f0-4fdc-4910-ac28-c2c213d544d1", "comment": "Malware payload (Formbook)", "value": "dfea7d39fb81d9a02a6f2dae862cbee7d92ae766", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164631, "uuid": "9257f21e-2215-4c09-a1cb-53c823893d7b", "comment": "Malware payload (Formbook)", "value": "15fe643aba4a0cbe63cdd62084d44b5abe8fe5f421df21ae585098d89c7a984c614757424a94f6f0da001912525574cb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164631, "uuid": "d2f0a076-9157-4a39-bb7b-75a4ea89aa39", "value": "T1BDE423B6AC3492DDB7F5598EF4D8DEF85639050F4B377149818BAB18C34C4A460BB28B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164631, "uuid": "a301e454-c3ed-453a-8e20-7e1cbb6d953f", "value": "12288:mImLRfnou9X0nTqEnyNkAAPv0/o+zJM2/UEsTUtvoy9WdvWSrn+h:mJLRfovnTqEnyNNwUoesItgy9Wxn+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687164631, "uuid": "b488fb59-32ea-4c09-9da0-28374b168793", "value": 663727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687164631, "uuid": "45efe7e8-e490-4ab4-8fbc-0945b84bf1b5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164631, "uuid": "71ac821f-0ae3-412f-830a-5b14f97b71fd", "value": "Quotation RF181-2023_1.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e117e65c-0e8a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687170013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170013, "uuid": "15dff99a-d2ca-42d2-b4dc-3fa72e5651a1", "comment": "Malware payload (Amadey)", "value": "89714c3399100187a5b5d3bfa0801431", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170013, "uuid": "9649859c-b845-4477-988b-c94ae4d6b875", "comment": "Malware payload (Amadey)", "value": "2a87658b07d37aef9321625344994ed0c7e8163f243ce624ba9f5b2768cb14f4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170013, "uuid": "a59ee759-d046-42d6-8aed-769854c0943e", "comment": "Malware payload (Amadey)", "value": "cc9b070e64b5c2779c3ad295479e9b36ed21f39b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170013, "uuid": "d017b666-54f5-42f8-96cd-d9139e07f6eb", "comment": "Malware payload (Amadey)", "value": "2fbb0cf0b3da193b9d864b51b86c8693e16ddbf047efd546c581456b8fdc7b603adcf824a031f6dde379d087e99171ef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170013, "uuid": "9f1b6e43-7041-4773-a89e-5cc5c9422bcf", "value": "T137D41253F7E91032D9B42B7058FA07E70B36FCA14874A76F2B969D4A0873980A476737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170013, "uuid": "9177d3e1-537e-4dc3-9b8f-be1569c86ae6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170013, "uuid": "cfae9b22-1481-47ff-b745-99d261753f1c", "value": "12288:YMrNy90OF4JT7FRCkKL3DxcnU/pP94rhHeaLIARrG1JLJEPiGDb:FyU3FRt8GnUxPoVvEAU1Jze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687170013, "uuid": "a68c8f8f-9ab6-4179-ae64-fab436f37c89", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687170013, "uuid": "da2f5bc6-80e9-4862-a2c1-acc04be9b3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170013, "uuid": "aeeac2d4-51cf-4e55-872f-93b95c79fa36", "value": "89714c3399100187a5b5d3bfa0801431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de35b833-0eaa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687183753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183753, "uuid": "d9546c76-c034-4e78-8776-902eaf6cd1c7", "comment": "Malware payload (AgentTesla)", "value": "4a90a5843b529617b685342a21d4b498", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183753, "uuid": "3d94f847-c2c2-42d2-865e-9cdfb6c9d3ac", "comment": "Malware payload (AgentTesla)", "value": "2a91feefd62b7ea2755b002001d55417f592149772111a7371a1789b56e11689", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183753, "uuid": "a8aec3cf-c805-469b-9cf7-1ebe2aaa1bd7", "comment": "Malware payload (AgentTesla)", "value": "f20840abed47d32e82ad53818b3bf8aa235428f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183753, "uuid": "14dfa336-be55-488c-b680-d5bd336933d7", "comment": "Malware payload (AgentTesla)", "value": "2d1dc943743a65c102cb02f229b716886fe509eabfac9c41ce68894e4f06c2ffe576c568b2354fda5a4230be49fb058b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183753, "uuid": "4beb3c14-beac-412e-a61a-056e28cd9316", "value": "T1C3529650BB64A123F72CBBB4ADF30E5D536BA140D182EB4E1BCF058A64D07EC156266B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183753, "uuid": "44589fee-1eea-4be1-bca6-b50b7d0993c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183753, "uuid": "f9129b2b-65e8-4693-8a78-0eff14eff99d", "value": "192:c5DoPx8xyuNC3n798oHt4oBYRiv4y2X1y5ISv:qDAx86n798oHtHqM4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687183753, "uuid": "2d753c12-fb4b-463f-83c5-e62c5e760d26", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687183753, "uuid": "08659531-6bb8-4855-ad0f-84cd5a0aa3d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183753, "uuid": "259b9aef-c88d-416d-8ea2-5535c5f7be3c", "value": "__CN01 _REG1 _RSPVLN2 _333.PDF.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24a2ef4-0ecf-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687199543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199543, "uuid": "34080aa6-47ce-4666-886a-8511e92d588b", "comment": "Malware payload", "value": "edd984376553dff62e3204cafe82801f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199543, "uuid": "ffe52c00-e715-4bea-9667-221ecf8818c9", "comment": "Malware payload", "value": "2b2cc01532fb103fb6dc38d9ff9b3e2ffe8f3993d9e56a4aa2964ce56f0edac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199543, "uuid": "75b37356-d96f-4d51-925f-93639de05f5d", "comment": "Malware payload", "value": "33650bfa9c51809038da629611e275678ac71b1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199543, "uuid": "a4a30ba9-4417-4082-a441-623fff15b4bc", "comment": "Malware payload", "value": "c8a993f2b366e68936f98fb8736f9dece24b3afb05aac5680c1c19b396c16373a9fcb6800c8a4c819fd9d3ae1ca0b5eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199543, "uuid": "54a86032-6132-4d4d-9035-e471c1fe14ca", "value": "T16ED63373BD1D6063E11A3D73E88A590FCD50CFA179A1898B4DAF305F6476BEB8D58202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199543, "uuid": "dd459a7d-df1b-4712-9541-7fe316b6f93c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199543, "uuid": "71b2221f-73ef-43c5-990b-d14a8b55303c", "value": "393216:oNvX+EnpoJBNeZeDzGbNnFlQHAiTgABgphdUF:8vuEINIFXyAcYpoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687199543, "uuid": "c285cdac-ba18-47ad-bd82-545d10608c80", "value": 13772800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687199543, "uuid": "cb875088-285f-4282-8720-a506de6a4094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199543, "uuid": "2b23835c-c49a-4765-838c-45b2bea76c48", "value": "SecuriteInfo.com.Win32.Trojan-gen.10283.17823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5671c91-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687160572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160572, "uuid": "bd5fcb67-7691-45d8-b5c9-cb05ad175457", "comment": "Malware payload (SnakeKeylogger)", "value": "88adf26cd24272be9a66147e15a3d03a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160572, "uuid": "31899023-915d-4918-8f16-19a420d253d3", "comment": "Malware payload (SnakeKeylogger)", "value": "2b5e4a5d2f7cbe457964fb8747517b38b253d7f3b1d289a0257172dc150e0248", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160572, "uuid": "4b62549a-894e-426a-acab-c33fe0c9f868", "comment": "Malware payload (SnakeKeylogger)", "value": "cc68340a0ec5d36035689b73caa1db67eac5ffe7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160572, "uuid": "a81d8de0-2a86-4405-a199-10873a093dad", "comment": "Malware payload (SnakeKeylogger)", "value": "5601d579deabd52f4fe86e28c29c2ac15e6c16d0c7dc917ffeff675d1b7841557489c9efb3c2b1c76623c9c3dd35d33d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160572, "uuid": "13f9e649-5c99-438a-8fd7-e213feaa308b", "value": "T117634987F25A95B1D58D0F3AC56FC9040B25EF92FA93E71A7D8A734A19333C5D81220B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160572, "uuid": "6e3e608c-87f0-4b59-b687-f69306ab348f", "value": "1536:IYh1KPotLwdrsWXsARD6XysaPdusL54iKEFXvxKqHsI:IoVQQWXsxaPQsL5/Xey1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160572, "uuid": "a56ce0dd-9fc9-41b4-93f6-bb9fe9ef7ea8", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160572, "uuid": "9cb5adb1-7d94-4625-a931-da57084f0792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160572, "uuid": "fcc01bf5-21c0-4ae1-a89f-2f2f0ab5ad13", "value": "Xudzxq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426978b5-0e8d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PrivateLoader)", "timestamp": 1687171036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171036, "uuid": "ed52f123-6b7c-45ca-8fe9-af2707a1e94f", "comment": "Malware payload (PrivateLoader)", "value": "4937b0553890805901a3f03af54bf82b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171036, "uuid": "f96a71ea-9091-4641-9b2f-44a93ce62d57", "comment": "Malware payload (PrivateLoader)", "value": "2b8fbd9c119e96331d5470721923a28c816e1e5bcc3ad7c2fde45cd823629884", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171036, "uuid": "e4b34fd3-b55c-4d45-bb46-b2cad157cb58", "comment": "Malware payload (PrivateLoader)", "value": "3ffeb94c32ff3a74fef2120354fb7fb1c8ef5840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171036, "uuid": "e6d5d932-b597-42f5-9d1b-8dbddfe52074", "comment": "Malware payload (PrivateLoader)", "value": "a9ea5e366f872c869480a4861a101ea715d5a288dd6294e34a0c1cd0345be476972a1e8f473c1347e729c3599e02f3e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171036, "uuid": "1f683743-5677-4604-88c8-471eeeaaf850", "value": "T14525CF10F3019072ED621430299FAB765A7D78300276EDABDFD009698D76BC1F265BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171036, "uuid": "52bcbd73-9334-44a8-8a41-636557426c10", "value": "4480d061c3a4bfd23c4bdc107636fc65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171036, "uuid": "af869f5d-8fa8-4d64-ac58-f3be0617a4b1", "value": "24576:s6g2/Dt6D1vB6qzkhgOMdFtzHqfl8O2anVH3qPi5+ThvKtzd:sa/Dt6xvBpws7gX5+Tktzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687171036, "uuid": "2b1e66d5-be0f-4f9d-af47-1d877650ab64", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687171036, "uuid": "af050349-dab3-4039-9821-2f19d40b4c90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171036, "uuid": "6e20759e-93a3-4ae1-bd8d-9542a3358f58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f7c48d-0ec8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687196429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196429, "uuid": "85eeb9b2-eafa-4be8-8726-a55ecb189e7d", "comment": "Malware payload (Mirai)", "value": "9e271c1cadd1b2947dcb617877006df0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196429, "uuid": "7aea7bb9-5529-47d2-8c0e-47cf21b6a0e0", "comment": "Malware payload (Mirai)", "value": "2bdc5de54c2c4910f9238f32483e3a3a7cee0f68356d1985747992e96dcfbc66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196429, "uuid": "de08bada-2428-43f8-905d-b06ade8d4fe8", "comment": "Malware payload (Mirai)", "value": "f9bb472d3ce496d9634b59cf4a05c97f254b1c91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196429, "uuid": "adb48a8e-b3c1-4d43-9b2e-e3e8ca615ae8", "comment": "Malware payload (Mirai)", "value": "cdc4374666c46d2d63aeedf71aa3e289548997f955f87311b95b04b9067e5468509751a3aeec69e9c91b44b71cbdbc62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196429, "uuid": "a5edb423-cd9b-49f0-927a-b7b5c8a8d9b1", "value": "T1ED5339A1BC919A12C5D0137BFA6E418D372663A8D1EF32039D252F5137CE92F1E7B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196429, "uuid": "7df3aca9-657b-43f0-a2c6-fdf077f116af", "value": "1536:ARZH99K/RpbRWTsWPyGU5C1YOLyahWZ5Y5TBitFb0sI10:6ZHjkRLW6boCOL9hWAB0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687196429, "uuid": "a90a3cd2-2a50-43fe-8360-aa303e385067", "value": 63796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687196429, "uuid": "b16320e0-25f3-491f-9bfc-d7fcb7802d82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196429, "uuid": "4c784ad7-5176-4062-9111-891bafb1000a", "value": "9e271c1cadd1b2947dcb617877006df0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d50993b-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687175322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175322, "uuid": "93e062ba-ca4d-40af-9b2e-a8eb2faa5344", "comment": "Malware payload (GCleaner)", "value": "b79281d0666435bab232d9b8646717ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175322, "uuid": "cdc1df3a-06ce-48c4-88d9-07be3952da57", "comment": "Malware payload (GCleaner)", "value": "2c08f15d82331447838f49f8a800157278b272bf3d138d5ce920e25f58dfb73f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175322, "uuid": "b93efd75-4539-4db5-a0f9-546cd73f0546", "comment": "Malware payload (GCleaner)", "value": "e2e0b06347e104a83a9c0990affec649675cf819", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175322, "uuid": "2cf69573-87bb-4918-b68c-14e15c964191", "comment": "Malware payload (GCleaner)", "value": "b071717053c6deac4effb7775354830f263adf919c7ab2e4aa5f574b8c9828da782aadd05e9193f982d3e358e5e092b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175322, "uuid": "e125e62b-c6cd-4cba-a5fc-e1338fed7b1b", "value": "T1A164AF43A2A13D50EA25CB338F1FC6D8765EF6508E097B6D29189A5F24F12B2D173F81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175322, "uuid": "e7d0f7dc-0089-4d5b-91af-f8ff6cd64680", "value": "7444f526e1fbbb340adaca08db3fed51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175322, "uuid": "907cc1d3-23fd-4cae-b5ea-e81da1653818", "value": "3072:LyCD1aNlpKlxFyi+kwoyUgcmmTeDTQBxruvgvvHsYI3RL1ttPb5XCbSeRjSW5C:mCD1oSyW6cmmCDMBx6YHsD7tvaRO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175322, "uuid": "9e001275-36e8-4032-8df2-ee15224f4a6b", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175322, "uuid": "5d7c1561-3304-4a13-bfd8-307b0d9328af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175322, "uuid": "f1d1005f-0242-4395-9561-f49627c0d2af", "value": "b79281d0666435bab232d9b8646717ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24dee0b6-0e72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1687159390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159390, "uuid": "596689f6-b575-441c-ac77-6c72066cbd8f", "comment": "Malware payload (Smoke Loader)", "value": "753b1e9a9dbe86ab4c580942fdda1222", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159390, "uuid": "954cae04-a25f-4503-948a-842d6b37d7e8", "comment": "Malware payload (Smoke Loader)", "value": "2c4cefea32bcd7a2b3fce9441b265f7c4aa36a7dc54ddf4964a6b799266760cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159390, "uuid": "f719c455-9246-4b22-b0de-92e8d6e9fe1f", "comment": "Malware payload (Smoke Loader)", "value": "d0c6e50fa3a8451c9576f00ec86aee3a89c97d10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159390, "uuid": "b766c6d9-85dc-48f0-9d4e-a16f754be0db", "comment": "Malware payload (Smoke Loader)", "value": "1d4ddbf3faa7922ae357a481aafcb71445d6f2c0aae4b56f324e12db74d1ba62fb9c108121708f89f5d4def560e3ef78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159390, "uuid": "f67b2051-bbb0-464e-a1b3-78b470d719fe", "value": "T17C349ED272E1EC70D5251632AD2AE6F52A5DFC508F282797E3187A1F09BC2A1C573317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159390, "uuid": "6559c545-0241-49e8-9a92-028928f09951", "value": "e22f6bb2be4e12044608fc1a03b29b46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159390, "uuid": "d76b0c11-78b8-4ec2-850e-ee35ed96386a", "value": "3072:ry0jG8JYhONZkksGoT0RtYoQdldb9k3fbDjEXk0Aio81s19vxW2oAYwM:Xj7KhONCksRnPuWkffRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687159390, "uuid": "7a4f3f71-176c-4b97-9575-7ab516a75fee", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687159390, "uuid": "0650e6a4-4ff0-4c3a-b2f6-fada5dfdc9c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159390, "uuid": "529d8c3b-0b21-4cfe-af31-60d3152db607", "value": "753b1e9a9dbe86ab4c580942fdda1222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd2b90d-0e66-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1687154410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154410, "uuid": "084d7361-8662-40c8-8b37-dbaf9a012e04", "comment": "Malware payload (CoinMiner)", "value": "10f47af828a8e5880a751635143563cb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154410, "uuid": "e4e36b26-6bce-4768-8639-819223ed4b2b", "comment": "Malware payload (CoinMiner)", "value": "2cf7764d7c90c8bd63c0f5f4d1a5554fbca5276210c5b5d7e013b7dbaa42d6fb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154410, "uuid": "58542ff3-41b8-472a-bf82-2f73a8649723", "comment": "Malware payload (CoinMiner)", "value": "af570f4569ce36e58038c44a176148afe6b053bf", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154410, "uuid": "2dcdfbec-e085-4d48-940e-45fed08c4ef3", "comment": "Malware payload (CoinMiner)", "value": "aa2a994ae562d4048eac598d5d29bfe1dae10542aa0342b8c6d31cdc14aa3042ba6725b004e5f141e4cdb0938d919417", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154410, "uuid": "3395b92f-f287-41eb-8a60-dc45c01ece8c", "value": "T1DD44E54A2F51B538C00DE8705BA83290DB392E253B7B43762B56143AAE34EE74DFD5C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154410, "uuid": "c2c31133-c553-4c56-b8f4-157dc890f89d", "value": "b88ff38d8a9dd531263365f3574a285e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154410, "uuid": "a1810bbb-9821-4841-b63d-6509dc955fcf", "value": "3072:H/JBX+goMLnQ4JwiBoykRbe7SvHztuR6ISIOaPp6F2WtuT4+zQ8Kxq:RAgojHiAASvpuMIPM4jzhKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687154410, "uuid": "36e13486-90e2-427d-9a23-ec2aef8456f5", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687154410, "uuid": "9f5c4b95-2ba5-4b63-bc28-da42cfbb7264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154410, "uuid": "36e5a72e-38e2-4130-b30e-d1eb95072bbc", "value": "10f47af828a8e5880a751635143563cb.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8315160c-0e79-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162554, "uuid": "eddb4ebe-a6a8-4927-9bac-4d236148ddb2", "comment": "Malware payload (Mirai)", "value": "f643cb58a73fa61b689516f984563603", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162554, "uuid": "68cfb47c-5710-45d4-b3d4-52a367195201", "comment": "Malware payload (Mirai)", "value": "2d1fd0e1a219044fa8059e7e004b3f7d68c2b0259bb6c17d5d1b4733f796b1ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162554, "uuid": "13226d01-5aac-4c1d-a0c6-a6ca679bb3d9", "comment": "Malware payload (Mirai)", "value": "4f53020c8b24eb36d6b477d75527293a7e695995", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162554, "uuid": "0cfdbf73-f09f-4b44-b052-94833fd9856b", "comment": "Malware payload (Mirai)", "value": "553b1b0599f26b6a9708dcbf452c8338ffa2e27e0caedb89850a824aae24da54084bd5d751500fc35a76dff6f5aff0a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162554, "uuid": "580c9a1b-4ffe-4a62-a82e-6759fd5abde4", "value": "T1CCB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162554, "uuid": "526bfb94-f7d3-4ed8-b13a-d7941217e0fa", "value": "1536:wu27gBY9FSSpj3z5Qxw6YaWWgg1T/LWy:R9sSyzz36YaWWgg1Tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162554, "uuid": "d02017d1-910e-4ab1-b2e0-7acc1e9bc3b3", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162554, "uuid": "07678877-af3d-42bd-8561-f988f086faab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162554, "uuid": "d368a402-6907-447e-aa66-0012d7a310a2", "value": "f643cb58a73fa61b689516f984563603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6457554-0e58-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687148494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148494, "uuid": "7b792447-9cdf-4180-88a4-8315f0b3c2ec", "comment": "Malware payload (Mirai)", "value": "da7e3273887626a6d221c07bff7af252", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148494, "uuid": "39780142-4d32-4a3f-b13c-7e227b0de6bf", "comment": "Malware payload (Mirai)", "value": "2d8fdab74e980d8d3fc99004c1b8b16274e46c1fd31bd350eb75999f5a4f6a53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148494, "uuid": "605508df-1e6c-4c2a-a074-bccfddd181eb", "comment": "Malware payload (Mirai)", "value": "212faa217707444779db724777ce7531de408adf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148494, "uuid": "b9993518-4e06-407a-a4b0-c0fc08b10e1b", "comment": "Malware payload (Mirai)", "value": "ce46f31f12934e71a6d99682c59b968a5630943be195f703f3b9c5c2e82c479e553575d052f5b3cff33793aa9e4d9e74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148494, "uuid": "297ed811-c8ae-4ebd-8cf2-65481cc4db45", "value": "T13E639C3AE42A59D8C08A4138A4E88F742F93F5C083536DF75AA682B15043DBCF509FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148494, "uuid": "96c03131-135c-4ea3-ad44-b48510791ecd", "value": "1536:M/ZPUMDAOahk66n56dLwtcn9AKfmYNmasAFCTLu:MRP/3dn56dLjlmYNmasqyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687148494, "uuid": "0f32d4a4-c5b2-4df4-bf8e-38eab68ae0d2", "value": 67784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687148494, "uuid": "c102da1e-1955-4564-96e0-c02c7f0efe8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148494, "uuid": "89ddcb73-7924-498a-b949-f0c0e8379ef0", "value": "da7e3273887626a6d221c07bff7af252", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f01029-0e85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687167874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167874, "uuid": "260d9a50-b826-4243-8db5-9b0c305e57e8", "comment": "Malware payload (Loki)", "value": "1ed82735a5c87f9d432b4870b59e8421", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167874, "uuid": "fa427f2b-8456-4d47-a26f-f99e8e4b524a", "comment": "Malware payload (Loki)", "value": "2da9fef1973b5423e662c91f088ec0b14a524a49184a0471e474a55bdd65a5b3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167874, "uuid": "065fde1f-6f70-42c8-8ee2-85516220e10a", "comment": "Malware payload (Loki)", "value": "29e35abd4367a08e91ec8922d33e396e24a6b4c0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167874, "uuid": "3067279b-9d03-4327-b963-de1087ed6bdb", "comment": "Malware payload (Loki)", "value": "8202b0662dac87d591f9dbfb5455d8609c4ac65a67c5b1afd59194a74fa0392b0968beaf505f6378d11e877137a8c655", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167874, "uuid": "beff8921-adab-4504-8331-eaa305eacb87", "value": "T1F0A5121DE144977CE74607B56A82B059810CBCB27FC958827BC6371F6E33BA698E35C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167874, "uuid": "bba84d49-19dd-4331-a560-cfa307adf834", "value": "49152:HQmmQ30DSQQ4EhfyB3QmmQ30+NQQ4EhfyBRR1XGfXCcPiIJH:HpmQk/mfa3pmQk/mfaRzWfScPiIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687167874, "uuid": "feeec461-69d7-40c0-9473-54f5dfaa4eca", "value": 2171392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687167874, "uuid": "0b92b338-7598-479f-aa59-643ffaa09269", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167874, "uuid": "e183873d-66a5-4fbd-9e86-ffbe63245479", "value": "Arrival-Notice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0f1f6e-0e9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SpyNote)", "timestamp": 1687176531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176531, "uuid": "8570e1bb-62a6-447a-b0d9-f05ca798a898", "comment": "Malware payload (SpyNote)", "value": "209c643b01db6ccc41682bda204e5312", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176531, "uuid": "354de5e6-01d5-4827-b5f5-41330ad480c6", "comment": "Malware payload (SpyNote)", "value": "2e09035de157e2408cde9a28e627e1692386714e25a8a3ec14ed7a8ed88820c3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176531, "uuid": "f47a7680-80f1-4511-86b8-cb4679fbaa9d", "comment": "Malware payload (SpyNote)", "value": "a672e6ac67cbf3e6eba08239357eb48ce27d002b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176531, "uuid": "e015c0d0-f4e9-4bd6-aa98-0dfd704f7287", "comment": "Malware payload (SpyNote)", "value": "06457e96e4992fb16b3e4b364eb8cefd45ef5e0e29334ad81cf4391013b25e8492194398db0522f9e8e64815d9076f8c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176531, "uuid": "1ab118a9-f4a2-4936-a8a4-7a1ad67c0a17", "value": "T17396EF8BFB05A46EC5F782324676076656074C5A8B93E6835E98722C1DB79C00F9BFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176531, "uuid": "313c6093-acca-47d3-b8c7-c4fbb19efa32", "value": "49152:CtaT2qy03UYunR8JAhLOHOYOTNG+T/oZCDrwAx3ntzSXf/r4sVTR:CtaT/GYULKBUG+ToErwARty/r4cTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176531, "uuid": "92dc5d8c-e6b5-4647-842f-e8c1a787694b", "value": 9221784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176531, "uuid": "a1d043c0-a1f0-49f2-9898-3d0656286f19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176531, "uuid": "992969d0-a87b-4a94-9db0-4c2e8093d772", "value": "selcuksportskesintisiz.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d284a4c6-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687168271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168271, "uuid": "e7107847-b944-46fa-9e8a-b43e96a2b134", "comment": "Malware payload (Mirai)", "value": "57a298d43e7e51abf1c2521d9466e1c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168271, "uuid": "85de3ef7-b7a4-491e-8141-bddc5e5856bc", "comment": "Malware payload (Mirai)", "value": "2e1a5f61413377cb3970371e750c3dea70cac61d54204f39e35f1a4a9e1944b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168271, "uuid": "0640ddee-1a6a-485f-b9e9-ec62bb199b26", "comment": "Malware payload (Mirai)", "value": "e2955902f6adc58d43386343a544beebefce2382", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168271, "uuid": "98775833-d354-4a48-9d0f-4e4407ef0c87", "comment": "Malware payload (Mirai)", "value": "81f1fcb6d68e7e54092f8aeac4113aaa729b7a63f14b1f89e23937d70a2d1fda49716ed22ba2c1d0479570cc702f5a10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168271, "uuid": "e181b7d9-7296-4643-9aae-de138f3626db", "value": "T1E8335B0272280A07E4675EB0353F17E093BFE99021F4F688680FDB5A8676E775186F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168271, "uuid": "fa20a7d0-0069-43a5-9aaa-80739b14e052", "value": "768:YpazA2xCRBPT5WxFzIHFbGMS9MPbit5Op76+cuKgOf:PzPwBWX2FbbSiPaUp76+fKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168271, "uuid": "9a7812ec-7d5d-43a3-9271-cfb409a209bd", "value": 51048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168271, "uuid": "6d5b8b40-4d84-42e4-a109-9d447df502d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168271, "uuid": "378e5825-e08c-43d1-8856-826217841253", "value": "57a298d43e7e51abf1c2521d9466e1c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fe9dcc-0ee6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687209351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687209351, "uuid": "14c96169-9cb7-4c3f-bd95-29ff695076df", "comment": "Malware payload (Mirai)", "value": "ca290061dce71646070d1633fb6049f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687209351, "uuid": "90592fc0-7812-442e-bd98-fa48f0b1b929", "comment": "Malware payload (Mirai)", "value": "2e7852d5b742917df9ed4e962f397a3dbbd060bbb817ae906eab2ba52469fdc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687209351, "uuid": "0ad2f1a4-df81-4524-9f55-962ea4242cec", "comment": "Malware payload (Mirai)", "value": "b962a8c1821c0cd8908f656a4d420ce59a448953", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687209351, "uuid": "39f23ebf-21de-4f25-abe6-921f39189af9", "comment": "Malware payload (Mirai)", "value": "bccfc6b5fb9c498d11d7b1c12fa572c44329e909425cd552ecd116c761d1db17ba834336facb78d1128d73a1b8c0ceda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687209351, "uuid": "a4c88958-c4b3-4ecf-bfa0-b4cb0d4f404e", "value": "T190E2E15276CB158DE70A883D0C3E3D58AA60C71992F61DD7BBE0147A9DDAF205B0DB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687209351, "uuid": "d135b50c-e984-49a6-bdac-b37c9e87711c", "value": "768:QfT79V1YNAnPYUCIlq7BedqSwTln8FcfON2cnbcuyD7U4yqn:Q3b11nP4I87BeMP8ojcnouy8Dqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687209351, "uuid": "0cb9b630-1949-4e3f-95a3-2ffc074d5f3e", "value": 32548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687209351, "uuid": "3b383458-68c2-40a5-b6d2-41c46241fc39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687209351, "uuid": "fd33a52a-8ba3-4ca6-a5ee-62b45f347a10", "value": "z0r0.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b82a55-0e90-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687172278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172278, "uuid": "829dfb00-454f-4bc7-b5be-cd6fb6ced0f6", "comment": "Malware payload (Mirai)", "value": "57862f438f8a282142487a6bc98e4f74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172278, "uuid": "b248424d-9b28-4f59-8bcb-30e6c1d0bf47", "comment": "Malware payload (Mirai)", "value": "2e7e910b1117f86f6773abea929f9470345136589b7b81a6b9d11de2d30a6906", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172278, "uuid": "3d04ff28-0042-485e-bc2d-7145984e9eb6", "comment": "Malware payload (Mirai)", "value": "04939f11b4e2c7ecbaf44b0e5b96c9e87f466a47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172278, "uuid": "7bae1fa1-4504-4a84-83e0-c2baa92e0c2c", "comment": "Malware payload (Mirai)", "value": "9c8fe5f91f6e170f8574818ece246dba04a20b32d006e0b555d5a58f06b7be526dac5da412648f89ef0f63ad7116b0bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172278, "uuid": "ad2020af-40f8-4b0d-935d-40e3a614466b", "value": "T197731817B5C189FDC05AC17056AFA536F462B1FD2238F2A767D4BF226C0ED201E19CA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172278, "uuid": "bb617162-a9ba-440b-9d0c-37fd7eb7cf87", "value": "1536:ollp9+yskM4yaCWP1lgwUga9FE9d3P9DCmNPak55k8H767XSEltMtLHtwbZnt:mlp9qkFbhdKwVKFE9d3VDXPakI8u7XJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687172278, "uuid": "c1763084-602f-4bdf-8bee-cb10157fab7d", "value": 79104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687172278, "uuid": "8a5d8877-8e44-4dda-8694-04151d14eb49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172278, "uuid": "dd779cd2-99a2-4715-99df-19c00e5946b3", "value": "tsuki.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d109f1f2-0ec1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1687193609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193609, "uuid": "86bd5ddc-cf71-4971-b436-82ba5c773284", "comment": "Malware payload (IcedID)", "value": "4ad5da3c74db6614aeff9d4d46a1ef24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193609, "uuid": "c236b692-72cb-42bf-ac2e-4dbe6d6385ad", "comment": "Malware payload (IcedID)", "value": "2ea5fd6b8b0354c95a41470ae8cb816d0ffb61b6b34cd827ffa160c963b850ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193609, "uuid": "9426c082-d3e2-483f-a709-a78b0e0a14ee", "comment": "Malware payload (IcedID)", "value": "a117ebc1e8733fd1ee8a54cdf8d78b0eee3774f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193609, "uuid": "387da609-71cc-47f8-a01d-54478bb2c5fe", "comment": "Malware payload (IcedID)", "value": "4677a4a909632204d6349b612e04f406630dabfed29098665e10d9a10e64c026b4cd0cb724dc6c52c92dba03ac867d8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193609, "uuid": "7e9e312f-b82a-424d-a46c-b82cfbe54e61", "value": "T11E15D03D76640E63D6B946F74041327147FBD91A2B6FE7C4ACD2B0EE6BC0BA4560260B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193609, "uuid": "6cef21a9-f03b-463e-9866-28a10c1cdf11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193609, "uuid": "2db0dabd-c1ef-4c37-af1e-7365b2f6b91d", "value": "24576:R1BYqtm8OqKwbOSdXD85UYSIJIru9N8MC:x+8OGqSdXwhSIir8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193609, "uuid": "1552fdc8-82ae-471c-8d9c-32ca57e574c5", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193609, "uuid": "5b313576-c2f7-4c7d-bc8e-901ea5113dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193609, "uuid": "ffbd8842-e829-40bd-8ab9-0aefadeb84fc", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50cc9c43-0e7e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687164617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164617, "uuid": "5d083ddf-b9a1-4241-84c6-2bffe9d578f5", "comment": "Malware payload (GuLoader)", "value": "51950df8c8c2f84bacf2e689b2c2f290", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164617, "uuid": "15184c89-74ea-41dd-be21-ddf86331df06", "comment": "Malware payload (GuLoader)", "value": "2ec288b17b197d23ca19f26611ba162a377b1050c21e4273a68c3b2d6b88ebf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164617, "uuid": "572effeb-5b41-45f4-9523-312f59c94ba7", "comment": "Malware payload (GuLoader)", "value": "33f66ea580fc59815f0af19581a0477b1164b907", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164617, "uuid": "c777d5de-fb05-4304-9872-0cdfdd4c44cc", "comment": "Malware payload (GuLoader)", "value": "9aaf532c6eab277918fc110a56a05f908dd0aaa95c286970f790b889ca8025c0c78cff8a26d9fa1cac56c2d7c6ce9ecf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164617, "uuid": "a778acea-f187-4919-993b-6cf76f136c36", "value": "T16CE41249127181DAD0947FF11E70A52D76A36D152298860FD7B07EC82837B93EDAB3BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164617, "uuid": "2e138179-bdc5-4b7e-90e8-6e7a7bcb66b3", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164617, "uuid": "93e012c8-11c8-4fff-b372-3ba16a1b4e2b", "value": "12288:Okr0inpA6+2EqDvKXyiXor9iLYC/g1l7ptlBypfry1QRdSiu:30inW52EqD5qYCMl/ypfry04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687164617, "uuid": "61aa0666-f818-475e-8835-07c6d9341437", "value": 671365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687164617, "uuid": "d3e7d760-29ee-4cd9-bba0-d35e672c9e65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164617, "uuid": "12dd945a-8c2b-4bd6-b62c-9f89f3cf0f9c", "value": "NEW_INQUIRY#8375_A2023_QUOTE_MATEX_VIETNAM_LIMITED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6967db-0ea0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687179324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687179324, "uuid": "7abd1014-8da4-4a8a-b8c6-db9e72dafdb2", "comment": "Malware payload (RedLineStealer)", "value": "b95c18d9530bd6d418dce211a29f35c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687179324, "uuid": "0b726020-6a03-49f8-a2b2-2d5341c306e8", "comment": "Malware payload (RedLineStealer)", "value": "2f147b494d861fffbcac1e6a6a1d06e6b0580e1477d3b0baf1cdc32cc855c1c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687179324, "uuid": "f13a7b25-dcf7-4a90-9e5f-041f6fde7c9a", "comment": "Malware payload (RedLineStealer)", "value": "85e0dd161ca1ce1f5c3541786f3a010f48eebb32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687179324, "uuid": "01d45f1f-91ae-4374-88c4-11efb7bcf701", "comment": "Malware payload (RedLineStealer)", "value": "71ce57bbff93ef709566a5494948dcfb690bcbf9515616cd0c95eda026bd14229d14bebc05b7a33de5735912451e2b40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687179324, "uuid": "d4da4adb-dd51-49b2-a8d1-4c4de9a6c4fc", "value": "T1BFD41242AAEC5033C8F52B7158F743970B36BC91AC7493672B54695A4CB2AE0A47633F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687179324, "uuid": "8b75dced-9bc3-4129-a752-7454c372072e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687179324, "uuid": "908f6e4a-fae1-4f53-a47d-714b4630274a", "value": "12288:TMrhy90RB68I3OEdS0iPSXO8pEwm795YpIQqdQ24xNQ9V4bNq7PeN22:iygRy3PBOKEwo9OCQEQ2GQXaNAeN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687179324, "uuid": "a9832624-f27c-455c-a3d2-6432ea48149d", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687179324, "uuid": "5750b21e-e6bd-497b-8a96-2bc9d7fbdf11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687179324, "uuid": "a5fbd22b-b4d3-4962-87a8-0f28d92df08f", "value": "b95c18d9530bd6d418dce211a29f35c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498688fe-0e7a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162887, "uuid": "4aec57de-852d-40a6-b106-a52411aa08a1", "comment": "Malware payload (Mirai)", "value": "78f2363bef1d7ad993b403fbebab2aa0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162887, "uuid": "2688541d-75c4-496e-ad2c-3b051ad0d8f5", "comment": "Malware payload (Mirai)", "value": "301fabc381411225889f33942e46ac0b70c3c9f37bfe9108271d2614deca3938", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162887, "uuid": "8d8f1542-21d8-4522-a3a9-8d768a66f2dc", "comment": "Malware payload (Mirai)", "value": "da6c73887d88b8b4b79359172c4cff3ac9566e6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162887, "uuid": "809367a5-3b2e-43fd-ad64-798002958ee4", "comment": "Malware payload (Mirai)", "value": "bd9672482cff85a2a6fa12bebdb7872918f89f8390018f19ddd536d34c9f1758d5f8667a9e371c6b27d937ff006c45f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162887, "uuid": "a8db64ac-7e69-4d36-8a07-6da1ad1267f4", "value": "T12AD34B46FB818F13C0D6177ABA9F42053723D79593DB330659286FB43F867AA0E63906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162887, "uuid": "bb025b44-43f1-486a-bb71-c6f353fa8473", "value": "3072:5MHPp2YD4jM82uSHfFBIFKFbwegZS9j6RM/96mywPoIlq:5MHPp2tjkuSHfFBMKO5S98M/96mywPo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162887, "uuid": "ca7202da-0c8e-494d-aa40-ec336dd83a30", "value": 131723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162887, "uuid": "f80f57a4-d4ec-469f-9abd-cbe2ace5af2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162887, "uuid": "bb6d222a-1e1c-4640-b2ee-c3fe4175a9d3", "value": "78f2363bef1d7ad993b403fbebab2aa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90df2266-0e99-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687176321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176321, "uuid": "62628c3a-0a96-46e8-91c5-c15fb0b17493", "comment": "Malware payload (Amadey)", "value": "4a98dfd9207fcb7cf81ccf1b31d1ad0b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176321, "uuid": "c658700b-9ace-4478-b68d-5d905194b4e9", "comment": "Malware payload (Amadey)", "value": "3023836b37a47b6599e276d2d7553299e07a1c372c40d47659d6c041595b1aa6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176321, "uuid": "9de0b8c6-ce4c-4e18-822a-fff59b5e400d", "comment": "Malware payload (Amadey)", "value": "be6f13f2b7012c90f2f16008a0478bfcb4a953a8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176321, "uuid": "01c346df-8015-4ee1-8651-450a7dd6fcad", "comment": "Malware payload (Amadey)", "value": "02d6be314033ee301c517b3024f14330f9bb4662e5180e75271507bce990d06c9d0d3a978dbb3e0fae5a65be0a30146a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176321, "uuid": "b406d591-7864-44f8-9487-96ef192a8d7d", "value": "T146D41222ABE85073EEB427B058F757971A32BD915978475B2B805DAB1CB36C09C32337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176321, "uuid": "1115f0af-2ce8-4db0-8586-5fd6234ff9fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176321, "uuid": "bcf5a48a-90a4-4a05-b7aa-eff62d57711b", "value": "12288:kMr9y90z9Cwa9VGStVWxZVlxhY3jJXD+LQdJivQQtj27dQg:ZysgwgxExfPhYzFDIQWntj2ZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176321, "uuid": "220d7bd3-4af7-47f9-a97b-e40fc2666ac1", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176321, "uuid": "e4e9e81a-71b0-40a9-ac9d-cc752a93d82a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176321, "uuid": "e75f90fc-226f-4dcd-8c60-dc9256ae91bd", "value": "4a98dfd9207fcb7cf81ccf1b31d1ad0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08183895-0e81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165784, "uuid": "4c5cbfe7-7c55-4366-9add-a7ed533d415b", "comment": "Malware payload (Mirai)", "value": "4c9ccca6c5f4a348d89121d192c7da92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165784, "uuid": "8228c556-82d9-44c5-8f9b-b16162bdac15", "comment": "Malware payload (Mirai)", "value": "312468b241f4bd86636daa9c011c87b5689b49a95b855bb548eed35f2a7fef9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165784, "uuid": "54da027e-169f-423e-9110-fef00148a0b9", "comment": "Malware payload (Mirai)", "value": "aee2262248dc30d7e3f8adb869f1a5e2ea0e85f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165784, "uuid": "f6f2dec0-0ecf-4ae9-95f7-12f6121461a6", "comment": "Malware payload (Mirai)", "value": "199c58d0cf3ef2b9f654ec036232b3555ab11083dd86bd258ae11fd6d2695d9383f4c2ef2e9a469a8172f2d46d0b6acf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165784, "uuid": "d7e5bae8-7ca9-4d7e-8187-7a00d9b39d75", "value": "T1B623389AF8429D7DF94BE77E14164A09B93173D052831B2A13B7FEA3BC331691D12E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165784, "uuid": "8df0b327-b35b-42ae-bc62-b022b60015f3", "value": "768:6FPewtBdxjcJw2ZXUI1VjSxu+1Exf8MYqEI8q8DfFG2:8PJjcJzFVjSg+Of8MFEI/8Do2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165784, "uuid": "9b1e5346-5fa4-4632-b051-2706e995c90a", "value": 46668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165784, "uuid": "407ca7a3-c7cb-48e7-9c34-9337043fc125", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165784, "uuid": "ffb4c695-de6b-4e6e-90e0-3feb14a0088f", "value": "4c9ccca6c5f4a348d89121d192c7da92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb46c33-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687174165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174165, "uuid": "516a0db9-c489-4c0a-bff2-9a6458129043", "comment": "Malware payload", "value": "7aa0bdf940ac2375db5fed1052d0ce06", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174165, "uuid": "0b04bd58-4304-4915-aa35-9aa1b84ce81a", "comment": "Malware payload", "value": "31a65f0e2fd2b8736fe93de4cbab505c8c828a718a8e5148f1baa765a4d48193", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174165, "uuid": "710aed2b-056e-42c7-ba5f-48808c174000", "comment": "Malware payload", "value": "b5b8df3b270fadf000c99541ac7f125a80d70f48", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174165, "uuid": "8281272c-d235-4228-bdd7-f02a96f0c3ae", "comment": "Malware payload", "value": "1018c93caac82ce08875d30d9bc466cb9bb4e1bb2b8097aa02a38e464a01834e67ed124b10abec8e186839b66a42612e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174165, "uuid": "9dcaffb9-56eb-40fc-8a04-0393fd5ae053", "value": "T14AB1D3D85389DC4B5E8F5F63EA754DDA213282761BC43687831DBD4C25EC84BC58847D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174165, "uuid": "136888ec-a4aa-40fc-9102-ecfd91ad3c58", "value": "96:5zYnIZGWhgkRrJGYGiDLeaqZR4uxasc3JuECkY+xro/2ZCcHHUYBmUvGVql:lHM2tTGiHgeuQ3s7kYV/ICcbBmnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174165, "uuid": "4749d136-e1fc-4955-8ed9-7ae3d63b1af8", "value": 5363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174165, "uuid": "4b3f5cca-5594-4934-bc5c-644a117755b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174165, "uuid": "3469c129-b262-403d-bfad-4fafe3ddb3c0", "value": "background.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0886346-0ef2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687214573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687214573, "uuid": "28e9853f-b51a-4468-bea4-d9132c4deebf", "comment": "Malware payload", "value": "abe3925ddf359d1dcb0ef8299c8d82f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687214573, "uuid": "f5991778-b183-4c45-b2d8-0706cc9aa489", "comment": "Malware payload", "value": "336805e47329a9349dd7e1a2213913f5c4873fa85c812d29b9c9f6c540d8e082", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687214573, "uuid": "db4359c4-0da8-4f19-9e13-d4dcdcb10682", "comment": "Malware payload", "value": "28a7b8e01318745362d505741d3359a9d58ed5f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687214573, "uuid": "ae349ca4-ba19-420f-8621-e6adbf1eb603", "comment": "Malware payload", "value": "e898ee97acb6882657594bfa030e2ec163165ffa0b405e755d517388d58b0e4573d16eb7a58903d29a0b06bb5f0e9474", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687214573, "uuid": "694794e8-9c20-40bb-acfd-f5da3886f3a9", "value": "T16F656D22F2C2847FC4723A7C9C5BF699D8157D102E28A84A7BE45E8C0E397433D699D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687214573, "uuid": "d1f63313-79cc-4e4f-a04a-2405a27b469c", "value": "78c9e2c31285b4ac9148c2d16bffeed7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687214573, "uuid": "67992f26-6e02-477d-bffa-56e64672670c", "value": "24576:yPmGZnLfQgqiWuvffICxlBs0Smags9ViRlv/lrLRbshp:mP1qfaBsFmNs9+Nbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687214573, "uuid": "87e43b11-0b8b-4986-bd6e-375367907548", "value": 1431040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687214573, "uuid": "68d8d938-157c-4bc2-96de-f77a7e8d1a1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687214573, "uuid": "5dff62d4-0e1c-4d7f-9fa0-170d5603ab9c", "value": "vp2023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00b7cf1-0e8a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687170012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170012, "uuid": "71595e92-041f-492b-8fb6-96bc68523a85", "comment": "Malware payload (RedLineStealer)", "value": "c90d979c8a302a193d165e9633efacfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170012, "uuid": "bfcdd6cd-67d1-45ea-b5fb-832597ef5e1b", "comment": "Malware payload (RedLineStealer)", "value": "340305a8de12c982e01e0be406d07f895d202355ddd53b870b9d83c14ea3d150", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170012, "uuid": "385197b4-e93d-42ac-a2f0-792298f16b11", "comment": "Malware payload (RedLineStealer)", "value": "a8a7cabad26a5015505814cf9278b8d353c85d9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170012, "uuid": "216248a6-5a62-4869-a199-e0006e671c14", "comment": "Malware payload (RedLineStealer)", "value": "8d555c9769086191587f0c22962dc4dcd5f906360727a66f6430a381716f8bd8a7c33c6ec1a48dd3b0616c5e7efdd4c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170012, "uuid": "7868f23a-ce04-4fbf-8808-cd1d2073195c", "value": "T14CD41242EAD88173DCB52FB0A8F607C31D36BCA04D75832B7749AD8A48B36946935737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170012, "uuid": "0ec1f77a-44c9-417f-904c-e5a732b652af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170012, "uuid": "22e56807-ff3f-489a-8dbb-bbd8a6f9c6d7", "value": "12288:QMrvy90HpQ8C+3FYgpNPRr8Z5u7XhoncrKgGO:vylA3mk827xIc0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687170012, "uuid": "1c18083a-52ef-44e2-a11c-6640b4f4d3a0", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687170012, "uuid": "4776f95b-1f30-4eee-a952-27cae7fe12e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170012, "uuid": "6195a44d-b234-48be-a212-1854c612095a", "value": "c90d979c8a302a193d165e9633efacfe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6ca2cc-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687175348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175348, "uuid": "2f0b79f5-81fa-4c6b-ac5d-8677921bdd7b", "comment": "Malware payload (GCleaner)", "value": "81d6716b4719b3e8712cb5e4b53c8930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175348, "uuid": "f55187f5-60cf-4fc9-b46c-794fed0b11ba", "comment": "Malware payload (GCleaner)", "value": "343175dcf013f7ded62c2c5b6c61e827660912eb58b4cd13889595b438dc1199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175348, "uuid": "998149af-ef9c-4b8b-a7d9-5a592c23292d", "comment": "Malware payload (GCleaner)", "value": "5bcf7bffa433f2e93d8771b48a4a4818059113b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175348, "uuid": "491726a5-fdcf-4320-b2e1-001fc1c640d1", "comment": "Malware payload (GCleaner)", "value": "99d9c4a7ceb7726de74f5f6310e07f76f88bee3bf1ebb885d8de26682077ae90a87d470bb65f150e919d9b196e96ce7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175348, "uuid": "98ac0f31-2fc6-4aed-a655-175c1cdf27a1", "value": "T19D649E5363D03D60EA25DB728F2FC6E8774EF6504E097B5929289A5F24B12B2C173F81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175348, "uuid": "c5b96243-eb0a-402c-962f-d1b99de05b5e", "value": "b59226af1f8da49814d7efdb5ac034c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175348, "uuid": "15fe3572-093a-4f51-970b-f90280fbfaf4", "value": "6144:zVq+6ULYu+P7MGgc55Y+BipGw+8vCbURa9+RqnRxi:E+LYTPYGgUY+TgRaYRKRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175348, "uuid": "0b6a7151-bd8a-4df0-aafa-0cef29ac579d", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175348, "uuid": "c649ca71-500e-48f3-b800-ec5b3059d3ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175348, "uuid": "d7278207-ac9b-4e7a-bb50-3bbe21b820d9", "value": "81d6716b4719b3e8712cb5e4b53c8930.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036404b6-0ece-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687198847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198847, "uuid": "94c36493-6532-4bd1-a5f6-1e48190876b0", "comment": "Malware payload (RedLineStealer)", "value": "e1f3790903d8c63669907448eaa3dbad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198847, "uuid": "7a9700a0-bf37-4595-acfc-ac8b46b092d9", "comment": "Malware payload (RedLineStealer)", "value": "34bc45f895d67407509a698a1356bb6b83afee483b48776853a449918900e40f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198847, "uuid": "40493206-b9a2-47df-bad7-ab476cd2551b", "comment": "Malware payload (RedLineStealer)", "value": "b03c444a24e482c89d8c902f86f29cbbd7fd16b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198847, "uuid": "e3d0a166-c9f3-4b3f-957f-1e51ddc365bb", "comment": "Malware payload (RedLineStealer)", "value": "15be88886e420347a7c736aa077a8a0f3136f91c8d279d0e47088812870a22ed267d3683558ff4629a803feee2886446", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198847, "uuid": "84b1a056-44d7-4d53-b4dd-c1447719be39", "value": "T109F40240B4C4B124D87115325CAA7A42BDBDF4948E34DDAF7F94330E8AB52E2B9F152E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198847, "uuid": "e9ae3b76-1cba-48da-ae45-bbd8582d9c5a", "value": "d91fa928c738702455bfa66ac3685503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198847, "uuid": "b213fb34-d8d7-4de4-a6a0-874c26bea9a1", "value": "12288:HEwlR2v7fWlu+T/Yznfz4J/tUiC7a9cmKOU0lR7BYxIaVtL8UG3KgRXP14ECE:7Ru7fIuBj74J/tUiCDtUgVVt8ha4yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198847, "uuid": "0c369c58-11d2-46cc-b293-9ed56ea82cf6", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198847, "uuid": "182da32b-949a-40ad-a71c-3e350bd777a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198847, "uuid": "522337e9-e05b-42b9-8b3c-e2491390004d", "value": "e1f3790903d8c63669907448eaa3dbad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccc9e2f-0e81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165792, "uuid": "c2b5ff09-3216-4995-841e-103960ac5284", "comment": "Malware payload (Mirai)", "value": "c4506e60526ee8c3981692583df37f1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165792, "uuid": "6fa9cc42-fbcd-4993-ab5a-35b262ca13b1", "comment": "Malware payload (Mirai)", "value": "34e682cd4d3afbd28da249d28dc46dcf7741206a34961acabeddb79fc591c06c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165792, "uuid": "32632c9d-45bf-4dd8-825f-19e7128b69b8", "comment": "Malware payload (Mirai)", "value": "9f6f070f6230ee64dc5095a7ebd919c3b2066c70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165792, "uuid": "111d9017-ff19-47ab-8c24-1aa8d975bc01", "comment": "Malware payload (Mirai)", "value": "a43bf6deafcdb4072b7e03e9a2490c0b95ddf83b7086a384146f2d724a3487c4c951e86a6f638fae61a3b07908ca6c71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165792, "uuid": "0e8aeec2-b3bd-4a47-a2d0-847696a52073", "value": "T19AE30956F8819B16D5C152BAFE1E028E33131B7CE2DE72029D246F347B8A87B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165792, "uuid": "c9c44151-11ee-4785-998b-958bf09d1a6c", "value": "3072:5DIEt2bUFSQf/HXvx1arj/as8DTf133f4zdCVPSn+:5DUWL/HXp1ILaTnh3fqAPw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165792, "uuid": "26098711-7c2f-438d-8f67-b664cc52fbb8", "value": 154064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165792, "uuid": "39267baa-d81b-464f-8283-94c936f3e205", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165792, "uuid": "aec0b589-1966-4f1a-928a-ec6c81724f15", "value": "c4506e60526ee8c3981692583df37f1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024cb588-0ece-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687198845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198845, "uuid": "f5b97ceb-2fbe-44c4-8e11-ffb6296222cb", "comment": "Malware payload (RedLineStealer)", "value": "968958491b8acdcdba2ffe30c4ac7a83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198845, "uuid": "1ee0f603-5821-4b2b-a0b7-2fbfdc189a8f", "comment": "Malware payload (RedLineStealer)", "value": "35ca9e1bbc346e37654a30f90147563d54fe2026310aa8e27869fb5a36943c43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198845, "uuid": "fe8da2a6-0ed1-4522-a162-e806ee75b66d", "comment": "Malware payload (RedLineStealer)", "value": "1a5a2cb01f08f48517d5fc00682ecfdb967e74eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198845, "uuid": "76864c7e-cef2-4a29-b850-14ecc2a7915f", "comment": "Malware payload (RedLineStealer)", "value": "86ccad11db18b67a7eec72c0d167a63c0586c6440a41d86eb0b05b83949581800fece0ff94b2f5e85a6067a2c525a18d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198845, "uuid": "1c47356f-47ee-4250-9b63-40d6d6e23ff5", "value": "T126D41263E7E88473D9752B7158F706C30B36BDB28D78532B2705A9890CB2794B931B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198845, "uuid": "4d294d18-87b1-4dd8-bdf9-10627d633812", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198845, "uuid": "b596aac5-3149-488c-a8bb-d2af0be65eab", "value": "12288:DMr/y90L4KicSp6KBs588sy4EJvZ7RHLteW+QZIty4IfXkMPOU7tqQfr:cySzicSQuKXd/7p5eWQ44JSDfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198845, "uuid": "16720384-01e7-4f1b-8a59-ad265d7f5ee4", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198845, "uuid": "cdba5297-f091-4c14-a7aa-25f3bfd54b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198845, "uuid": "e9c7dd29-89eb-47ce-becc-8457d98f98d2", "value": "968958491b8acdcdba2ffe30c4ac7a83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb1bae4-0eb4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687188075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188075, "uuid": "c2ffe6a1-2bb5-433f-9c0f-c45034115f4e", "comment": "Malware payload (Mirai)", "value": "ffe8ee2b5a6ca865d58ed7862162b0ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188075, "uuid": "f219cff7-fca4-4d82-8a73-b6325ae1f27e", "comment": "Malware payload (Mirai)", "value": "3648b5bdd786a29fc72c50216656ffbcffe295715541e84813a8d702457f8921", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188075, "uuid": "712b8dab-8556-4fae-8aeb-5e56540d23cd", "comment": "Malware payload (Mirai)", "value": "d85d0914eb230a91e02d9928f07cb26ee44f0080", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188075, "uuid": "d52aed00-ed4e-4cb6-99b1-ff51550f3b75", "comment": "Malware payload (Mirai)", "value": "a288149668b9883a5d32ad162373424b6a52bb900f1c82effc9f74cd41f0cc1013b4449dabc73bc0ca7746480a4df04c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188075, "uuid": "b72cfe73-dd9f-440e-8767-6da23525630c", "value": "T14EF3D70ABB711FF7E89FCD3705A90B45149C581A22A87F76B630D468FA4B28F25D3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188075, "uuid": "e6c3984a-ef8c-4195-9beb-2bcceec05452", "value": "3072:zulxV8R9r20FUjmmNLYPfNhd2TkfeWKXHvN8Qa1h9WJS:qfVcr2UUC60PfNqykN8dh9W4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687188075, "uuid": "c2338b86-ff9c-4c26-9b49-c3c6f393a6e8", "value": 160340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687188075, "uuid": "bd3bd4a3-4126-4d8d-a4b7-eb45a5a5f73a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188075, "uuid": "37619cb0-b0d9-4ea9-a518-9982eb466623", "value": "ffe8ee2b5a6ca865d58ed7862162b0ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88248860-0eae-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687185326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687185326, "uuid": "88581baa-c5cb-42ab-bb71-18a0f980ddbc", "comment": "Malware payload (Amadey)", "value": "0842183a070378b3049560dd0a9026f9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687185326, "uuid": "0edb04ae-684f-411a-af03-c9eab0e42136", "comment": "Malware payload (Amadey)", "value": "367fbc78ead2f3e3b9751423f0f6662b6ded68d3b312e6fd862e36bb3070150e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687185326, "uuid": "ab1f143c-c4d7-4eba-a46d-be8b97682586", "comment": "Malware payload (Amadey)", "value": "ab1d539be4e198e5dc89c5b2b2cbd7fe11f11dd5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687185326, "uuid": "34daa045-2448-4e79-af2a-0c1e45add20f", "comment": "Malware payload (Amadey)", "value": "a185c81aa01a68036df8e29e0fa76b205242fab58c90c2766eff7b22121cf0e08fffcf0b359e387929d42491019a0486", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687185326, "uuid": "d11044ae-bde8-4f91-83fa-9b1ee7a1d2d2", "value": "T135D41202EBD89476D9F4677008F643C30E36BC61AEB483A73781599F4C72A95B63172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687185326, "uuid": "513ee224-3ca1-4185-a6fb-414d697caab7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687185326, "uuid": "38fc4aaa-64a1-4a09-b5e1-fb96f21c3f58", "value": "12288:XMr2y90hv6Xa6v6XGz2ybiphcRFJ8kwk/spLIEE/IS6lR:lyibk62zlbi2FJ8kw7I2S4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687185326, "uuid": "1bf2d464-04f8-4ccf-85a4-3d9057e74bc1", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687185326, "uuid": "2e12e414-40e6-4317-94b2-278eb16beeb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687185326, "uuid": "47b5063e-c9db-46d4-aa5b-cf42d16c50b1", "value": "0842183a070378b3049560dd0a9026f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec674698-0ea8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687182917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182917, "uuid": "cc3e30d2-8f72-4f97-89cb-13b27a51a086", "comment": "Malware payload (Formbook)", "value": "dd37c82eb9f068581d8a02c11b3d4be4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182917, "uuid": "e201353f-b593-4a8e-bbf8-285517ef69ae", "comment": "Malware payload (Formbook)", "value": "36b01f2918bc713fb4a312e98ff091a0f36d227b4c3e51a77ccce6b554d45287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182917, "uuid": "ab8e0b9a-8ab9-441e-a36c-4dea446cc278", "comment": "Malware payload (Formbook)", "value": "7c79993f2c636dae6efbc3d9cfc66b899cc42519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182917, "uuid": "f8360770-6a44-4032-bc73-3653a6ba394a", "comment": "Malware payload (Formbook)", "value": "dc91e3cf7f30d21f4aab1407e87009f797867f44042368a84ec05b698fc30e997a19cce1345e8f27f2da882c4d7802e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182917, "uuid": "a7268cb1-94b7-451d-88ee-2e21c9ade9ea", "value": "T1D9F49E3391741477ED161D3D48BAC7A418267D322F34A48BFAE23AE99F36152F8242D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182917, "uuid": "823612e5-1fa1-48e5-91ac-0e3e0b4765d5", "value": "f580d797d5fbc3df79105c3246aad078", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182917, "uuid": "2a54cc4d-3c2d-451f-8cc9-a048d3136184", "value": "12288:NEdx8epMpDHeLp0ewAKOXCofPHEl20/WAN9PuCCJQppO70an:NIdytHe1hFnfPHAxPa7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687182917, "uuid": "b86d9216-2fd2-40ad-8d5a-d0420b982bbc", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687182917, "uuid": "063b33fe-db48-4ed1-8b38-0f7e8ecc4664", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182917, "uuid": "0675ef81-dc65-4462-8e96-d1627f750873", "value": "NIEUWE BESTELLING.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c06e927-0e79-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162516, "uuid": "4f18ac5f-0085-485a-a992-5a2054c9aa6a", "comment": "Malware payload (Mirai)", "value": "6d331dd5eb0b031ba9993edf026a8e5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162516, "uuid": "5b967aa3-b9c4-46a3-9f72-1581788a5271", "comment": "Malware payload (Mirai)", "value": "373d165f0bfcc341b8f4416379104106b32eb190cbf6d7ecf5d1bb07bb92db56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162516, "uuid": "5cb1ab20-b936-4985-8571-59fa49f160a6", "comment": "Malware payload (Mirai)", "value": "ed7a0d529c6b9bf069aed6667b9806d057663295", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162516, "uuid": "c1fde28f-e3a8-40e0-acfb-e26c8184f17a", "comment": "Malware payload (Mirai)", "value": "88f76e89125eeac95ac1233193e0e44c5a599a11d60d21203a787aa283ca8555ef682a7cfd04b35022febb304abc0541", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162516, "uuid": "b4ed5f1d-3f76-42b8-8b18-f4a79fedb784", "value": "T12B82C030619770B5DBF00431EABEC68B57160BF8E1F832932A487B7ADD4690715F91E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162516, "uuid": "557e3382-768d-4997-8784-1b341d26fb0a", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUu2PsND4udhymdGUop5h5lA:2dV0P6+kom0tVAoNvm+tLYsNDLds3UoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162516, "uuid": "5d9d24c0-5066-4295-b345-4f031e61f628", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162516, "uuid": "7a28f0a2-c445-4897-b249-25c667f66d34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162516, "uuid": "78c61168-b17a-47d3-9184-4233c4e7c011", "value": "6d331dd5eb0b031ba9993edf026a8e5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511c95cd-0e68-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Neshta)", "timestamp": 1687155169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155169, "uuid": "930b9d9a-a4d6-4e1c-8f1e-182544039da3", "comment": "Malware payload (Neshta)", "value": "e6f4b8be6c8a48d519ef8d8957655b99", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155169, "uuid": "bbc7e24b-ed72-475f-984a-9acde95e93df", "comment": "Malware payload (Neshta)", "value": "37796a5aed7aa8aebee13255f6e2ee0eabd877bc2d03916cfb709b660cbbf097", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155169, "uuid": "41437e7d-f215-44a9-bad1-c94eade61fd5", "comment": "Malware payload (Neshta)", "value": "18591c6b347ac9e10665c4330d31df41f258af45", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155169, "uuid": "6182d7bc-132d-445e-90fd-55580d5baa1e", "comment": "Malware payload (Neshta)", "value": "afbb6199c7679e3e0ddcd4537def615fef3eb4360be82d63a1df6ae2b3a9d51a7323349cd7899eead75f9a7da2ea0420", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155169, "uuid": "c7f5d8ea-8add-417e-bfb7-d40196f0df3a", "value": "T17715238D12DDFD49D091ABAC87085E3FBA1BDEB28D4FD8AE9B5948D9CC150148CC3AC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155169, "uuid": "04ffcb63-6b2d-4dbf-a42c-e5248a390d65", "value": "24576:lNp8SKqlr48RI4+hs/RppVrI/FgLC0b6GIzq91MqJ:lNp8Snl4TPhs//ZRbT2s7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687155169, "uuid": "b473c0a5-542b-4e69-a213-7997e8c15a05", "value": 881507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687155169, "uuid": "a105e22d-22b0-40f0-8565-31608bc47184", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155169, "uuid": "19a59aea-c9e8-4adf-8cac-ea4bf26a941a", "value": "SwiftBankCopyFile.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddea5afa-0e68-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687155405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155405, "uuid": "1a0fe516-752a-48b3-8e46-e490d7f7f1b7", "comment": "Malware payload (AgentTesla)", "value": "1e716cc186c0b4370eef2859f5e6cc72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155405, "uuid": "727dd7a7-184b-4d63-ba3f-6b3e0a70f44d", "comment": "Malware payload (AgentTesla)", "value": "37c0e9a66fe3527cfa004c22b3b43deab9a11abf3953b6e43d7a48b3ddbb035f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155405, "uuid": "cf51aaf2-9434-4c1c-bac8-4760a2661384", "comment": "Malware payload (AgentTesla)", "value": "a9da3ab8603bb4ae31653d2352a5bbc5211ea0ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155405, "uuid": "b7a1bb1b-a077-4e95-81e6-b3cb45f7cdd9", "comment": "Malware payload (AgentTesla)", "value": "26fbe9ca88579c562ef10d2125b089a30912f6aa3e399f8f9c042efaaa65d8352887290af0027ab91d5bf88ef714acb3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155405, "uuid": "ca4bdd8e-4771-4787-b699-37b3c45fb1cf", "value": "T1271533B62C83D396530ABE53D48A4DDDB7636BF480C6D672634C420135B1AEF2D2EE19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155405, "uuid": "6f3b1521-7eee-489b-8ffd-4f1cf92fbe89", "value": "24576:okKTTma7uKEYmycqEj7CUgH3G3F+rxfY5NCO3:uSa7uKbWqEj7ZordY5Nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687155405, "uuid": "06d3b652-37ab-44cf-a398-cce410632f06", "value": 881802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687155405, "uuid": "d2cccbf8-39b2-4a57-a841-a0c31ef80c03", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155405, "uuid": "c4a4842b-df18-4fbb-9587-a59286e8e617", "value": "open invoices-07-2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b400262-0ec8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687196445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196445, "uuid": "a90e432f-7979-47fb-86e8-40590dbf3aa2", "comment": "Malware payload (Mirai)", "value": "80b8521384b2b197f85c45ed8d36b07e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196445, "uuid": "2ce55a7b-f319-4020-b612-9788bcb16652", "comment": "Malware payload (Mirai)", "value": "3839fe689a9c4bc90f7850b90afa691341b82bfef1b665c9f02bc90888e424af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196445, "uuid": "ee033611-117b-4ae2-bb87-cb8bcf44e7f9", "comment": "Malware payload (Mirai)", "value": "6466b76313a59f7d1455e4ba188ec2d3670ea63c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196445, "uuid": "7e9da373-10e3-47e0-874a-80fd8d523d79", "comment": "Malware payload (Mirai)", "value": "d64812dd5c6a0c049fd1f722b2a1ae3376e3987478e304407c161517cafbb5aefeb36c196b3f4482c122688d96324f96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196445, "uuid": "a6c5206a-8168-4c34-867b-cb0c8ccdd67c", "value": "T1A8435D42722C0987D1935EB0253F1BE183BFEE9024F4F685694FAB4A8236E731546F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196445, "uuid": "59afa65c-6ebb-4590-aaa8-7c67b0c66cd8", "value": "768:qS0Mbc9Xd1vAvIHK/Rb7DiJVRcxKa/J2SvpL0YIs6mLnsZK10UaK:Z4Xd1vAvKE5vYYI/0nsI10w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687196445, "uuid": "492f7998-0dce-4857-ac68-5148ec45765b", "value": 59800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687196445, "uuid": "1b5e5a80-3cdd-47bc-a745-c27dde914622", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196445, "uuid": "160abe25-9296-4a05-8691-fec10700b4c4", "value": "80b8521384b2b197f85c45ed8d36b07e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f410d93e-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687174340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174340, "uuid": "9c6eb9a9-c10c-4375-945e-3de70fea1acb", "comment": "Malware payload (AgentTesla)", "value": "f855618edbdc3d9a2feca6aa55b9c11b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174340, "uuid": "e3a6c1ef-6d6c-4ece-b9ff-bdf59bcf80b4", "comment": "Malware payload (AgentTesla)", "value": "3884e567629d6433ebefa10b2e6d53a27f7b19c9d2e1c4ca7126fc4ceeda230f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174340, "uuid": "b2366efe-a660-4eef-ad07-19778ca11c66", "comment": "Malware payload (AgentTesla)", "value": "778ba3349fecb99d951d26abac2a8df62bf2cd30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174340, "uuid": "526a6674-6aa7-46ec-a28e-1af76022d9be", "comment": "Malware payload (AgentTesla)", "value": "3a4bee9605e3e91b9af20209e4aa290f58374f8ea46e36eb26c71fc38c309c39d08d5ff973ca576029b0c8c8ac62f6ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174340, "uuid": "f47e8a59-efad-4566-baef-537050316f8e", "value": "T1C435F5C61A14A747FFFC86B50099E13F126E6F5DA914A2CE5E91B3E5A233A0D0DC1B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174340, "uuid": "ce291394-4981-4202-ac78-9d7c55f31f44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174340, "uuid": "7547f5e4-2d5a-450e-93ff-3d59f12206f2", "value": "24576:GQYqtm8OqKW3nNcF1apNL5dJurc5Msk+mgPwiSL0jb85:7+8OQN2Y7BuYznIiSL0385", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174340, "uuid": "aa619b35-62f7-4852-af70-7dd6c131067f", "value": 1163776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174340, "uuid": "758094ce-672b-449f-9e2f-5cd8d449d6de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174340, "uuid": "8720fb97-990c-4071-859a-a8e5d1c4e468", "value": "096 invoice.Docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d852bd37-0eaa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687183743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183743, "uuid": "09b3ff91-b871-4610-a744-689e2fa2b673", "comment": "Malware payload (Formbook)", "value": "53eefc4a10664ba6a512bc16b484ad1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183743, "uuid": "3ab3f3e8-b3ab-4d60-b52b-3db3b82b13cc", "comment": "Malware payload (Formbook)", "value": "38b5256b4f2f7e3042dfd4772e94b5a76bfc30cabc09fc7cb622b38dbec0a445", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183743, "uuid": "f3f5f13f-5755-4764-a731-3d5526aa9579", "comment": "Malware payload (Formbook)", "value": "fe7184cd4bfc4ff617ef62ee58d56309324d4580", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183743, "uuid": "b576ca91-8ab8-42f8-902f-37907b86d3ee", "comment": "Malware payload (Formbook)", "value": "705a6feeddda5eb90845c6d093cd66aec28c57a92a24161f60b47d09a9bbd650f2277975d50037da9d124a82ead162a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183743, "uuid": "038ecc02-c4d2-4359-8eb0-70923264e36d", "value": "T180059DDEE3E2C933C47223384D5A9351782ABF601958E886B6D8399CEF7E584781D353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183743, "uuid": "55b04ac7-5ede-4eb8-8a16-578feccbf963", "value": "37795b00317f02deea74012e147ddf7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183743, "uuid": "f0c8c938-1a80-4559-86c3-5b54b963d200", "value": "12288:RElktyzweXm40fStl4/ukRiZLTJ3r1XmXmF8KMrFiojZV:R0NweXJj4mk4TLmX48KMrFioj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687183743, "uuid": "ee0db6c5-ecf8-44a9-8b19-91ec4f96e9fa", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687183743, "uuid": "d84ee0de-21ab-4947-a902-0dfee12e8729", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183743, "uuid": "38251c4a-33bf-4a02-b1ea-c23d293d1e3b", "value": "Weftbsliwmaage.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01635e52-0e84-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687167061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167061, "uuid": "888b7dd9-eef1-42a1-9278-956c6123e7f1", "comment": "Malware payload (AgentTesla)", "value": "385da19a95cafafb41fa3981d12e0873", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167061, "uuid": "b92e5a7e-ed66-4559-9874-6b60fe903b41", "comment": "Malware payload (AgentTesla)", "value": "39893af7f960c76c20ab2b99e5caa2acabab3c7fc01e47791586f451eba5be5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167061, "uuid": "2aa90593-dcdd-49b3-90d3-8d0991eec092", "comment": "Malware payload (AgentTesla)", "value": "a0038f42c8ef3b50a7d5d497fe4640d3d3350d41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167061, "uuid": "c5b5e150-ad4f-469a-a084-03723d767784", "comment": "Malware payload (AgentTesla)", "value": "82335b2d9ce7721ce3cd4b9fbe717af29bb73e8ceece456e4216bf9ba3b8490894c5d1eca379308276f9c685c3dc9607", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167061, "uuid": "5dbf5912-3c2e-46b9-b7e7-443437ba3968", "value": "T134457923A6EC5BC2E07D43B84C15F33D17656D26682ADE595E92F0CA1A31B0509F3A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167061, "uuid": "a86064f6-10b2-41c6-ba65-64752a4460c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167061, "uuid": "c51701c7-2b04-4e7e-8468-1c10e1cfe6e5", "value": "24576:RQYqtm8OqKo4hAiBm3X0pKXj1MOd51bh4G2T:2+8OT6iMn0Ezak1bh4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687167061, "uuid": "33859271-32f1-41de-9775-cfeb83adb4ff", "value": 1169408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687167061, "uuid": "9840d8b2-c468-4071-8599-3888296dc345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167061, "uuid": "ff593263-13c1-4b99-855b-4018f2d5a02d", "value": "Halkbank_Ekstre_0230616_073809_405251-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afc8270-0e7e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687164608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164608, "uuid": "e2f12d19-895d-4d6c-93ef-0620fb41f23d", "comment": "Malware payload (GuLoader)", "value": "cb3a12ea955e91761139bed5790d39ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164608, "uuid": "e5325bc1-15f0-42e9-afae-27a2a2e1d6ac", "comment": "Malware payload (GuLoader)", "value": "3a0d3b11f7880446616cd7ac67a77de79e821a124eafd1d346d1f919ee9af1a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164608, "uuid": "a7a0a96a-8e32-435b-8a4e-d8269ca99796", "comment": "Malware payload (GuLoader)", "value": "956e52f2b5a08c72b64057b975940b4c7ba3b894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164608, "uuid": "0d3f6fa1-e911-4856-a085-eb25ea9117d2", "comment": "Malware payload (GuLoader)", "value": "a7f1153da7b01600817054cfb89381e816f3913fdaa106bc0be5954d7cdeccc5c88b2596f2cef1aac7071cc5e43a9deb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164608, "uuid": "ca5aaf19-b5d1-4f17-908b-5f732bce027b", "value": "T18FE40203F6EDA0EFDA348B718F3543F7A6265D230AB40906B7D0B75C057A6BD691A2C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164608, "uuid": "a6b8ec11-f9d4-43f1-813b-1222409c249e", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164608, "uuid": "e2a71307-a105-4f33-bb7a-b7dea58b21a5", "value": "12288:pku3BF0Sjqq0VcPT9qIiXor9iLYCe208ct591l7ptlBypfry1QRdSiw:T3z0aqq0V+qYCk97l/ypfry0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687164608, "uuid": "162d9666-a892-4e8c-842a-16ef4df72fa8", "value": 683732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687164608, "uuid": "496f136e-d0c9-48ec-b94f-458ddef56833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164608, "uuid": "a4dd8fa6-1b21-473e-9677-c63621e0d575", "value": "Export SHIPMENT Docs No-285380XXX AWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e36980d-0e79-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162573, "uuid": "561e3538-e492-440e-b05a-314ebff40236", "comment": "Malware payload (Mirai)", "value": "d5a4c4853ce2805b48b66a6df832cd41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162573, "uuid": "4cc64793-454d-44eb-a467-b288cd869d90", "comment": "Malware payload (Mirai)", "value": "3abc7513b21464cf9392f3b3195238fb11fee04a6bdaa83fb7b70d5e69907c69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162573, "uuid": "54b695b6-cb98-4a65-8079-6cd91630947a", "comment": "Malware payload (Mirai)", "value": "38650ee2d43ca4b0e562520eb5d2196ec494e1a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162573, "uuid": "fbc77103-d321-4ba2-884a-e04209194d33", "comment": "Malware payload (Mirai)", "value": "45428c21a1415b8009d202b8a176cdc4b9e953f46e213081563a07a218a94ded60a27e75a84f6e5ff9d34a15422c5550", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162573, "uuid": "e9af619b-f284-42cf-bb28-35f8c7dcd2d1", "value": "T1F8C2E165F7307936C9701C7AEB7989C72E82063C30FE337799514C3D6ED198662E44A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162573, "uuid": "491d1f29-aff2-49b4-b3f2-5e32cc9a4eed", "value": "768:+MKyhegCCMqfAgHMZ0PNqZQnVI2E399q3UELuf:tKy4qfAJZ0VPSQLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162573, "uuid": "5564cecd-299c-4b16-af75-fb1e032ff068", "value": 27292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162573, "uuid": "c1ea92a6-2654-413c-a829-106e378f0d5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162573, "uuid": "6da5b844-da34-4439-9c94-b5c99eab44ab", "value": "d5a4c4853ce2805b48b66a6df832cd41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80dd11ea-0e79-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162551, "uuid": "1954409d-5519-4014-8805-db1fc2fd8eef", "comment": "Malware payload (Mirai)", "value": "26a9449294f937ccd11f2b0ffa03c4c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162551, "uuid": "810e6228-1e3a-4094-8501-7651e6142875", "comment": "Malware payload (Mirai)", "value": "3b20d7e07512a7a64348e7dcd3b7d1bfeb44c2e0df6d535c07440e9a8f770c4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162551, "uuid": "a28705a5-d5e5-4909-afea-f591ebc97d64", "comment": "Malware payload (Mirai)", "value": "e1c86065a4ee47d90b752be0fe8c140adee8a7a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162551, "uuid": "8e41af0e-736a-4322-b7e4-5ee63b5152c2", "comment": "Malware payload (Mirai)", "value": "9ae550cc52337d1126df99e603e88d61ab33cdfa34e5dec2f187863f1abcd4d1345b9bfdb3092c6f8a58196fcbcacbe7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162551, "uuid": "5657d6dc-6488-42bb-b535-a247035296e4", "value": "T1FEB2CFCDA1883845CE9D6C7E1A9E5B324E1C51E872CD9B9E63605CD433BE51AB04E07B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162551, "uuid": "244bebb2-52b7-43e4-acb5-adda0d30735c", "value": "768:obrQlS07dEv0UXqUhvQE+CXQXfb8LTOdukNHuWZqSWvt:4QlS07FUXqIYSXQXfgUuk5u6qV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162551, "uuid": "ca58e3dc-6218-4d9b-9233-a4b64ff952b2", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162551, "uuid": "1e1a5c1a-eb84-4ff0-a827-3f6d20fdcbd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162551, "uuid": "cd6ab9c7-4ce6-4977-baf1-133410884ccf", "value": "26a9449294f937ccd11f2b0ffa03c4c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3b18e9-0e95-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687174518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174518, "uuid": "068f65c9-2809-4bfb-86f3-0909c1ffa629", "comment": "Malware payload (RedLineStealer)", "value": "4e6e943f28e62fc4073a20add8fd64ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174518, "uuid": "0e0003cc-09d9-49c8-be63-0017a0ed146c", "comment": "Malware payload (RedLineStealer)", "value": "3b7e4f66c4398814f9c83b444dcc14b5ba2e407f00c411a9059247b40266d4d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174518, "uuid": "80fc2b9d-89a1-4f08-8e60-cb7d339dbc62", "comment": "Malware payload (RedLineStealer)", "value": "e1c830b51fb6913fab4b82b50b53c90bbcbef03a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174518, "uuid": "45ccdf99-9a1c-4fa1-82d6-aef4a04fe091", "comment": "Malware payload (RedLineStealer)", "value": "d635a93d2a108ebe06d27e2fda1fe693c140565e5473660e83ad53e99d33e22424711ebb77ba37ef9a4983542ca5e036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174518, "uuid": "ef791dfa-d75c-4c34-a4eb-0a7098a4e7de", "value": "T170E41213D7E940A7D8F41BB04AFA03D74B367DA01D78865B2241AC6E1DB7AC099317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174518, "uuid": "83b6fa55-3f91-4611-bff8-4a3f07631c95", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174518, "uuid": "6b7e4e7a-9b92-4588-aee7-33c08183dffd", "value": "12288:AMrsy90CxrFRLIX4K/TGr4BZxYIJCElT/2BdsAij9R7z4dCZ+0jJfMTmL8:cy1xbIX4K/aoZhCEFuIPR4dC/j+yL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174518, "uuid": "e2aa3417-7e6f-4000-9085-439767d0e89d", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174518, "uuid": "539e8df7-44cb-449c-a4a8-c36e378218b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174518, "uuid": "397db9d2-c27f-480f-971f-c0f4f75b1994", "value": "4e6e943f28e62fc4073a20add8fd64ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f06e35b-0e7b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687163219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163219, "uuid": "b656f936-c8f6-4788-a0fd-007095fb39c8", "comment": "Malware payload", "value": "5282c51d67e07be0b7ed28a363353f7d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163219, "uuid": "717cbbff-e310-4282-a17d-2104108fec7a", "comment": "Malware payload", "value": "3b8ca9d2165b8abf5b78607ced6fc6fb8b8f2f701c96a69c72ebbe38d249da2a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163219, "uuid": "715807aa-e6cb-4705-b4b1-e89aa293174f", "comment": "Malware payload", "value": "a7478a5dd9b84d588b9c5a776e2706288f4c2d12", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163219, "uuid": "86daa7cd-c118-459a-bcc5-19049a5bc71c", "comment": "Malware payload", "value": "5322e359cae5c91e71610758d88a06ce79dc6a7fd993141525b47b8f6063238313a5a056c511a3a755044a280183ebbe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163219, "uuid": "07da56b4-a53a-4f43-8d9b-6beac40fde3e", "value": "T1B0958E62375090BEC2AB3130510AB37AE2BEDD710E35C28B6690FE7D3E74593552876B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163219, "uuid": "eb20b780-f422-4960-918d-b1fb83d454f2", "value": "4f76e3104232066d41f3c7e60c1a6c70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163219, "uuid": "a14b123d-d3df-408c-8d2a-26e006db002a", "value": "49152:vqTErGFpejv5AS0ukJIDCeX/veAZfqJ7eqjguYz4wwMQHUsdGk1RZ7+A34d:vpGFpW5f5kJIDCeX/vjfqJqqC4wwMQHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687163219, "uuid": "c8622a04-699d-431b-8a89-49d220516129", "value": 1901056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687163219, "uuid": "5b48db7b-94f6-4cd1-8259-5d668b65cb36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163219, "uuid": "fc2ae35d-4812-4eee-a5b1-e1a41766e07d", "value": "hodll.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e276f22-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165418, "uuid": "f656a893-14f0-45a9-9376-15e5ccb455a4", "comment": "Malware payload (Mirai)", "value": "4629e78a31247d971d8ad7e3b10eb96f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165418, "uuid": "638bad24-1325-464a-aaf9-f6b88a979d1b", "comment": "Malware payload (Mirai)", "value": "3be55f308897689db59dafcfd314f47cff225585a58a7abb0c4565f0ff325b56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165418, "uuid": "d7233969-9531-42aa-853e-6e2cf942cf96", "comment": "Malware payload (Mirai)", "value": "ec2061ff0aa78538fcbcc3c6f6bdd770336f3573", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165418, "uuid": "2c95beb0-18ce-4d13-8738-8c3c92854b06", "comment": "Malware payload (Mirai)", "value": "62440e14b233ab8881af65cea41f3ffc0adda5a101deed26e01c89e1bc6f99f48219585897f452bd9871267c5d73fd02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165418, "uuid": "eb901098-c879-49b3-9238-e340229f1e1b", "value": "T141F339D7F800EDFDF80AE33B48530916B130B79254925B377257796BEC3A0981967E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165418, "uuid": "e5492171-bae6-4922-a976-486ee581274d", "value": "3072:5j1fZyqHbfMSPcxROWsxJ6jWa/swNIppCNgVfjbicLpEyEa2yZ/wp:Fj34gHyjf/IfCNkLpEzyZIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165418, "uuid": "055ef583-afc4-4300-9671-3cbdb9421fb5", "value": 163788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165418, "uuid": "ceebeb1c-3fad-420e-8898-9a50b73d4dd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165418, "uuid": "3a101a81-3c97-4d1f-a96f-63b8d4a26444", "value": "4629e78a31247d971d8ad7e3b10eb96f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f803648-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165447, "uuid": "18f0c11f-8b8f-4759-948f-756d89f71f37", "comment": "Malware payload (Mirai)", "value": "311629250ece9e04b78d6077b07e3bea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165447, "uuid": "75872a61-2c18-4d20-930c-a0ecfe672838", "comment": "Malware payload (Mirai)", "value": "3bf10dfe8c8fd604cda23203756bff1f9bb68ea08ebe0b314939a82facf894d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165447, "uuid": "be45783b-5364-4c48-b2eb-83ddd216057f", "comment": "Malware payload (Mirai)", "value": "e6b59373cec56c80c533830e5203e16a6afad63c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165447, "uuid": "b37c91a2-06e7-4ec5-941f-ce252fa3a0fe", "comment": "Malware payload (Mirai)", "value": "416ecea9aa3096e2ac63e9cc8cb9f30a67518d445e85bdb2b1e89f63a5e2a7dbaee9b1313370c49132a74872218b1a53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165447, "uuid": "848bb8cb-7ea7-455c-a9b1-3b9621aa5206", "value": "T12F539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165447, "uuid": "2f041d46-57ec-4601-8f2c-9dcff0889607", "value": "1536:PaAtVnz1/mUUNztiYmW6yhiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwNkT0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165447, "uuid": "28385b0d-89b5-4e9f-a4c8-3b2299a68ee3", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165447, "uuid": "5ff802a3-0a91-440d-924e-6d3916f7d626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165447, "uuid": "dccd6665-c479-4e60-86a5-dd9be7b39012", "value": "311629250ece9e04b78d6077b07e3bea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09cee98-0e66-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687154470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154470, "uuid": "0d848776-5344-41b9-8d56-1528a3ef4f8f", "comment": "Malware payload (AveMariaRAT)", "value": "050996957129a8cefb90f41eebbcd607", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154470, "uuid": "0de4ab03-d8ef-4a02-8d3f-4b64f30fcdfe", "comment": "Malware payload (AveMariaRAT)", "value": "3c181a546c2a99ecd127075771a18aa0e9856efe2373526418d0db71e1e01904", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154470, "uuid": "5fe22a47-c77b-4c58-afe9-da1fa54950c4", "comment": "Malware payload (AveMariaRAT)", "value": "6ddddd1c62cff506b33c5a1dd665d390a333cafe", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154470, "uuid": "c24baff5-2e97-4dcc-a4b4-a2cbfb535f3b", "comment": "Malware payload (AveMariaRAT)", "value": "0d4d8c7539d039bef6d95bd89e4c7a13af0046de0a85ea222215b290a9555d70e0859ae77f5cb9ced859bc4e5fab4f77", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154470, "uuid": "d9121cf0-c235-47a9-ab2c-2013bc4e1335", "value": "T125A42335B2CCD75CCA87C1A6426149D6D2209EAF4960B70BCB26A7CD6CC6FF829744CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154470, "uuid": "912c8fcc-8dee-4411-9d58-c8eea687401e", "value": "12288:tYjPfptOkeKD0P+dkD7gEix4In9N+DHdb:tYaKtdkDtDInsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687154470, "uuid": "9c8bb090-23c5-46ee-a282-dcfcbfea89ef", "value": 471215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687154470, "uuid": "6cf2184d-7220-459c-beab-9183725f76fd", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154470, "uuid": "c4b8a4e7-1819-44d8-a0bb-8561faf0659f", "value": "PurchaseXOrder-ScanXX10030022266X-Xpdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38956db-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SystemBC)", "timestamp": 1687168246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168246, "uuid": "e158805e-c673-47de-ba48-bdd9091010c8", "comment": "Malware payload (SystemBC)", "value": "e28bb0c12be9480d98e49fce8cced7b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168246, "uuid": "06f4c92f-a684-48ba-9ccb-33efdc04e073", "comment": "Malware payload (SystemBC)", "value": "3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168246, "uuid": "60651189-89cd-47bf-aac8-749ca822739d", "comment": "Malware payload (SystemBC)", "value": "e7f2fb2ebdcd1f416422ecfc9a2e3bdf4dc2e845", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168246, "uuid": "9b9d15de-08c7-47b4-8642-040cc87fef0b", "comment": "Malware payload (SystemBC)", "value": "fd9b1b62ffa723baf64f24aace9302d4022a8f49dbc8635d85daf02df7348997031fa886ba27542b76a19557ca1ea903", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168246, "uuid": "4147e55d-14cd-4c37-95cc-7bd17a2018cb", "value": "T120545B9392E17C65ED264B729E1FC6F87A1EF5504F497BA712089A1F04B31B2E133B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168246, "uuid": "f9dce175-834f-4574-9688-f08074b80fd7", "value": "493c0587242c6f974644a1959b9764db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168246, "uuid": "cc883119-5ff8-422d-b29c-f6194eac8888", "value": "3072:d5lYIMAbKnUtNBizA3DAbxk57Ei3LSmPI0DnMOC4YMA5ydszTgXl:2IMVUtrrl7BDnMf4HA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168246, "uuid": "cc04c7ff-45d8-4efd-88d6-0eb76e7ab09e", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168246, "uuid": "ddc0ce3a-f8d8-478c-9cd4-c0ca08e70c0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168246, "uuid": "8d76673f-84b2-4ad2-9e0b-5e1e0840c8da", "value": "e28bb0c12be9480d98e49fce8cced7b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c34978-0e9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687176920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176920, "uuid": "7962ba6b-6f7a-4497-be69-1a9354cdc318", "comment": "Malware payload (RedLineStealer)", "value": "4755b942c3ebe6582e5ebe5f7a78b1fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176920, "uuid": "5b48f175-e35e-49a1-ac12-a85d1a7b9785", "comment": "Malware payload (RedLineStealer)", "value": "3cb38b2cb3aa7dcd458371eea86304dd3df9d65ef48eb953f383a97883575d51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176920, "uuid": "5a10c5cc-8dd3-483a-a1ab-73951547d71a", "comment": "Malware payload (RedLineStealer)", "value": "c9322c3e434935dedc3052eb13112c8c99678e6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176920, "uuid": "97f3f464-c141-4fd5-89a5-79f20352bf71", "comment": "Malware payload (RedLineStealer)", "value": "815265bb468f845e2bd985f8e00d116fc0faebd17a301c153782271628cfdfe45e04f6910729c0fb5de369fcf4189279", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176920, "uuid": "1a1c66fd-be82-434a-b313-067fd90cb515", "value": "T15A544B0FB5C50336E471103D2BB02956EDEDBC910D34ADB73A6CC329156BBE2A9690DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176920, "uuid": "24025240-e048-467b-97ee-e9b9493c6e9b", "value": "d91fa928c738702455bfa66ac3685503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176920, "uuid": "0fd96103-591b-4ba2-a596-3961210f7f7a", "value": "6144:9Xukab22twAUjnFM9P3Z73jLxYKJk+JyvVLMl:daC3FOLxtRyvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176920, "uuid": "eee4240f-a506-41e6-80b2-78200ff671d1", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176920, "uuid": "2abe8fb8-dc80-4eab-866e-3ab8d2869e8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176920, "uuid": "2d93526a-9ec1-461a-ad16-2582337779e3", "value": "4755b942c3ebe6582e5ebe5f7a78b1fa.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43bb5e2-0e8c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687170797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170797, "uuid": "aec99964-8305-4cba-bfc1-cc2fd6eeb915", "comment": "Malware payload (AgentTesla)", "value": "6292cdf074922601a8f882921ca08c69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170797, "uuid": "299f12f0-e7dc-4052-9b99-247afe62f34b", "comment": "Malware payload (AgentTesla)", "value": "3d0816e876a59f4e3b56bd2105122ef69499f79bab375b0956716494eb286dbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170797, "uuid": "928bd319-80e6-446a-89b8-9db97d617c96", "comment": "Malware payload (AgentTesla)", "value": "9162e9e76e014575f675ac989e7a3f6101d8dc57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170797, "uuid": "b4137f8c-1266-4c03-a626-666e7907834d", "comment": "Malware payload (AgentTesla)", "value": "ded6e1e772c90383de9c27b86435d6954881662f3b157d8cd75a2e96fab311ac1fd124069988cb12f2f5a094caa316e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170797, "uuid": "e5937a19-ea61-4fae-b251-7fe7eddc3ba5", "value": "T10015E0243A790F56E47D97F94441723117BA6A6A783ED3284FD3B0DB1A62F410E51F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170797, "uuid": "e7cf0f3c-707d-418e-aacc-88bd0d3954d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170797, "uuid": "6a226960-6db5-472f-a96d-1620340ef620", "value": "24576:fQYqtm8OqKuQ2AHokZ1Rely+0BbSILMv3+FlYILz:Y+8OgFALvRd+/mMvuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687170797, "uuid": "a4063089-ca60-4b33-88e9-f837e94f9285", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687170797, "uuid": "98a61775-e14b-472d-ad24-7abde1300ecb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170797, "uuid": "247de682-8e25-4c20-a6b2-4664363185b5", "value": "SecuriteInfo.com.Win32.TrojanX-gen.28883.16875", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56d772a-0e90-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687172544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172544, "uuid": "026f72a1-b06e-42b9-a4cf-f737b9664f04", "comment": "Malware payload (AgentTesla)", "value": "095d9924de77dc0096561281296bcfb0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172544, "uuid": "f6a51b7a-8317-4536-aa8b-b1a72a3471e5", "comment": "Malware payload (AgentTesla)", "value": "3d9b67b5dc857a2663548b9335d48dde0a880f6b61490f0cced767399a166f2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172544, "uuid": "78c20f7f-d572-470b-a411-d64b0173e769", "comment": "Malware payload (AgentTesla)", "value": "2e4838dcd32911c66007af6698e44c417e79cfea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172544, "uuid": "dd73b0f1-a4d8-469f-854b-06dec9f81ab5", "comment": "Malware payload (AgentTesla)", "value": "a5f1fcc138c658f424909769f288a35de7365b74745cb5d19947a82fbfbc09e70de0cd739114542471deb919e492284d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172544, "uuid": "d7d8a48f-9e90-4061-8a7d-0ac382019a35", "value": "T12615E12076780B16E47A97F80551B63107BA6E6B783EE3190EC7F0DB2A72F414A51F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172544, "uuid": "0a989cb7-544e-4fab-8576-5751d5f6e342", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172544, "uuid": "7bb0f6ce-0dd1-48ea-9345-c7ac27f71656", "value": "24576:kQYqtm8OqKLM2uxp5GQY1NHjlLlE0IGcARj:9+8OGxm7NFZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687172544, "uuid": "9aa7214c-dd0c-4463-b4eb-3001be0445e4", "value": 921600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687172544, "uuid": "194801e0-8f6a-4b09-8866-352e1a66474c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172544, "uuid": "cadb8f4e-c36d-433c-9b12-1f52070c3b82", "value": "Kredi Kart\u0131 Hesap \u00d6zeti - 4508xxxxxxxx0017.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca9e438-0ebe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687192233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192233, "uuid": "faf80e77-a121-4c42-9b7c-2c7e78183bc9", "comment": "Malware payload (Loki)", "value": "931e722f5e3571939e8503189b782db0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192233, "uuid": "67bd4574-a44a-4e43-90c6-4fb6a12c03fe", "comment": "Malware payload (Loki)", "value": "3dd7f1720261b8846b6d2fb7fda89dcbc93fdbc7b69f7c49301daa5add74838d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192233, "uuid": "50a032aa-13c5-4c78-a56c-74bf233985ae", "comment": "Malware payload (Loki)", "value": "b37014f66d8b904725f488e9b8b8480675147314", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192233, "uuid": "be599b7e-82aa-4d40-a6b3-2a7b0b5ac7c5", "comment": "Malware payload (Loki)", "value": "44b173ec61c8d049538e864ec3513f7f1dd14a884a0b01eb5d70699188b0cb3bddac2020bcedf66b3c263a51de7186e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192233, "uuid": "3580ade2-cc4e-4029-abb8-750f676038c7", "value": "T12AB4B093F6C0A275F4BB8E31B53B90609A377EA66E51C52F3085B3581873640EF72B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192233, "uuid": "1c35bab8-b358-43f0-a6f4-768392922167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192233, "uuid": "d9b9306a-c379-4af2-b052-3b571a09ae90", "value": "6144:2qJsocMS507SQfzFp6Wndk9YvhVTcgL/dpd1N/trCSeL2o6/n0h+ag1CWQbSfQqJ:jJsocMd7RpR66QgL/TdPUSL8EKqfEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687192233, "uuid": "bcbdbf2d-1ffe-47f4-9eb0-bd926cad7ebe", "value": 523456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687192233, "uuid": "576c9754-d4ba-4ce6-a569-408aa7407858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192233, "uuid": "7f99acfb-0f9e-40fc-8955-e1caa0a46246", "value": "931e722f5e3571939e8503189b782db0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d1741d-0e73-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687159920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159920, "uuid": "6640fb9d-03b1-42b9-91a3-ba917a5c5e8e", "comment": "Malware payload", "value": "4eeb97de95b657bdf03b3da83f96c3db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159920, "uuid": "eb4443f6-f062-41c3-84d0-b3bc8254dfd1", "comment": "Malware payload", "value": "3e24e97aba6e7432395abc346ee3484b9dbadbe803a046a84ea41529d6ed8c89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159920, "uuid": "effcfbc8-20e7-494c-b259-4e8af10eff53", "comment": "Malware payload", "value": "d32d70daa59b32581909fa6ceae676e1b56daee7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159920, "uuid": "1571ecd4-ade6-4add-902e-ebf77d81fa87", "comment": "Malware payload", "value": "877d38498166282622efc46f7050a6e552ecfdc2520a544da7ccc34dcdb99c5a93969aed9b93b077919dd24c0c2a99f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159920, "uuid": "35e50695-4ec7-4a1b-b38b-495a3bd85f82", "value": "T132E42349D16F9E42D81FA1BDF6469008A9F397B1EB0BC52E07C2477B753B1866230AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159920, "uuid": "5fcc9ccb-e561-4237-9904-dc1dd8e09f59", "value": "12288:ulLQW2jd7k7qPUOGy1fSG87f7xU2pyv2fczHTTAJiULFH6NooFoUd7A9BG/X7D:+L5trsP8DNluYCMJZHOoKobnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687159920, "uuid": "4f50984c-9e8b-421f-b48c-7a6df77c04e8", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687159920, "uuid": "7098e353-8eac-45b5-bb77-85a3ec9979a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159920, "uuid": "cd2bfe26-d8bd-46dc-bd83-1742185b865b", "value": "SecuriteInfo.com.Win64.PWSX-gen.8281.26128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1a9424-0e90-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687172419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172419, "uuid": "5d8b0e6c-5f1b-4211-9d86-b979d7d8abd6", "comment": "Malware payload (Amadey)", "value": "4b9a0313bc3053a737c3806435aec1eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172419, "uuid": "49a67124-1eb9-472e-a0f2-c7233aa677f1", "comment": "Malware payload (Amadey)", "value": "40e0c600d7cce1266068456274a50cda485bf20632bc5d072b780a0cb423f7cb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172419, "uuid": "99614f00-31b7-4ab3-b950-e4261fac68ce", "comment": "Malware payload (Amadey)", "value": "02a10c80f8d426bf585933f6dd5c3e3de12248f2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172419, "uuid": "83528c3b-029a-47ba-802a-3901f7f9ce06", "comment": "Malware payload (Amadey)", "value": "ede373a3400c0ab13409fcbfc0169a60935e54c3909e2c26c5291ebcbfe68297d74414c2e3b09a30e0d25ad88ebffc2c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172419, "uuid": "1fac1df6-4954-40d3-8e6c-a0394860f8ce", "value": "T1E5D41252BAD98072C8E25B7118F313830936BD614E7447AF2796A95B8C73644E137B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172419, "uuid": "875beb28-05a2-4250-a7e3-1f5c690bd04d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172419, "uuid": "7bf834a1-14a8-48d7-9098-f6c08e9013e5", "value": "12288:ZMr0y90d85iFBotOp4JB8KrWZzu1lVM3oIq:JyT5sU04J3rV1Ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687172419, "uuid": "8edd31c8-35e3-4a75-aecb-2938369c174d", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687172419, "uuid": "1c8c4d52-e2be-4eb5-b76b-20b12297b843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172419, "uuid": "268f85f3-3379-4443-8749-dfd349ae922e", "value": "4b9a0313bc3053a737c3806435aec1eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a900c2-0ec8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1687196460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196460, "uuid": "b11ec62c-208d-4acc-963e-fcadba5dadb4", "comment": "Malware payload (Smoke Loader)", "value": "5fb4661d4331b84fd2eef4710a0bcb49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196460, "uuid": "68ae6839-8c12-4579-89d8-728bbe31b32e", "comment": "Malware payload (Smoke Loader)", "value": "40ebe2f864e61a190e83905b6dd90a640139852e3d1ade8256d5b53cab4b5511", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196460, "uuid": "e6e18cda-a131-4746-863f-a5f958f7f894", "comment": "Malware payload (Smoke Loader)", "value": "5a24025bd8775fd98c406ea2f27796ee04570867", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196460, "uuid": "aad9dc19-6e4e-4204-bc0c-32f9ef04acbd", "comment": "Malware payload (Smoke Loader)", "value": "277cd4a0791cc5c86ed047b1266670495edda0b8fb542fbb0941f82c1434f57400bca81b02bd779009c3dab60046e9f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196460, "uuid": "29fda1dd-2bd3-45d2-9c76-e76ee9b7170a", "value": "T165347D1372A3BC64D52ADB768D2EC6F87B5DF940CF19379A12186B1F05B02A3C57231A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196460, "uuid": "c82f5435-3050-489b-a4d7-974f9acf7a31", "value": "908fbf99c3f8c44c371239c262bab2c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196460, "uuid": "2cf91c5b-0bf8-49a5-8188-d97c27920cf1", "value": "3072:ZayEur8zSdGaO0yp1mwHTsbVD3ei3qVlCGxNbFSga0Nz1nrI+PEY2oAYwjJ:MuomdGaO0yp1Hsbt3ehjRcga0RfEZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687196460, "uuid": "31c41b6e-cb7e-40cc-b38b-ce0b35f36aec", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687196460, "uuid": "2519c496-bd65-46b4-a5f7-5ffea45a07ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196460, "uuid": "9ae11dc7-4fa8-4db9-9708-1f562b4730b3", "value": "5fb4661d4331b84fd2eef4710a0bcb49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29643bc2-0ec2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687193757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193757, "uuid": "b72b48c5-4a1e-457f-b05a-467a0861f0fb", "comment": "Malware payload (AgentTesla)", "value": "a679e481d2868515a01976a1120c909c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193757, "uuid": "b76b9a6b-c4e9-4514-8e2d-4f69d663e631", "comment": "Malware payload (AgentTesla)", "value": "414d2654c6775e6e6b37f805c3c672e33cfd53e0859769bfadc5f437be2b3b12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193757, "uuid": "943f17f7-cc52-4588-a07e-4b44baa1a126", "comment": "Malware payload (AgentTesla)", "value": "e849bb609181b287c3f4b81f0ca7999484c93fdb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193757, "uuid": "e7052db2-3093-4c40-9ca6-d7a389799067", "comment": "Malware payload (AgentTesla)", "value": "1dcc8b5f954cf738de27a0f3cda1a82a987e2035dda5c87c12e0598dfe2142c824837462ec7cd9e8c39f2bd573c74393", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193757, "uuid": "0f4acaed-349f-4bd8-bcf3-45ede50f4045", "value": "T171641207B250C477D9510B32AD72C1FEABA6AC169CA8630B73D07F8F74B6441AD2E719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193757, "uuid": "d399e4f4-1cf8-41f4-9b55-dd95d3f9f484", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193757, "uuid": "2f867926-cf42-45f1-85ce-36d1924dc328", "value": "6144:AYa6m3Pm7oO2nh6oQrGDKSUjuOQkP78Yg0GmI2GTOdYinSohC+:AYsfEoBh6oQybUCe78B3TOdpnSt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193757, "uuid": "9c7fb77f-eb07-4d5a-a7dc-79b987121503", "value": 334652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193757, "uuid": "7e5b419f-5e5b-4125-af4a-1f896bbae07c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193757, "uuid": "e76967dc-e28e-4ad6-8ec9-84261ae6a911", "value": "a679e481d2868515a01976a1120c909c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feeb305b-0ecd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687198840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198840, "uuid": "34545d5d-1fb2-4911-bb4b-0dd1fa8aa5c9", "comment": "Malware payload (RedLineStealer)", "value": "1312732362277a32f534bd21cf547985", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198840, "uuid": "ae683c59-af22-46df-b348-2338859a0427", "comment": "Malware payload (RedLineStealer)", "value": "42e33f88b96933f3ca961f17c2d6dddb75ef0a12d63445050bab49932ceac31c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198840, "uuid": "e138df2f-b434-4f71-b033-89b957fc004c", "comment": "Malware payload (RedLineStealer)", "value": "cdc0901b1740e8dd52ff8d70c87bcfbfe8ebcf86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198840, "uuid": "fc73d9cb-e2c1-497a-8f87-b2fc031f8396", "comment": "Malware payload (RedLineStealer)", "value": "8c1b3f91c86d7fba426e848d0f3f60b0f665408f13d2a7fcde3cc1dc1808107a54ade09d82512be1dd1adff18ac87f8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198840, "uuid": "2304a1bb-788b-4449-91d2-80981d50928f", "value": "T1CFD422066AD48672ECB67BF048F603C31E3ABCA05971466B3245ED4E5C722C0B4777AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198840, "uuid": "50facf5c-a154-4ef3-8d31-9aad08914469", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198840, "uuid": "3d83bafd-ff34-429f-a59f-d813467dca81", "value": "12288:IMrGy907DhU4GsEjWlEpPk3i+29TABHdim0GNrSW42HEc2nFKmVbITS:eym1U4GDSOc3NUUB930xt2kpnFxU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198840, "uuid": "2fdb87f2-cf33-4546-9d9b-d23262013ccb", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198840, "uuid": "9a9802f3-51cf-481f-a909-05771f5e2136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198840, "uuid": "0d72d15f-e41a-48e2-b7b3-7f44773e6dd6", "value": "1312732362277a32f534bd21cf547985.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db88bf13-0e65-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687154113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154113, "uuid": "5067237a-d940-4da6-abb2-9b260c9571bf", "comment": "Malware payload (RemcosRAT)", "value": "9f8fcdaf77f1ffa7326404c88659764f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154113, "uuid": "7a6b5eb4-cd62-4ba5-b64c-c72ebfa9e390", "comment": "Malware payload (RemcosRAT)", "value": "43bdecd290fd3df3dc807e4744a50fb488624a8653b3db356c809b3898d975fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154113, "uuid": "74ed3de5-5803-456e-a39c-be23d7978166", "comment": "Malware payload (RemcosRAT)", "value": "7c7abde1b5f87c19067b741ce79d08416559455f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154113, "uuid": "7ea09e53-e2b1-4780-bd1c-aff9bb1f428b", "comment": "Malware payload (RemcosRAT)", "value": "1e803b76305c5d3dc5a1b2656983c28fa411d345e616914f84d8a7bbc81bc928ca6474c45d457e5d0e1d27a1886ceb97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154113, "uuid": "7d2faa86-de36-4cc0-9083-9e4c91effcf9", "value": "T1013501C6E9814587EC1D5BB940727E71136BBF79BCB9E24D9D49B0E07AB36830032A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154113, "uuid": "4238271d-6ccb-4783-b4f2-96cb0896b3c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154113, "uuid": "d22d55f8-1c07-44c4-81c4-04fe2dabeb03", "value": "24576:Z3Yqtm8OqKkM4bJmPwYk86L2TmFSX7UetmlEu170wnn5Jm4:Z3+8O54bYPDyUgHlEBEn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687154113, "uuid": "efbc1acd-ece1-4576-b90c-ea5e49e0a1a5", "value": 1128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687154113, "uuid": "4ffd9de3-b801-4c77-b71b-24b294ca6434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154113, "uuid": "f99b3f9b-a1e4-45c8-ac68-3f726d065702", "value": "DESGH123ED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e748a4-0ed4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687201460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687201460, "uuid": "5f68bff9-a176-49c7-8e2e-30441553303a", "comment": "Malware payload", "value": "1cede77039df6d22d96360212059602f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687201460, "uuid": "c3652aba-fa21-4018-a962-276fe5a5722a", "comment": "Malware payload", "value": "43d54b8b86ae2493574243c900db4aef7fc5dd96ea5188ceaafecda01c02130b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687201460, "uuid": "136c4923-ae26-408d-94b5-b57a969470b3", "comment": "Malware payload", "value": "f7f46f792be1ab6957eb946d7c23928beec9c4a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687201460, "uuid": "5f1fa4fe-23ce-43f4-b66a-54195e59613c", "comment": "Malware payload", "value": "9b0e397db832cdf2c6911de69d0d8b70c611b993894096f7718867e5a884a3a4320cef14d6c5ec3c5e46f8c21d487e67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687201460, "uuid": "00d2a99b-de52-44b9-baeb-8891f01fcdc6", "value": "T1D5E207467BE58219C6BC6AFC9CB313110772E3838472EB6F5CDC48DA4BA76D00641EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687201460, "uuid": "827d66d6-c60b-48c0-b7d9-383fc2310a30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687201460, "uuid": "5197d2b4-075c-46c4-8594-698ff5a567f7", "value": "384:r0bUe5XB4e0X+Od6ANuiEO0YatWTatTUFQqzF3Obb6:IT9Bud4guiEYK5b6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687201460, "uuid": "843b67ff-59de-4e25-8e03-98bb19f8355d", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687201460, "uuid": "3585afca-aa4d-4bc5-8aa5-1a8c4c2af7c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687201460, "uuid": "3563e86d-b306-4d40-9a5d-6d0e6e7d7f01", "value": "xpI5n5WZxYih.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18a50a7-0e5d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687150580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687150580, "uuid": "41c48c87-0cb2-4e75-b1c3-2e71706701fd", "comment": "Malware payload (GuLoader)", "value": "56ba46ec43f6471f0e85610f81d2bbb6", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687150580, "uuid": "b905a5a6-44c4-4bb3-a37a-3a98f234b818", "comment": "Malware payload (GuLoader)", "value": "43f009602a3449253ea551c01ee4709326be180a4b7829937a0f2e2891b89004", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687150580, "uuid": "b161d0cf-00d2-4582-9c26-2dd4020f5a05", "comment": "Malware payload (GuLoader)", "value": "8207ddce2d7ed0f8fdd7ce55474b1f981fe83a3e", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687150580, "uuid": "3665f354-0a96-44e3-822e-7c1a610c0aec", "comment": "Malware payload (GuLoader)", "value": "9d86e3e2de5932cbe60f3f7adfce9207a02a59bb34ba089ede49775ffa1ec612a3b352dbeab81b39b81bde4edd2f757c", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687150580, "uuid": "5616d383-d516-4f4f-8b79-322f86d71297", "value": "T17674230615406A227191C39EF078387F6AB454BEEB847FFD4F2BDE885E06BC26639C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687150580, "uuid": "e3f332a6-6e61-4141-8d09-1c905bbf624c", "value": "6144:1MxsNVcs3PvaUPQ7tBF0bl4J+pbk6TzPWpqFL95xiUt9yqITrBN5/W+o2YD:6xU3M7lil7k6TKpqFL95xbrIpNlX1YD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687150580, "uuid": "c04768ca-1f12-4590-92f3-c4bf1350aaf6", "value": 339091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687150580, "uuid": "cf35f252-3a39-4894-af1d-335548ae9e28", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687150580, "uuid": "d3a11512-5af3-4344-87a5-1476a6fd169d", "value": "Termination Letter.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f17853-0ea8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687182905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182905, "uuid": "ad4bf0b1-d5d0-4f7c-b2fe-29fd39810ff7", "comment": "Malware payload (GuLoader)", "value": "df60ffe946985bb16a6cbc862ed67a2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182905, "uuid": "6abd175d-6729-4316-ab00-ab10f00e64b2", "comment": "Malware payload (GuLoader)", "value": "44b7dfcb3fee43eb6de84138c06b2fde701eac3521328c4c861cb64a5a44e429", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182905, "uuid": "3718cdc7-878f-45ed-a3a2-23cfb85523c6", "comment": "Malware payload (GuLoader)", "value": "60fffb41e6b34859a10044b8b4d36ea05f519063", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182905, "uuid": "df3acee6-2979-4c32-92cb-348f2120e740", "comment": "Malware payload (GuLoader)", "value": "d15a4b23b2474096aa7426d61d6efdc84dd6d3c6086a22357e58f41c2cfb80e28e3552d27a65be4e3ddd72562a4f100a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182905, "uuid": "e988fe3c-2f40-4779-8ad9-cbbd362df011", "value": "T178840192E29480E7ECB9177068331E27256B3D68B5B4DA0F675B7625AF333D2042F907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182905, "uuid": "44238d2a-5b37-41c7-b716-a9e405db39b2", "value": "66fcdd6338ffed276966867e7cf86116", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182905, "uuid": "1749f0be-f4bf-467f-8b73-58258a4c2d0b", "value": "6144:v0xJt5VEQV2CNy3uC4CVfb95BlVZTzJ6Z28oEC8xcYi/oO4IPvg:v0Z4TH3u/MfbrBEjCoO4K4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687182905, "uuid": "fa78badd-2134-4c6d-b1b9-5e30158c79e3", "value": 397097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687182905, "uuid": "7ef32e0c-6d40-46fd-a590-27879feb2f9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182905, "uuid": "17665e30-2df8-48e4-b95f-632227ce432f", "value": "RFQ_ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b371e9-0e9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687176866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176866, "uuid": "da22c53d-ba5b-4249-bbd1-a2bcbda7281d", "comment": "Malware payload (Mirai)", "value": "c47074c37e0810bcf63c51bf7665cd1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176866, "uuid": "a7f600c0-c83a-4dcf-8ec3-55fdb6c0e9ee", "comment": "Malware payload (Mirai)", "value": "45568f59ca0357744a880dd04f5834fc55a7aac301d7336de29120541ede8e89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176866, "uuid": "2ec0387e-2bf1-42dc-b225-6cda54ee6858", "comment": "Malware payload (Mirai)", "value": "441bf807ec0282a40cf3ea4d20423f546297c6c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176866, "uuid": "adf93672-d8d3-4bbd-ba09-28aef5231588", "comment": "Malware payload (Mirai)", "value": "97699d9c791c3a6b385cb569b23359f8b5c30b87b9e9bf60cccd62aaa8f2ca9f09630175c10193274fd5247b61b55ca2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176866, "uuid": "b773b6bb-f16f-4600-88fa-e4c927966026", "value": "T14533971A2E22DFECFB5C873547B78E21A698339626E1C685E15CDA001E7034D741FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176866, "uuid": "380e5094-4f6c-4912-8af6-b41961203027", "value": "768:RDBXxXBZq9rHUR43tjwRxOMvfuF/bpxpf2WfWEsL8fu/Za87fc3iR0Q:3BXBZAU6djwjOMvY2WfWEsFMwfsbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176866, "uuid": "2c0e0f16-7b5e-4d56-98f7-44280be4d0f5", "value": 51212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176866, "uuid": "9f2f5e8d-c0d0-4e1a-9a51-5bb9085abe7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176866, "uuid": "cfe614fd-7775-433f-8897-c2fc57a01baf", "value": "c47074c37e0810bcf63c51bf7665cd1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2b4c9d-0e65-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687153897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153897, "uuid": "0776da66-71ea-46e0-a7f1-f2efbc949533", "comment": "Malware payload (Mirai)", "value": "2588c2a06fdfa2498eae1b7ef3a24cad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153897, "uuid": "ef291fae-4042-4342-85af-620a9bc94b3c", "comment": "Malware payload (Mirai)", "value": "45e655010b5ecc505b9512286953181a1a68c1466638355c8b1ca91bb69b45f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153897, "uuid": "20055614-17ab-4918-8c40-662338db26ff", "comment": "Malware payload (Mirai)", "value": "298a1ad80b682e526af66221c0ace15f01a22c51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153897, "uuid": "fe94a0e9-0f9b-4b70-90c4-c703701b11a5", "comment": "Malware payload (Mirai)", "value": "94741b5121053f040852e77bb1570e3dd346a1e3917cdaf77ac682cf818fc20867be288264672cfada3947cd320cc00d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153897, "uuid": "447ba193-6470-41c7-8260-ad4c7d3ed779", "value": "T1F6732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153897, "uuid": "7a1902b6-0e34-40c4-87de-43def323e802", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9Wf:927jqCt8v3GI/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687153897, "uuid": "be149e1d-2a76-4fa6-9f59-42969a18e672", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687153897, "uuid": "619dd05c-5ee9-4e64-96b5-7d7a89f36318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153897, "uuid": "430d0ea7-6113-4295-8787-39e1db9499aa", "value": "2588c2a06fdfa2498eae1b7ef3a24cad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4dd3c3-0e7b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687163243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163243, "uuid": "a4687272-78a3-4d41-9823-84c1b5bae486", "comment": "Malware payload", "value": "dd28ac25432b831336d6070736569219", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163243, "uuid": "233fe85c-0a95-4a66-954c-766181b3805b", "comment": "Malware payload", "value": "468d71fc7e7a6d72d51c2f61f6463d625ef29fe3b90198d3b6cc3cf892d24301", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163243, "uuid": "530556ba-4b82-43d6-9062-0eee37c01a8f", "comment": "Malware payload", "value": "86e4c86f5dd46c6d98f60d75ec0dd4837a7041e1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163243, "uuid": "8c0cbce2-1b63-44c5-b9d9-69c6b292f103", "comment": "Malware payload", "value": "d89dc7f406821699503667f917d7dd2ad27f9f8afec2c728a6277ead9c07cb941b1fbf87723999c7d4e1d0c71c79a092", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163243, "uuid": "4dfb0e64-f369-49a9-9276-7b23a0ac63e1", "value": "T197368C227DA26A69C1144E307D9FF77F132F5EE1960C856E523ABDE82A3253067327D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163243, "uuid": "8479cd25-3c19-4068-a398-fe5cce317963", "value": "49152:updSvPe+Y8YsOs/7mE4GtTmYGcLs8AezN7dXmJ0zjxq7lyMbWi1+xl5:upYG+YUOs7kGtdG9kdJB+lyMbJ1u5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687163243, "uuid": "b178e48a-c3fa-43dd-adbb-9c447254229f", "value": 4915200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687163243, "uuid": "d1b2fea8-3cc1-4532-9467-5908c0aec0f4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163243, "uuid": "887f98ef-4028-4e69-bf11-94fa246c1727", "value": "TBGTeWF.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e854af2-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165392, "uuid": "725d76db-7033-4bc7-a959-69497754da02", "comment": "Malware payload (Mirai)", "value": "4458b3151dcc5536b24017111c4c76c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165392, "uuid": "314d629e-82c5-4635-87df-8559146b70ac", "comment": "Malware payload (Mirai)", "value": "46a630e6ecf93ab35f6ee57b06486d157f8a25ed60f3374f34de73cd53ee317e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165392, "uuid": "430af1fa-2405-482e-a80b-f54e7b56f757", "comment": "Malware payload (Mirai)", "value": "e5655aceaf09f1c3d8f44994413ec99b74ab676f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165392, "uuid": "91043328-4695-4cc3-a879-9353b2cd822d", "comment": "Malware payload (Mirai)", "value": "56b2b9aa869802137747a6c72896cd28f66c5f802d7da40b53b1bdea243a4627e427ff30416e628ce25397cf6a3fe711", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165392, "uuid": "dc7b3bec-9ec6-4a4f-a4fc-fe3bdc772b4e", "value": "T126D2E1339C2EAACBDEA413F3747ED13498514D74218F328EB2997858887F5FA641C69C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165392, "uuid": "c55d2d96-c138-4bcb-b7a2-b229aa6da394", "value": "384:MjecMliFob5ojNzZcR6mtGsxhahJZuOrmPkKyh8nM0rzeZRH8WGII7KqB9d3Agmb:mecseM5YNz6xUYkKaSzGuWGUsBLo2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165392, "uuid": "13896b52-c11f-47cb-85c4-5e808e79a58d", "value": 28440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165392, "uuid": "aed34311-006c-4184-9c79-3f81cd86286f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165392, "uuid": "dabf258d-262a-4943-b65c-51aedf5a0783", "value": "4458b3151dcc5536b24017111c4c76c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5b1918-0e66-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687154542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154542, "uuid": "9db2961d-d0e3-4d9b-b350-b100b1899619", "comment": "Malware payload (Loki)", "value": "4d0334c33495d93ea69d09255e1595bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154542, "uuid": "dd1808ff-8a13-4454-8bf8-85297f3cf415", "comment": "Malware payload (Loki)", "value": "4764e72be01dff161ce0a248e78c76787c80e739267b687b922f0e422852b7ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154542, "uuid": "927d4cc3-5a1f-4fd3-b05a-5941ce036294", "comment": "Malware payload (Loki)", "value": "9f2744c86b1b00eb41c9d12f84abe03ec53b7c31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154542, "uuid": "bd029c72-a687-4029-8718-1b597b944bc9", "comment": "Malware payload (Loki)", "value": "04823f302a44cb4336f5f7f954e55920d7693a2a4a6b816b31fa61b933810d929f44fe08c4b095c478bc1ef6b85369cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154542, "uuid": "06d898bb-60ce-4193-8b8d-1741e1cde8a5", "value": "T111D412887824A567C4AE4BFC46957376677F4BA87932EADD1DD3B0D4AEE0F012A00743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154542, "uuid": "2f7b6d12-8ee5-4564-a470-ae58fed858bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154542, "uuid": "84e37c62-2ace-42dd-9e23-5061f2991aec", "value": "12288:RttYq7J3At5iHOq+ZQqEdS5tG9ijVpbdxooxe7WMGbEIAUZm0:RLYqtm8OqK3QwtBcCebGbv100", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687154542, "uuid": "6c2802dc-ba83-4ae8-8ee7-171be8ba3be2", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687154542, "uuid": "0d0a7c66-ebf0-48d7-ba7e-d7e22ee184c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154542, "uuid": "24e13070-8a91-4b11-b33a-2cb65b9df1c9", "value": "daLAahYlFp95DiQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c194fb-0e51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687145330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145330, "uuid": "082d254d-4f11-42e4-ab4a-e7c5967259b9", "comment": "Malware payload (Gafgyt)", "value": "b965465f583e7fb7c339b84f40b4895e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145330, "uuid": "f0f562cd-46e1-43ca-8631-8893f2641b0b", "comment": "Malware payload (Gafgyt)", "value": "47a4cbfac6b42cffce5c84b671514fb5bd1cae5fb28790adc37a3b25e7f6ab73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145330, "uuid": "0d11d556-01e5-4412-a9ea-69cfb7db03b9", "comment": "Malware payload (Gafgyt)", "value": "c0dbe5282c1b827cf7480a336ac300c7db262cc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145330, "uuid": "9586bef7-28c2-46ac-9ecb-9cdb5842d883", "comment": "Malware payload (Gafgyt)", "value": "d3dbb95c5fe3832dadd0b6ba71714a04d7ce10e9e908cb4a3d496e3f1c1a9d409fe05da43109013378ce3e9946e83df9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145330, "uuid": "855d1e4f-b874-44b4-9b03-653b57a4637a", "value": "T1ACC3F93B2B130E63C0CA107116E30332AAB5DF4938BD5697B9D17DAC6F36A9434167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145330, "uuid": "e1be587c-bba0-45e0-ad1e-1f07afbaf743", "value": "1536:HFhqF5Xrlm0vkBABl1vcAt/OPo95b/itYpWvYqy+mpi4kOCXN3lXGr/Nb:WqAb9B1SoPb/fMmp/kOCXRlX6/Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687145330, "uuid": "bea64607-0b3a-49d2-912e-f00276eddcf5", "value": 125567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687145330, "uuid": "9e601119-ae1f-4ea0-9f57-472f0d64a4e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145330, "uuid": "2e1174ba-c8cb-4789-b75f-6e1f1925e4b6", "value": "b965465f583e7fb7c339b84f40b4895e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4110a7ff-0e8d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687171033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171033, "uuid": "c864b0c5-5260-4e65-b800-9235ae7610c8", "comment": "Malware payload (Mirai)", "value": "18223c91ce34068a9c351ba43ae89ac0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171033, "uuid": "b825cb7c-41b4-4b58-9d48-ca628937c1ed", "comment": "Malware payload (Mirai)", "value": "48229293fd3fc43ff43117f5d313ab3358b81723d0573ab789b62bdfe2d42d41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171033, "uuid": "6c2b0a08-d151-40a8-aee2-635a34946d1b", "comment": "Malware payload (Mirai)", "value": "cbc167d06ceb69eeb8175062ee159689d6290986", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171033, "uuid": "873235ea-6dd9-404b-91d3-334dd99280c8", "comment": "Malware payload (Mirai)", "value": "5f1106ea78fe5dc881fa296b307386bdbb3e67f9da6e2d36f9018458bc11c3fec728dfae4cccde84530102c75c6ca369", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171033, "uuid": "948880d5-4fd1-4d37-88f5-0c70792c29bf", "value": "T1AEC2E0A1E1F72DCAFB7A6E501A65C2C167B04E9FB77BCC92195C9F0808A311B47197C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171033, "uuid": "5050429d-6824-4f13-a6d2-9c02db0efd8f", "value": "768:lG959yM0HWubJsWDYcGkTiH4uVcqgw09S0K:tM0HRJswYcGk2H4u+qgw09S0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687171033, "uuid": "962cf609-d334-4866-a4ca-5759f45fc6df", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687171033, "uuid": "813a5bdf-cdac-4be9-9c0f-473d13731169", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171033, "uuid": "86b8ab92-9eb2-4fdb-917f-cdbc483b1332", "value": "18223c91ce34068a9c351ba43ae89ac0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf72e3eb-0e5f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Neshta)", "timestamp": 1687151516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151516, "uuid": "4a915df7-f83b-442c-b560-d726c43d8ad0", "comment": "Malware payload (Neshta)", "value": "3f55c06fecccd19e79fb8e7f969651eb", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151516, "uuid": "e73543b5-6bea-4bcd-9edc-b532e2807217", "comment": "Malware payload (Neshta)", "value": "496d03b8f3e5240900229ed930c776b133b7cbbaa395dd232b12066e5dd0de20", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151516, "uuid": "4f074462-2b8a-4176-bc56-acbf5376bdf1", "comment": "Malware payload (Neshta)", "value": "9233c3e42e677e34cf4bdb1b4cb7b09d6145fba3", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151516, "uuid": "0757b402-8cee-4b3b-9d9a-39608c390262", "comment": "Malware payload (Neshta)", "value": "e4b8bb61d4a7478c27a4aff3174e28efab17adabfca32850c2d4aea7cbd69184fdd97f38c9f25a7b04cdd36e6f6a9278", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151516, "uuid": "e2d3d6f2-a219-4c4d-b805-4a53463dff45", "value": "T172F423F014FA96A8B47F61071EBE08AF8A7F0E046768594D544A9F04DBB4A73CD4E90E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151516, "uuid": "bd0f703d-aca1-4adb-8415-e523d104638b", "value": "12288:FvgLrghhWIrjoUOYCr3USHEUr0wXlQW1LPbKuPdkmuov+5dydViAJt/VHbXcTg1d:e+JnoUkrkSejWJx3vAaV37dbXYgpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687151516, "uuid": "c0116811-959b-480e-81c5-fd9e551d568f", "value": 758758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687151516, "uuid": "f0f6790e-f5bf-409f-8560-13ccaa230f26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151516, "uuid": "9cd6f933-0bfd-4cfb-b134-9fdbf0ec7890", "value": "PARCEL ADDRESS INFO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015b5736-0ece-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687198844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198844, "uuid": "ee919181-1e0b-4c29-a042-30a2e5513ab3", "comment": "Malware payload (AgentTesla)", "value": "acf393be7b52380c3334f80cc14bc202", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198844, "uuid": "0611214a-4bb4-4b00-923f-1f92b5367aa0", "comment": "Malware payload (AgentTesla)", "value": "4a0c2ce543e926ba97824ac228dc8c9acb2352d8f1ee57f13115909737dc5e15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198844, "uuid": "d8811934-63f4-452b-91eb-f7d56ee2bb9e", "comment": "Malware payload (AgentTesla)", "value": "1e5ed90a65cf8ecc79d33c0e63d64d18aa2123a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198844, "uuid": "93d37286-a175-4354-b446-ee8ceca570bb", "comment": "Malware payload (AgentTesla)", "value": "26bf08889f3d803cfa85d043056ff53eaea7fb9f3bf2a8dbd128a6776d00065fec70c331b2ebfb07c0eb5afe15e60a20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198844, "uuid": "94c61ffa-e62a-40bb-8135-d340a1592ac1", "value": "T1EA54126CA9A08473E1970B312DB256361AF9DA130575C64F33517E0EBDF2B91BA4FB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198844, "uuid": "ab91d2a8-eb22-4836-928f-37a96e541699", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198844, "uuid": "db9e01f2-e427-4d16-831b-b7e58ebd434b", "value": "6144:PYa67hzQnJtdCTwQ1Nb8bjodw8Rqtkx7fMRL54IOgAuxFl5:PYJhzzTwQ/8jowA0OLM154ISi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198844, "uuid": "dc190551-3b78-4098-be79-00033944495b", "value": 291147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198844, "uuid": "0244dd26-ab69-496e-843e-59774df92e11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198844, "uuid": "a1c2c0ec-7408-4b3b-9a02-58d8c16591b5", "value": "rOriginalShipmentDocuments-AWB4447097169.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee81de9-0e58-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687148481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148481, "uuid": "844671d3-985c-4f96-9c55-c16694d69b76", "comment": "Malware payload (Mirai)", "value": "af339914fcfd1354a55311e8b8b43d20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148481, "uuid": "7557d282-dc4c-4cf0-80f2-c1e7be698391", "comment": "Malware payload (Mirai)", "value": "4a198bb1696af1558331c4b82472d6ff560003b3f0bd4b66cb58943768c24522", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148481, "uuid": "28c65f88-7c94-45fa-b99e-53e8d023f62e", "comment": "Malware payload (Mirai)", "value": "0d45bf2d09a323659764bbc6db00586b39a96a5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148481, "uuid": "04a1d59b-5b71-4bce-b50a-9848d4d11190", "comment": "Malware payload (Mirai)", "value": "b1e44f99a247aa7be5d2204f786add9f24a08ac7e9e7ad0e4e756f10cc02fdb9075af6d34be59c674639b33d677da968", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148481, "uuid": "5f748f8a-d28a-40f6-8d7e-9bde40d2e725", "value": "T1D4B2F1624D225867CEB614F3FE1D1B837E8484B865F6B177261482707B93C81F2FA583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148481, "uuid": "3c759f10-2bcd-45e4-b061-2dead888edc6", "value": "768:Gvq/RO/a/3e4oQXFSJezziPPsLWNVF3UQeZcF:GsGa/M2FSUz9S7Pek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687148481, "uuid": "366ef3ba-5e70-4873-b525-4a6493d12bc1", "value": 24644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687148481, "uuid": "f8086497-53ef-42b5-b5b0-ed76e05ae4d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148481, "uuid": "2c2fcd65-701b-4ddc-bc96-f76499602acf", "value": "af339914fcfd1354a55311e8b8b43d20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47069d39-0e7a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162883, "uuid": "d42d7142-69af-4a46-bfbc-5f512ae3e878", "comment": "Malware payload (Mirai)", "value": "918261cc26c02939719e8f2c2cedc142", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162883, "uuid": "a44501d0-1597-4710-8126-543cc2eb9ac9", "comment": "Malware payload (Mirai)", "value": "4c68f4f11bddd172a2389a425b93bd9740237621ec0a8c415098a5a2e30b7313", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162883, "uuid": "938bd0df-08b5-4f28-84f1-4a504118d160", "comment": "Malware payload (Mirai)", "value": "cf7ecd8020a6d3bc635565e9a5bee65ce666dd88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162883, "uuid": "dde2733b-e53f-44d8-ab45-2d9a0cd81a18", "comment": "Malware payload (Mirai)", "value": "ab082774b14548113086b0ad2df05a567731e2158dc7bc2a4d4841bacc30863e6b0e2a7cae2a4124cb97742a85a99ff9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162883, "uuid": "adc475c8-8c8e-40f7-ba77-fdfa1a3c8669", "value": "T13E330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162883, "uuid": "d2a0125b-8dcd-4ddf-a156-d61b507d0489", "value": "768:gduPBFnHooqR8qOCKq2pH4Kg9e+TK806MMUVjzkfQXObHud2oGo:r/hqaJ9Dg9eqK806MHdkfQX6HuCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162883, "uuid": "26ffece5-dcd4-4e3e-857d-9f1da837f2bd", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162883, "uuid": "15f894f6-efe1-4df3-bbd5-ab8a88d673be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162883, "uuid": "df550c50-a43c-4ba7-93be-dcf6e2fa4bbb", "value": "918261cc26c02939719e8f2c2cedc142", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d35785f-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165444, "uuid": "7761091e-8078-4be2-9a72-ecc1c91a7788", "comment": "Malware payload (Mirai)", "value": "5da50abc7e9255f554f41d0616b95e58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165444, "uuid": "2de7a3e3-a4cc-40f1-a09c-dbf3b2199857", "comment": "Malware payload (Mirai)", "value": "4ca31643d77dd99c20690d56551b172c26869d48ba89f39506d377073285c154", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165444, "uuid": "18d7fa38-3fd4-42f8-8746-f89f6bd630a7", "comment": "Malware payload (Mirai)", "value": "55953c7ff078dcd53ae8b7926c6e00680213e695", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165444, "uuid": "517303d2-2732-45a8-b497-4da6903c874d", "comment": "Malware payload (Mirai)", "value": "8776e66d907327f29ffec36b0e25ea8fec96b2b1cb73d05d8ebc500bbfd2909f55c8178ee24a5063e32ad7684559fea1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165444, "uuid": "856732f5-d792-4e35-8a4b-10036056441d", "value": "T143C2E1F16448A4A0CCD01D7047BB5EC2E66B6AA9D6C1F11F6240A1FEDFC709820FF956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165444, "uuid": "5c5bf41d-ad34-46bf-bfb7-0ce8990fa13a", "value": "768:afZtU9zU81ZvcJBmV2kUvZpxusgGD53Uh:G6Ukufi2PbksZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165444, "uuid": "020aa532-bbe5-48d9-babc-e8e8df066568", "value": 28096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165444, "uuid": "92954e78-04e6-486d-ab30-116343a473fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165444, "uuid": "74b17b6b-271e-4e87-a018-0544974c615b", "value": "5da50abc7e9255f554f41d0616b95e58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f48b30b-0e95-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687174520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174520, "uuid": "df39d6f9-d914-406b-a7de-54a2ad6c1b03", "comment": "Malware payload (Amadey)", "value": "a830c4b4286403324eb4a202b04260e8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174520, "uuid": "5c9f0a17-b682-4428-b073-9770b0021178", "comment": "Malware payload (Amadey)", "value": "4fc91338a68b0d910c0cda912862387fd02b96e96be18c58a895d078005a5207", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174520, "uuid": "b6484e12-6686-4a01-9637-e72bf253735c", "comment": "Malware payload (Amadey)", "value": "fa5926e7892defebdfca55d4dc48e4970161cd75", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174520, "uuid": "20bdb003-7dc3-4aa7-a5e9-42a6d0e5d1ba", "comment": "Malware payload (Amadey)", "value": "f9652d8cd05f521c0fb527120d158fcf94df8e6a99f5b331f5a8a33e685038b5d11684980113d508ffdd1b637a6fd8d4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174520, "uuid": "95900219-6d1c-4e6a-b7ff-fc5aacfa678c", "value": "T16ED41253B6D84163DCF53731A8F7238306347D759D788357238AA9990C72B80E936B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174520, "uuid": "98a34f1f-06c5-4df0-a5b4-d5a05444bfc0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174520, "uuid": "292e1799-7016-4e5e-b556-0d6beff0e7d9", "value": "12288:rMrNy90uUf/oJLgdAvoAB9xH/TZOGv8n2K5ZL2+t6lr8F:WyOHoJEdMoAR/IGUn2q4IF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174520, "uuid": "a79a483a-6e34-4ca2-bd0e-1d188391b287", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174520, "uuid": "b5d49464-aa84-4f3b-bb23-369ba53c5523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174520, "uuid": "fd9e8f0e-9ede-45e2-91e2-a5bf7ef7eddb", "value": "a830c4b4286403324eb4a202b04260e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be31c936-0e6f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687158359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158359, "uuid": "0424220a-f824-432a-85c3-5c77ae038cbe", "comment": "Malware payload (AgentTesla)", "value": "93e14766707f806751e89600c19ccd98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158359, "uuid": "812c03e4-9571-4f59-b142-3ac6a81b6975", "comment": "Malware payload (AgentTesla)", "value": "4ff53d51192c6ea0c793cb31e4f9846f8cd443deb3d4b18b24ceab48a62adaa7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158359, "uuid": "d1dfd59b-2f7d-4926-aacf-76a31ceed7ae", "comment": "Malware payload (AgentTesla)", "value": "d257d23fddf5d7e511233ae9c15e07b5abe951bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158359, "uuid": "47535817-020a-41b5-849d-2e66938882cf", "comment": "Malware payload (AgentTesla)", "value": "83033690344c2cdf3ecfb8095df2ef88c55ec16e30a6a6666683b792e376e4fb3909ad7239df3772500f77a81fe36024", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158359, "uuid": "91980466-4fba-4023-97db-974bddf87602", "value": "T16ED423E69D6967A368A41C0E82F19C4F4A2DED788C1FAF0CD1F516AD1D4715F06007AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158359, "uuid": "e11b61f4-1ef9-49ff-a5e2-7420978fb459", "value": "12288:xcZlnuVqYIWAbHxLPZM6tWR+ddf+09O28KU8quunYA0gohm:wBaqYMbHpZM6QRIzB8FiA5ohm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687158359, "uuid": "cbd6b2e1-af86-41c2-aaa1-8ea6f5e44cb9", "value": 653950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687158359, "uuid": "e021f747-e34f-4c96-afb9-fb666da6efa6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158359, "uuid": "c4c62e5d-09b4-434e-999b-73443f241f5f", "value": "INQUIRY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5414bc-0e5d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687150468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687150468, "uuid": "34b74518-0025-4153-87d4-686d6573d3ef", "comment": "Malware payload (AgentTesla)", "value": "5205b2fef50765ae73d9dcde3bb795d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687150468, "uuid": "96ab178a-5154-4166-b4d0-cfd469143386", "comment": "Malware payload (AgentTesla)", "value": "50bae1c9f9a7f88a62c43f7a35ed95cd2da487956f79651d49e6df3cb91f7994", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687150468, "uuid": "5d8ab866-7c31-45f5-8117-0a6f893a5033", "comment": "Malware payload (AgentTesla)", "value": "5bfa4de5110046d7c3508bbff12ca51c5bd65f4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687150468, "uuid": "80b83522-68b9-4e52-a1f1-1b6de1808a51", "comment": "Malware payload (AgentTesla)", "value": "408e978eda13f505d8711299a890cfca5e3f3484e07a4a2f0b0873acdad2e8f04e3a94201d732e406ca6a636e15cdf47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687150468, "uuid": "5963f2f1-ff24-4f59-89d6-cac78059d89e", "value": "T1B5C4230C545D21F6D136182BA2CF64C677B9E9077FEA5AAB3F9190798BC3F8436B2410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687150468, "uuid": "1580a51d-efa1-497f-aa2d-ed6a0c3a09b1", "value": "12288:tvmd1JbcRcwHRmY8BBGvTIIoMCcWVqNXcvNbybPhPuzxaiNfWinp:tvmd1kcwcGbNoMoVqWNObPhPMxaynp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687150468, "uuid": "7956c379-d51f-4ffd-898d-b901367ce2c1", "value": 590188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687150468, "uuid": "87aaf5e2-3ab6-4ea7-83c1-eca14a2482ad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687150468, "uuid": "9268d7e0-7bb3-4f40-83a9-e027e64d05e5", "value": "Advance Import Payment Advice & SWIFT copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35768ef3-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165431, "uuid": "3825b84d-ce5a-401e-93f5-f5a85882ba46", "comment": "Malware payload (Mirai)", "value": "20bfe06a33470417c25de2bac9789a55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165431, "uuid": "a4808f14-b397-4411-8dd5-2cade7706e36", "comment": "Malware payload (Mirai)", "value": "5102e6550599ed697fbf410af93754ed3d50544045e1806902b06166ab45cc95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165431, "uuid": "d2d18e9f-23c2-49ea-ab4f-df134551d5fb", "comment": "Malware payload (Mirai)", "value": "0d2e8225b2c2b1cf884630fc7ee10fc55fb132d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165431, "uuid": "85397a6e-0435-4715-8f1b-58fa7147bbe0", "comment": "Malware payload (Mirai)", "value": "6bc175ee568f97820f3cab7c6cdb4fe295a385e4b1f03f0a7572662e8187fec80c1d60c88c084d8222a9f47e9a7e3e3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165431, "uuid": "563dea16-fff5-4dbf-aae6-a0bf60343f5a", "value": "T123735D24A9792E26C0D4A17B62FB8321F2F6230E2570965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165431, "uuid": "61121e3e-5f0a-4957-875b-e133f8348257", "value": "1536:5ms+geQfvznpCR8ee84cN6AUiAvFI7IlNnws8A:YwfdNu4cwZvFqI3w7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165431, "uuid": "7351b0d2-96f7-4c73-b68a-f8f044f2a213", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165431, "uuid": "a077f947-df42-476b-b266-ee392813d1ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165431, "uuid": "bee3034b-33a9-4847-bf48-5e951f043f6d", "value": "20bfe06a33470417c25de2bac9789a55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ecac9fb-0ec0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687192907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192907, "uuid": "8156c8a5-e899-470e-af7b-5e932b71866e", "comment": "Malware payload", "value": "6edfcdab8bc3155f6b212c34410640af", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192907, "uuid": "c8e4e020-0c40-4be7-812c-3bcb2125b14c", "comment": "Malware payload", "value": "511ff7b4835d116b11f378662c3f4e4f37a61a4b0acec07152b96c874e0c07dc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192907, "uuid": "90be7d08-44e7-4330-989c-355248a12810", "comment": "Malware payload", "value": "30ae0d48a83aa793fd9291049bb2dbd1eda09e92", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192907, "uuid": "e22b0d40-6a3d-42a2-983b-b6909c41cf01", "comment": "Malware payload", "value": "687e8b884134b62eaf69f6429aefd7497bf70264fcdbc5acec8bdf4cf4344f7e0d552f10c6bd5bdb2f159f72b25fb511", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192907, "uuid": "e4dadda1-2d5c-4e1b-a9bf-000e4de60c7c", "value": "T16F3502A0848C3CDED39247D16B1F3D2E756DB232F2C917852329CB920664A7F6653A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192907, "uuid": "57141f4b-90cf-47fb-a1f1-3f9c7bc297ae", "value": "24576:0ErD0/jBPoplVEXbcc/rReDzZ63T4+gWKRmpvh4:0EIjBPop4LccFePZa6WKgp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687192907, "uuid": "b927fa04-5fcb-44b6-a1f0-8e8687d1fdde", "value": 1155787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687192907, "uuid": "fdd8a79c-9a65-448b-99da-9d5522adfe11", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192907, "uuid": "30fb1f5a-6d2d-4248-b25f-5177adf3dc61", "value": "rapport 2023 MZN Thoma.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454610a3-0e93-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687173618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173618, "uuid": "5a4817fa-adcd-491c-943d-d931a75eb08e", "comment": "Malware payload (RedLineStealer)", "value": "d992014ce2e1f98f98551affa46848ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173618, "uuid": "b3f6bc13-47bf-427c-9f30-f78114688a49", "comment": "Malware payload (RedLineStealer)", "value": "521dcc37d3061837443e0e903d96433ce572e186e7a41a92a0b111f8d2fdddc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173618, "uuid": "244adf7f-98ea-4480-89bf-32f06c2934f2", "comment": "Malware payload (RedLineStealer)", "value": "fce4865a2b03074c5c80b44fc54756b7b5388183", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173618, "uuid": "1122c994-f980-4511-ae1a-1b233adb2dd7", "comment": "Malware payload (RedLineStealer)", "value": "abd902daac8f54cebc357ccfce70ff90afe5bae02177751385efd28bb896b47bde99b31499039a3e8fd4c32c067ca25f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173618, "uuid": "08ffe598-132e-4ef9-bf0a-ea01eb8153f8", "value": "T187052283F6DC4427D8F55BB00CF203931E3ABDE04A35839B5A565C5908B3B949972B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173618, "uuid": "8b1845e5-7bc6-4169-8ff3-f4f98e5478fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173618, "uuid": "26e8e556-7c72-4e08-9393-abc2a8a7e3de", "value": "12288:1Mrty904NEMxUdAa902Zxc06v6mDYRKgu9qlPVePxbqlmtNOHH3xwFvwilj+QsE3:8yLrajdZm0I6mDHA4bq2oBBQF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687173618, "uuid": "649264e6-b2db-4cc7-b167-2a59d98ffdc3", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687173618, "uuid": "832707ce-a478-4b6d-9d8f-8ebb4c5b1c80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173618, "uuid": "d5fe42ed-9c28-4eb5-9f92-f19868672fdc", "value": "521dcc37d3061837443e0e903d96433ce572e186e7a41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d0acf0-0e7e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687164619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164619, "uuid": "92717895-8083-4ea9-90e1-983ddd7b1779", "comment": "Malware payload (AgentTesla)", "value": "51a70ee0dd493610f28fb93b0946b8bc", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164619, "uuid": "f752172f-aa29-4641-aa0b-a8e0722d6481", "comment": "Malware payload (AgentTesla)", "value": "52562622255c916f0dfc42d66093356784d77e5e69a8752a43460509d62e3867", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164619, "uuid": "780595c2-e5a8-4860-9406-bb46b8a51d93", "comment": "Malware payload (AgentTesla)", "value": "90447e80fc5cbec4336e9ebda6d4965ea319d1ba", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164619, "uuid": "ebc949c6-da39-45dd-9bef-a053a3eb167e", "comment": "Malware payload (AgentTesla)", "value": "68b2ab97791eb5d7e9fee572472e02f8d7940ea46ead1c536ce40ca5efc35c8dcfb95f689ad16bdf1e89f049dfa7ce05", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164619, "uuid": "0626ddd7-2267-445e-a133-52dd751633eb", "value": "T1F7C433647A3DA16AD4EDB42FA136EB205EDA5320C9163C1C47D338ADF38784F0557BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164619, "uuid": "5438d0a4-39e5-402d-ac66-d6c0d2ea2117", "value": "12288:pZYxc6+jkRfeTKFXufwrU+xSro6liUNH4EvU1ZIzIzPtwYKZnpW6:paq6+XeFXdrU+xSro6lzH4wiZIzS1KZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687164619, "uuid": "44c97dbd-5751-4bde-b79d-d3ee4a341919", "value": 592494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687164619, "uuid": "2ce8ccf2-270a-40ac-8e3e-50e52b76459a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164619, "uuid": "62a3b188-b7a9-44b3-9cf9-133675614763", "value": "New_order.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa64f29-0ec0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687193016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193016, "uuid": "525bff71-fc38-4e8d-8b81-68e8e15361ef", "comment": "Malware payload", "value": "6cfcd7cf6081cb3dddc3b942446d9e43", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193016, "uuid": "884f885f-4d22-4e40-9df0-274bad5bee53", "comment": "Malware payload", "value": "5259f147e8dee58a3e88aa1edf3521ab687bb28d52c1087c97b8a979d9d3c2c8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193016, "uuid": "684146a1-3866-44ef-824b-076dfe13a86e", "comment": "Malware payload", "value": "1318648598ea9886bad3e53962a2d65d633e055d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193016, "uuid": "31ab1162-e325-4003-9612-ddd8af8ca1a0", "comment": "Malware payload", "value": "4122db5a79c2e60e16ddf92c57d88f13c76ac3432aa4f8e4e95306e7ee0a9198431b931d3d8787608459ce79a7338d65", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193016, "uuid": "1917e8d3-4b65-45ad-9ea3-2d3dab071c28", "value": "T16A1633265F8B3D3A0BAC832A206F2F659BBE0EC584A8E7D406D525C703AD755C43FD19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193016, "uuid": "aee22b95-23a6-40da-8f7a-c9e31b051db1", "value": "49152:mA7srW+3kru5lgZDFlrcmLVEXKTiYz3M/QtuYKv+utgy0gh0HVTl8:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193016, "uuid": "1f6ead7c-cca2-4b10-b0d2-28b8bc94413d", "value": 4094591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193016, "uuid": "8249326a-f615-4f88-b1c7-e592bfdabbe7", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193016, "uuid": "e2afe9d1-79b2-43fc-917f-a9730a1f9454", "value": "build_SC.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a2d64e-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687175390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175390, "uuid": "dd56619e-71dd-40b3-962c-47c4b53ea571", "comment": "Malware payload (Loki)", "value": "96a204f79a93a4443063d0ea8919a72e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175390, "uuid": "a6bb9cc3-5262-48bf-9b69-df3b7f1402a2", "comment": "Malware payload (Loki)", "value": "531d226fe14b20d380f1b6c9598bfa9f483b75ed3b0ead4b25bfbc8a77c603a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175390, "uuid": "c72a065c-32b9-4f05-a786-9bba4cd38b8c", "comment": "Malware payload (Loki)", "value": "4671c5adb80bacd83c18872a9682296be1bf7dda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175390, "uuid": "7a255b3a-9b50-4c53-a614-e08754b62da5", "comment": "Malware payload (Loki)", "value": "536f6ec77784f867b927a9ed8287709c22269b2087a3f666a864cd0486f7913985faf2849d9edb0414d58cf29acdba69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175390, "uuid": "f4252ea5-e433-42a2-acac-24f36e7304f3", "value": "T158457C213A45C912C14D36F6E1A7613053738D82232AE70A69FA33E61D337EFDD5968E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175390, "uuid": "b46139c3-7bbf-4d01-bf1b-4cfdeb0e5abd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175390, "uuid": "6916b212-ce3c-45ac-84ee-d7226a4216d6", "value": "24576:GIt+p8e+XnwifOe6lcv9VAoCgITP5B3ScmaqcASF:d+bifOe6avYopITv3ScmiASF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175390, "uuid": "120e1f69-2ede-459b-a759-0a63cdcae32b", "value": 1188352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175390, "uuid": "d1d1fbe9-5917-42fb-87d0-d9cea351d33f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175390, "uuid": "af6cacf0-54df-48f9-ae67-fd13f3177aa4", "value": "96a204f79a93a4443063d0ea8919a72e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a7d2d8-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687160540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160540, "uuid": "3eb2717b-01a6-43cd-bcc7-baa146d47116", "comment": "Malware payload (SnakeKeylogger)", "value": "34e350b1ef6d8511f590de0d913e25fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160540, "uuid": "9f63da32-e4d9-40ea-8838-1af84aff2fd7", "comment": "Malware payload (SnakeKeylogger)", "value": "53a5947ea1b0cc194c76b83f3036a04ac4ea8a7f2bdd249c55f05677795e880a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160540, "uuid": "dd3584c5-cea5-4871-9eab-b5ccf3a28f4e", "comment": "Malware payload (SnakeKeylogger)", "value": "59f4fb3bfeaae1b90a227d1c6b69fe7f0abc075b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160540, "uuid": "74528325-8deb-4d0b-8bc8-1ecf6037ce9e", "comment": "Malware payload (SnakeKeylogger)", "value": "fb2415e6e03479c77627213252585d6d3786e8464bc2f90f96bd56aba65cd706ca9184a9e8b76b7f1a8408b05215bae4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160540, "uuid": "5b1c6b7e-a754-43df-98c9-7cbd818b9f95", "value": "T15CC3085C3BF89904E6FE8A7301B15215C7B9B8520A9BCE1D1AC1F4592A7D680CE27FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160540, "uuid": "0976fec6-d95a-41f9-8e1b-889a9c38c1da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160540, "uuid": "a35fb6fa-db77-4a2c-9ef5-d69e777eb4be", "value": "1536:EFlAi3bCo1sI4SSGP0NZu0eLTxJjEf3Es34A6b/UamrswncPpiOWBlxF0Kcl:EFlAi/s+PkZu0eLTC4Bb8zchwBlxFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160540, "uuid": "018db001-ca76-4982-9be5-40ab84d79bdc", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160540, "uuid": "e131f023-2d9c-4248-8919-199cb7e0b05b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160540, "uuid": "f20844f5-adba-4cd5-87f2-246b3fd88591", "value": "53a5947ea1b0cc194c76b83f3036a04ac4ea8a7f2bdd249c55f05677795e880a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263bf990-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165405, "uuid": "1bff6e04-7f8d-4fdc-b95d-6149b3ca0aef", "comment": "Malware payload (Mirai)", "value": "c5908a8cc9672f3a8943dbe13bfa0a78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165405, "uuid": "eaf1ca88-450f-49ee-a6e4-110fad46e56f", "comment": "Malware payload (Mirai)", "value": "53b5764cf18431f9f1cb2299d34787696e8c95b25687e2fb77b3f5a13a256999", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165405, "uuid": "5a7254ab-5b35-4f97-84f1-d0a6a5eb0579", "comment": "Malware payload (Mirai)", "value": "1915b544717e1afd84eb5a2d08dabb5dc76e6cea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165405, "uuid": "0e1903eb-c350-4285-8eae-6fd1f772c4a0", "comment": "Malware payload (Mirai)", "value": "615376af9ba0398a459f0ee1c48fafab256659aaae3f9d6d115d602317bc06600581ef609d3757e1479866e8dfdd0bef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165405, "uuid": "97e2591b-47a4-4cba-8a20-61e1ef72c923", "value": "T1A7E2F137A23384C3C67069769DA5468627F887BCD07CB2A2194950381FA26CB8FB74D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165405, "uuid": "13708151-f39f-4689-85ab-94ca437ea032", "value": "768:uoiWiO031vdWFc8tejeYsXnp9FnrQQy9mca+9q3UEL5IU:uorm1vEFcVjeBXnpGmLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165405, "uuid": "c8f61f73-7e9a-49e0-98e3-3e39b59bfb88", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165405, "uuid": "a8e162a4-7cfb-4552-b249-c41713432409", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165405, "uuid": "a6ab7202-d35b-4ead-bd6c-955d780cbab0", "value": "c5908a8cc9672f3a8943dbe13bfa0a78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4685a9a1-0e8c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687170613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170613, "uuid": "51374907-ae19-40a5-9222-4586553c4e05", "comment": "Malware payload (Amadey)", "value": "2b93a11747ba6da2eb40c11cc90ed5d9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170613, "uuid": "ee243098-4467-4096-b6f0-e35372767efe", "comment": "Malware payload (Amadey)", "value": "53ee2143ab012cd4fc37ab89860014be7619a75af3db77e15dac7e79eff5f750", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170613, "uuid": "e3d3b7dc-e4b0-409b-832e-eb5fad022e77", "comment": "Malware payload (Amadey)", "value": "8698f974b1cf0a576becccd6e308fdc3bf710183", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170613, "uuid": "c1a50868-800c-4bf5-a454-66975bf6163f", "comment": "Malware payload (Amadey)", "value": "3a08aa321612acaa14812b3885d25db4f1519e76119d1fd4bd520edf28353fa3ba984b529a34aa138984338bf905de30", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170613, "uuid": "f9336c0c-8125-4397-b69c-d54696183018", "value": "T1AE052363F6DA8033EDB81BB04CF752530A357C619A7857B7274A98AF8C72284D43177A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170613, "uuid": "c163454d-5c29-4514-8858-3c8e5824a788", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170613, "uuid": "44eaf72c-8241-4f3d-8ce5-037233b02bac", "value": "12288:bMrsy90GApjvms6RRsRxG2Qts80hHR46FNGqk+ZtW5H9bXwN23yC+z:vy1Ass6RRsrGVObdR4eGH+HipXi/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687170613, "uuid": "075dc089-d111-47ed-8d68-473803ef3810", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687170613, "uuid": "a79d978b-59ee-4c80-9ab4-1e3d740fd1c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170613, "uuid": "4c870ad3-807e-4a69-96cc-15cdf7f6e4a9", "value": "2b93a11747ba6da2eb40c11cc90ed5d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1d4d4d-0ec6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687195780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195780, "uuid": "154bda00-074a-4e6d-bc2d-ad543c847783", "comment": "Malware payload", "value": "e988cf25575c7d7d325f53319e28ba32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195780, "uuid": "f790a6d0-3cd9-43e3-ad84-b35ebad70056", "comment": "Malware payload", "value": "5407e6fddbd9a41d4537e3762150c44b0613e094abafc7d2a31ef6216de0144c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195780, "uuid": "f8625988-39d7-4378-a4b5-3c2f3a72393e", "comment": "Malware payload", "value": "46a96e6ad67ebe06fe54aa1c8c36323d3fee3df7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195780, "uuid": "49dab4f0-1117-4c31-b61a-f629f6038644", "comment": "Malware payload", "value": "fa8f70dac5d096c1f5a5a00bd935adbf4d712e40bb4a12347c63bb3353f6be5f908628f0b0d618c56567cc0a70f4b31f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195780, "uuid": "454e25b7-0411-4dbb-a044-0162703cc363", "value": "T1D21339087B8C9936C79DA97D81EB210013F1A6FB3603D34EEE8061691E63FF56506B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195780, "uuid": "cb46101f-38d4-4349-bb85-3711bbbc8279", "value": "768:zzRireTYMFB11BaYW4tb5ay+PE0yN0RpwkPemXwgcM2U:zzcr85FWw5J+PZO0RpwQ3X/V2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687195780, "uuid": "c6510263-4028-4292-b8a5-7df73be928b5", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687195780, "uuid": "adaed5d9-8faa-4ccc-9ef0-1457dcacbd93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195780, "uuid": "819fe8cb-1243-436d-8513-24b2f8c824a4", "value": "SecuriteInfo.com.Win64.TrojanX-gen.11450.20975", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d80f06-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687168298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168298, "uuid": "ff9e7e02-e659-463d-8df0-93d30dafe1a9", "comment": "Malware payload (Amadey)", "value": "228119ee4c65cb1007f6a059d9b9ea04", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168298, "uuid": "acbba319-91a4-4987-92de-adbd2a43e363", "comment": "Malware payload (Amadey)", "value": "540b52866f994dc6c92ed34bb9e3d7f9ed6183ce5ad09daa9c0704da733ae060", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168298, "uuid": "7be427be-09d4-4fd9-be19-69da8e657963", "comment": "Malware payload (Amadey)", "value": "fff65d55391a3aabd4262886cbabf87f6f2600fd", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168298, "uuid": "e9420883-79af-4706-9132-8eeb0196bc79", "comment": "Malware payload (Amadey)", "value": "1eb32583f5877025e5001e8336c16de6c9e677a707dd8cd8d88e5219a88ee9a2f036517ab0644c5d11f105e129afe90f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168298, "uuid": "f87518b6-3d72-426b-b425-7b46b35a6717", "value": "T17B363328CBE4B6AD39D1147A133536F7D05E1B67BCA09B3F4FED82C724742401299ADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168298, "uuid": "43416327-3d66-4ca8-b837-e0c251b54c48", "value": "98304:O3vnS3jwpt1B1ODe16f/dqDlvgYCrBBkTRuRs4hI5z:OKMnODe16f/dqZvawRuRjqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168298, "uuid": "b59536cc-9619-4f14-95ac-bc18497d1996", "value": 4898675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168298, "uuid": "ca1d1c5d-68dd-4c51-b37a-138372f435c5", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168298, "uuid": "91fd42e4-7ea4-4cd5-a8b0-2889c8604c68", "value": "228119ee4c65cb1007f6a059d9b9ea04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7050557-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687168252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168252, "uuid": "14ff4c85-13ee-4ab1-9c71-8ea4f3661e14", "comment": "Malware payload (Mirai)", "value": "ff08a73a212945da8dc2de3805aee8ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168252, "uuid": "a64f97cc-170c-442e-80d5-db4160b7a8d7", "comment": "Malware payload (Mirai)", "value": "548428c51a1383e1e1d9c45139c74e9c2dc5af2aab9c5ddba3ac80f917384cde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168252, "uuid": "40d0a7ec-d9d3-41ab-973c-ad221d920835", "comment": "Malware payload (Mirai)", "value": "13667f9017ecaf771da66ae97abde8de99533e1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168252, "uuid": "5b577da5-c778-478b-86ea-c696fdfe945c", "comment": "Malware payload (Mirai)", "value": "76d8a14958a7fb17fabce77d2ca2a44f2965881d356e2aba02f6b0096474f59299af58cfc5926eac836a880819fa878e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168252, "uuid": "f62563f6-fccb-4e2e-b275-38fecbcef520", "value": "T1EE63B61E6E219FBCFB5C873447B78E20A75833A626E1D245E15CED011EB034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168252, "uuid": "5e99b3b5-c809-44f9-8747-dbfc165a5a79", "value": "1536:y1xZeojGvZuKrgFrmWRTBKH8tovMXqbZwxmvi45JtAT0ZSqaM:y1xZeojGvZu9FrfRTBKH8tovMCryT0Zr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168252, "uuid": "5eb9db7f-9415-4616-b41c-b90c323fc5a0", "value": 67808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168252, "uuid": "0224cc03-7ed9-44ef-aa6a-e8a8488adc87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168252, "uuid": "d4ef9b76-7dcf-470a-a17e-9b1f4a26b925", "value": "ff08a73a212945da8dc2de3805aee8ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42819123-0e51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687145266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145266, "uuid": "11cab635-147a-467b-ba12-0ff4ad3d1d0a", "comment": "Malware payload (Gafgyt)", "value": "8232f03c6a2c36b2df8b9360d4881c32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145266, "uuid": "e5b51864-8b87-4b91-ae25-49f00b299d9c", "comment": "Malware payload (Gafgyt)", "value": "55e5459845f700f4cd31984536cbff439b870003fb6d2044d51fb52fb54d84f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145266, "uuid": "ff4c27bb-d2ab-46bd-ba33-2c2d575355b8", "comment": "Malware payload (Gafgyt)", "value": "c9add18376982db2b91c51ffbfb81248e7b43d57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145266, "uuid": "9d5c4d6e-15aa-4058-87f3-47343b817d25", "comment": "Malware payload (Gafgyt)", "value": "2eac18b421144cebcb1dbbdc9c60c77bbcabc26d03d0f51558289b481127ee8ad81e71bb87d35483748d7cdd4008bc4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145266, "uuid": "efa6f0b7-2744-4f0b-80ed-f2f6bea567e5", "value": "T132E3A416BB619EB7CC5ECE33069A4502108CEC5A02D96F2FB2B4F55CE76B94E09E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145266, "uuid": "a48625a6-cb45-41f0-ae18-065b9d4a77fb", "value": "3072:XjLriMOPtRyFYAniDmXFTmsTM20XwHL5ENb:XHrkPt4FYAjTmsTM20XwHL5ENb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687145266, "uuid": "b9d05858-42f8-4050-947d-afbdfd55c100", "value": 153082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687145266, "uuid": "495a2793-a06b-4d03-845a-152bf1df8fbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145266, "uuid": "53a3a5f0-179d-4d64-8b25-0265fc95e594", "value": "8232f03c6a2c36b2df8b9360d4881c32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0775d6-0e90-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687172418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172418, "uuid": "6f137884-78b3-44e1-9664-dd8f9cdf8e5f", "comment": "Malware payload (RedLineStealer)", "value": "c43999c566045b6a0a9bc207bce94c81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172418, "uuid": "55f3f6e4-e3ff-410b-b3e8-453696692718", "comment": "Malware payload (RedLineStealer)", "value": "5614e3eabed5fabac6c80ccc888dce6df456d19165a1a18234604acf47019650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172418, "uuid": "c5412d0a-28a4-4f90-a8e1-c34b23a5f8e8", "comment": "Malware payload (RedLineStealer)", "value": "5c89611ed842cf47a0c002c13a40e916f4a8bcec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172418, "uuid": "3a68b5b3-d3dc-4044-b4a3-ba82589f0786", "comment": "Malware payload (RedLineStealer)", "value": "4cc42bc6169bcb6b56c4fb1c929c30fb6f53689536509d5e776fd713bfe11e506657bdce43ef92c75d334bcc92c09a03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172418, "uuid": "61882bd7-4f0f-4e2f-976b-76f38dbd5ba2", "value": "T1DF44E64A2F51B538C00DE8746BE87290DB392D263B7B43762B65143AAE34EA70DFC5C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172418, "uuid": "05b93b28-5df2-4c68-8f70-da37a9c5a35e", "value": "b88ff38d8a9dd531263365f3574a285e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172418, "uuid": "8c3c61c7-3dd1-4418-b692-460b5a2d2be4", "value": "3072:t7eLuNL7wRgphy/S2auSq8f4uilEKq0piWFHjtsn4ePLOmQGgKJC:heqQRDPSqbuaDjWpPLeKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687172418, "uuid": "aadff0bb-f08b-48f1-b1cf-3e39d826ee46", "value": 258053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687172418, "uuid": "f81a8915-7b43-43f3-9434-53ebe4640159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172418, "uuid": "da5c30cc-02f1-43c3-a883-7aa6455e6000", "value": "c43999c566045b6a0a9bc207bce94c81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e310437-0ec0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687193040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193040, "uuid": "41401a3b-a48d-4f60-a0b6-18778fec697b", "comment": "Malware payload", "value": "b3ca3299d9eb527a687232c6ec7bd05e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193040, "uuid": "9900d586-9c52-4b42-aceb-eae558cb68d9", "comment": "Malware payload", "value": "561cbe3e6bc18eac2a78545d5d6da27b559fb8040256fad41454ee30a6a7483b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193040, "uuid": "065967ad-d8eb-47ef-af09-ee65d041a470", "comment": "Malware payload", "value": "7a571ab6f59b91d14b6b9592d42c08e193ab4845", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193040, "uuid": "1f3f7132-d9bb-4c79-a269-8674ef5f5903", "comment": "Malware payload", "value": "e766176716d06b2792ae724aa1c17d0c5e135e7ca086fce644169df031b7182cc0c130d9e6d0e5c258fbc94fe3b29a45", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193040, "uuid": "73fe8645-098f-48b2-9b8d-87e5b00a53cc", "value": "T1212523528FF7CE89497E833872AB7F0B39848DE540D895CB91C1E52719E6A00B4FB58D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193040, "uuid": "69489c64-7bfb-473c-ad6e-c17a39d2d60a", "value": "12288:k+OmToydDoCViG60XQ9APT70WPKAL5VUtQRf/8YN5i+FgHYmwHfYPy00OrdMUJ0Z:kpQtRo9APT9ZpfN5WVEleyNQVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193040, "uuid": "967424c6-3a02-458f-b191-3095eeffcd6e", "value": 1022895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193040, "uuid": "85a1a78b-4e90-4837-b4d0-a12670f6c3ec", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193040, "uuid": "c70a757a-c452-470a-a627-79e7102a99fa", "value": "Hceea_SC.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac8217b-0ea4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1687181089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181089, "uuid": "8ead6aef-ca85-47c8-8fd9-547bac62decd", "comment": "Malware payload (Gh0stRAT)", "value": "355ed0eabe43403ba9096a03e42adae5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181089, "uuid": "931a8151-997a-40cf-bdf4-fc0e8d3e7d93", "comment": "Malware payload (Gh0stRAT)", "value": "5669edda5656dfe9205a94276715f97b7fb4b72535fea93697e018f9510739a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181089, "uuid": "99e1b172-bbf6-4906-80ed-c97c8142b728", "comment": "Malware payload (Gh0stRAT)", "value": "6051c975d8cff1a1edfe6309d37fe9785f896cca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181089, "uuid": "ad67a46e-a2c1-4a5e-bea4-bdff7fcde7a5", "comment": "Malware payload (Gh0stRAT)", "value": "c4b32686b64190b91225fd3d740cc0e13f892f4110e62e85a52aa7fe6c2cae290f643f7a5629f597b4a043d484846943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181089, "uuid": "665b166e-3d3a-48ee-98e1-6ce6e43f08eb", "value": "T12E959E31B79080BBC6623530994EA379E76DA6700B3952F75B901E3E2E704D3993C76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181089, "uuid": "1042a6b4-a876-4008-bab0-b7148e9be489", "value": "0fe9b30ce4005cd74e1b34112765aedd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181089, "uuid": "c1e10202-ed89-412e-ab74-a4bb9d2da6c3", "value": "49152:EwQ6PRyjKaE3+9jsCsz8h68xawsVu2dEiH4Gowhn5ynpW7wCjl:EKPRyjKaE3+qCSX8xawsVu2dEiH4+Ypa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687181089, "uuid": "15969a9a-e73c-444a-a032-5724267112ee", "value": 2035712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687181089, "uuid": "146db874-eb61-4066-9eba-57d94b853ec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181089, "uuid": "fc4ba6ca-fb5c-4950-843d-4a8bd101ee81", "value": "shell.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83853db2-0eb3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687187466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187466, "uuid": "c98a27b8-98de-4918-83fd-64a484abf9a3", "comment": "Malware payload", "value": "a6e742a9d3f202ab8c83211c9a639cdc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187466, "uuid": "cbd32c04-b30c-4d1d-aedd-1834748a7a7b", "comment": "Malware payload", "value": "567e821e4f36c173e3aad3f9498db472d8b39db3092039f0ee7593e82de766a5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187466, "uuid": "1baef3f1-9728-4517-b9bc-9469cdb3d5e2", "comment": "Malware payload", "value": "3794db1da348d4aa7179eaaed45722c6e6709e32", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187466, "uuid": "404ea6f4-3508-4aa4-b6a7-c351db117a33", "comment": "Malware payload", "value": "1b0a59542dad479b57b9c06ffe6fafe5e8f4a95b62f7778d72f7cba66d2449c72736d69d8cc98464c122ce15b69b8165", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187466, "uuid": "4e218729-18ac-4e61-8129-68d0882e0eda", "value": "T1B845339D362061CED62C91B8E2D7CBDC68CC9780520AD6823F83F5CB978D7F2963554A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187466, "uuid": "dc88a3da-7983-43ca-bd7b-003d3191110c", "value": "24576:ds6b995Lvc2fdX7jROVYbh1xqnU0/qbBnUaB9n7KFS:FbpLvcadnAYbhV0/qFbBdGFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687187466, "uuid": "ac992835-4d3c-4b25-8a29-1ca10c7bbbab", "value": 1198278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687187466, "uuid": "6a50a2b6-406d-4702-aa00-1e58d9052cf5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187466, "uuid": "dbfa68aa-ec3f-459f-b338-dca217752b7a", "value": "10852189293.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5130a4b6-0e51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687145291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145291, "uuid": "9c84bd36-7ea0-40ab-9d7e-30d923119c2a", "comment": "Malware payload (Gafgyt)", "value": "92e14e74461204723b42e175ff3b5620", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145291, "uuid": "5c9c0922-fe11-4cc4-a95a-163405d5739e", "comment": "Malware payload (Gafgyt)", "value": "56bc86e86ec1af2a0a026dc634761338bc33ae5962a2be8dfde83e597395c48c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145291, "uuid": "458c2c95-d445-473c-8103-606cdc87c4f5", "comment": "Malware payload (Gafgyt)", "value": "40fc69c65922cb6690cd5a7f0f5114c5aaf880c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145291, "uuid": "f944a023-1511-4609-bf9e-a9d787ac8612", "comment": "Malware payload (Gafgyt)", "value": "d738806389c67d1b45fa1441bdb9000c0df067db0aec35f42c6a29cacd1b6ce8d510d3efc0429c909f9645eebe6b3242", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145291, "uuid": "ac4c7350-c18a-4453-b070-42e93a98c10c", "value": "T179934B426681CAB3D1431AF516E7DB250532FD7A1A2E8E1AF75C3CF49B36084F225B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145291, "uuid": "d6e28525-df3f-44c1-94d1-c622c3dfd3b8", "value": "1536:FSr2aU0do4pk/Uq9lqQoXkXR79Tofyrhe2/vW1FjxF3kgdSOmpiIbuiyNc2Xr+T:FSKaU0TpAUq9lqkXRZoqrh3/v+xF39m/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687145291, "uuid": "970c4b0d-7cd7-4c08-858d-068a62deb62d", "value": 93265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687145291, "uuid": "d504b33e-2aed-4700-aa58-2d8aa133d108", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145291, "uuid": "475b98b4-5ed3-42eb-8a88-108d72cf5bb3", "value": "92e14e74461204723b42e175ff3b5620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c43969-0ec2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687193699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193699, "uuid": "bbe25026-a283-471e-a1a1-6808b6f93459", "comment": "Malware payload (Formbook)", "value": "c8d32b80ac5ea9656974182bf5fa8526", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193699, "uuid": "3639fd50-710b-4897-81a9-462a41b703da", "comment": "Malware payload (Formbook)", "value": "5710572191f804e2f5f91ec37236187038467ef22922976630028ea45d340807", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193699, "uuid": "73663c5d-eac5-4aed-8142-ece1bd1fc96e", "comment": "Malware payload (Formbook)", "value": "39f6f848abbf88c0479737a2f665cfac748cfa27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193699, "uuid": "13c657d2-7188-4a6e-baa1-058aa30d6457", "comment": "Malware payload (Formbook)", "value": "1ef1953bf63eacaed339663d07806603cb8d6654938a603279db37bf45fbcb74f6dbb9a6c400003d471171bc1dc8a5b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193699, "uuid": "e8804ad5-3821-4166-9a9c-8aa066f71908", "value": "T1B30512184AE9621FE6671B7DEB54BB791B3BEB046A37D32B2C51B0C3AD12B500B01375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193699, "uuid": "cc9725c1-2186-4812-81ba-46e3e09e459e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193699, "uuid": "4c162540-fd09-4ed7-8dff-e4bf1e69febd", "value": "12288:lQSCihWjoqjD1xZPc38GJb1trxYrCaZH062ttYq7J3At5iHOq+ZQ:dCAWBjHZPmB1BxYrCgH062LYqtm8OqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193699, "uuid": "3e292cd5-f4b1-4f64-a741-72acbe717a25", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193699, "uuid": "af627b50-cb58-4cc5-b139-61971986104b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193699, "uuid": "d3fe305d-b17f-4b28-871c-276af0ab622e", "value": "nellyzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed3d7b4-0eac-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687184425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687184425, "uuid": "c222a25f-44b8-4b47-9b6d-3ea307e4aad6", "comment": "Malware payload (Amadey)", "value": "57ab5b6025deee4673776d45dd5c686e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687184425, "uuid": "8e0c0f08-469b-4ab7-8962-6ddd69b8969c", "comment": "Malware payload (Amadey)", "value": "57b7e6ca23498eff3f900f41d70342cec7f2fddeea52ff389ff05c75168ec0bb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687184425, "uuid": "8ea9a0e2-778d-49f6-9b1f-e6ad83ef2f19", "comment": "Malware payload (Amadey)", "value": "6ba996e9bb8c8d0e533a90c28bba8509ac05ec8b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687184425, "uuid": "0e2c8292-0c36-47c3-acad-adeea2273467", "comment": "Malware payload (Amadey)", "value": "13aff0c7baa21ed2b5ffd2364e7d137035d1a5aece6e324e23c06d992f616882ee1deaeb962f5f571d2cf8a253215510", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687184425, "uuid": "843cc1a6-0a5a-4de2-b638-4122e48bb423", "value": "T145E41207EBD84521DCB62B7088FB03870A317D618CB8876E7342696B4C736E5B636367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687184425, "uuid": "ae8dec1f-daf0-46fd-8cf0-ea5eba16b140", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687184425, "uuid": "5735f5ab-9a7c-4b3d-8dc9-f91894b9d7ac", "value": "12288:QMr4y90Gh35hRZMzbO1Ujs5b5bLYbcD2/vKhqW/+M/ZXU:4ynh9UjWpbHn/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687184425, "uuid": "7834e1bf-9234-47ae-b9b4-1531e5755968", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687184425, "uuid": "8de64ffc-06f8-4047-9a50-1cec02a7660f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687184425, "uuid": "6acbb2c1-a357-42d9-bf03-72c06cfa45e9", "value": "57ab5b6025deee4673776d45dd5c686e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60afbc1-0ea9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1687183309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183309, "uuid": "7f2eee21-0444-40d1-b7ff-dbf1c4999a25", "comment": "Malware payload (IcedID)", "value": "6172cb3957b8d2e9c6826b552ce3639d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183309, "uuid": "9eeb22b4-86a0-4712-95fd-8dcae3b70d9c", "comment": "Malware payload (IcedID)", "value": "5839da1f2d15ad51aa8165869552f628e67bb3e30341ea9f619a1167301e8354", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183309, "uuid": "4b760fed-78b8-4647-8db8-78d2078fce19", "comment": "Malware payload (IcedID)", "value": "4baef093ea515002536b9de941b4a6df8d7a28a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183309, "uuid": "3109b0c7-36d3-4f1f-8ce5-cdb11504040e", "comment": "Malware payload (IcedID)", "value": "2fb3b26684f4fc6eacca01f354bdbe9da3dd616221073c3317e4236f33cd6eb6135d60ad1d7625e67c4000223ee33ab4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183309, "uuid": "f2df1c55-5fb6-4031-99f4-b7599529ff84", "value": "T1C1F4AE27E5E06033D3221B79885783956C36BE702C27689B3BEC3E6C9F391446D69277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183309, "uuid": "e189b793-d453-4977-b636-9916a99660b0", "value": "c5ddd70a2f2ce9f4b9e5f4b86e781216", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183309, "uuid": "14bd9ac1-72dd-467b-b513-ea7bd180cab6", "value": "12288:D4iyBJSbLJfaMAhJVNRdfNl6lFqZLDZGqtV2ZE:D3ykf9AJ5vcADHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687183309, "uuid": "bda9043a-91a3-426a-873d-3f652a0b0adf", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687183309, "uuid": "44356bfa-2381-40f4-a3ad-edd5940a9072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183309, "uuid": "8d1c3f0e-f164-4dfe-810a-a923de678d9c", "value": "Yeni sifaris siyahisi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5530a01-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687168276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168276, "uuid": "8ecdf4bf-c5a7-45f4-bee2-29f3cecee578", "comment": "Malware payload (Mirai)", "value": "160b7aeb93d9bda2bdcbea509ed13914", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168276, "uuid": "701e1e6e-7ac3-4e54-a057-0fa96dbc3bf6", "comment": "Malware payload (Mirai)", "value": "5858fb30290f0da86cde0b9eea2beb9ce85c33482f9c7d09abea458233e92bb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168276, "uuid": "33513fed-2047-43fe-86c4-2a16d07a2fe9", "comment": "Malware payload (Mirai)", "value": "1ba4b805805821266d73bf7f827dc17d14bf1e62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168276, "uuid": "a9968578-bc4e-4439-b247-29ebe0ed2ad6", "comment": "Malware payload (Mirai)", "value": "4e7d41ac01ec29d9d45f08f9e9dedbd2183d50dd136ee2b29db76c7bbb7dd03902b527b8b477591c126f6e5e0e433716", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168276, "uuid": "70ed5ea0-fee8-4b8b-8a66-0e4429aaf38b", "value": "T138237DA6C8796DD0D1588274B9248EBC1B23B405C6A33EFE5E45C66A4007EBCF62D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168276, "uuid": "8beb5e0b-4b10-4842-a622-964fdfc45456", "value": "768:Fa3wtkeojMWeqUyYPneUFiBGr+GynzkgC9oNibz+CGIbV:Fa3wtkZbxQneVGWkg5Ns+CGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168276, "uuid": "dcaf395a-de49-4b93-a787-32907399207f", "value": 47700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168276, "uuid": "67d5752a-c949-47a5-8d41-fa96ad066952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168276, "uuid": "f01499eb-336a-4b91-995b-157e811360a1", "value": "160b7aeb93d9bda2bdcbea509ed13914", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31da0879-0ec9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687196778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196778, "uuid": "84ab4ec3-29c1-4767-8c6a-46679f23bb0a", "comment": "Malware payload (Mirai)", "value": "3e45b778a4601dea6bdc176b5d16ba5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196778, "uuid": "a0b57004-1319-4c2c-b243-3bfd729ba6d0", "comment": "Malware payload (Mirai)", "value": "59314f18b154ce9e7fde33697c893e93d6078b46141a7c30ea218484f70506ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196778, "uuid": "1dbae6ad-3996-4674-a6e6-fc5d33bc2c47", "comment": "Malware payload (Mirai)", "value": "488cf12c051919408db3284535aec229b4f2a9e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196778, "uuid": "07d6a844-ce72-4cd2-8596-a48f178a54a9", "comment": "Malware payload (Mirai)", "value": "4013282e4eede69623defa6cfc14bd26c8e393d5eb8406600adc89f15e7d7aa3bc1ae327ededfd3c0689d7f21203be0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196778, "uuid": "349f3884-ed34-4313-894e-e052a5301545", "value": "T139B39D9BF34715A1C86306F04BC74BEE2A173212AF6BD9E77C0D29395C781DB4A06792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196778, "uuid": "3ff047c4-c176-4f7d-85a8-7d057cd20f2f", "value": "1536:aYOcXWX64ob112YYdDWycTEzrSPo+glLI10G/LWcM:aTcGXxoTfqDWPEXSPo+gKHqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687196778, "uuid": "b113e90e-49eb-4903-81bc-16923f7a895d", "value": 117320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687196778, "uuid": "c8ceda73-c3f7-4920-90ab-f3bc870c16d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196778, "uuid": "d8998021-bcaa-479f-9198-73d95e7e17a6", "value": "3e45b778a4601dea6bdc176b5d16ba5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d35e4e-0eb2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687187230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187230, "uuid": "070e78d3-8a06-44f0-969c-b0087c8b7072", "comment": "Malware payload (AgentTesla)", "value": "8d7b6423c0bba9167f16184c3241cb18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187230, "uuid": "dfa56609-fa99-441a-88eb-b3ba8d80f058", "comment": "Malware payload (AgentTesla)", "value": "5935b528198306ddd89ca0f4c5772393861626a24253b2de9f7fb74eb20e29b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187230, "uuid": "b4b5af36-2152-4106-afa9-c7a9159ccdfd", "comment": "Malware payload (AgentTesla)", "value": "bacb69618886a16e12bff6eb85b592a79e193979", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187230, "uuid": "e22d06b9-e040-4813-b851-45eb808c6713", "comment": "Malware payload (AgentTesla)", "value": "fd4f34923eb4ea22500ce527d6331c6b69e8304f227370b8647fd994abc2090312e09c4ea9385edd3ce4ca5c76a86a88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187230, "uuid": "187af0c0-66a6-455f-bb29-4fbce23939df", "value": "T122F41214A7BD8747D6BB57F86560923007F275AF293BE34E1E02B0D56A62F124E02F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187230, "uuid": "78b7f586-b91d-44e6-a872-f97bada16789", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187230, "uuid": "58b687a3-9ca5-436c-a54f-b7e1cb331bd5", "value": "12288:WynCBqO0cw98Ac3uFSRjmleuUn+nG1Zbo78cMQiume/PmDo+EXqXdV:1sqO0X7c3uFSZInnG1Zs7Em9ed4qXdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687187230, "uuid": "117b8530-29f1-4c9d-9d3c-e38e19cd8885", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687187230, "uuid": "857f7d31-2e35-4e06-a29f-62a841e54fbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187230, "uuid": "aa0727c6-420a-4788-b593-10b311073b76", "value": "Enquiry E0359977A-4659122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037e3a12-0e81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165776, "uuid": "bf887d90-ff5d-4d5a-b2c7-96d2dc5b46f6", "comment": "Malware payload (Mirai)", "value": "4764f6ff088329c15fb0044439f582b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165776, "uuid": "d41c62b6-c79c-4b27-92fd-99d74596c6f1", "comment": "Malware payload (Mirai)", "value": "59d04075342140fbcd7d0beb033bd97a5de3c6548843511b3beeef612bad0f4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165776, "uuid": "64abafe1-6ade-4dc6-8399-5764bc9b04c8", "comment": "Malware payload (Mirai)", "value": "d3773126b4fbc06b88d7e4c3a4ab11bb94fcd320", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165776, "uuid": "8b2f0b73-ba5c-4015-a816-37ba52d2c9b7", "comment": "Malware payload (Mirai)", "value": "aca18993f96884821a2fd19e7575ef5be0ed3bb3a41f78d061dc533deac1f1de930e7472c937e33c0d466af8d3231b90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165776, "uuid": "c9c04726-49b3-43b0-a2fc-c63ad1109708", "value": "T19A632A7C1655B26CEAE59074F09330E528110B5C37CCA2D3A1E341B5FE74B89BA4AE6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165776, "uuid": "a602cf31-b082-4f8e-8ff6-13cb4421684f", "value": "1536:kpVc3eB6E/JkJlLTkbOq7cjOzV+99eGo3o:kpOuB6c9qH6zA9eGo3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165776, "uuid": "dd6b8ce9-f8d7-4b17-ad4a-feb2dfb52542", "value": 67080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165776, "uuid": "5aa9d13a-379e-471a-94a8-9d9e107520d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165776, "uuid": "461eedb8-72d5-4639-8538-b0b4932443e3", "value": "4764f6ff088329c15fb0044439f582b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac0eb18-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687160554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160554, "uuid": "fae4ca67-d247-40d4-bb9f-c96c78a46782", "comment": "Malware payload", "value": "3f7f021238cf44a01a4ee77a06dd2fcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160554, "uuid": "e3025d95-f1ec-4aee-9c18-926f0c253420", "comment": "Malware payload", "value": "5a7305d764a87afdcc5f815ab4ab28cf7c88715edcc04123af1eb458477a4b90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160554, "uuid": "6259f166-2cd0-4a6e-8ff8-7590a4b48d22", "comment": "Malware payload", "value": "ee398a362f3cc0eb9e73944d457645cf072aa506", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160554, "uuid": "e3aebfe3-f291-4175-87ff-5fe030e3948c", "comment": "Malware payload", "value": "7e8103222fb462f41f2bb43187f01893c73b022c6fddf7ca6802170d0ca7fe8ef4b1190d1b2aadcceaf6f027db77cd4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160554, "uuid": "ae2fc3bf-57b3-42d7-8237-580d4cdeac15", "value": "T16D623C17F3A4C233E9E9477D452312440776B7B2A31BD72A29CB609638B6370D292BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160554, "uuid": "4ffb989c-77b6-40d9-b422-dcce75a24bb7", "value": "384:53Ba/Br0eLvbBaqeX/aj70JZ7BrQf63w7lS:l0zbAqsTNB/WlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160554, "uuid": "64865c2b-1b95-44f9-91a0-87990600b624", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160554, "uuid": "6a8aef0e-8e1d-4272-8846-1bf403c82195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160554, "uuid": "bce21fe9-c425-44bd-b42c-8d92cf907ea2", "value": "NEW MACHINE QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b029c39b-0ece-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687199137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199137, "uuid": "5e6becec-d510-443c-ac5a-1b791bcd0b8e", "comment": "Malware payload (Amadey)", "value": "9f9387ce8109d23d6c6f9047bb9ed430", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199137, "uuid": "9f56f186-c3b1-4f3b-be3d-cb2f29955c73", "comment": "Malware payload (Amadey)", "value": "5b8d7571928fa4985caf43f8a1b91df34443cd9d18f3df76a10b3f67683d3054", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199137, "uuid": "a5ac9944-b36b-4fac-966c-ef0d6af2e72b", "comment": "Malware payload (Amadey)", "value": "0edc3586657c850d639071b482619ddef2b5b944", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199137, "uuid": "55865985-a6b8-4db3-b54a-5338108b6461", "comment": "Malware payload (Amadey)", "value": "801610296fee3c4eaba2bc7133312916980bd6a8deb1aef0a1cbe46c93c44913bcda3b1d3ac5cb4b913fb1e99e47afdb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199137, "uuid": "09c8d7a5-99b3-4078-8f11-9e83cbcc9046", "value": "T15BD41242A6E80177DDB61770B9F602D30A37BCE09978D3BB76C5595A0CB2AD8A130377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199137, "uuid": "44dbbdf6-0911-4080-953f-c52fa53742d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199137, "uuid": "b927c77f-b6b0-4dba-8e40-530d46fa5b37", "value": "12288:aMrDy90KE32nLKU8tETbTs0GaRnhRGABUl9QBvp0H/nHoN:ZyDnRSgT5GaXRGAul93H/HoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687199137, "uuid": "d10d8944-a4da-428c-abac-d76515203569", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687199137, "uuid": "6d8e8bc3-a53e-4f83-a58b-e302737c3a55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199137, "uuid": "341b7ebd-8909-4536-acda-779007caba84", "value": "9f9387ce8109d23d6c6f9047bb9ed430.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19793e20-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165384, "uuid": "7ba8245d-7cde-4971-a200-252920192a48", "comment": "Malware payload (Mirai)", "value": "76d75425c6447c492899f163c061ce92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165384, "uuid": "c641358a-c388-48da-95bf-55521b5d5af3", "comment": "Malware payload (Mirai)", "value": "5bc0bf740de9345c0d1015900159c6a280d3713ff1a4423400bd26fb37467eae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165384, "uuid": "54c83ff9-9afe-4c25-ae9c-03b30061495e", "comment": "Malware payload (Mirai)", "value": "c30a479a66fab442928e484df3ac0eb47afe7335", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165384, "uuid": "af75a050-9d75-4c96-8804-528642499085", "comment": "Malware payload (Mirai)", "value": "c4c7a71315e41b8077126384177f111fae405387c12c83746833745e4785f0ba5d3a350d015ccf6557df57ba631edf7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165384, "uuid": "2630f981-e178-4448-b456-7e5677f9ee54", "value": "T1EA133B02721C0F17C4A35A70253E5BD187BEEAD022E4F389655F9BA68A75E371482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165384, "uuid": "b0e9ada0-bc00-416c-ba72-d2b5c956b782", "value": "768:s4UB4TLiotRfYRW0CRG48XWH9sxClF32MusPzFOM1dWYlL1TvwZ1:3UBeqmTH9RjMM1dNLmZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165384, "uuid": "935df67f-79ae-4e03-869c-f98b6625b973", "value": 43772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165384, "uuid": "b7505aa5-9936-41fe-95c3-553a7016f187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165384, "uuid": "b5d52146-c857-4e5b-8074-e0a78344144f", "value": "76d75425c6447c492899f163c061ce92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86871979-0ec0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687193054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193054, "uuid": "08d012df-9eaa-477c-919e-7261fe7e83af", "comment": "Malware payload (Amadey)", "value": "5053c50a703f87c79b7a0e19ce557ad5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193054, "uuid": "36efd80d-378e-40f0-8f0e-510f2bb65ddd", "comment": "Malware payload (Amadey)", "value": "5bcc4276629357cabb9323b2169ccbeec318b21754f29cad7135dd3285ca61f9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193054, "uuid": "5b967b33-02c8-43ff-9175-36746e528a70", "comment": "Malware payload (Amadey)", "value": "9e5e0ba3b32bfaf7743c9cab1927528adb873818", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193054, "uuid": "f997b816-0f4f-4c39-8a55-f87d11359487", "comment": "Malware payload (Amadey)", "value": "7825918d0cdb94e4a2ad1e15111654904b4c4857a0405989b5ae7175c6dde100708f4b8d5010f39235e449b3fb3691fb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193054, "uuid": "6c9db7d7-ee36-4fa0-8c75-5072d0a24dfc", "value": "T145F533115F9C5EBD49988206707B1F1E17D04FBAC02CDCE69369B6CF651FE81A02B62E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193054, "uuid": "67f8577a-5b44-4e0a-97ba-b6d185625274", "value": "49152:3PbKtxgeaOdP/Z5jfKYdzOKzHTadu39pDzrZkSQ:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193054, "uuid": "687c77b2-4bb5-4bc0-b488-f98ea2b9d0fb", "value": 3505406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193054, "uuid": "e28c55a8-2e3f-4e15-8a27-a57a9f44d250", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193054, "uuid": "2e8220e7-37a8-45e1-a1b2-a1f170e7e54c", "value": "CSGO_Hack.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1693483-0e9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687176832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176832, "uuid": "a6fe24c5-7c5c-449c-8814-57f3acc29beb", "comment": "Malware payload (Mirai)", "value": "54b977ef8b0653e77cc1d8dd5f5b4a5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176832, "uuid": "529d0d94-44aa-49d9-8a4f-976542770623", "comment": "Malware payload (Mirai)", "value": "5bcdef559691aae62c171e7abbc43b3911074351b71316a7c318e9a53045efed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176832, "uuid": "2d1ca6c6-8fe1-4ece-914b-fb0e9592d5ce", "comment": "Malware payload (Mirai)", "value": "917164d4f70ee159b44ea38c564d02fc06c725de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176832, "uuid": "b80c2c06-7d43-4748-a466-340648611b69", "comment": "Malware payload (Mirai)", "value": "f34dae8f5d6d0c2ccce7c32874f96d27a4e39467d5c88e8e80f92c72edf2dad7569e262656d4637cce8b4195627d39cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176832, "uuid": "58afa67f-04b5-4282-8b24-d11cb39d8dbb", "value": "T19933A309BF650FB7EC6BCD3749E91B0524CC651A21A93B3A7834D81CF65B21B4AF3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176832, "uuid": "5236d673-7e26-43c7-a119-5cdb66f64e6e", "value": "768:lah45iaRluGX2Ht6/2CJ65oMeQ5ecoe4tuEsYlXixYf6S3VY:lah4wMuGX2ah6d15ZoztuEr56V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176832, "uuid": "e832f424-0a6f-4031-a871-5ccb6f197576", "value": 51548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176832, "uuid": "f9373b26-980a-4196-ac83-bdc38d1d660d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176832, "uuid": "e8357765-5698-4cd6-9c14-c57801ad3e11", "value": "54b977ef8b0653e77cc1d8dd5f5b4a5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcd24d4-0ecd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687198838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198838, "uuid": "a537c331-97d3-4c27-91c1-e0c7199bc6d5", "comment": "Malware payload (RedLineStealer)", "value": "13d194688a8e57851f5a66c905e50706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198838, "uuid": "23e9115e-13d5-4bbc-8494-a5345f5d005c", "comment": "Malware payload (RedLineStealer)", "value": "5c2c9a566eea71e269aea70ec4480f8580be7fb8ed90525c510ecaf78959530f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198838, "uuid": "2fd2a097-3d62-4a6a-905d-2087b1055261", "comment": "Malware payload (RedLineStealer)", "value": "ce28ab49ef2117edfb948a0cccf68e31e7b7c5c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198838, "uuid": "ad450587-1894-45b2-a232-c36ea80a6416", "comment": "Malware payload (RedLineStealer)", "value": "52ef698a8e869e2d5b23908015ce6ab6283ea8dab8ee1b4b7b90eca12359943f2e2637e2f6869a64459f34b928175f61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198838, "uuid": "9801ac9c-cdf1-402f-a091-d8c6904aedb0", "value": "T120D41262E7D98033C9F923706CFA17C30F31BCA2597083562B58A94B5CB25A49D7673E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198838, "uuid": "70df9ab2-0390-4544-954b-88eaf2bb0bd2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198838, "uuid": "24edef17-31f2-4cbc-9781-bd708608c739", "value": "12288:WMrVy90aLNykTZqv/1qBXCAMxCi4imbwebWdss0shZDYu:Dy3EZ+XCNmbwj08Z0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198838, "uuid": "453776e3-c8e6-4340-8f6a-a71064df3daa", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198838, "uuid": "4331276c-64ac-40cd-8141-b2e9bbd5e8c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198838, "uuid": "c3d57c06-3ed5-44b5-975f-c964e3b2b690", "value": "13d194688a8e57851f5a66c905e50706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f9025e-0ebb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687191074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687191074, "uuid": "8222b09f-bb76-4ce1-9631-271d416bd381", "comment": "Malware payload (RedLineStealer)", "value": "67d6a918fc89a950738fdc5a9e56123b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687191074, "uuid": "867bd636-f670-4e6a-8ea9-56c9c0d826fa", "comment": "Malware payload (RedLineStealer)", "value": "5c43e762e23599c29a344fabf02fe235e79c9e4697da49d0a17334979faa3920", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687191074, "uuid": "1f9b8208-7bbe-4326-9219-2fed6d6ba447", "comment": "Malware payload (RedLineStealer)", "value": "be4dd4003cb6b849142a9130965cf1e868ba3667", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687191074, "uuid": "a2ed5c83-a60a-42ee-a9a0-e4b8b09cdcd1", "comment": "Malware payload (RedLineStealer)", "value": "c2a51f60fc0ef517fe202e02dd4ed41af57440b456a27ff1c5efc4c9680e81dd52382076887b3d1b0444f59c07925c02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687191074, "uuid": "c1da0d17-9aa3-400d-aea2-269419798a4b", "value": "T1A8163302B5E8C0F6F9579671E08115B06978BFB92B2173DB3B44B621B4363C0E7B619B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687191074, "uuid": "1c3030e1-5f1d-41b4-81bf-05772c02178e", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687191074, "uuid": "aab5f702-6496-4369-a3df-0b057b3d0ba1", "value": "98304:g/5Bfvl9K/RrR3L+fDLWLCv3lyLrxypjdI+3GBOBL0Wui+rTYoSsen0m825Hsc:g/vTK/VR7HL28xypjx3G4BLPwQsO0m80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687191074, "uuid": "9c71c1b9-ca28-4202-8c5e-a00266fbd7b4", "value": 4139912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687191074, "uuid": "24ee0039-2b4e-403b-a061-76beae38ccb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687191074, "uuid": "9acdacd0-3993-44f7-a5d5-27c1ce90be9d", "value": "67d6a918fc89a950738fdc5a9e56123b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8c6a34-0ecd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (FormBook)", "timestamp": 1687198435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198435, "uuid": "15ee4f38-2fc7-47bc-9d91-6eb2ac79a298", "comment": "Malware payload (FormBook)", "value": "88fdfae9d664a2576b3f39c20d43868c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198435, "uuid": "584a09af-9505-4031-bce4-7aa8dfcdea85", "comment": "Malware payload (FormBook)", "value": "5c6873fd1aa1695b372614ca9f9d67bd1150f45da9d8781a4fadcb9f381a2d82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198435, "uuid": "b6f3223d-7e65-49f6-b702-e2c9133cc4f5", "comment": "Malware payload (FormBook)", "value": "d6001e09f85a66c8d27c04e80cd0dea19924fb99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198435, "uuid": "18abbe2e-e0d7-4aaa-b4cb-8003a00b5ab2", "comment": "Malware payload (FormBook)", "value": "9d8c973a8c3c991c33a1f0aef2637a0d04092e999cb7c2d152126d89105f9bd1ca0a6b57fb0224cd9373b9800d02e055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198435, "uuid": "bf48b297-65a0-4d0f-abfe-943c3e63d3f9", "value": "T116F48E72917414B6EC55293D48BADB981925BD312D38788FFBE23AA4CF39182F8153D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198435, "uuid": "f6d98feb-ba6f-40dc-8bb3-d6a00ca82244", "value": "f580d797d5fbc3df79105c3246aad078", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198435, "uuid": "0b18d5bb-ce69-4958-ac8c-6c7b97be0054", "value": "12288:NEdx8epMpDHeLp0ewAKOXCIfPHEl20/WAN9PuCCJQppO70an:NIdytHe1hFnfPHAxPa7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198435, "uuid": "194e5384-e3b1-42c4-a3c1-2fe53bfef47e", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198435, "uuid": "9eb1ab8c-f66d-4ecd-b0b4-89b183c28690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198435, "uuid": "4609548d-05a9-4500-b6fb-4cd0614fd43e", "value": "z89Qdphtrfmblsjfs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b22948b-0ec9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687196766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196766, "uuid": "e7df476d-5535-4ce8-a8d4-eb80adf17079", "comment": "Malware payload (Mirai)", "value": "52d7a8569adea3d274d096c38c32908c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196766, "uuid": "b2b0380d-54fe-4e70-a7db-df00b60c55a6", "comment": "Malware payload (Mirai)", "value": "5c85f9d88acc9a830e4099941d308a9f4c49f0ccf818d17063f56271d5a1cbbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196766, "uuid": "540ff4b1-935e-4f20-b792-bab508acf517", "comment": "Malware payload (Mirai)", "value": "e3e38ed3604ec7e9de8b0d9360c2d4010e6346a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196766, "uuid": "e30918ca-ffe3-454e-a982-ef2817b9206e", "comment": "Malware payload (Mirai)", "value": "3591abd3d45e3439f46c356f50210b6da847bb18b7b4af5b80ddbd8df30162d58eacd5c2f67ce5d55be498e7d6c861e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196766, "uuid": "4e28f857-ba62-45e8-acfc-236dbe7b24b2", "value": "T16E83E91A6E258FBCFB9D863547B78E11964C339637E1C284D15CEA012EB024D742FBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196766, "uuid": "0fdce06e-1494-496f-bf09-ccb86a10c0b3", "value": "1536:e7OximcAq/v8pc41JhUAmdKFMmub+VM2NKg0DI10ezmm:e7O0m7bppUAmcFUb+VM2Nxnjzmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687196766, "uuid": "801b2496-6fb6-4ce0-9f61-0a17d8096f69", "value": 81400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687196766, "uuid": "003dd514-77e6-4d15-8497-7d415e2e8439", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196766, "uuid": "bccd3b22-9f55-41e9-8fc7-7ee7745adc5a", "value": "52d7a8569adea3d274d096c38c32908c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b83737-0ec0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687192865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192865, "uuid": "d202255a-7ce8-4773-aaba-5f0a441abc15", "comment": "Malware payload (AgentTesla)", "value": "39d43cbc0e1bff3b362c2e7035617f37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192865, "uuid": "08f85516-581a-4da5-9460-d986cd40396a", "comment": "Malware payload (AgentTesla)", "value": "5d0c01b1ceef88fb8963383443d7b833df48e10f8708edbfadb457c4ca99ffb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192865, "uuid": "3329b672-eef9-4ee9-b54f-be8b60c1743e", "comment": "Malware payload (AgentTesla)", "value": "b594421b818fda79c02a11ed4d55c6a912619d3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192865, "uuid": "4556f012-7de6-428e-b8e7-14a3b4f85b7d", "comment": "Malware payload (AgentTesla)", "value": "c5c840060c51968cbc61390462750a74f9526e0dc76e78a0be03637955c2c708dda51b6a8e804dc021dd837108b0ec9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192865, "uuid": "0e8ed0a7-fd85-49b8-a7bc-a811813a4784", "value": "T10AD5B4037797C4A2D171EB33CDDE908447A5E9A23723D77EB59A231A0903B669CC261F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192865, "uuid": "39446534-397b-4518-b547-fae6026ea9cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192865, "uuid": "87c6ea63-6a08-42c5-9483-0103431a9ed4", "value": "24576:XZE6QrxuaySjnE6MYXo5AOvjlFboX+lz868qgCFndzvppKrznmr2yWGgCCPQ8ywt:XK+T9OhghpBQrRC+nXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687192865, "uuid": "3211863b-16b7-41b4-aa0f-7019d645d802", "value": 2841088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687192865, "uuid": "f7cf42c9-0489-46e5-898c-f7a1a0ccef00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192865, "uuid": "9015bbf4-4251-45f8-a9c3-b0a8d5179bf4", "value": "mojo.payload_Encrypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0deb979-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687160564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160564, "uuid": "36f78b79-d0ed-4f0e-b5de-d18097bbf43d", "comment": "Malware payload (AgentTesla)", "value": "de09182b5625ca30fb531716f619037f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160564, "uuid": "86027248-ddb1-4d87-b83e-e60fd7f6e428", "comment": "Malware payload (AgentTesla)", "value": "5d0cb2a1e1ff92207e164875672b29884edac956fd8894bf3846e58189ba0ecb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160564, "uuid": "616b6ed8-aec5-496a-acf2-3a76daa1093c", "comment": "Malware payload (AgentTesla)", "value": "794b52e7182cab0ad9f53c8b1eaddf9f69e4d9c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160564, "uuid": "a89a2ce2-1fe8-41ad-a439-aa63b39d4fe6", "comment": "Malware payload (AgentTesla)", "value": "0debaa7442c4d6c8bc3a411c8d526f2b1a2359303aa45b9d9d4132da54d5df850dbbbf565525561bccd7e9b0766926a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160564, "uuid": "493f1d1f-f12c-42af-b088-bf06f28e862e", "value": "T1E335D33E9CBD4237A670C6A6CF94B866F454D3B731122D39A4D35289862BC4B3AC713D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160564, "uuid": "81a5bf89-006f-412d-8722-84590adcf1bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160564, "uuid": "e5ecd84e-8fe3-4ea4-bb04-f1a0cfaba858", "value": "12288:w0FpLcFaGCK4UWlbZmKv3/zJm2fKB6oOQD8DYe:RFFu/P4Uyh3rs2fkOQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160564, "uuid": "faee087e-4892-4dde-a82c-8e4c85cfb425", "value": 1162752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160564, "uuid": "6e84a12b-75a1-4028-b56c-dfee2d472f9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160564, "uuid": "c1e3511a-79b7-462f-b216-643ea91a4abf", "value": "Sample-quotation-catalog.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3dbc4e-0ec6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687195773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195773, "uuid": "9701addb-e0c1-4b77-8b90-aed2531d6f0a", "comment": "Malware payload", "value": "b65bc68f283b52e91fc2e75f11112d99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195773, "uuid": "e66ec7b1-8f11-4e00-b773-60129656e2f7", "comment": "Malware payload", "value": "5d4dac5c9a33f891f246c6d412535ef7ba67ccd8281ded5652595e05a854eeb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195773, "uuid": "31c0d381-2e3f-4bc8-88cb-01a433ee01cf", "comment": "Malware payload", "value": "19e37e76b768e052a742e8a6339530328a3be3e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195773, "uuid": "b13e7f2a-ca14-4c16-9f1d-f785d41a5bbd", "comment": "Malware payload", "value": "eb8bc662e27097853dcaf1218133d209f80b7887f7bfb1d6dc956aaec545a7deed06685403d27150b9d7e1d1cdeebc00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195773, "uuid": "2cf7ab2f-90ef-4054-beec-3cbb5a17d4a8", "value": "T1A56338386F8C5927C6589D79B1E7120FE3B16DBB3212D20BAEA472141E737F94C06A47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195773, "uuid": "2f27dc54-19b6-477a-8c0a-07a685b99d1f", "value": "1536:+XEDmo4w1JdUBqQ/5J+kMZ7wd//2CqGfaDm:LDmCFUIcxMr+Um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687195773, "uuid": "b4015abe-2724-4da7-a5d7-b85906a5ab9c", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687195773, "uuid": "df7f3ee9-d0a7-434e-847e-991d849c3112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195773, "uuid": "029e97c3-c1f2-44a0-802f-3b247eaffc4f", "value": "SecuriteInfo.com.Win64.TrojanX-gen.31386.21259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e334bdc0-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687160568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160568, "uuid": "9afe3454-157f-486b-9d1c-0d22b91c9e58", "comment": "Malware payload (AgentTesla)", "value": "4362e2ddfbb6b8495fc083750f36c70d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160568, "uuid": "87596b4e-1a73-420b-ba54-5cbbcd194c41", "comment": "Malware payload (AgentTesla)", "value": "5ed11a0df9fba27a5396e764f91ffdef4cc12784303f8d48bd1090528df306de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160568, "uuid": "7c3bd93c-2014-45ae-9483-552a9229058e", "comment": "Malware payload (AgentTesla)", "value": "1f528bd0af68bc70ed625b97f6f8b2d53aee0d31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160568, "uuid": "d6931842-3f93-4f73-8c19-93f2388bf049", "comment": "Malware payload (AgentTesla)", "value": "9bb0cdf8558bca6d876ba5ca7074ac598f737d6011debafb33e9faf701364c487f0f6f1196f606b2a386af38c7cb5dad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160568, "uuid": "a43ff910-4d77-4ed5-87d4-c2833b21a273", "value": "T12D25F123F8CCA6D2E0AD067C9D64F3BE26255D616832DC562D92F0C9A934B0605F3D7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160568, "uuid": "0ec3332a-2e27-41b0-a498-933b6a7277eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160568, "uuid": "2ec7b081-e235-4ad2-b4d1-df4fc3234416", "value": "12288:oltYq7J3At5iHOq+ZQN8aPhdXaZoBoShEPCUmPrqWwt72Fms8Ly8/kpIE0RT:oDYqtm8OqKu8aP2ZoBS02WL5+N/keE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160568, "uuid": "b06f7098-af4c-4e0d-ab3b-9e2daf91f828", "value": 990208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160568, "uuid": "96fe0c86-6e59-4363-aea2-bb0569a15149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160568, "uuid": "67f89ca2-965d-4d37-b87b-a955eac3cf71", "value": "Swift Hard Proof Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae591b0-0e67-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1687154783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154783, "uuid": "211f30cd-0b52-4ff4-95d7-878eadf6d9e6", "comment": "Malware payload (ModiLoader)", "value": "8c565a67ce14d106962eb8d68da3253c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154783, "uuid": "27fd7cb4-9231-4e03-8c80-1e87be9a36e8", "comment": "Malware payload (ModiLoader)", "value": "5eff178850a6bd5ec1db551590cb0bb785642e16bde4e517dcde49df96445cca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154783, "uuid": "ea970372-4523-4451-80bb-fa258f6adc52", "comment": "Malware payload (ModiLoader)", "value": "7eec80bd95e46b1118d33d1d14990b3e2770c45d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154783, "uuid": "56a7e5dd-ba1a-4b4d-a886-edef6cd1d74f", "comment": "Malware payload (ModiLoader)", "value": "506dd24138d9ba286ca9864596908d7bdb7ac4c07ef859fc1e5abfd4cea43b16ce01eb7f8fb15c54653cadfed68a8a53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154783, "uuid": "4da4cb55-8a38-4e60-870d-962063eecce7", "value": "T11FF49F92F1D1D037D937E9388C1BC6B5A939BE603D6C644EABD53F481E39A8075102BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154783, "uuid": "94bf06f2-a7c7-4d83-bcd8-28bb49cae4f6", "value": "03dae84fd619ea38fe725058ccceee22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154783, "uuid": "053fe122-40dc-4ae3-98e4-663b593fe20f", "value": "12288:JSuomfiNNLKzD+ldOLC1XoWbSTFQfMjq0l+b1ftP5b8:JF7zZLEOhQP0EP5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687154783, "uuid": "79b968cc-54fb-4b40-b8ab-53c5d7704a22", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687154783, "uuid": "b45ea6b4-ed2c-4ae7-8025-e76624be6217", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154783, "uuid": "d7573fde-20a8-4844-88c6-9e168901b550", "value": "VNAV16801MTUProposal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbbf60e-0ecd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687198836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198836, "uuid": "d2671835-9500-4e86-947e-8a7471f041f1", "comment": "Malware payload (Amadey)", "value": "78693e6554fa4a0bc699295465224573", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198836, "uuid": "4073720d-eae6-4b0b-9e25-4d877314e61b", "comment": "Malware payload (Amadey)", "value": "5f47fd8fabbef15a179233c5804fda348ac5336c59a81700b7b2fee97daa86d7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198836, "uuid": "3a8d8f55-e1dc-4dfe-a6d1-0995f1d43fc2", "comment": "Malware payload (Amadey)", "value": "a4713a9a4d4dcc26f3c8e377bccb225301d08180", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198836, "uuid": "d58cbc39-663f-484a-aa6f-51e18250c15d", "comment": "Malware payload (Amadey)", "value": "1b452ae1f6e700f22fb634d300c0759e10ecc1a3d2be0504c93c74905445422cdc327e98117f45d0e7bc4527faa66936", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198836, "uuid": "202e794c-6ac9-40e0-9810-bbb8108e63b9", "value": "T1D0D41203ABEC8172DDB00BB05CF507930A39BDA26D38565B2642A99B1CB33C4E576777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198836, "uuid": "d1624b86-0e67-49a9-8709-73390233e904", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198836, "uuid": "52373e59-5327-43bd-a9c6-e5a610f1167f", "value": "12288:mMrXy90D3SvL8GVcCLVnKzSLo4WlNCSsmFkDhkfNQpMxHzh:5yvvg+xnKiQCeFkDyfKpM9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198836, "uuid": "7fdaea0b-c3a5-4ac7-8351-0ed0ec2fd47d", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198836, "uuid": "0563bee8-1a58-4f4a-9f55-0567cf77d984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198836, "uuid": "a129e4a2-3cbd-417d-98d6-edd3b1368a3f", "value": "78693e6554fa4a0bc699295465224573.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fffd49-0ea4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687181194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181194, "uuid": "2fe02047-9a98-4900-a729-d6fdab123443", "comment": "Malware payload", "value": "f81f2a386d178aaaca5e4ee4abf9a8f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181194, "uuid": "4e3a34b7-af43-413d-b20e-277c6f365df5", "comment": "Malware payload", "value": "5f4d4debd1963cf4b835ec2741ea8d623030ed4e5ea1ac4c221948d6bc3b0569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181194, "uuid": "5155ee37-a305-415e-bfb9-85d056a2a4b4", "comment": "Malware payload", "value": "b787bcc20f260c5336f491275a7944816a8254ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181194, "uuid": "ace88e02-816c-4e01-b5e1-9ad6b51f5d75", "comment": "Malware payload", "value": "f5148e372d17b804e0cd3782b05a946c5599e3ac5f43d99e0378f90652e92308cd33c842e613395369352b7c2a522e2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181194, "uuid": "96b442ab-936c-419f-824c-e1eac0890ce0", "value": "T12BB480129752107ED6FEBCF38071A867F62118E215D01B7FA68DB60E51BA8CF356D30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181194, "uuid": "6c0e3346-712b-4b4f-ad40-b63a55c33290", "value": "a466b57d7fdb09085d9f83450c0cb42a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181194, "uuid": "810c10f4-fb64-4164-b90e-7ad67d206bd2", "value": "6144:qi2LMcpjyglkOZoGfnQCflcduB/6Dm9JXZyLYgtfVfQ5Kczwqzdh:PSjoinQGAyJXaMK5qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687181194, "uuid": "3ce4981d-b28a-4faf-8d3a-72cd2ee9a197", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687181194, "uuid": "250cb779-8300-4dcf-8e56-7e2e338f145a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181194, "uuid": "2c10ae81-5034-4217-b248-017df220c1ea", "value": "\u56fe\u7247Q.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee70770-0eac-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687184291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687184291, "uuid": "20626c0a-6763-4033-85da-49b38a4e256a", "comment": "Malware payload (AgentTesla)", "value": "ea1d6cace3635d89d4006de56118d85d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687184291, "uuid": "fd580085-953c-45b3-9450-57b3059064de", "comment": "Malware payload (AgentTesla)", "value": "5f6a3d5fb0c4e69f47dcf68021f1bdd1ed6648a67f986ed66893d72b37ef03e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687184291, "uuid": "8e253ecb-6daa-44fb-81df-6b897d0df313", "comment": "Malware payload (AgentTesla)", "value": "bb53364299c24c0ac8d63053e57a77edc95b641f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687184291, "uuid": "d58c030a-1a0d-40c7-a303-400f6f8ab4f5", "comment": "Malware payload (AgentTesla)", "value": "2a41b9cb031a4be272d2d8aabed8a906242fae75df49a186d174da2332e6252d95bf2f0a145e337117f8dd1494073708", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687184291, "uuid": "abf0492c-e8e8-43f9-b9fa-fbb7e7ea7caa", "value": "T1D6641257A5A4C8B7E9721E315C3A25485A7BEE343C6CB3070FC83696BB778C0992D312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687184291, "uuid": "423693f1-a334-40e3-a769-3738356c9c97", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687184291, "uuid": "e1c37d55-e030-49f0-9421-f29fff51efb1", "value": "6144:eYa6KB/pCbMP+NH7Y7/qEAsiJkDOeP4Fsmm7KJz7szDDtu2PA1:eYA1D+Ra/4siWDOeQ6mm8zkDJuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687184291, "uuid": "5021edc3-aaa8-4f84-abba-304d3ad83112", "value": 325744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687184291, "uuid": "828d1e6b-ca9a-42a6-b173-8ed7c27cbb11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687184291, "uuid": "6a4995ce-7fa3-40eb-88d1-3df36964a411", "value": "PAYMENT SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0988025d-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165357, "uuid": "be985664-dde5-4c29-8585-45d54608efe4", "comment": "Malware payload (Mirai)", "value": "792095ee9d686ef5b3a71709baf8a314", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165357, "uuid": "179dd73b-95c2-448e-a3fc-403fed99553e", "comment": "Malware payload (Mirai)", "value": "608648fc7776451e37d3ae57c79ce3dd14ad6e3ae9217852dbb6afa3a355f3a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165357, "uuid": "da171dc5-73af-4e5e-8a2e-5044eb798e65", "comment": "Malware payload (Mirai)", "value": "10400abe4610b102f5a17c4595c24a073ef2f526", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165357, "uuid": "c8c2d113-475d-4a4c-993d-f283a30572ab", "comment": "Malware payload (Mirai)", "value": "e28895344b188e0bce5ed07b3fa1241c29d8572a3e648b1cbc79ec1fc0c616f5aa8dc3090be39dfaa34440f0f40eebd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165357, "uuid": "8e524e4e-2597-46fb-8201-b146e26c48bf", "value": "T157E34B06B70C0E47D1632EF43A3F27E193EF9A8121E4FA44651FAB8A9271D321546EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165357, "uuid": "a2a3bacb-071a-4008-9c05-d072970bffad", "value": "1536:UjZVrjq9H6sUlzxprvl0Of8HXbq4xiUOjAM2fKDwvAPW8IfAcOfi9mDzm:RNUlzx1dpi+UhMj1P0GS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165357, "uuid": "e25d65ab-9f14-4f34-b083-ea2b71b23dec", "value": 145924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165357, "uuid": "c4be9f23-7336-49ba-9cce-6f4ec9150a1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165357, "uuid": "1aba1c6e-cafb-4786-898c-c8f0bf3db689", "value": "792095ee9d686ef5b3a71709baf8a314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babec35d-0e9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687176821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176821, "uuid": "b693c322-e59d-4c70-b716-33c8d8622ef3", "comment": "Malware payload (Mirai)", "value": "df9196f3781789e5cde4dd529789d75a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176821, "uuid": "4781b820-fb2d-422c-9b47-754d4e05be8c", "comment": "Malware payload (Mirai)", "value": "60b722c4b7bffa8cb62f7fd6e63a2faefee4ce4f1823c44efcbcc8c984ce394f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176821, "uuid": "04f70582-8daa-4cbe-a930-70ba553242bb", "comment": "Malware payload (Mirai)", "value": "be0d03e14c4cc0d6ace63b3872c09da1a5776a71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176821, "uuid": "53b6f12a-9c96-49da-8f3e-529440b02629", "comment": "Malware payload (Mirai)", "value": "a2338ff95be4806acc3b3cb5f930021ed7c27a74c6d15b29573f1592baba2b964ee0c0b17c1ac18aaef5ea98dc0e9956", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176821, "uuid": "7082eb87-8091-42bc-ab35-ba5d3dbd5180", "value": "T1A7031896B801DD7CF95BEBBEC4174A09F260774551830B3B23ABFD936D322544D22E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176821, "uuid": "bb9a019e-e8cc-4c3f-a069-f6a5fd321e7f", "value": "768:VYefytU+kyLdPx3ICuAf+d90RpOUrOlRlW8Mar+:6GysyJxI7AfhRpOMOly88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176821, "uuid": "9f8e63b2-49bd-4ec9-82d8-59c1728a4e1c", "value": 39784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176821, "uuid": "149021b5-ae20-4386-8ca8-e6478579c83f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176821, "uuid": "5a1fc393-dfca-4fc2-94c4-698e01e47afb", "value": "df9196f3781789e5cde4dd529789d75a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff73c7e-0ebb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687190815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687190815, "uuid": "7a184759-485e-4e46-afd7-f199de25a1b8", "comment": "Malware payload (GCleaner)", "value": "9a97e9f36c856d7660f1dedd940a7527", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687190815, "uuid": "c309f900-c014-4ae0-a984-4728101a365f", "comment": "Malware payload (GCleaner)", "value": "60da6ce55330f4f38e98b39bf07cf75fdabd80296429f1538c48d5df499d48d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687190815, "uuid": "64097fc7-7f7a-48e4-83d7-b290b5cfe11c", "comment": "Malware payload (GCleaner)", "value": "5b2836e25c740fd47781a965a5a20f684b93d675", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687190815, "uuid": "d77f23b9-fcf5-44f6-8641-6b4539aa802a", "comment": "Malware payload (GCleaner)", "value": "d9e4508b0ba03b32ad9f2fe9c8a4a3d5332471e5e6cd52611f9b3e83a7015eadd74e99fa2bce3e7741ccd0efff65e496", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687190815, "uuid": "b1643bb0-57c1-4af3-bd7a-7fe1e255b56b", "value": "T13064BF0372E3BC64D526DB728D6FC6F87B1EF9508E18279621286B1F09B02A3C573756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687190815, "uuid": "e3bdda2f-1fd7-44a3-a6cc-766d857bbe4b", "value": "908fbf99c3f8c44c371239c262bab2c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687190815, "uuid": "2fd993fa-0ef0-428a-a6ae-f697f6393307", "value": "6144:XNoiqOcq/PdQPkZEWFEnuAktCN+OKW0w6wErska8MqvmEZm:XNd5ca6kKZnHyC8OKW0w6TskvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687190815, "uuid": "1336e8f9-c410-44f3-abc9-417a27c6f240", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687190815, "uuid": "80aa51e4-9024-4c30-8d05-a2edd3e352b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687190815, "uuid": "95f2e716-b26d-4f4a-90c4-a202cbcabb5f", "value": "9a97e9f36c856d7660f1dedd940a7527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33bf10d-0e8c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687170796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170796, "uuid": "a1f54f2f-3660-4f7d-9503-f81a2c74adff", "comment": "Malware payload (Mirai)", "value": "ca3e24f9aa4a7aa3f5f7e487aaea1399", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170796, "uuid": "2482a143-bff6-48d8-b115-f03b14bfe0c3", "comment": "Malware payload (Mirai)", "value": "614fe910375a994737e8b1fa1851c71561d8a6ac6bd3f3bed88609c29add0a8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170796, "uuid": "a37275cc-2157-4f35-a150-84eb1c222715", "comment": "Malware payload (Mirai)", "value": "dce14db6ebc96841db042a9348e497c493bda08a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170796, "uuid": "f5171592-d68c-4e1b-a698-f0ef52b767c6", "comment": "Malware payload (Mirai)", "value": "376d59534188f71f4846ddb0343d84676e9c97d3bc202cc7952f0e1954ce5184d9e16b9b2e78fcbb926db12ac1fc46aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170796, "uuid": "15666193-fb81-4c07-b2e1-bf874a3dfd72", "value": "T189D2E0295121718EFA9DC8FE527E034311B60BF53AD46545F6B1EAB24E075A0BCB73C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170796, "uuid": "d18b729a-683c-4118-9bac-a4d53a5a4ece", "value": "768:7h7ts9UPoiajRgDuMeCF4OGwXgT8lHJgGlzDpUYsl:7hLajROuMea4NwXgkVqYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687170796, "uuid": "5fdc04bb-d446-4b22-a303-f0def4ccbc63", "value": 29392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687170796, "uuid": "312f42d6-fb57-482b-8d1b-9fbf0548542b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170796, "uuid": "c756990a-0f41-40d3-8ad5-946f8e0ec4b5", "value": "SecuriteInfo.com.Trojan.Linux.Generic.298040.24530.4373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5933dd64-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687174080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174080, "uuid": "d6944aaa-1211-41f6-a475-73b38fa342fc", "comment": "Malware payload (SnakeKeylogger)", "value": "b870213a44b08d484f2ca124ec1a40e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174080, "uuid": "77008102-0930-44e5-bac9-d886a3b41a45", "comment": "Malware payload (SnakeKeylogger)", "value": "61e078d216229dec7f1fc09d3e3276167dde775b252bead7a5e28622a68a8d68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174080, "uuid": "ee4da212-e3f0-462a-8543-6b0ef95273be", "comment": "Malware payload (SnakeKeylogger)", "value": "96201272bbc9b924ff47fcc4800e07c33c92908a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174080, "uuid": "4c97e716-9dd6-4750-87c0-6cae28908896", "comment": "Malware payload (SnakeKeylogger)", "value": "27667fe27104510574667f2bb3aee8d53ef5f1ede761f1bcedec99774ef606858d484a4af651a34e79266603d19d7163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174080, "uuid": "127ba427-f668-4802-93b7-da7b502fa87e", "value": "T174257ED1F190889AEDAB06F1BD2AA53015A3BE9D54B4C10C1A99B75736F3342209FF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174080, "uuid": "b9eff25a-e7a2-4532-aa8b-dbbcad13e815", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174080, "uuid": "eb4f6361-aeb0-49cf-a536-78c3e3734972", "value": "12288:7OiMizNT6HCQUtvLGWCrHxpD5B/mf7bp03APEXqXdV:6DizNGCqnTjuXpP4qXdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174080, "uuid": "a7656ecb-53f4-4c5b-b4ba-056e6f86cace", "value": 1041408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174080, "uuid": "1f878ca0-0129-483c-afd6-6eab147fb708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174080, "uuid": "15adbad0-abf3-44d9-a36d-0382602340ec", "value": "b870213a44b08d484f2ca124ec1a40e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0e02b1-0e67-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687154647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154647, "uuid": "d5fe5c65-15f3-425f-88db-f67794db2330", "comment": "Malware payload", "value": "009deafca708d29cfe9d3af4b10a4312", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154647, "uuid": "e7e1fff7-bd46-4081-9e51-b7e346edee77", "comment": "Malware payload", "value": "620d39d5f8f4e4e988ba3397c599012cdac59bab78241afe2ed3dcebbdfd96c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154647, "uuid": "00cad68b-a1b3-4491-8252-1ce3112e8214", "comment": "Malware payload", "value": "8085f28036d20bb6bc5be6d19360a35eb03c0421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154647, "uuid": "2e08e4cb-7646-4ade-8dfd-1b366991e803", "comment": "Malware payload", "value": "d4ba4bef8b42ea521bf68cf282f49a9208bfd12402047e8fb7f30978b1537d5d6511dd879532a8ea12f2dba5d58d4cb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154647, "uuid": "5b73035f-32ce-43c4-a1ac-0122c885bcf5", "value": "T135055A1AB2D7143BC03706BD492792645C3B7D202A96585A5EFCBF4C0F392A33D36E96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154647, "uuid": "77a4c853-4dad-4a2b-b5cd-8657f24d5299", "value": "c00b6ba7dbbc6abee9ace3a65a49ba24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154647, "uuid": "fd3ab195-547a-4bb1-bf98-ac91a34ffd16", "value": "12288:3wCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEL888888888888W8888888J:jNzCtUpQ9WWPBSSRMTEpXN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687154647, "uuid": "dd522da8-4c4b-44b3-8267-db7502750312", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687154647, "uuid": "2471cf76-863a-43d0-9987-0aef4c962837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154647, "uuid": "5c896e4a-fcc6-4fe1-9134-315fa32659ed", "value": "Cosco Cargo details and Manifest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10eba6d-0ec6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1687195783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195783, "uuid": "c3708ff7-f266-4501-8cf6-8005b92ade06", "comment": "Malware payload (Vidar)", "value": "dd7e7b33542e08e9d2a0a0184cce60dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195783, "uuid": "b17d47b2-19a2-4b27-ac8a-ca87f364aa82", "comment": "Malware payload (Vidar)", "value": "62c56d61f99355ea6740a6b775427bf8c28924d9a27a1222f7b65d752e18063e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195783, "uuid": "c1bc7c86-35a1-48b1-ac2f-73059e6df50c", "comment": "Malware payload (Vidar)", "value": "5def2fff12b197a6c431beab348d5e641a84b932", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195783, "uuid": "e45e79c8-a067-48d3-a422-dfa2f61cba19", "comment": "Malware payload (Vidar)", "value": "2e12a0fd37563a55d9c8c2b1354fd29c153bb32f8a4ad54b4e3bfe99d4c701eee7b74266a9642912aaa8885f115cdc63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195783, "uuid": "c6494196-cc15-4218-bbf8-2eb3b5d74d45", "value": "T1DE463342360D3A09EBB4977C9F1DA1EC5B33A3541B4DB256C95E2D302876FFD06C6A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195783, "uuid": "87e6b703-660d-42df-8a81-ccc4e03c99b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195783, "uuid": "f6a62f61-f45a-41e1-84b3-21b36186e37d", "value": "98304:Rn4qVAdvwOh5jZtvQJ/AWpvDDBc/JFeaCSD2fiyAfgZTvJQEWyZ//bnw5DfDGDj3:Rnup95Vtv/Wp3BqPeaC5apfQ5HZ/znwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687195783, "uuid": "6b34e9b8-9865-4349-b25b-cc24e18e615f", "value": 5370368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687195783, "uuid": "6bff91ec-2776-42f5-a800-bace0d544f8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195783, "uuid": "1d058ffa-e509-418a-9cea-3c94be3f1260", "value": "SecuriteInfo.com.Win32.TrojanX-gen.13002.24017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e213924f-0e72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687159707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159707, "uuid": "73603100-1b4a-4c61-a7c1-2957d9f49009", "comment": "Malware payload (SnakeKeylogger)", "value": "1dc67aa3a84bdc06105b1ab05f05a75d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159707, "uuid": "83e36b18-e744-42ca-8a88-c8e618e62610", "comment": "Malware payload (SnakeKeylogger)", "value": "64d66ac60714c0fde68722e28c101fbc7f3b7237b04f2f2942f4b5f28e72c008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159707, "uuid": "dc339d92-3293-4489-8a7e-2aebfcf61ef4", "comment": "Malware payload (SnakeKeylogger)", "value": "c5137a5842175b0358c0a367f309fb20c666b945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159707, "uuid": "922fdd14-06bf-4e8a-a28d-a3646966f03f", "comment": "Malware payload (SnakeKeylogger)", "value": "d84ced5edd24d7da0ddc53f88d4b9e3a2cc38943e13f4315f34b362aaaf3b82a94a7a79c95213de3a95eba768ae97b22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159707, "uuid": "8ad1be71-1407-486b-8aca-c918be0de458", "value": "T111E412989CA55B43D1AA87BD04D437B5233F6BBA7927F70A1DE3B1D4AC62F864900703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159707, "uuid": "68c402f1-6480-4bbd-84f2-4e267c1c23da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159707, "uuid": "3e50c7f6-d891-426e-9dc5-67234461e5b3", "value": "12288:5dtYq7J3At5iHOq+ZQpYgzelIc7uZlpVSlGl4at9muqGTSFt:5bYqtm8OqKQYgzeKOlA9e1cST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687159707, "uuid": "9da59a86-e87a-41e3-9bee-de05fcf90e72", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687159707, "uuid": "0fc3e36a-50da-4d07-8614-fce1314acc09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159707, "uuid": "49690234-3ecb-4050-83f7-6828512eb6ab", "value": "Notificaci\u00f3n-AEAT..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bd60e4-0e93-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687173853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173853, "uuid": "2474fe04-b1cf-4ae5-9a9d-0d3349087ca3", "comment": "Malware payload (Mirai)", "value": "dccc7ed99cd8d8abcc20e67d2150c9af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173853, "uuid": "1b0872d3-e25a-41d0-8aaf-7f027d3ac018", "comment": "Malware payload (Mirai)", "value": "64e1363bb75ec0b4c4f247275439feb17a6e3f94a48f19dc5bbe04351ff7f9a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173853, "uuid": "f01314e3-72b4-48f8-84dc-7ea71b753de2", "comment": "Malware payload (Mirai)", "value": "de8e34109bd2b21cbf176feef41bc2b18ac469b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173853, "uuid": "fceb59a4-1aea-434d-8564-5446feb4d949", "comment": "Malware payload (Mirai)", "value": "f8f4948a0151a6d6078aa0a6f25fb91f4ae01a5f5dcbec036def9d1945d3e23ed66ee1ee51eb90a3ebb4ebb92a5bb019", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173853, "uuid": "1e44a426-218b-4223-b690-d9ab3744228a", "value": "T132733A55FD815A12C6C513BBFA2E058D372523E8D2EF7207DE216F20B78681F0DA7A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173853, "uuid": "caf9535b-2cec-4621-8d79-75d71dbad40b", "value": "1536:TNUCVgC8rG0G5A1y2IwpAfhc8mbQS+RQ5dl9BvDjYfwbZnN:TisV8rUbfMbQS+RQXlDiwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687173853, "uuid": "ea33cba2-16e6-4944-a2e9-4a1492061df0", "value": 79164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687173853, "uuid": "6d44220e-4bcf-4cd7-8f3c-4d5b9b39f113", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173853, "uuid": "99e13e28-5b0a-4420-bfd8-a77785e7ccb0", "value": "dccc7ed99cd8d8abcc20e67d2150c9af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee65e37-0e51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687145260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145260, "uuid": "95b836c3-037c-4410-9741-8c8d5457e2b5", "comment": "Malware payload (Gafgyt)", "value": "e10cdc5b5d6a1680516ec1485272d506", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145260, "uuid": "c13d5ebf-ceff-429b-ab89-6b2daa0130dd", "comment": "Malware payload (Gafgyt)", "value": "652e826887adf4f2fa3a8aa88d2d0a8366c4d9fc5a45c7c865cefa7dcb974fb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145260, "uuid": "1a7cd051-59c1-4a97-986c-cd17ff4059f2", "comment": "Malware payload (Gafgyt)", "value": "6891dc5b38e183e9d98e9dee3d7cd82d473d89c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145260, "uuid": "d5b3b43d-1c03-442a-9422-bb1f21990e9e", "comment": "Malware payload (Gafgyt)", "value": "b14c31eef78f64eaacbd5f3fa74eaac72186a664f9343e6130ed3bc4f7c2e660fb3ae703a8847f52d24f0fa6f98306f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145260, "uuid": "298cb839-0e69-4c4d-8f65-abc3a3726631", "value": "T117044A05D6508B5BC2E227BAF68B424E33339F54A3DB331999387BB43FD27991E26111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145260, "uuid": "313ff0f9-fe95-42a2-85ee-1dbccab1202d", "value": "3072:co3jklBc7C8tawPT1ad1yLm0zW0iivaTXrM/9iimU+wnFQ8cNu:cx6tawPT1azyjW0PvaT7M/9VmU+wnFQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687145260, "uuid": "c242478d-a39f-4552-9d2e-ab6e4acbbaf7", "value": 174909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687145260, "uuid": "43848d39-1358-4642-a492-7a03277c4bfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145260, "uuid": "9f375cbf-08c6-4d7f-8e39-1b77136c1210", "value": "e10cdc5b5d6a1680516ec1485272d506", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2394a4-0eb3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687187531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187531, "uuid": "e92b4f6c-5907-46b7-a7c7-cf54d16983c0", "comment": "Malware payload", "value": "06155acd7db4ec1f7157afbc6a0bbf8a", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187531, "uuid": "a62d9e5c-5feb-43e7-b696-fe6c8e1a470f", "comment": "Malware payload", "value": "6551405add13649d2c6ea0c44e377af3528b58395b7e1590cfa897b1a0bc512c", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187531, "uuid": "2e57ba03-d484-4b11-a446-e3e6448ae424", "comment": "Malware payload", "value": "8600b78816a1d4ef6a9314341eda2008edabed24", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187531, "uuid": "1dd9a1ed-b6e8-4232-8cf0-9c4062ada16a", "comment": "Malware payload", "value": "49db8336dc38c1d6f01a97578d87f914ca070729b2a67b5cbeaf120073511b33aa45bd9b9509352e029cde338e2c232b", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187531, "uuid": "8aaf9f38-8d19-4b4a-b017-285c0f4a0b21", "value": "T124216330D0C91824C91ED6B0CC2D77A6865B174BA323BB5E31A04BB0CA1653722E4EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187531, "uuid": "3ae8ce94-deeb-48e1-a15a-dce3893807d9", "value": "24:9cfLUQXlMod9WMCbqcmDo9kd/XhAe48BZs4fJrU18qEc:9cfXXlZyMCOcoQkNXeMZs4fJOREc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687187531, "uuid": "7ae14953-8883-43e6-9dd8-2feb17c916f0", "value": 1150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687187531, "uuid": "428c8a6e-421b-4b83-8b8c-04f7e71f952e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187531, "uuid": "50f9cc66-01e4-447f-83c0-a60796b865de", "value": "Webwhats575276350446319.769417.86869..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4adf005-0e93-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687173831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173831, "uuid": "055d1c27-a223-4196-a341-7433f2ab255f", "comment": "Malware payload (Mirai)", "value": "bc383747b8c3fa20a46117314004d924", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173831, "uuid": "eae1fce5-6a28-4d2c-9268-3c67602a623b", "comment": "Malware payload (Mirai)", "value": "6608a8ee24fa85f00c45e235fb6b4f9201c08d7f1a3231dd86e9b1606658b681", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173831, "uuid": "5fe06c2d-4554-4291-8fb3-e631f43cac0f", "comment": "Malware payload (Mirai)", "value": "9169c7fbf480eb9f3848511c5a2ee7c297d0e1f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173831, "uuid": "14a2ef88-a169-4d4b-8ab2-e6f02d02df28", "comment": "Malware payload (Mirai)", "value": "355608874caae77e681f5ba0a7729211314c52f80400ff0ce519d95cf7c8d459afb42faba8c067d7cfbb14c8e7c6ef9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173831, "uuid": "44886350-96e3-4e12-8de1-8e0248336f0d", "value": "T1E9F34B46FA814F13C4C61776BA9F424933239B94D3DB73068928BFB43F8669E0E63945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173831, "uuid": "c9c2720d-0a5d-4b10-9fb5-6868c714a7e1", "value": "3072:cJtReLHRKF9ZanaEVE9HzGyG8K/a/XfywbZn526ExvM/9irV3Ds3b:cJGjUOnaEVE9HzW8KsKwR526EFM/9ixI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687173831, "uuid": "21a803ed-7bea-4444-b043-18598184e225", "value": 168461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687173831, "uuid": "133313f2-87d3-4260-b76c-65f9c0d10e30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173831, "uuid": "22b2e01b-2b20-42d4-9aa2-1df48e2b2957", "value": "bc383747b8c3fa20a46117314004d924", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde6d9ea-0ec6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687195778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195778, "uuid": "0cda3ff4-466f-4221-a309-b8f978943ded", "comment": "Malware payload", "value": "eb38de8ec4529606906c7bab63b147d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195778, "uuid": "83bb9624-e291-48fd-8599-31ba744cb47b", "comment": "Malware payload", "value": "6610efd2a470e506202b162d47580048968f7a113bd9e34de71ba455fccdc689", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195778, "uuid": "367f1843-039e-4b77-b121-d81619be8124", "comment": "Malware payload", "value": "57fa513a3e07455240f27b19fe446c355eced675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195778, "uuid": "83d27522-8733-4d30-bfb4-1921e8e8f4cd", "comment": "Malware payload", "value": "8cdd7746ec6bf65685b8fc5e8041d83f00a3d9413c15863cbf4499b897fb7a716f1ea7dff969fd1c1b13a4638dd29347", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195778, "uuid": "2b104b16-73a1-452a-a1ea-2524d2729cbc", "value": "T1F95633432D1C3A02FB58C97F05F6A4483DE63DD968AA6DD8BC4426902C79FFE07066D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195778, "uuid": "77f9227a-dc98-40b7-b916-f4a05d13fcc3", "value": "196608:vV54qiSfe2RQ7Sy98OWz2et7E5vLe/Vnxm7mfA:vv4RwRQ7TeOv22vLe/VngqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687195778, "uuid": "e45766e1-a0cd-4177-bf21-5d0597634343", "value": 6355456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687195778, "uuid": "d8836590-94b2-42af-bfee-f74ce2625f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195778, "uuid": "ab3092d8-d905-433b-9cd6-342c17d1bdd7", "value": "SecuriteInfo.com.Win64.TrojanX-gen.18944.32054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd95b480-0ea8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687182892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182892, "uuid": "7dfd9e89-b49b-430d-82b0-1a78acd7b8f9", "comment": "Malware payload", "value": "16a51ca50dd17fc42ebaa13bae3513f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182892, "uuid": "4cad9385-088f-40b2-8129-eaec831cb3cb", "comment": "Malware payload", "value": "66560c551ae5b2b38eed49ca1a3979cc6f937da553e29136ef11debdaaf3730a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182892, "uuid": "76966175-0396-484d-84d6-3ad5b2ee254a", "comment": "Malware payload", "value": "d6158a39498b13856dfd4f16b6de7ea38a4c520d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182892, "uuid": "c43d07ef-1743-4140-b54b-23ebd4465d59", "comment": "Malware payload", "value": "75d92cb9fdfb7fd2c7baca8df4aab8648c4280ff64a02bf53ae0cc48f74743a4c48af2b0b5414b2f2c36bcd41f3288b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182892, "uuid": "f94175ea-f8ee-4aad-9f9f-fbb73170e460", "value": "T1C1C41210B390CC5BDD2146315DBA8AEB62A87F055C414A3F3B64BBCD7C3AA40E81D77A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182892, "uuid": "45e3e5a4-7fff-45f8-99d7-efea546e4a37", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182892, "uuid": "f6c54258-f2cd-42dc-b5f6-a6f3d3537250", "value": "12288:8g65/YI5lyVqiU98ismsMi+sRvyRwOaLF7tyqZ/pPsx2OcN:8g65AIvya/5vGOAtyk/pPsgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687182892, "uuid": "8d88f7af-ce54-48d7-962f-dbbd1b0526e3", "value": 588392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687182892, "uuid": "1d5e139d-11e3-41b0-887e-e3a0178ccc33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182892, "uuid": "bdf26cc9-01a5-4c6d-946a-f5a3f9f35a12", "value": "doc_JJTHOG2309 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec4fd55-0e77-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687161822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687161822, "uuid": "4676c17b-07f4-4db3-815c-44393e5e0a5c", "comment": "Malware payload (Mirai)", "value": "a147fd7f6b23285ef215a05d5f3884e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687161822, "uuid": "e6dfe9c8-fee2-4559-a33e-95ad7fc5ee40", "comment": "Malware payload (Mirai)", "value": "66dccdec81b69c25ccfa292d8281a9715a640e45ae0989502190fbcbdcc19658", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687161822, "uuid": "4363560b-4039-40dd-b904-476dfb84a833", "comment": "Malware payload (Mirai)", "value": "183e6f5d2dd9a95c8ba214f1f81134297fffb494", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687161822, "uuid": "5a1b2d5c-9c58-47d3-a2c3-0848dc6fee07", "comment": "Malware payload (Mirai)", "value": "0211dc6030dc6018d42dd43be91c9e2d0c3f0f5617a6760ddd2fff7ac04da221420955d4e70bc129c222855adf685ab9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687161822, "uuid": "98db0284-9115-4416-b6a0-16ae66675faa", "value": "T19F335CC5F543DBB5D84204703072EF339E3AE6FA215DDA87D3E5A532AC83502A50BA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687161822, "uuid": "4446cd67-505a-48b2-b22d-7465cbe3b8c0", "value": "768:ytYRSjaQ9DaZ/oJlExakbMqu8iuIkvKy+h1laTm/4RsvKQLDJCgMjz:WYRSjaCu1wlPGIly+hXaq/4G3LNCgMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687161822, "uuid": "6ca26a21-2878-48a1-be74-1fce0d36215a", "value": 51380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687161822, "uuid": "dd543c8c-3982-49a1-9e35-09ed392fe59b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687161822, "uuid": "7cf00330-b87d-415e-b931-e9cfa01eaf69", "value": "botx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d864a947-0ec6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687195769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195769, "uuid": "21394235-1c40-434b-b004-4b2d56ac844d", "comment": "Malware payload (Formbook)", "value": "d295211b783d0ef3be258ab3c84eaf74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195769, "uuid": "a65a59d9-ae6a-4d22-8562-29bf1a232855", "comment": "Malware payload (Formbook)", "value": "678aa6c076f895db645c592cb306c005b685d8f8629e98da6bff6bbd9db661ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195769, "uuid": "cee91d4d-9065-4f4e-8dfc-abb2b375aad4", "comment": "Malware payload (Formbook)", "value": "33fe91592c79b63af6f15ceebfed4f9960fa73c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195769, "uuid": "b33e417c-035a-42fb-a6fd-6ecba3f8e8df", "comment": "Malware payload (Formbook)", "value": "18bec8144fe07d5f0cad4770253c6a56ccaedef30a3699b321290b9544fcba0246756565c5ad966788d3d34709a7b4cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195769, "uuid": "72fb020a-61cb-4c19-b5b2-802369ba0a7e", "value": "T14D54122D57A4C5B3E84238321D3E9F339F65E41A1890621B63E0AD5D7E36782C90DB7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195769, "uuid": "1f36d6ad-2c6c-44d4-b380-91b93077a2e8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195769, "uuid": "d3512e9c-175e-4c14-869c-f25b5d714bc3", "value": "6144:vYa6BTppMsDGDqKv/1AgOEloa62ZNwvZESHhFVlibpOfJtmLivX:vYbTpOsDGDz31AgPPfwthFVliQmL4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687195769, "uuid": "c4be0fca-9e31-46ad-8d2f-deb72e4eeb2b", "value": 293277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687195769, "uuid": "ac170ca2-f98f-4f9f-84f9-fed89741da6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195769, "uuid": "698a8b53-a995-4227-a1c2-d3495a88b9a4", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.22803.4515.12611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20df5bd-0ee8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687210415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687210415, "uuid": "54a80832-5ebc-45f1-8cb8-ce6f8aa024d0", "comment": "Malware payload", "value": "a3b504470b6019058edf10bf9424f89c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687210415, "uuid": "6116a13e-1110-4606-b059-982ae5e205be", "comment": "Malware payload", "value": "67e056d8f7e8d81f2228b6ccc2e8797042bb4803803afa1d64eb0c43eadd0a63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687210415, "uuid": "d72825ca-048b-4326-a3b0-33322e35ddac", "comment": "Malware payload", "value": "e5247c19d8eddc7affef40da64a788d1155da416", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687210415, "uuid": "61c18fb8-c890-4435-830b-42b09f1d96c1", "comment": "Malware payload", "value": "02edbd60d2379385d88d69559f9516a62df8be3a4c9295f8ed8ba374255bcf9010c3027b1cdceba304fcd7332193395a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687210415, "uuid": "ba571664-a7de-407c-87c3-e79f4849b5f7", "value": "T17DF5234152BCCC71C98A0F3FE553404889AFA9638E8AF70FB10717ED2ABA746B553593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687210415, "uuid": "4c0821af-a75c-4d9b-8555-4a71782919d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687210415, "uuid": "1c03f09f-9233-474e-90e6-86faa141db57", "value": "49152:qTTZUqYOm2TDfxU+Mcox8w+DhAiYIYUZ8DOp00T24hz5muZS3EEg4PfOIcC2tE26:glYOm2PZ6xT+VSiJtrz5hZv4PfAC2tE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687210415, "uuid": "30a68d75-7b10-4083-812f-7172a6e8b7a5", "value": 3336704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687210415, "uuid": "21d7905c-7d75-4050-9c8f-5ac32a840aa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687210415, "uuid": "e47093e8-e4c7-435f-b72e-f4c6fad4c608", "value": "wergwrgewreg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a72e8a-0e51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687145318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145318, "uuid": "9715cb33-ed76-4a70-b245-a74496fb02e1", "comment": "Malware payload (Gafgyt)", "value": "13498718e82ed00d64423a1fb4468814", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145318, "uuid": "c928a186-c036-4f71-95ef-234626539d1e", "comment": "Malware payload (Gafgyt)", "value": "680c958d2c7eb57f0925e746ac78e4e6e1dcc2ab236bf1b499710e0d58f9aba2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145318, "uuid": "349c8afc-e99f-4633-807c-c1986f769b33", "comment": "Malware payload (Gafgyt)", "value": "2f55372951024cf6b3fda481e213b454f54ff031", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145318, "uuid": "fce59ccb-dec9-40e1-8505-235aefbcd5a9", "comment": "Malware payload (Gafgyt)", "value": "5df1615252e89a620139f55872e1936a7de08aa1c81b32515b1c4259a58f519028f4210fb7c73858e4029c6b2c61fecc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145318, "uuid": "f12c17a3-6cac-48a9-ba08-7e1e12cbf30e", "value": "T1EA932B46D642C6B3C8430BB602E7EA6A4A31FD265E2A9F4AF31C7CF45B338C97115761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145318, "uuid": "60799fba-9fcb-4c6c-933a-bb40ea1f32e9", "value": "1536:gE16Es47EPOnyLf2szIYWws/1D9LC113pjYnpxbRpYWfmpiIbuiyNc2Xr+T:gEW471yLfuf/1D9M13anpxRfmpFbuiyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687145318, "uuid": "fb72e831-cc80-48b4-9396-df3ae5cc7179", "value": 97201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687145318, "uuid": "adbdb71c-44df-4fb3-87a2-fa61be58e650", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145318, "uuid": "a6ea28ff-80c7-4edf-8700-d88e4dc69997", "value": "13498718e82ed00d64423a1fb4468814", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1706c06-0e93-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687173826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173826, "uuid": "2fdb0af7-40bb-4dd7-9504-07dd68a1518b", "comment": "Malware payload (Mirai)", "value": "f3c25fe87841fb1590bc4b11cd59d9bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173826, "uuid": "4c93ffa3-5b78-4cab-aadb-655e6497705c", "comment": "Malware payload (Mirai)", "value": "681997ab2b4f39b6d4c2d2967a14f9abb6adb1ce4fadb74ba303ff0af46d8767", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173826, "uuid": "7944191f-3148-4344-b1e1-1ea36d8c2836", "comment": "Malware payload (Mirai)", "value": "e946424ee943813ddace0e177d89d5c6fe38f130", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173826, "uuid": "e6c2a1c4-28e9-4a25-8d57-e7b478531ba3", "comment": "Malware payload (Mirai)", "value": "95594a98edcd74e1cad7c4027416a9683b056a7952d8144223d5fd1f6022bc9f538091f2256eca8e63f3994fc95a4cc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173826, "uuid": "a15b97e9-294d-43cf-a1ae-ceab9837cb99", "value": "T148A3A40E7E118FADF7A9823447F74A26B65823C637E1C585D1ACEA015E6024F641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173826, "uuid": "c7743551-38e3-4b0a-b69b-1e83cdd352ed", "value": "3072:QSG4Ie3uRUZtqajU14iokV19+1tLAwbZn7yI:04ICuRUZto14iokj9YGwR7yI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687173826, "uuid": "43deb796-25dd-4c59-89cc-fc102299d973", "value": 101096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687173826, "uuid": "af38b689-f61d-469a-a0e3-0c2f76f8421a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173826, "uuid": "776526c1-4070-48c2-a3d1-6952b1d03564", "value": "f3c25fe87841fb1590bc4b11cd59d9bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124ae000-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687175250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175250, "uuid": "e1446879-225b-42e1-a211-27c7600b431f", "comment": "Malware payload (GCleaner)", "value": "8d7c79f58ed99de60755774f6b57226c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175250, "uuid": "034151e3-ce12-4e98-b1f7-5be50439dea4", "comment": "Malware payload (GCleaner)", "value": "68bc628a7d81fe62482cc6e60ebade1d504dfbf631539b0baa46db764d109e8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175250, "uuid": "ef98b3f3-e734-4cf4-914f-c556f321f823", "comment": "Malware payload (GCleaner)", "value": "e1aa956f6922e18eb560bad3d5bdfb2d0945419c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175250, "uuid": "a274a8bb-5bfa-425c-8c18-26b91bf0ee82", "comment": "Malware payload (GCleaner)", "value": "ec76b71e81af3021043786123d92ffbea068a45c26c15ce62acbca4e5b4a2d7edd7ed9d9b5dad8a0c38fc94bf9ebff46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175250, "uuid": "b23f2686-0b78-47d8-a89f-ad907a4e808c", "value": "T1DA649D5386E03D50ED259B329F2FC6E87B1EF2508F593B6911289A2F48B21F2E573351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175250, "uuid": "cb67b6a1-9cbe-4038-ad31-fa239de95e3b", "value": "0e48d5f6d89199cad77b21fdee68f524", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175250, "uuid": "6992818e-bb1f-4843-ad73-b4248a0d096b", "value": "6144:NTxv86kh3sIzzONOlpTZ8O0z1NjEPH01GVpgG/:Nh86k6IuMbTZl0zXRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175250, "uuid": "0dab8355-c8e7-433f-ba44-e877c612d93a", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175250, "uuid": "7c3f27fe-7246-496f-bba1-7805c4862b47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175250, "uuid": "a461c66c-e868-4e44-b5dc-d1f510f6335b", "value": "8d7c79f58ed99de60755774f6b57226c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05de6be3-0e81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165780, "uuid": "42cb07cd-45b2-4843-a375-35469638fa05", "comment": "Malware payload (Mirai)", "value": "8ee587fe364b4fe7990430447358803b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165780, "uuid": "baf123b2-52c7-43bd-b842-5ae84ae60480", "comment": "Malware payload (Mirai)", "value": "69646f3bea3bd32080381b0455fea998a01d85deee1f4b313081a59aac637eeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165780, "uuid": "68a1774f-17ad-4874-83fe-50a69d115e02", "comment": "Malware payload (Mirai)", "value": "93b8318b3bdb8850d47f70439af772809f1bdef6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165780, "uuid": "5de7da25-c1ab-4823-bf49-c54a786ed1a9", "comment": "Malware payload (Mirai)", "value": "31ad892c62f2e6d12516c0e16949592f0dcde9549e6e0c67940e1e80009a031cee937f78d06c929bb034cd6abbe4e5e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165780, "uuid": "b0efc5b8-942a-4446-aa77-1f5eb72eb797", "value": "T15DD2E049D2ED2985CF2D197C825D1369A944B0C0334DDDAB0B668885F7BBA86BD1F074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165780, "uuid": "280439c4-1a41-49c7-9cd2-f75181497933", "value": "768:j1uUtLrVDsAp6tLBTEKLr/eNQiuhymPh8zFJUMEJbKWUZ:jbDs06tPL6N4h36EeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165780, "uuid": "ea593b63-1732-4f82-9a82-25e468fc6fcf", "value": 30316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165780, "uuid": "161e7a15-d74f-482e-b3b3-bdf56b82159c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165780, "uuid": "bcc35495-11e2-4c13-b495-f4bb56bdde3f", "value": "8ee587fe364b4fe7990430447358803b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66253bcf-0e65-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687153916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153916, "uuid": "13de824c-6e3e-4fe7-afae-235fa44398c8", "comment": "Malware payload (Mirai)", "value": "d28233ae9b32e71c0acb5305c0cc3160", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153916, "uuid": "c2ba71f1-cda1-4d1c-a394-b671efabb5b4", "comment": "Malware payload (Mirai)", "value": "697cb99c0e0cfc005ae9cd373eff1d9de70fff94f4069a83729d9a3d4822be7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153916, "uuid": "dc09118f-4276-480a-b08a-7074f9250573", "comment": "Malware payload (Mirai)", "value": "cb4681331bd98ba73a8f826b70d990f28ae5789f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153916, "uuid": "4b5e9537-117b-407c-b57d-cd116c29ece4", "comment": "Malware payload (Mirai)", "value": "5b8c09a7eb01e3c09b3808814df10391688fe86e13a9ff9990b5f9451b35dbaf7f6b994fe9b01201a5b1f80381572d02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153916, "uuid": "1ebc3306-06d0-4b81-ad44-54eaddd7e63b", "value": "T13CC2E0A55228C472B1B45436FEBF01036736CEF8CAAF352662144734E097D26E6B5B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153916, "uuid": "26d2a7af-27f9-404e-bb3a-bb44a705aae1", "value": "384:KBH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plNCrhymdGUV:byNUQUfhQllxlaH0MFjlOnGsOs3Uoze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687153916, "uuid": "a83b6e96-1297-4b49-9bed-04022e9ddb83", "value": 27344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687153916, "uuid": "27871657-38e4-4443-b2bc-157dd312f996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153916, "uuid": "6901468a-5c9f-4468-a178-fd58c019aedd", "value": "d28233ae9b32e71c0acb5305c0cc3160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049e72a1-0e72-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687159336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159336, "uuid": "0ee095c9-f7be-4e0d-ae39-d4074b6fa3eb", "comment": "Malware payload", "value": "426158be43e4eee3d9ccfb7368d44975", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159336, "uuid": "2278faa4-aef6-414c-ae76-3fe187c945f2", "comment": "Malware payload", "value": "6a672c8f16ee8ff11efbd71b207c8d40b25b6638e0fb06f1502678987b78e2e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159336, "uuid": "8b721798-35b8-453f-a216-010f7d2b0dd6", "comment": "Malware payload", "value": "c3f5bcad9d8bbb6a6ce3f569b7efdae8411f3b91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159336, "uuid": "58692831-c8e8-47ba-9613-3907cc3faf66", "comment": "Malware payload", "value": "1a14e416acb4f6170eac7f13c447910f1bdfd46e9517fcd67afc906666f0632445b25fa4b76201b355686c5c642f8b90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159336, "uuid": "6c69a998-0ccb-40b4-bf02-a2523ce6408b", "value": "T1FAE22914B7EC8762E6EC57BD9831110003B6AB777233E75D2E8295D81A733A08A55BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159336, "uuid": "9cae8800-5759-4a12-ad78-425db6ef37a8", "value": "768:kjv/IVNsQuk2CoAzzwQ5lECwZikq0ILLLlCB9d8In:kjYVqQupAz95CCwIktiMBD8In", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687159336, "uuid": "7fd49b70-c91b-43c2-b12d-1b890f9c4e98", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687159336, "uuid": "3fd793e8-94fa-47f7-b92c-e9bbf45ac351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159336, "uuid": "bfc3b679-c66f-47e3-b6c2-571e47e9a0a9", "value": "REQUEST FOR QUOTE_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2668f99a-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687175284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175284, "uuid": "ec312cd3-eb51-4b43-8f17-2bdd782fa28d", "comment": "Malware payload (GCleaner)", "value": "90259c5d2850f7d7855be7db78629b72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175284, "uuid": "a694dc78-f83e-4954-9ec3-0ed307f702ff", "comment": "Malware payload (GCleaner)", "value": "6a8cb23bb2fd68188be4b1cfba7dd08b29455f4b4b3a57e1a8c3257efddfdfe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175284, "uuid": "fd70004b-066e-4f39-b8aa-d6fd18565bb8", "comment": "Malware payload (GCleaner)", "value": "e20767977b026113d9c434df8c2be4d110d2eccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175284, "uuid": "8e7cb9b7-3ffb-4013-814e-5d52c167e34c", "comment": "Malware payload (GCleaner)", "value": "eaa2e02c80c5407b7e4bd3f83005696474cb1da666a483a584599f825dd2a4d149167658696b677696126c270f3dfb1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175284, "uuid": "3a838d07-14a0-4ac6-8d5d-5d571614065c", "value": "T1AD74AE8396E13D65ED254B338E2FC6E87A1EF6504F183B9B22189A2F48711F2E533751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175284, "uuid": "7b599a10-076b-4ed3-801d-e2f7f247b33a", "value": "493c0587242c6f974644a1959b9764db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175284, "uuid": "254e22f4-dfb2-48fb-adf4-c37f98f6d90b", "value": "6144:AK2Xp9gTz+G9r6PYvt2DD8ULNUWrW4XaxZf:A4TzXgDYULeWy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175284, "uuid": "96869340-5ce7-4abb-83f7-019f70bf2e11", "value": 360960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175284, "uuid": "667ad8c8-6b32-4522-a58a-2e2dfccbeb94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175284, "uuid": "4b987d2b-38a2-4102-9b8a-20d5d7cdc4ff", "value": "90259c5d2850f7d7855be7db78629b72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a65ede1-0e51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687145306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145306, "uuid": "286ac818-e2e1-4fd3-b18c-9dec692227a7", "comment": "Malware payload (Gafgyt)", "value": "c190223c8c1cf16ef2ba206cf916cf02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145306, "uuid": "1285f379-b41f-4d91-a092-8d41abb2e74b", "comment": "Malware payload (Gafgyt)", "value": "6b4cdc3740dbba9652517ebdc328f912f6deb1b65d28441760646fb073a0235b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145306, "uuid": "650df889-6766-4dbb-b1d6-52af6190e183", "comment": "Malware payload (Gafgyt)", "value": "5dab33af82146cb9c4688b9c2df8c605861af829", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145306, "uuid": "fb28ac1b-30af-4c30-9889-5ce859e68b72", "comment": "Malware payload (Gafgyt)", "value": "9e49324de3d8bf1765ff494a7e7db46f49e1447bf25ab832aa62c561073f923e2bd1c0ab1418362c73e88c3ffb5c983c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145306, "uuid": "8c512930-4f5f-4bd0-b07b-021a6928a973", "value": "T1E5E3733A7E21BFBEE578863107F75F70C799299226A18342E26CF6185E7128C1C5F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145306, "uuid": "e55fb6d8-368d-4823-91ef-4b3cf7f3a84a", "value": "3072:keub5nOr7hYWM+34CTFcR3egENrrKE+ymsTM20XwHL5ENb:k/lnYHRlgwr2E+ymsTM20XwHL5ENb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687145306, "uuid": "f08898b1-285a-439e-a9b9-4b3629d46f54", "value": 153082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687145306, "uuid": "f825eae1-11cc-404c-a72b-0dc4c250037d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145306, "uuid": "d5a80650-d4ff-46f5-998a-3be9b64582f6", "value": "c190223c8c1cf16ef2ba206cf916cf02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cdd0a7-0ea5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687181344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181344, "uuid": "37b5a6ef-fb2c-41d6-b798-ad6d670b3711", "comment": "Malware payload (AgentTesla)", "value": "0e6d2843238316ac0cd35ec43030a349", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181344, "uuid": "22957cdc-f1a1-4a3d-8f1a-5016bae81f8e", "comment": "Malware payload (AgentTesla)", "value": "6bb04208cd9e4b060346473d2edfd1a6b64aa87cfbbf8e49646b3ee342b91609", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181344, "uuid": "b7ac0699-a828-4d6c-870b-823164d47b9a", "comment": "Malware payload (AgentTesla)", "value": "0382d99d1d8226e8811444b3e5beeded5c4175fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181344, "uuid": "af3eea79-ea83-4bbc-b73b-45f81275a45b", "comment": "Malware payload (AgentTesla)", "value": "adffac9de256b6ac6bfbf1cca528cda46b924b054342a1e6f000de49a30f31ab642b55589369bb7b67cd10be694e454c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181344, "uuid": "781d5a90-5156-4a64-9a9d-f22419d66baf", "value": "T11405120635180A1BC57A77F54F51B2B073FE9BCA3919E3CA1D8BB1C998D6F462610E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181344, "uuid": "ec52c982-6fc1-4370-a9cf-c7a8e2d64f4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181344, "uuid": "7e721d8a-dbe0-438c-97a9-0efef994feab", "value": "12288:1ocvG73htU7/2eQ1x9ozypYEwtk7mmSYnKvyGUiVX4it5kYltNjPLL7B2FPI:1ogG1tCueiOz2YEjLyZIOdjPLL78e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687181344, "uuid": "e5415432-222d-454d-b260-c352b72c782d", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687181344, "uuid": "b0caa183-5a2e-458d-935a-88f03b1b113d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181344, "uuid": "88a354f4-6a0e-476c-b769-2cc8a427658b", "value": "PO 2901123_Omega industry ltd_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09096e13-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687167933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167933, "uuid": "232e4b43-de8a-41bb-a8a7-21f89e1bf011", "comment": "Malware payload (GCleaner)", "value": "f97dbcbcbaf345aea014619f687fa35b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167933, "uuid": "390d3da9-3bd9-4c3f-ad8f-4ab4b4f58fd2", "comment": "Malware payload (GCleaner)", "value": "6bd5b1d7737856bf00fb0d15837b58a189a4c36b9628610e47086dd665fb2daa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167933, "uuid": "2c4056ae-44c6-4c26-b51a-dd32f2dd44a5", "comment": "Malware payload (GCleaner)", "value": "d50db55ec83cc4d7084d259f9bbb994986910594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167933, "uuid": "30be2887-42ed-47b8-9031-06022162fece", "comment": "Malware payload (GCleaner)", "value": "170e77b31fa4582bf07b45e91cc4e8e168ce6c6e9482d3f076d4cc3e9fe5e6a6761b4ca9808241e68399c9cc9e6c8840", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167933, "uuid": "3b2be911-43d8-417b-b617-082d0bffc3c6", "value": "T101646C53A2A13D60E939CE728E2FC6E8361FF5504E49BB6DD129DB1B08B11B2D273741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167933, "uuid": "996999b3-f4a0-4d9b-9ccd-449dd6a1403d", "value": "a346b9b1867290f612560daf31aace2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167933, "uuid": "77aaccbd-b71b-4e83-9d6a-37f1eda022bd", "value": "6144:H+bFtVFRFtjlaVOGfI/EeiIbbeY/7eOe+i:HoVHFZlasGfI/biSG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687167933, "uuid": "33556cb2-f50a-4c1b-9c88-5ddcb97b63bd", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687167933, "uuid": "1c3e430c-13c9-4731-a11a-50e3ce5a985c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167933, "uuid": "eebeb42a-7c08-4972-badb-c6a2e7cd9318", "value": "f97dbcbcbaf345aea014619f687fa35b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2998f0d-0ebf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687192806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192806, "uuid": "a185baed-f6a4-479b-95ec-f20c15cdbca6", "comment": "Malware payload (Amadey)", "value": "5ee0717be491e47a97affc5d4bc8d206", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192806, "uuid": "81ce6f07-40b6-41b1-bf75-3f5c524d79b8", "comment": "Malware payload (Amadey)", "value": "6c2823c8c32e25f2bd3b363460fd2a45e49da6bb683c9de58f1ba30fb71812f9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192806, "uuid": "53cc2986-8cda-4cf8-b58b-7f0cc4376ba9", "comment": "Malware payload (Amadey)", "value": "75517f884aa0939945d50181a9116b33afd7b053", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192806, "uuid": "29807b12-1457-441e-92bd-7c3084638b23", "comment": "Malware payload (Amadey)", "value": "993ca2ad719be22b02a66991cf4f2544c1576448d4537ec65f87ddec38f0f1f24e4e0f4d61f4ba9390c5f5af546802c1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192806, "uuid": "142d64b2-c0f3-48a9-9e45-e2c04a2371b5", "value": "T10543F3E30D44AAE877D55B2EF6ACA53937A12DB7143BEB546092D91F1312400C8EECF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192806, "uuid": "d6e0fe0f-6820-47ba-a9f5-723ba63e343a", "value": "768:jaaYhlmBrbO/HdofLAH7HkRYoYfDt5ELy6NpjdkhYVd9:jv0lmZO/9oTWEKoYfDt5EWaZykd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687192806, "uuid": "4b59806b-7dd2-4b3d-8923-1933177094ce", "value": 57427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687192806, "uuid": "ed65248c-ffbe-4bec-838a-3c622fc4ab96", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192806, "uuid": "e3a188ed-11e0-4c33-8705-3210b96d754c", "value": "thomas.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab99d836-0e60-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687151885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151885, "uuid": "734ada31-44c3-42b7-b1ba-76c7baffec09", "comment": "Malware payload (AgentTesla)", "value": "06dd0006f90093d4f7aa7872c6260034", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151885, "uuid": "d2f04649-25d0-4495-8aab-56b269778ad6", "comment": "Malware payload (AgentTesla)", "value": "6c4676eaa49ff4a328c146d4420937dd3ab8e065f18dc16eb8f92ec1702c5e05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151885, "uuid": "7e205163-d4bb-42ab-ac61-8fd2ad39e980", "comment": "Malware payload (AgentTesla)", "value": "8dd64d964938b5664815fed469f2704feae7bf2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151885, "uuid": "a490b0ea-69e2-47a8-8869-2a3833e7c1f3", "comment": "Malware payload (AgentTesla)", "value": "714ff894ed2707218b42e41089cd670f70ba7c65cb9252e38b3d2c39167a8f2064a8c8b7ee93ce91d4d96a294c8bdfe3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151885, "uuid": "36aa1d85-3b5a-4a23-84c5-b00f0b887dc6", "value": "T1B7D42323C5B853185873835C07FCB256AEE30796B5B7A0AB9B0B365714272D07AB49E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151885, "uuid": "212fb1ea-6c0f-4ad5-a8f9-4e7cea9bf9c1", "value": "12288:5iKF4Ve2GaEFmvwV8jvt8DS7GSReg6VXAU7BwdOBKktKVatQifo9niBw:R4VxU2tUGRd6lmsBZtCa0iBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687151885, "uuid": "68fb4790-3844-4008-8c79-976807b427ba", "value": 625600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687151885, "uuid": "df60b3a9-76b5-4196-99f1-20ad93b80ae4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151885, "uuid": "76e21848-7df9-4828-8548-48c67c048e2e", "value": "RFQ-1579.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ac09ca-0ebf-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687192597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192597, "uuid": "3c69537c-0452-412c-bc1b-579782cc5451", "comment": "Malware payload", "value": "e06d0fd1f0556326d0fdf41d13f4aa3a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192597, "uuid": "7049bea5-19ff-423f-9857-fa45aed63070", "comment": "Malware payload", "value": "6def6cfb9bbe33db9f0077a336ef1f8d90047bbc8a321f8ad6abfbef2d2da176", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192597, "uuid": "7b9b88f6-bc8f-4556-99e5-afc4aa4cd469", "comment": "Malware payload", "value": "bbd91710b9b4150929dde74b2183433f6c938930", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192597, "uuid": "4cd50e66-bd84-4136-b0bd-8222d3cbb9d8", "comment": "Malware payload", "value": "d309e5c09cf3419dd3fdc53d0967db3656e533bfd5c8941bbc097101da1fb92c16be1f08ef42e36731adb2044d86b2d0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192597, "uuid": "102054b8-2fa4-4db7-87dc-6e8d18eb1d74", "value": "T1AC73E10277FA5644F1F32BAE557A60A50B3BBB645A39C25C016CA90D2BF3D408CA5F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192597, "uuid": "4205c0d4-895a-4842-a45a-5f39257f63a3", "value": "1536:44b5X/AkV+4VPJv69u6uRSqFBeWp5QZ4b5X/AkV+4VPJv69u6uRSqFBeWpg:44b5PAkV+4VBi9u6uRSqFBeWp5QZ4b5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687192597, "uuid": "18919aeb-e3b5-4717-a37c-dbf5315a9658", "value": 80650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687192597, "uuid": "ac508203-a321-4053-9c02-e05aab700ca4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192597, "uuid": "d9ee8a77-38b2-4ab5-ba67-d42a4cac97ea", "value": "Comprovante677677.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683d48f4-0e70-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687158644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158644, "uuid": "68a3f5a1-a28c-4853-8fd2-c27e53b126aa", "comment": "Malware payload (AgentTesla)", "value": "05276639850b2842fe77365f002ba312", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158644, "uuid": "5f11dca6-e96b-4c42-80d6-379005bed044", "comment": "Malware payload (AgentTesla)", "value": "6e41de3cfe2a499488f1eae60dc1ba0f35f0e86c2428271e78bc8ddb51e26d0c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158644, "uuid": "4d223e36-51b1-4248-af32-66d88f68ad3c", "comment": "Malware payload (AgentTesla)", "value": "1f51af2c0de67e8d6db342048ef7efb5b81d4212", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158644, "uuid": "76a5bca7-1f3e-40de-a7c2-e6608caec341", "comment": "Malware payload (AgentTesla)", "value": "bde43877e492ef0aee9fc65f96aa17f929a755379baecfd8c9010e4c44b597491a6f3504a988cf3464a3dc26f89015c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158644, "uuid": "d452faaf-035f-431c-96b6-1e1f7d396420", "value": "T194F4124838648643D8BE57FC46A53AB3177E5BA93827E7C91CA3B0C8FDE0B451A10787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158644, "uuid": "f4ef32d3-d3ae-46df-92ac-dce04a4a73ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158644, "uuid": "6f20133c-ee12-4b5a-a9a9-6d5e7001a80b", "value": "12288:/ntYq7J3At5iHOq+ZQ44kvGZe6n5WeYtbQobJYvbV4Q+Y3Qd6sCRjhGZbSsMKsm:/tYqtm8OqKt42GZe6y1wVD+pd6PRjhQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687158644, "uuid": "9ed31d5c-40d3-40c4-baea-690c790ee081", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687158644, "uuid": "9ee88d2e-8c88-4d09-9184-895634981aeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158644, "uuid": "2be3427f-966a-4723-904a-392e668b508a", "value": "JQ234102474.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d857a456-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687160550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160550, "uuid": "784a94cf-3253-4864-a515-cc3eb2ee7854", "comment": "Malware payload (AgentTesla)", "value": "07b835a7025fd999216fd49634d5aa44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160550, "uuid": "bf46cb27-bb49-4d72-9c77-5d5ccdcf25d3", "comment": "Malware payload (AgentTesla)", "value": "6e55ebd8042f6fdfd619a858843ec888a56a7be49c720c50410bdb719099256c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160550, "uuid": "d7055a14-811a-4c7a-84d8-88b7a806e4fe", "comment": "Malware payload (AgentTesla)", "value": "f3d6cd8773d1fe43eb313d67c7986af005e2907c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160550, "uuid": "bcd2c859-6956-463c-ba37-4f646b36481a", "comment": "Malware payload (AgentTesla)", "value": "8f65437bff74d914c227f8903399d9f767ae79d1a4fc62231af5cbb5f88a45e98d58e6bbce7623c6f2af9cdac8109b20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160550, "uuid": "0d50b128-5832-41d8-91cd-f653881e3c79", "value": "T127F41288386A1A57D8BF4FB845A0337113BF5FB63513FB985C93B8D9A8A4F811921353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160550, "uuid": "40c42e37-64e5-4211-9666-2703112db1f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160550, "uuid": "d82c6445-aff6-44f7-af73-dd6fbcceec10", "value": "12288:3XtYq7J3At5iHOq+ZQKz2Hcxp1pm5y+URVMyIB3zA9/m1LtlSmZB7ap6Mc0:39Yqtm8OqKcEpOs+mVMBFc0ZTGc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160550, "uuid": "f1960ef6-ced3-47dd-91bf-d2e87d683800", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160550, "uuid": "5e9e7d4c-0cb6-4d8d-8b1a-c677b6b050f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160550, "uuid": "68650326-c759-4d8a-8e57-bbc50d024108", "value": "DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea2808a-0ea8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687182626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182626, "uuid": "8417d7a2-7906-4115-8e0c-fed3f5a255f2", "comment": "Malware payload (RedLineStealer)", "value": "99aa44bb194a176a4f351e8e13aad500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182626, "uuid": "23090761-bc31-4ca2-99e3-ff04628bbdde", "comment": "Malware payload (RedLineStealer)", "value": "6e5e27bc92b93de549b7aa49c8121317d0a69d8c9656c7654ddd224b3aa88dd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182626, "uuid": "64cf1bad-9256-4af8-afad-3f5983279afa", "comment": "Malware payload (RedLineStealer)", "value": "2ca7ed101793fe00147a01ef598b07c66c36caa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182626, "uuid": "1c68c58e-bd08-4bc5-b135-374976494f51", "comment": "Malware payload (RedLineStealer)", "value": "779528ac90c8e0a1852cefc6f7e5722e2c0cea1857a560c665ec2e88545d742fe99942434abab179a71acdcd98a4c76b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182626, "uuid": "4ec32e1e-b146-46bc-8ec0-ce7ab8e65210", "value": "T133543B0FB6C50336E471103D27B02956EDEDBC910D34EDB73A6CC329156ABE2A9690DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182626, "uuid": "1453560a-91de-4d9f-b5d7-02f68b73f1bf", "value": "d91fa928c738702455bfa66ac3685503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182626, "uuid": "45088ae5-5a3a-4e72-a704-5e231bea6ba9", "value": "6144:gi5YdP2mQVNQ0FKHgKNRBH13TLxNP9T0x+SRMJ:vYd4LQzgMLxNFYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687182626, "uuid": "472f4d12-d1a1-4352-bb29-e0263a869d76", "value": 279557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687182626, "uuid": "da594ff0-1900-44c0-ab6a-041db4552de5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182626, "uuid": "20cda5eb-7ead-4c29-b57d-f162c75767d6", "value": "99aa44bb194a176a4f351e8e13aad500.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617f1523-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687174094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174094, "uuid": "8337b4f0-03b9-40ab-9505-94c25dfa229e", "comment": "Malware payload (GCleaner)", "value": "5b0ec48e715eed7c00ef7801a1d18b85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174094, "uuid": "717dcc5f-d7f1-4939-8655-4cff9c9418e2", "comment": "Malware payload (GCleaner)", "value": "6ef3cb86624f365a270577001d0845baa4d89cdfb74909e933359047fa55dc6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174094, "uuid": "fc0f1dc1-1b42-47ef-b3ed-e28febbb6157", "comment": "Malware payload (GCleaner)", "value": "9198c8febfc833bc2a30c9ca2c5f9ab8d1c81162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174094, "uuid": "60f48aa6-d250-460d-a473-dd6b235f7bfb", "comment": "Malware payload (GCleaner)", "value": "1bd439f1d4a666ba85042d81b7d71d0b285b978afab035816f8e7bf2d47c7d6c8d410944dceff97a1e59d89979e6a2df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174094, "uuid": "0d0b36b6-d3c8-426c-b70f-249e6ee79579", "value": "T1DFE502416902B914C6610E7DADA9C470A3261C170F38855CAED0BF67B77F8BAFD0A17E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174094, "uuid": "03e9bc78-d136-4ed1-8eb1-970935775152", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174094, "uuid": "59be0af1-45d4-4251-83c3-e2fb7dad4e70", "value": "98304:Ba5hlWD8lnCw4KVFIPsi+C8gIFEdtADIyCT:mhlWD85PUugIFEzAKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174094, "uuid": "b639afcf-7d26-4204-a1d5-ba2589be79c4", "value": 3151604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174094, "uuid": "9db41941-c00b-4c4c-9466-c424828b44d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174094, "uuid": "7ce5ad6e-928d-491c-8908-da9ac7973ae0", "value": "5b0ec48e715eed7c00ef7801a1d18b85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d522383-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687175376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175376, "uuid": "8ad9981c-b8ee-4817-961b-525456d78a47", "comment": "Malware payload (Loki)", "value": "78c56c6fd7ed0ff5c69ec132d61e27b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175376, "uuid": "eb66dca8-5924-46c8-8396-cf72b5961ece", "comment": "Malware payload (Loki)", "value": "6fac7a1f4443bf70639465110324881bdf63d2bb86e1a4397dd72a25fa1364a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175376, "uuid": "685877f6-1e3d-4479-ba40-6d4615d3cd24", "comment": "Malware payload (Loki)", "value": "74a6d0f1b2439cff590d63922f4c3f442f39ab10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175376, "uuid": "15ddc1e2-093c-416d-aff2-94b2add27558", "comment": "Malware payload (Loki)", "value": "8b6a73f5cd18442508976603802b2ea4f12e7eca03b0d5fe64653e49f125b7050d3169b7fda5f1e61349a377d859305c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175376, "uuid": "cafeaeac-57e2-4b3a-a474-b9075608f028", "value": "T12C94CF12CB3C5D07DC1465B5AC7796B3ABA49D344A7C594371EAEC3BF828272AE0D10E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175376, "uuid": "1281ac76-209f-4f71-8ea9-6de453706978", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175376, "uuid": "804138ec-e5b1-480a-8224-9fbf87e667e6", "value": "12288:vqugI2VOoo9QTB8gw2JL8xjiUinElye4HbFTt:Cr3Ooo618faCj3inzhTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175376, "uuid": "00da4ee4-5c1d-43a3-80a3-c0bc5c11ea87", "value": 424726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175376, "uuid": "ff0837f8-b9e0-4c44-b248-750dabcae105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175376, "uuid": "f7c8e305-6ea9-458d-8f7a-16d7c3cc3b7a", "value": "78c56c6fd7ed0ff5c69ec132d61e27b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07af285f-0e7b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687163206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163206, "uuid": "86c94be8-b8f8-43b4-bd00-f012caa095ee", "comment": "Malware payload", "value": "d70a24f62e13b0cef702fb029f27acc6", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163206, "uuid": "36c73fde-de3d-47af-bd1b-83a473526929", "comment": "Malware payload", "value": "6fb437b6e7298f1a2e34213fe895ab36f47c788e20ba8d320b396c83daefffbe", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163206, "uuid": "1f9b7da3-525e-41c2-9c1b-1913fbe04fb7", "comment": "Malware payload", "value": "61bd2539c06797783b54783f840ced97eb7478da", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163206, "uuid": "28f55052-57ac-4bf1-aba3-820dbcfdf987", "comment": "Malware payload", "value": "d66ae77a823b7da64b16f1ca6689e1db52b0af9564d092beaf14a3979011981e8f205edd1e41b54dfe72b3ac44273dcb", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163206, "uuid": "12c8f038-1a0d-4c37-9974-43844ef1ab41", "value": "T14805D5CE5D5C08EAC5666DFB85120636D26F3C0C2310CA5B97E0B3C52EFB59D8637AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163206, "uuid": "719eacba-0225-4b21-a1ce-b99d70fc1ffa", "value": "12288:kmnlGy57lYDzJBZhR8EyokybvnzgWkpgvgU/hvLYVxlFa1o3:HEEYxBPR3yJybvn0WPIUZvUVxlc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687163206, "uuid": "c3c26d18-fec3-48db-b49b-3cef8e1d3855", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687163206, "uuid": "a5d7dfe2-3064-43e6-98c3-144725f30618", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163206, "uuid": "7704a467-fa15-4dbb-adcd-fa447f36a8b3", "value": "ada.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308b00eb-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165422, "uuid": "34b15e0c-9169-477b-94f6-bbd1334bfc3d", "comment": "Malware payload (Mirai)", "value": "e1fa000cfffd1f664d0c674cb60b2eae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165422, "uuid": "33bef2de-64a7-4167-b02d-88e22cee9ce3", "comment": "Malware payload (Mirai)", "value": "6ffa5527bfcb62ea79c570bea0914846a50706245ba89014005e1e10ef64c623", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165422, "uuid": "05bb265e-6e44-4d87-89a8-9381143f135e", "comment": "Malware payload (Mirai)", "value": "d0df0141bdfe2a1467441fcef8f131b41617a3d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165422, "uuid": "ca740025-da39-428a-8f1d-7d1eefb77350", "comment": "Malware payload (Mirai)", "value": "80b24fd26863d799d6df5b6e21dd75001e5dba1f12f394cf30e69932b2fb4b52b92801471631a0936782a1e90aa3fe53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165422, "uuid": "81f08969-0467-4121-81b7-78bcfb4a77c0", "value": "T18B233A35BA761F17C0D168B521FB4B6876F146CE26A8CA4E3DB20D9EFF618406503AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165422, "uuid": "60e5c8cd-b524-458b-8b1a-5a7480f9c92f", "value": "768:3BoBCKHvxxNDs+trBy1ZBpUP7X8slI4AQjqO++PWuVOw9:3B8zHvxnjrBy1/pUPT8sdAQj4+uq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165422, "uuid": "0ffe25d9-84e2-40d2-a819-93904a219a9d", "value": 48848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165422, "uuid": "5a30e334-e39d-430a-8e02-0197145a244a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165422, "uuid": "6170a508-a4ac-495f-8a41-3e8612612a71", "value": "e1fa000cfffd1f664d0c674cb60b2eae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1554cb7b-0ea9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687182986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182986, "uuid": "a05a438b-031a-4993-876b-9b224f7503e6", "comment": "Malware payload (AgentTesla)", "value": "6d9e1fcd9ae45d233550f73342574664", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182986, "uuid": "2d832bc9-4c5a-4ae1-b0f0-0b5db743e4ef", "comment": "Malware payload (AgentTesla)", "value": "70a0259f530136555c14fbd2b93b36e5fbdf2cc55c8bbd7ecc2de5dffb5c1f10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182986, "uuid": "fe81c847-df98-4f89-9eb8-51b2d0d736b4", "comment": "Malware payload (AgentTesla)", "value": "ec2cac21ab2d97c5f1cd0c3173f0eb26dc4accca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182986, "uuid": "70db7c91-d2ed-4aa9-bf9d-61b02878f2c5", "comment": "Malware payload (AgentTesla)", "value": "4893bbaf7793db887ad5da0b6fa904f605e7bcfa664d7cc72c89834bc72cfcfb1b44d59374c2005d5d65fbcc1d36688c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182986, "uuid": "ba0691d3-d4e6-4c33-ad89-ce38e9783b52", "value": "T14DF433A47788F47FF66CE760124A741D4615D13B8C02BEE34E61A3D1C3214C5EE2E6AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182986, "uuid": "a6db404b-cfbc-4c30-beeb-0c79de7a8000", "value": "12288:LML7nvXmvq+xOUP6DcmNacf7Hb/eee+heUPRRvX3b94YeOzrYOGsfG/nj5+:SmvqKP6DcmIcf/5e+RvvnJxxzrYI+vjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687182986, "uuid": "8d52ebc4-c7b3-4bfb-960e-b3f35687de13", "value": 748011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687182986, "uuid": "0201c1d0-78ba-456e-9b60-67bcd852ea41", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182986, "uuid": "3ed143d7-54ea-4a26-ad1b-a591e713b809", "value": "cotizaci\u00f3n.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880265f2-0ee6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687209378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687209378, "uuid": "67af5680-2bf8-45d4-8f48-1f947610e07d", "comment": "Malware payload (AgentTesla)", "value": "c24e64b4df2bc6e4bce1ec5d7dc081cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687209378, "uuid": "4dc127cc-0932-4acc-8ee4-26f4992263d6", "comment": "Malware payload (AgentTesla)", "value": "720be830d608d17de8f83bde1fd7a90db5bd75ebad8fbe10d60ea4bd1fa9f760", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687209378, "uuid": "3c315098-ea3d-419a-9136-5f1299b2ef76", "comment": "Malware payload (AgentTesla)", "value": "c66ef29f4b47945687f9ecf63b754ebcae36e673", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687209378, "uuid": "4c2ee218-58b9-4a3c-82a5-90e92b4ee80d", "comment": "Malware payload (AgentTesla)", "value": "d5bbc9c81b512d11c56a09a762ad96135b98410daa8c6d3ea21470630f302f2c3e78ce8369d5ed7f84dfbc913e7e9f06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687209378, "uuid": "e50f1000-7807-4d16-bcdb-8e38d4da3f0e", "value": "T1EB05E09C360072DFC55BCA75DA582D34EA64B9B7670FD207A85322ECAD0D69B9F100F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687209378, "uuid": "8520cd2d-eead-443b-9fe6-b335d5da5465", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687209378, "uuid": "76f19ed8-3100-48a5-8107-203d1c2290ab", "value": "12288:eZcMe9OFZDmyNO2uKSu/ifMEyn3cErWB0WF7oN2AkPoLBtYq7J3At5iHOq+ZQ0e9:ke9OFZDXcu/MMEA3MGwA5Yqtm8OqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687209378, "uuid": "5331f353-d4b3-4395-8d1e-e3b221101cec", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687209378, "uuid": "55179d90-b996-4286-bb83-df0f06b52a06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687209378, "uuid": "38826e26-47a4-4bac-b9c8-09b7b442f9cb", "value": "CTM REQUEST BIRTHSHIP..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7a1d4b-0ecd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687198832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198832, "uuid": "925272c1-4e75-455f-aa31-9806e1090d4c", "comment": "Malware payload (RedLineStealer)", "value": "004c237bb3671c85b6982f7436274dbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198832, "uuid": "3f22d1b7-b175-4396-a407-bd25407d2679", "comment": "Malware payload (RedLineStealer)", "value": "7233015fc17883e2b8d9cdfae497cc88f61045be329736360dcf911f8054401a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198832, "uuid": "fef41ab7-de3f-4db2-a15c-59a7a3d2911c", "comment": "Malware payload (RedLineStealer)", "value": "3c98800fee98c1797d0b17e2ff693dd993624b74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198832, "uuid": "498d32bd-e1e5-47f3-b550-a108daaa5b8a", "comment": "Malware payload (RedLineStealer)", "value": "76da81e1f1b8443d25658a335d98578f9caa1bb0c6119bac6f07931ff15fe4cd22507557c7256457d351f340a7fddf10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198832, "uuid": "63b78552-9ff1-4a78-bf57-d694719305bb", "value": "T159E41242ABD85023D4B11B7029FB03571B3ABDA1993C436B374A986F0D721D8EA7536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198832, "uuid": "8a7f83eb-4e45-4da6-9713-ba4985013a5b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198832, "uuid": "2f2e1977-582b-4357-ab4a-dae20d99aec6", "value": "12288:MMrRy90EDaoWwGP10PvY99mi7H86xDwPecFdArFHlRVrf8J:lyHXWw0T7HxxDwPecFd+FHlRVTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198832, "uuid": "6f0f04b4-a061-4c16-a3a1-c53fdf0ff192", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198832, "uuid": "4571fada-7576-45e1-b5c0-48def72f8d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198832, "uuid": "0d89d3b1-6c02-4e3a-b1b9-9a23fcf802c9", "value": "004c237bb3671c85b6982f7436274dbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ace1f44-0e79-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162406, "uuid": "b6068f2a-72ff-4650-821f-3dc1cf555a22", "comment": "Malware payload (Mirai)", "value": "99fd5149677c7cd4290e5e83655b717a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162406, "uuid": "96d240d1-841b-4929-9384-403342feee34", "comment": "Malware payload (Mirai)", "value": "732e8daca7e84a277a4cf9eb2de029b6298f0801fa8f8cfdb6484c781c760bab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162406, "uuid": "cb844415-dea6-4b2c-85fc-fd990fb3a397", "comment": "Malware payload (Mirai)", "value": "befcd5bd4fd04a74448f47d0ededcd5d23f65612", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162406, "uuid": "26050448-1e0c-4e87-8c1e-2097d97713c1", "comment": "Malware payload (Mirai)", "value": "53638a21b2bd181877b7c5a23853ed7ee52175b1f879a4233729cbd02e9044061092d64042077b078dece5b90d056836", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162406, "uuid": "c78fc701-75a6-410b-a59d-27b246e93bbb", "value": "T1061308C4F553D9F0EC5A06703076EB365E35F1FA222DE553D3A5DA32BC82602EA0699C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162406, "uuid": "77f0daef-df77-4a3a-b818-a6fb2647e6c8", "value": "768:xMlB2zs8ssGfrRI6aQ2nEenzzq8uDOycN95VlVs:YYzs8ssGfrRI6aVnEeXWOrNrVla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162406, "uuid": "fbaaef1b-8a23-4625-8b3e-0970bc7e1fa3", "value": 41776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162406, "uuid": "11693c01-0a28-4f47-8703-63a0e40370bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162406, "uuid": "b278ccc2-a82e-48ee-bc88-5e2c79f54d64", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a6c1b9-0e37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687134391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134391, "uuid": "c7a3219f-57ca-43b7-b391-67ae0ccd34af", "comment": "Malware payload (Amadey)", "value": "de54b6558cde4619027dcf458aecb1d8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134391, "uuid": "e73ded90-3ebf-4669-bb75-90cf2e9fe32d", "comment": "Malware payload (Amadey)", "value": "739ef5fbfd92fd4c257ac98794c66bc43489216efc3f1d18511fa04708ccc561", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134391, "uuid": "f8a54fd1-1331-4c6a-bdbc-088503ee40c9", "comment": "Malware payload (Amadey)", "value": "075a55c48a38c911ce7df842075f1a25eb2ffdd3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134391, "uuid": "f3deebaa-0ae9-41e9-9d5e-38444a82dd2b", "comment": "Malware payload (Amadey)", "value": "4b29fd1034aa4da42332c8e93581231d07a2b468bcc20a40c85e25581288e70cb33802a2d89ae0ae49f0a8ac22b0aece", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134391, "uuid": "2c695c52-a3d4-4e0a-bfc3-0dd9bf9c31b3", "value": "T123C40243BED88532E4B51BB189FA16C31F35BCA25D78536F6296588B1CB22D0A13533F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134391, "uuid": "bc74ef28-0520-4108-92e7-91e30063bd28", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134391, "uuid": "762af525-526d-4637-9bbd-212923383167", "value": "12288:kMr8y90RMo3dnnIItyJFZ0f/WG9KS5YDuH+E6ji0+LrDwcIRh+:gy0Mo3WLJ0f/Wu1KDNt14rD8Ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687134391, "uuid": "f377fd9a-8b6b-48e5-9ee4-910e74b7aaee", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687134391, "uuid": "89f92d39-d920-4f5a-ad27-6c5a6513b837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134391, "uuid": "f7d53b76-95d5-4cc9-9f4f-e233db038258", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0cfcf9-0e70-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687158600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158600, "uuid": "4b5dbd6b-d616-4510-ad8e-f69013bb6c5b", "comment": "Malware payload (RemcosRAT)", "value": "e62b2af6a788ede29ceb8fe81e095dcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158600, "uuid": "29ce41ad-cc94-4e4a-a6a0-ae2021b06e1d", "comment": "Malware payload (RemcosRAT)", "value": "73eccdff40fdb6e75a49bde3dc11d35057b51a5566130ce312a5bfb100417fca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158600, "uuid": "34a154e7-9705-435b-be98-9ed6b30747c0", "comment": "Malware payload (RemcosRAT)", "value": "50c0b77bc337f80ef0a12e4f83190d72b7e590eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158600, "uuid": "0a2b8628-f0e4-4a0e-a71b-49b4b06d1ef5", "comment": "Malware payload (RemcosRAT)", "value": "65144e4a1e34e81d65dbe1a25b745a5a32606d52943a6f605126e29b0dc3e9fb2f21cabf212563b8bd236f5e25dc98f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158600, "uuid": "0980e79c-b79d-482b-b88b-8ad5771f8958", "value": "T1BFA4BEC0F55085CAD4FC0A737D8A72253AF07E58E5B0263B5296329AB7F32D12A1FD49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158600, "uuid": "c5585244-3ca9-4a52-969a-56a30c7cce33", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158600, "uuid": "3ecaf00b-2c74-4ed8-bc9a-3a6e2bd40b76", "value": "6144:/VGdx6xeUgDBLCPGmI1pWQrOswRpkYSKobMAQDbZQfAo73WjC6UsQvA0GXJ1wtiz:tML+GtpWQ+SYVohEQfAm3qB+x8K33c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687158600, "uuid": "dfae7805-1b5a-456b-85bd-11be4dca4c78", "value": 489680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687158600, "uuid": "b3097222-b279-4b9e-b8f8-9a63daaa193e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158600, "uuid": "7830c9c7-e314-4d58-bc4c-554bfb710340", "value": "INVOICE DT.$25,000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e3c689-0ec1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687193651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193651, "uuid": "13777d18-df40-440a-9499-9f7e9514e1f0", "comment": "Malware payload (AgentTesla)", "value": "d2dc5fb25a4861242df613b6ed6e48bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193651, "uuid": "b25a13bd-1936-439d-b7ad-7d11cc48acd3", "comment": "Malware payload (AgentTesla)", "value": "7474c59e2ced7b554bc03a190b33690f640a8f415b38fe21e2caa0a7a33215c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193651, "uuid": "64420bd6-2ea9-4b0c-abcb-68df445b4827", "comment": "Malware payload (AgentTesla)", "value": "0def6082281daf52858e76a79ac31bb4da08e87e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193651, "uuid": "94b2a091-750e-474d-ae25-206877e9947e", "comment": "Malware payload (AgentTesla)", "value": "b7b7e119954784ecbe36ea1ac62e2675b2c6f9debfded5349accbdc0a2c832aec1c8049cb83e3ff43ad63d1bcf39e43d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193651, "uuid": "8eb01b89-6ea7-451b-a457-92fbdb719cb7", "value": "T17D545602A7FE1549F2F37A056E7A50A94F37BDA16939C94C408C1A0E0BF3E548D65BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193651, "uuid": "bdcb64de-2aa5-4c58-b250-a880aa12c142", "value": "3072:fmdNpoy/kxxI6CWWaWxKWWW4QCWRWtad4Vt5n5W5XNsn1W7HLDVZdMxzakYTIvsV:nNnWBMxzakm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193651, "uuid": "9a7591a2-1c0f-4156-82ba-46762b2b0404", "value": 296946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193651, "uuid": "31b2518b-0416-458d-9363-60477322cb12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193651, "uuid": "aa01769f-9b09-41f2-856a-647d661d07fa", "value": "12Vbs Online.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fb8890-0e8f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687172028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172028, "uuid": "8759a9ae-baba-43dc-8b81-eb060cb07140", "comment": "Malware payload", "value": "be3d6f6b64761699dcfe058a9ecc2dcc", "object_relation": "md5", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172028, "uuid": "b388331e-2ba9-407b-af77-56868746b69c", "comment": "Malware payload", "value": "74a3e7e6b4847394bc961d6e34c816a9ea2ecfe570d4e28bd555557c62dd380b", "object_relation": "sha256", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172028, "uuid": "e7bef364-64da-4a30-80d3-347d2bbbb6bd", "comment": "Malware payload", "value": "d824d699d5c1f2c48213e15a8f72c7edf6ff8309", "object_relation": "sha1", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172028, "uuid": "2f6b83d5-956e-483a-af5c-5c5c93acb701", "comment": "Malware payload", "value": "4bc3c64687b92b3ea79094954454ed54a0c49b4845283391fe7a79b3bcd9afbf657e0f4978639bfdc08992b088929466", "object_relation": "sha3-384", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172028, "uuid": "d8542f11-473c-4a2f-ae18-b89b59c9d991", "value": "T1A7F42325410214F1EFBB502D58AE29CB9DB636891BEBE1A0FD3C483D8ED654327DE58C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172028, "uuid": "0da94bb2-b6cb-4f6c-a452-3630995da964", "value": "12288:EEQw7AVkA1CrNLhOEbt673fDIasQuldqK/CZCnMyUj6RxdVcLWQt4jB9/1:EEqVkAUJhb073fNUdpapj2xdVcLWe4jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687172028, "uuid": "1ada0662-eb83-49aa-bc3c-8897930f536a", "value": 730034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687172028, "uuid": "818fe148-2618-4f38-9d71-fee4ddc3ea2f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172028, "uuid": "843882eb-567b-498a-aa4e-a4a3604657a6", "value": "GoogleAI Setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb6b261-0e7a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162896, "uuid": "54ece9cb-eb12-4f00-a2e1-1ae3db8131e8", "comment": "Malware payload (Mirai)", "value": "3a898b956adadb0d3acd990fd306ac8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162896, "uuid": "36a723bd-0a30-4474-8f0d-9d4d964e7ae5", "comment": "Malware payload (Mirai)", "value": "74e12e7b64bc044380d515b506fd8c873e237eecf1f0b27d48a790f43a433a73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162896, "uuid": "b18a7573-f8a4-4c11-8b5c-bf0f8d353f24", "comment": "Malware payload (Mirai)", "value": "a3f71ead33cc5890837e611361b9b4babc030daa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162896, "uuid": "58e6fae2-226a-47df-8d89-469ba495f57f", "comment": "Malware payload (Mirai)", "value": "dbf9ecdd14085c80be7fcb4b692f1213cd0edd0bf4fb54de779b760b4d63c8a677a1714971d1106e03829406b47b0dc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162896, "uuid": "59c71372-34cc-47f9-b47d-7fec2c7bb7c0", "value": "T136338EB5E42A5E90C15602746428DF345F23A6C4E3436EF60795C3E24497BADBA0EFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162896, "uuid": "b3ac2663-7789-4332-8fc0-10b916f67463", "value": "1536:Nak4Fo5dNwX4Eupn0IK5hkCCS0ob+10m0:Nr4mRk0n0IK5hkCFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162896, "uuid": "6eb8dff4-c7b9-45ad-b3a7-ad84c399cf55", "value": 51588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162896, "uuid": "22a920ee-6856-4537-bb93-9a1e15e884e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162896, "uuid": "b298b4c9-1914-4620-89db-a2d708327b6e", "value": "3a898b956adadb0d3acd990fd306ac8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98324f0-0ee8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687210373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687210373, "uuid": "23fe019f-0cf0-4518-b5de-11f8c5802628", "comment": "Malware payload", "value": "c1db46240a7a82f6f7d36e8c66b6158e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687210373, "uuid": "90d22658-edba-4583-84b4-916a39e252d4", "comment": "Malware payload", "value": "74e4b425d0d1ad36e8c3fdbd874857e4ba9bd6e3721e3cffe83947e353446ee3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687210373, "uuid": "27fc3cca-e162-4c11-9f9f-25f1ee4af4eb", "comment": "Malware payload", "value": "d5ecc30c52e8f1bb9a88f0bcf9910ec73d1f7979", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687210373, "uuid": "3f53bad5-2724-4ab0-ba9d-c9ff542668fb", "comment": "Malware payload", "value": "c8fac4ca6f831334eee5928b272289d287289f56f2bbcae118273ba22fc5896c2af2d82391ecd831d301c1edc14e56ad", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687210373, "uuid": "7f0bec62-5ccb-44a1-8b8c-b20bea0f6334", "value": "T1CF24011EFDAB76FDD04BD932108D8136E40E126C9486B26F62FC15A90CF5C660B47EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687210373, "uuid": "f0a3638f-fe73-4447-baae-e3d876d13df2", "value": "3072:E5RrQ3m9lTKMZYJWBn+wjS6qC2UeourJ1PP+mkZE67tqlTA5h3CDEPdrKi4WcC0A:eRSMKMKwBTDqCSzH+mYol+vr+Wp04TwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687210373, "uuid": "c48cf9df-41ff-4b4a-97ff-def54472dd84", "value": 223881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687210373, "uuid": "0bf32ded-ca7d-4973-adbb-b5fb2f7e8a22", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687210373, "uuid": "319ac15e-dbaf-4cb9-b5b1-5d799a9393e8", "value": "Final Payment Invoice.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfcc87ec-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687168266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168266, "uuid": "898e5bcc-3909-48d7-92bd-6c81b61d71b4", "comment": "Malware payload (Mirai)", "value": "5797ca21708ff8d43d76c7001290d79b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168266, "uuid": "f98064da-b8a6-448d-b9fe-2740784fbdca", "comment": "Malware payload (Mirai)", "value": "769d799f6ec8761f3e00ba38dc89c30bf8efbac6da59ceeaf2cc59ac9d5b8155", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168266, "uuid": "f8b004c0-7035-4c60-9fd2-e97d7d7ba0b0", "comment": "Malware payload (Mirai)", "value": "928b466abac875261e7e88b7b76cfd47762a01d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168266, "uuid": "26cb5d70-734a-42ce-93f5-af0166864e46", "comment": "Malware payload (Mirai)", "value": "410872a568393b3092fdb54fcb8359d3d60ee56ad885b37719fc636551dda81880457ca9c0cdeb0e64b00238066a96d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168266, "uuid": "8116a543-9b3b-40be-9242-17a71ca7d09a", "value": "T155334A21ED792E27C0D1B47A12F74724B2E6574E25E8C71E7D720E4EEF10AC061576B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168266, "uuid": "5abeed77-1214-44df-ad49-94f7ba0da847", "value": "768:u1o1Vq9mkgAL7AqxFjTR9St1BkbtQNQRmO+HdDuOHWUh+:u1OVSmkgAPAqxFjTm1BkSNQRkHd1J+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168266, "uuid": "9e5aa099-4737-4aad-b65c-9eb6446c303e", "value": 54600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168266, "uuid": "c9dbeaa5-deba-427b-8363-09546a268ed6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168266, "uuid": "ceeade74-6c91-4c4c-baff-7cee70a3bf37", "value": "5797ca21708ff8d43d76c7001290d79b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a517f558-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687168195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168195, "uuid": "3408d5e2-9114-45d9-9f31-8c50adb31548", "comment": "Malware payload", "value": "5fcf749ca95a51c345d4fafe1d542cfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168195, "uuid": "0c90d4f1-a505-4924-8d5e-c20d66389262", "comment": "Malware payload", "value": "770ecdc1bbda3d9400d992448dcb03597ecb46a1c596dc9b6018a9cd0df681bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168195, "uuid": "2c7e36d4-99f3-45f2-8f11-c78739e9599a", "comment": "Malware payload", "value": "8dc847b3f4e190b0719d37abb0f8f31e8108b0c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168195, "uuid": "98b69df3-72e5-4f2c-b9fa-00278fe847e3", "comment": "Malware payload", "value": "aee707d28dfd0da73f0de3c5ff43b8c186f35b92fbbd0768a5a8a8fb5e03e271a8736fae8f369501fb6fdf9be1860a03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168195, "uuid": "6bcbf754-ad4a-465a-af2c-b72ce9a139d3", "value": "T19E85CF3FF268A13EC56A1B3245B38310997BBA51B81A8C1E47FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168195, "uuid": "323a54b7-2fa9-4dd8-bb12-765e01ff5aca", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168195, "uuid": "91fa32bb-aa89-4d07-aa21-684e7f7b81b3", "value": "24576:s7FUDowAyrTVE3U5F/q1lOR1dcMKic6QL3E2vVsjECUAQT45deRV9Ra:sBuZrEUoq1dcMKIy029s4C1eH9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168195, "uuid": "df2336a4-9ce9-4d76-8011-541a848d9f36", "value": 1794588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168195, "uuid": "a41e6171-eefb-4508-9e6c-e3a86f2b7001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168195, "uuid": "bb3959ca-378c-4a2f-9acd-e767cc4e6c2c", "value": "5fcf749ca95a51c345d4fafe1d542cfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a56163a-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687175237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175237, "uuid": "25e51d48-10c2-49b7-a052-c062a11dbc58", "comment": "Malware payload (RemcosRAT)", "value": "4eb73d1c39f3ac7f1ce71c06c08b09e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175237, "uuid": "719b0cb3-7653-4f16-9c4f-8269645ba015", "comment": "Malware payload (RemcosRAT)", "value": "776a6d59ed63633532e699c5db03f021d37c8f7ac7dc43902ac8b4e4f73aeff1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175237, "uuid": "3a06046f-6344-422c-b314-be6534ff79fb", "comment": "Malware payload (RemcosRAT)", "value": "d7109c3d4a54b4ec00386d90dccb063b843941bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175237, "uuid": "57941d28-5cf5-4c00-a108-124b4c90c004", "comment": "Malware payload (RemcosRAT)", "value": "4f48bb09fcbd3f895ed26f067d3b45dd0ef96e29a098120f1b1bbdb545170bdb6834dabd0220761822144641f7b26fa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175237, "uuid": "aab17e8e-6512-4ad3-9621-ebf2fcd9d162", "value": "T164D4010735A081E9EE7E1DF7AA1B408073C6DC7BD55C920A7BC837960BF1192983A767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175237, "uuid": "65ce5938-91d0-48d4-8841-83d1bcd9547d", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175237, "uuid": "bc517f77-cb2f-40f0-9e74-4541221c4f95", "value": "12288:OkiLurdiRW+dnZ8BXor9iLYCt1l7ptlBypfry1QRdSiT:uLurdiRW+n8fYCfl/ypfry0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175237, "uuid": "1f0f9e25-c5b6-475d-8d26-a1c5a2a401f3", "value": 651645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175237, "uuid": "d45fbcfd-2a93-4c32-9aa5-411b3d9045e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175237, "uuid": "1165b982-d56a-4f4b-b457-bd0b16dc77b7", "value": "4eb73d1c39f3ac7f1ce71c06c08b09e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6190aafb-0e48-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687141453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687141453, "uuid": "7c291270-1905-421a-9918-09d8fe3b17d2", "comment": "Malware payload (RedLineStealer)", "value": "6bcf5def4c3e5f4c396e3dd09b0c293e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687141453, "uuid": "d9d6a143-5b7e-4dc8-832b-13e888a3184d", "comment": "Malware payload (RedLineStealer)", "value": "77901283fc6711af62fcd0f941765964d9dbe145f078df2e2b4cbc2eae38d850", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687141453, "uuid": "735ec7a9-e0d3-4eba-8f47-6c97275c24f7", "comment": "Malware payload (RedLineStealer)", "value": "09e0f16f662254677ea16a16616d8e88d85466f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687141453, "uuid": "3cd7d644-1b8d-4622-9165-c87d9765877d", "comment": "Malware payload (RedLineStealer)", "value": "b0e0e2bf074b4150c4af1117d80b52e8d712fb4ea50d79a6c5affee24e35270be289b9a4c6b4af1e7a3a934b7fe530d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687141453, "uuid": "b2f83167-21ef-48d7-9ef1-df06dbba7fdd", "value": "T180649E0397E13C54ED968B729E1FC5E87B0EF5908F4B77A612089A6F68B11B2E173710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687141453, "uuid": "281996e0-f6bb-4589-a66e-5dbae2972dc3", "value": "0e48d5f6d89199cad77b21fdee68f524", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687141453, "uuid": "974fbe1e-da4b-4039-9dda-0ee9b7c4ccb7", "value": "6144:uJw/5a46Ho/XktmqDzl5MaVlvxcv6krf:2vFosp/VlWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687141453, "uuid": "73a690cd-8a25-44d2-959b-3505248b41f4", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687141453, "uuid": "38ce669f-0e67-4761-bdcf-28f8365ff5ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687141453, "uuid": "02134f8a-1a63-46b6-b093-f1d913d96c12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e461af20-0e89-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687169589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687169589, "uuid": "84a48046-6f9e-4588-a753-ff96182099c4", "comment": "Malware payload", "value": "687c73fd30ed1e29aac69fbcbd6e86b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687169589, "uuid": "ed2a4868-aacc-4b2f-9706-33d3d199557a", "comment": "Malware payload", "value": "77fb7d679cec3e52b388f898c1f19352e89a46497d57a860ae9dda7157446235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687169589, "uuid": "9dd1d506-18c5-47b6-9c0d-20b535c6aa9b", "comment": "Malware payload", "value": "7b759ff57ade1f951ba6b6625dfa27b2c91647d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687169589, "uuid": "f9d9d0c3-f0ec-445b-a8c6-4b6e7635a6f3", "comment": "Malware payload", "value": "129e924e9880abea64bd0e4f19547033d29828a448e931ec46a7a1049cab46eebec609aa9e0b02edc94bd668e84cdc69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687169589, "uuid": "599e0ecf-2960-4114-9ddb-48557ca58225", "value": "T11FE406DA2EC09C2DE7D122F446D592705169FFE01D3CD2BB2A90A6297D36FC1C9F460A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687169589, "uuid": "038dfbe2-6be7-423c-b1b4-80986e6f2653", "value": "b2ec77c2c20458598ad25838cfdc80fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687169589, "uuid": "d5d525b7-8bc8-458c-97f9-b178b84c49d1", "value": "12288:XJhBo/30GB0DuI9FpJBRrbxB54hYvm4u6+6o08:XJg/3rI9FpJBZb/eYvbDTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687169589, "uuid": "f2d58ade-2aee-4f90-a868-31a173e3cf15", "value": 696200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687169589, "uuid": "24b72734-7c08-44cc-8b6b-4b809b62817f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687169589, "uuid": "bf0774ec-74b3-4c2c-986b-af74b8c1b2e1", "value": "npdownload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f7778c-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165369, "uuid": "688c1d8e-a89f-48b8-bc9f-e153a4c47a63", "comment": "Malware payload (Mirai)", "value": "10a09097a62cb677bfabce795aa7cedf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165369, "uuid": "46899d25-8f1d-4967-b06e-c4c065e5505d", "comment": "Malware payload (Mirai)", "value": "78b483d73f7cae2d1b017e445ab8d7d66c1975d2879f9da336dc2c21cd08f170", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165369, "uuid": "62821ebe-b2af-4605-9009-f4252dafb90c", "comment": "Malware payload (Mirai)", "value": "65ea121e1d322640bbab87ef97f1bd50b2578854", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165369, "uuid": "13e3d0d2-41d2-4f6f-926e-78c11dabbb85", "comment": "Malware payload (Mirai)", "value": "1e153b376dd17efba0e7ccb0a46aa9caa6f41386e14d144b205ac7074c29a536612760b82008b07d19e2fae7c7127d7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165369, "uuid": "0fcf8505-f2dd-4e19-8bac-f7bd6c775161", "value": "T198C2D140F0D21F46DEBA7FF25E14D7C2B7F4171E7A9AA991A198D343260E1224509EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165369, "uuid": "1cc38233-661b-4a40-a429-1a0ac78c4693", "value": "768:vVdafO76jpmNJ60RAIPLCWYwU4uVcqgw09/:bam+A48FT584u+qgw09/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165369, "uuid": "bbca7aef-d810-461b-a502-3a1f83b0f941", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165369, "uuid": "7eafc96b-4707-4017-a18a-cbea7be56e9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165369, "uuid": "c06a094b-4e6a-4bbc-b6e5-e4e58b48e4db", "value": "10a09097a62cb677bfabce795aa7cedf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b5a790-0e68-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Neshta)", "timestamp": 1687155178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155178, "uuid": "cb4df24d-e110-4008-bf77-ea3532901ba2", "comment": "Malware payload (Neshta)", "value": "306d1e300a8e742341f36303440d8fd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155178, "uuid": "732b273f-3580-4db8-9254-cedda223cdbe", "comment": "Malware payload (Neshta)", "value": "792d13b4f3887733a5ca23c9cb7f8f10186a796fb05891b4ff978cb526832ca0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155178, "uuid": "4f2bc3a7-1184-4fe9-8aad-82987d5b16d8", "comment": "Malware payload (Neshta)", "value": "1cb0ccc1d83a8677d2057de5a6db1abe33336446", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155178, "uuid": "a13e9b90-9d72-4def-9e42-18643ded0078", "comment": "Malware payload (Neshta)", "value": "8c37b8df2caa32983787cb651d46671f906445ba81dbe7dee620694201daadbd70515ef0c760504d97d597f0d512c39d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155178, "uuid": "476e7151-adff-4447-a138-a7996c194d36", "value": "T16A559D117A45C812C18D36F6E197603053778D82232AE70AA9F633E61E337EFDD5968E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155178, "uuid": "ea24d944-a318-4829-8821-a682f7355711", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155178, "uuid": "576467f1-8562-4218-a7aa-5da3ea72f08f", "value": "24576:5mr3W9c/Esa/4jm6lcv9VAoFevYmsceft/j8:wm9c04jm6avYoIghBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687155178, "uuid": "16074b7d-23ee-4e3b-9a70-c04e6933ba7b", "value": 1303040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687155178, "uuid": "cc5bbd5a-6a4f-4a3f-bde4-842241663213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155178, "uuid": "a2ed41d3-0d60-460f-a667-dc123a9a5acf", "value": "E5418BUVjfY7o0V.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a131f61-0ea9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1687182994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182994, "uuid": "994465ee-fb96-4dc0-9b5b-53f9d21856ca", "comment": "Malware payload (AZORult)", "value": "bb1ce76571f48fc3f8b46eb7190de98c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182994, "uuid": "35f736d4-2ddb-426b-a6c5-4c4f6f612143", "comment": "Malware payload (AZORult)", "value": "79c480e4e624e767affddfda25ca5b454505dcf79f1c772f604e2a9e649fc69e", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182994, "uuid": "cf41c950-594a-4876-b219-7b54b1f98600", "comment": "Malware payload (AZORult)", "value": "f3d2d2b5d9e5d3cc4b3a9f14e868b5fd52701096", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182994, "uuid": "440af8eb-120d-4422-b08b-0d73dafe15a0", "comment": "Malware payload (AZORult)", "value": "93b1a6019b59e900c24010a0d0b1bc681b9f6e3dabddb810713f74e31084bd33b21183fc14644b841bd61a895d53fbca", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182994, "uuid": "12506a68-89c2-44f6-adaa-26369e87fe4a", "value": "T18425238525B5C693E2F70DB17E3A93CFF6BAF0706D142E479B588860BB309EE4749850", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182994, "uuid": "eeab8a35-990b-4566-971a-80fbf01cf497", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182994, "uuid": "b0f9f0ca-0c29-49b5-a406-5e2ed7b88417", "value": "24576:wT1kbCJN5gd5pI82SYxVSEIZBm4M725AavgV+wBXLYY9cUb:wTebqN5gdzXAVSE0Bc1UweOjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687182994, "uuid": "0619606e-aaeb-4da1-b8cd-7a32450283af", "value": 970173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687182994, "uuid": "62ca929e-bb7f-45a7-b1eb-cb652e719932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182994, "uuid": "a27d2fb6-b14c-4840-9f16-e141e7019aa0", "value": "COA - SHIPPING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bbe51c-0ea2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687180119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180119, "uuid": "ee54c95e-b64e-4c48-820d-1806d00a2b36", "comment": "Malware payload (GCleaner)", "value": "77eee6a2134f9d916e527206962cb837", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180119, "uuid": "381ee1f8-f949-4edf-9cfd-a0341f78e5d0", "comment": "Malware payload (GCleaner)", "value": "7a0c33661059f2e23468db0dd8a10040c4a1706c60e6f79d5756b9b29c0e2f99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180119, "uuid": "80b85dc2-80ee-490f-aed8-5d3b9177a92a", "comment": "Malware payload (GCleaner)", "value": "a7ccaa707e71b8c8bebc6513160cc9edda322137", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180119, "uuid": "bc66efc9-ee09-42fc-b373-0de88d77e310", "comment": "Malware payload (GCleaner)", "value": "d560807f7c71b245c2383456a7b8390985a9e7a1b81bb6d82f11c693125b3dde7c8a19aa84052ef3c1d2019022371427", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180119, "uuid": "d667d3b9-f30a-45f4-ab43-e16c866a9042", "value": "T1A964BF13B1A3AC65E522DB318D2EC6F87B1DF541CF29679A221C6B1F09B12A3C573706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180119, "uuid": "9b89448e-45ba-4561-9c45-5b2cc234bd05", "value": "6990691db9b6eaff4e63b9caf9b8101c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180119, "uuid": "2e16644e-6be3-40e0-acb4-8077773b4fab", "value": "6144:lV0fobOXtqbhdgXAnfWRU4V9XYVXGaM8AtwOEmzBEZm:lVsoiXtmXLfWa4V9olGnJzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687180119, "uuid": "ee5c6dad-9aff-47bd-87cd-ae63e4127d76", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687180119, "uuid": "44001e10-864a-4b21-970b-56996a34e4ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180119, "uuid": "a8f1cfaf-abea-48d1-a833-128b17652396", "value": "77eee6a2134f9d916e527206962cb837.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acac63ba-0e8d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687171214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171214, "uuid": "30888883-67e4-4359-a738-78a60361e8eb", "comment": "Malware payload (Amadey)", "value": "bf2ed58cbcb3c7d4d4e3e38351337991", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171214, "uuid": "c3c50c53-565e-4436-baba-482c183437d0", "comment": "Malware payload (Amadey)", "value": "7a5d6e396e1e136896ffaa87dbf08d21221b1c4822a5796c554019d48fb8b58e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171214, "uuid": "b973b523-0f21-478b-a508-787dab751ac3", "comment": "Malware payload (Amadey)", "value": "6d68c2828a7d93fea15bd6603b0afec582aa7dab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171214, "uuid": "d495e6dd-3cea-4289-9d5c-aade05c9bc4f", "comment": "Malware payload (Amadey)", "value": "ee83e0b8e3617f3db284e8acfb9f4a808c7a4917978593b3f13ce7aefb66758db36f0423299274531d587aa202f0662e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171214, "uuid": "7f53a317-d0e6-4d39-9b3d-9f63f98d8a83", "value": "T14D052301BBD98032ECF62B7018F6038B0A327DB1496553FB3789AD166DB2698E531777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171214, "uuid": "33beec3f-a037-4cbd-8960-a67f65596ce8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171214, "uuid": "951e9ea7-3c92-4f3b-bef8-57233568110d", "value": "12288:QMrFy90lpPyeeaNHJwDH9bsPlcxZGlqAXkpb2HPOcd1Ld8dO5urYD4+dwofQdqcj:FyY6eealGjAuf6kpbA2dqurYDtfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687171214, "uuid": "8b67b5af-0e96-4408-82aa-c8c78f877ade", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687171214, "uuid": "b19f692a-4305-4afc-90f5-e9ddf76c5460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171214, "uuid": "ec3bfe86-8a4d-4f88-9140-7094cc6c54a0", "value": "bf2ed58cbcb3c7d4d4e3e38351337991.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf55a23-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165764, "uuid": "d5ae5778-6710-40f9-a39f-4ea5c3e13516", "comment": "Malware payload (Mirai)", "value": "9da9ed5c913f3e2d20a1a3c7fbad344c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165764, "uuid": "2992a8ee-8711-4874-8404-07d72c13e9b4", "comment": "Malware payload (Mirai)", "value": "7a7f7746d1ebc0237467b32633f396ee29b8577e91b2763a01f6c8334ea66949", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165764, "uuid": "94c7f85d-fb23-4bfb-b381-981e139e630f", "comment": "Malware payload (Mirai)", "value": "e23171f6551109d6b93b32a1c482e770cec792fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165764, "uuid": "da2ba8de-f33a-4817-b183-9361ff8d3d10", "comment": "Malware payload (Mirai)", "value": "816eb9f2ae70bf46209767c2fa4b0d288f085fba21d3722f64ac9db3a39323bba03bddd51a3a3b872bb80178b0512e1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165764, "uuid": "b9697eaa-766e-4437-9f2e-da2a0e6ef1de", "value": "T1BBC36C73C8666F58C668E1B4B0718F792B93A911814B1FBE19A7C7798043DCDF50A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165764, "uuid": "db703341-0e84-408b-a18e-e31e4ef1a525", "value": "1536:paCjBwAHv68CKW/Y7UwiCPmK80Tp7kOCKkvgGHLW40zwUhHhAVufdX:p3vvLCLsURY8ykKUg4LWBwUhBRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165764, "uuid": "183e9861-260c-441a-ac71-3199f0641c7b", "value": 129452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165764, "uuid": "4b0a2dc0-b0ac-4ac4-83cd-8fcf41fa7f23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165764, "uuid": "ee2166c4-a566-43ac-bbd1-18cbb9b5ab65", "value": "9da9ed5c913f3e2d20a1a3c7fbad344c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4144961e-0ea1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687179624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687179624, "uuid": "2b723632-371d-4559-ad8e-d0b3f7fb8033", "comment": "Malware payload (RedLineStealer)", "value": "a1eb350b895f85b22bd01486e5f15692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687179624, "uuid": "d3f6f09a-d97d-497e-a267-631cd27f43e8", "comment": "Malware payload (RedLineStealer)", "value": "7ab8dcc49e4eb0f926cc8f0c2e73b6a9a6feab0d722a1958782b017e4f40b5bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687179624, "uuid": "74c06f59-3715-44b5-a92e-352df1c9c7ab", "comment": "Malware payload (RedLineStealer)", "value": "9ad0390b3803869edc0d37d3918ff91d274958c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687179624, "uuid": "f850285b-188a-4815-8017-0bb0ff03e3c0", "comment": "Malware payload (RedLineStealer)", "value": "2d8832b9274507975003f66c5562dc1b5ad774bf258727aa98a7c50fe6ff756e8a292517d9436965aaddf0a50fa9c908", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687179624, "uuid": "1475774d-a051-4604-af92-a77cd5a2551c", "value": "T197E41203E7E88176DCB567B00DF703C32A37BCB2987452A76642A85A1CB36C56972737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687179624, "uuid": "62f9575e-d505-4e85-b79d-22276ebcd408", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687179624, "uuid": "efb58324-d143-4fc1-8c0f-c98c607f0acf", "value": "12288:uMrKy90cOjL9+EH40A0awyyPEe6uZFRnYQnbmRV3hpE:Yy/KN4p0awIuNn6R5rE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687179624, "uuid": "d06b1a2f-d17b-49da-939c-feef0cb17344", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687179624, "uuid": "85787f68-73ac-45e8-abb6-01d46ed8fc6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687179624, "uuid": "5ca28da9-bc81-4681-b221-770bc7341af3", "value": "a1eb350b895f85b22bd01486e5f15692.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b49d1d5-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687160421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160421, "uuid": "37db7ca8-b6bb-4dda-9c39-2052384504d5", "comment": "Malware payload (Mirai)", "value": "d7893c77ff2cd9e0c06d16037e994ebf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160421, "uuid": "7bd3ffd1-4f1c-44be-bc1c-0b55a35e7690", "comment": "Malware payload (Mirai)", "value": "7b40dd6fd6a6e536ef51819230207466d6e478cdd8876007e557b28640fd8274", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160421, "uuid": "528de0e2-e636-4623-8815-8217e359a850", "comment": "Malware payload (Mirai)", "value": "89ce61bd38113b38343092e0c80afb2c2bc04729", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160421, "uuid": "10847046-cdf6-4319-beae-6945a2507a50", "comment": "Malware payload (Mirai)", "value": "7f402080727d23c516b859c41156cec19ec66db9efa71553394f41fdd015a43ec6d9f213f59552b99d08fc145af35c17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160421, "uuid": "b2c63e86-d998-43ce-a86e-c47ea49ceba0", "value": "T176A2D019BF1C868BC836297955E9E6D22253FD61F2DCCC4D2940C15FB1A33A96870F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160421, "uuid": "eccb0621-d040-45d1-ba89-294a520c2262", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+Zk2admTb+502F2vwA9dWuMW21bAK1oTx:M98o08kxofBE+Zk2aITbp2F2TWul0c5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160421, "uuid": "1a2e8528-0485-4be1-898a-9849df9ec247", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160421, "uuid": "37249717-86bb-4f56-b95c-93af5b7b9d78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160421, "uuid": "7d4cc0cb-84b0-4284-86bb-130f284223e5", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba7554c-0e38-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1687134625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134625, "uuid": "ebaf82de-8a3a-4ddb-9331-39ef7472659f", "comment": "Malware payload (njrat)", "value": "8b1e894104495df4e85014285995f3e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134625, "uuid": "7876c38d-a71e-43ef-8fb5-63ace0c145bc", "comment": "Malware payload (njrat)", "value": "7b523a5dda82a18fa4dc0d96f5a19fa63a28396c43bfdf619b177d12b384974f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134625, "uuid": "80b8d44f-0686-4106-bc1f-5438760906ae", "comment": "Malware payload (njrat)", "value": "3e31d801d8c9d0708854fb963d483f65b302ea5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134625, "uuid": "1494b347-0ce3-4c0e-886b-72a4fa84fe79", "comment": "Malware payload (njrat)", "value": "8853bb8487d738954847f9c0c5f5aa618101be96aac1f57733e407d1cb437fb15f91d5a9d5bd44d1b1201932df7c9559", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134625, "uuid": "55c7ceea-1601-4a77-95a4-78709a2826a4", "value": "T19EE2084D73A48923C6BE57B84E70864207F1815B5522EFAF8EC460D61EA7BE41E00EF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134625, "uuid": "0f475d8b-438e-460f-bdb6-ad85a9661da8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134625, "uuid": "a0056ecb-9dd3-4115-8b52-433f3eec7ff2", "value": "384:vtNwd3pNw5HWpwwAsNTDVAhgpr8gwH1wUuMxAIZ3BCJlxTZHVkw3ccNwifGIyLsM:vDwd3pNw5HeXr7wH1wUgQw3ccrfLtfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687134625, "uuid": "0edbc8d0-bc24-4a33-9315-03018cb1f960", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687134625, "uuid": "f2b9bfb8-636e-40cf-b5fa-0fca0d8835e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134625, "uuid": "00f7aebe-cc25-49aa-a03b-1c03d54792c3", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69238db3-0eb1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687186563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186563, "uuid": "031c1c6b-3f5a-4d41-81c5-5607ad214470", "comment": "Malware payload (AveMariaRAT)", "value": "8052338c82b56e0a63a1907bb12cdead", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186563, "uuid": "2cfdd26a-5a20-4c30-8f9a-ae5b903bfff5", "comment": "Malware payload (AveMariaRAT)", "value": "7b5b1011379a1989001c46d67841937f12784d7be44c1c2cf851a72b9a135256", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186563, "uuid": "7a9be894-5fb5-4275-ad51-35c24ad26c78", "comment": "Malware payload (AveMariaRAT)", "value": "005f42668a4dcf9ae96edb821788d7f4049ef587", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186563, "uuid": "c1caba52-921e-4a3c-82fa-74c9d87ca258", "comment": "Malware payload (AveMariaRAT)", "value": "21b0c97b1fe53a80425da732cb28e166a586a7d9202ddd86bff790a98a3b6ad86d573307c11ba9002d158a8bf0001f56", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186563, "uuid": "4c87fe2a-d0a0-4a4a-8471-645c261b8a2f", "value": "T1A781E775070C1853DA53C6F3D5457F6B08E6F73ACACBA3C4176EF8B9015B192A93A282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186563, "uuid": "fe87c8e0-516e-4880-9469-e1ffc35ad588", "value": "48:RydJlZehr57WiPTfqx6mKbvBr+IurThGFpoKqSKZoSqdtPAzrlMSGXW1qc0oEx9m:RMyUoLqsITU3onP06EYRl4MAffZoHRw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687186563, "uuid": "895ab2cb-87d2-4bf5-8318-b796cd34b700", "value": 4081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687186563, "uuid": "399e2656-a4f3-4b44-94ea-fa1f504efd05", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186563, "uuid": "7c8ce444-ee63-46e9-9043-d324fcdc5dec", "value": "PO No 4000302979.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee06c45-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687175271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175271, "uuid": "42088ecb-51b6-44b5-9d48-9cafa097dc22", "comment": "Malware payload (GCleaner)", "value": "49453b8d7c5dbf37f5255e82fd0c8d77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175271, "uuid": "afb4be8b-41ab-4105-af3c-b8a5b71bbe90", "comment": "Malware payload (GCleaner)", "value": "7bb2b1114ebe80834530d7563d2111e350415bf027ef00dd2c81873afef5c615", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175271, "uuid": "7e53e114-309c-41b5-97fe-0bf9b192da15", "comment": "Malware payload (GCleaner)", "value": "77a90a99e07b1b3ee1b46ecd45e309857083cea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175271, "uuid": "ed0e36f5-1962-4b44-9cb5-65e1d5a36cfb", "comment": "Malware payload (GCleaner)", "value": "82ff89904dbfb27181ee08f57df340c550a5aea4eec2c857710502c3af7f300458b644872bfa23470acb060d039c063d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175271, "uuid": "854c66ab-048e-4cdf-92e1-fd1d28f1bf6c", "value": "T1C4848D4396E17C64ED254B329E2FC6E87A1EF5504F083BDB2258AA5F88721F2E533351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175271, "uuid": "710709ec-56fa-474c-bae5-9ccfbb4a89cd", "value": "20fbc66eb9a195a651800871cc7589a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175271, "uuid": "2feba8df-659d-4ca9-a17d-dd5220fed5cc", "value": "6144:RHw03IyMwPRDc5oeZpoU+1CWC5A4+lBLLtQdFdo5:1jMMRlrmAZfxQdFda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175271, "uuid": "d1c632e3-39b6-4ebc-a807-7aa1c8849755", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175271, "uuid": "37733d39-712e-4ff7-bce9-a544e4da5d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175271, "uuid": "91ec0ebd-83b2-410b-881d-099b35966695", "value": "49453b8d7c5dbf37f5255e82fd0c8d77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72c59d8-0e9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687176842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176842, "uuid": "fcdb5537-2c04-4a03-9ebf-89619fd6e50b", "comment": "Malware payload (AgentTesla)", "value": "fae26093299f08bf5f0e21ae0a9b4d1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176842, "uuid": "0c015217-c463-4937-bfaf-443e4678a44d", "comment": "Malware payload (AgentTesla)", "value": "7cae209399f08c5a85de444babd258aadb253b625356dcd47e4ccf4fca8a013e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176842, "uuid": "3aa3cc7d-ebcd-4d88-9e06-6107e25b8893", "comment": "Malware payload (AgentTesla)", "value": "4c19d16d199292744eee57f4dc6855ccadfdee91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176842, "uuid": "40b01117-0a54-4a94-b6e6-a1c152251452", "comment": "Malware payload (AgentTesla)", "value": "4be44f8c6ce118312653a1769f829b7a80866c39ab33dd0272aacba4c609126c420694751bf2bb29babd243051cbd7c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176842, "uuid": "7320cda2-e43f-4563-9f09-4aac1d5dfc5c", "value": "T1D215C5B865D122B795B5D662C16234C9F53F7322B3934D2921D2CFC3926294EB7EC80E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176842, "uuid": "7cbbb6f7-6a9c-4b2c-b8f6-3b7e7527b14a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176842, "uuid": "99f1cf21-21cf-4f40-a900-44de199b9bf6", "value": "12288:ERpWTnX5REw0Ko4g9fDpkkOSDtErPBhybpWpKpzfr:6WTJ10KdgJ9bRbpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176842, "uuid": "d4e397bd-ceec-450d-a1f2-83e41703be78", "value": 931840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176842, "uuid": "dcfe0b23-b738-45fd-8fa4-2e439142a9c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176842, "uuid": "9c796a5b-2e6f-4e8b-bcc8-820ed507fa73", "value": "fae26093299f08bf5f0e21ae0a9b4d1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35467c5-0eb4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687188056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188056, "uuid": "e936aa27-5cca-44a4-b267-b0a67cb25d96", "comment": "Malware payload (Mirai)", "value": "35326fce55401bc297ec7cb3ee8b9735", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188056, "uuid": "bc87b0a6-7c10-4c35-842d-6ca998b3181c", "comment": "Malware payload (Mirai)", "value": "7dc182cd5598ab639cb3662b88ab0725d249fc0209a9fb278f701389a4bfcc42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188056, "uuid": "f38f0b01-d693-451b-893e-6ca45a1eb6f7", "comment": "Malware payload (Mirai)", "value": "7e5d49e24461bf5df6a05e776134195aef8d9dcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188056, "uuid": "bf397c3a-f0cc-470e-ab7b-066b839796e6", "comment": "Malware payload (Mirai)", "value": "4b2b5f849fb5085fc84ef1c1d2fd475c89c0e0af68becffd062719ecc1e4fb96766a1067eb9413f1e5973b012f7ee58c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188056, "uuid": "072109b6-5807-43e0-b816-2628429d6533", "value": "T109D36F87B8019F3CF49BD67E41370A09B121925476A20B2BF396BD6BBC730955B1FD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188056, "uuid": "fb5313bd-9d2e-4879-845c-020617f0bec7", "value": "3072:/RSMAUeiWVm+YC75omuGSzKo2NjDfG/gIdRd6lg:QMAUeiWMVrmucPDfGDdv6lg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687188056, "uuid": "b46460e2-80ac-4b58-962e-dd4dfa719738", "value": 132620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687188056, "uuid": "b6684b3c-1558-46ca-97b2-72be331f985e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188056, "uuid": "bcb92d89-b0cb-434b-92a1-be9b46589d10", "value": "35326fce55401bc297ec7cb3ee8b9735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3cee96-0ec2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687193765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193765, "uuid": "bfac4bd0-e050-48ed-997b-b55acd84ad7a", "comment": "Malware payload (AveMariaRAT)", "value": "ec77a84dddf6fef090dde4d2ab3a1007", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193765, "uuid": "a97ca5ba-7c1a-4399-a474-01ec73680c38", "comment": "Malware payload (AveMariaRAT)", "value": "7e29847ad89b06a94bb9c64898f922688addbe295fad4667546338b3240aeffd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193765, "uuid": "7b7ec934-92e1-425e-bf2e-c17ce00f2588", "comment": "Malware payload (AveMariaRAT)", "value": "d846a7b1e67429ae1bec877938766ef81e023622", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193765, "uuid": "a246c9c5-9f11-43c6-97d2-f72d8ee159d8", "comment": "Malware payload (AveMariaRAT)", "value": "4382221711d4e3f633b5b3b737992d67e2899ce23ce703a26bba7f6419c8be851eb2bcd9601a42d58e072153e170b5e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193765, "uuid": "5ec89e66-bde8-468a-b6f8-ee4e1815fde9", "value": "T18324F101B2A0D053D5A253321C75C9BE1E82FE26DD981BAB33D07F6FB83A281D92D755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193765, "uuid": "d4c4f04c-c066-4e62-9147-0a9e354ad6a2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193765, "uuid": "6a0abd3c-413c-4bb2-995f-c3f86b0d0c99", "value": "6144:gYa6HollUqtrdWGmJKJE70a6seVSXRs0TZ/J:gYdollXtaJma6TMRHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193765, "uuid": "e877a032-930f-4987-86ca-897f07b8fd06", "value": 217760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193765, "uuid": "9dcb7f89-cefb-4944-9cd2-2ccdc2af1c05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193765, "uuid": "6fceebc9-9a43-446d-9774-d7d452018b49", "value": "ec77a84dddf6fef090dde4d2ab3a1007", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08097f68-0ea5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687181246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181246, "uuid": "dcca54eb-a875-408b-a04e-97a91aef38e7", "comment": "Malware payload (AgentTesla)", "value": "f785e9606f0617f0bfb6a6323e81ec48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181246, "uuid": "96d9ad23-3cd4-4910-9903-6611e5dd85dd", "comment": "Malware payload (AgentTesla)", "value": "7eef46c90c305b09e26682e975802942867f8d9b89e59643a4b721a7ae30c3c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181246, "uuid": "b8927ef6-2f3e-4b54-8d7a-339644e82caa", "comment": "Malware payload (AgentTesla)", "value": "eff8770948eefdeb91b746c4470985dbdff50a27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181246, "uuid": "4e0a6adf-a2c2-435f-b012-924d70fd82f0", "comment": "Malware payload (AgentTesla)", "value": "b0f117a55d14700b613ade3f0ee660960da2583a6932ba1cc9aa86a179b34b9c516704da02c20b2d268dbadae4615d44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181246, "uuid": "395c898c-4fa8-421b-9431-0ecc7c44f56a", "value": "T1AE64128836B1D55BE8934B721E3E0977EBF7A902297D9B0B131007553E01B63662EB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181246, "uuid": "a4764945-3e3a-4b49-af6f-ff7551771c7b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181246, "uuid": "5e7c501c-eec1-44b6-8873-0d7e6abd156a", "value": "6144:pYa6wXLl2QXApUqkbRtsvyuc6hS85HGy503aQ8+ZZQ7o+QnMK2iX:pYCLAQxnbRuyH6cQbya+ZZQ7RQnNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687181246, "uuid": "029a7389-a55f-4d1e-a61b-a22d7cc2aea5", "value": 313222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687181246, "uuid": "8e4ce27f-d678-4cb1-969c-6593fe7ba90f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181246, "uuid": "f5ea00bc-c2fb-4674-bf28-08e3048a3366", "value": "New Order 68921032.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f32f31-0eed-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687212347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687212347, "uuid": "ab7f0044-c33b-4662-9754-56f71aaf1b7d", "comment": "Malware payload", "value": "b7602315a23d46a720ad7cb8af62c118", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687212347, "uuid": "acd6dd82-2196-4e20-bd82-e35e1322bc65", "comment": "Malware payload", "value": "7f97aec4b235fc0fb0e404a95ea49629aaa141054d20e5d43786c210b35baaf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687212347, "uuid": "8ca441ac-525f-479c-9d0c-fa7473833765", "comment": "Malware payload", "value": "9b4344033db0a17c038833e51496dccdae71c55c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687212347, "uuid": "52d85ef3-172d-4b42-b319-1a2c459aee92", "comment": "Malware payload", "value": "f0fd7a88166941dba9570f040d9105703d14228cb881dad6ad88da37a8c67880e3ae4d80c8f022a5ffa58e07e8f52060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687212347, "uuid": "833ccac5-5d63-4239-8758-95d0945253b1", "value": "T1C306331176D06FE0D2490EFE2B51FA7B6704375AC99903806CC9A7AE5B2F74BD932438", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687212347, "uuid": "569a50be-f858-4acf-9fd1-312b681c509b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687212347, "uuid": "5e5fa284-e084-4587-932f-4022fcd960ac", "value": "98304:mKJm1hkS4yjkoyBnOwMVqOaXeZdqC7UO6YDsIumL/Hytn:NYpVy5MVXdf7KssIhL/yN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687212347, "uuid": "c3a44cf3-63a2-4c80-8c81-ca5a3248edd5", "value": 3873792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687212347, "uuid": "007caa00-afed-4fd8-8f23-c3d9309a1750", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687212347, "uuid": "8767276f-0782-4809-a3b0-ab1e88323db2", "value": "Dread498_protected.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2220e9-0e93-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687173844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173844, "uuid": "5520b9ed-5bb8-4cb2-ae79-958586fcd472", "comment": "Malware payload (Mirai)", "value": "c77ed30a4fd51c1d68fd761983e41dc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173844, "uuid": "b541c9de-138a-47f8-bdfa-ccd9b2110e28", "comment": "Malware payload (Mirai)", "value": "7fe389ccc85df4c590e07fdb8f0572aa40a8a356ca8f10f7333327a3a4492a55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173844, "uuid": "f6ad021a-3788-4dd9-a575-27432fc9b868", "comment": "Malware payload (Mirai)", "value": "f40cf0061cbda2898e377417f48d7fb3ee35dd5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173844, "uuid": "41361694-ab52-45f6-bc5c-3a576d43e016", "comment": "Malware payload (Mirai)", "value": "d0f262abc2a6c10aebeb624921e586f6cadb916ba1bea2330998328613d570b94bbd06e3008853bf7a35379b5517a103", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173844, "uuid": "67adc7ea-7772-4275-9e93-5adadc325741", "value": "T1C3532891F8819613C6D1127AFA6E028D3B2613E8E2EF72179D225F2037C786B0D77E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173844, "uuid": "52ae012f-38f8-42b5-bde3-c4989696b932", "value": "1536:uYuoeNyVV4BVG6S9VwzvySY8By3gckivDvs:uYub6mzvySYOA1Dvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687173844, "uuid": "c182115b-b7bd-4a8e-a80a-900cae81458c", "value": 62780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687173844, "uuid": "5e4247c7-f533-418b-8d21-e7fbdfa4d372", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173844, "uuid": "290ed6f6-7334-4433-85cf-c12604c99422", "value": "c77ed30a4fd51c1d68fd761983e41dc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114f529b-0e62-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687152485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687152485, "uuid": "0e92078b-908d-4835-a078-9b44acf8c74f", "comment": "Malware payload (AgentTesla)", "value": "58beb31f4f503ce0f5071c950e276750", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687152485, "uuid": "81c2c9f0-04d3-410a-91d8-b19387b349b8", "comment": "Malware payload (AgentTesla)", "value": "8060a0f4554d737c041ce53397a053cfd8c53fe97984df083935d5f62a56b3b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687152485, "uuid": "f8e1393a-2ab8-4c42-b4e9-aad047ea596b", "comment": "Malware payload (AgentTesla)", "value": "356a89e0788ead21df176664056d899ad814a840", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687152485, "uuid": "c0014fd2-012c-411e-8bee-6d7f22bdd9c1", "comment": "Malware payload (AgentTesla)", "value": "37e5e71d141f002d2191a0a06f03fb25e55e189eeb83782c766ef05bc7d8106a25d5a6f3f33e21325f5815ee37580faa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687152485, "uuid": "aa5a64bb-2851-49e3-880c-8c10b3419f9e", "value": "T1EF15E05022A89F57E03F87F990526130C3F52A23B57FE39ACDC321EA2D66F918A555C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687152485, "uuid": "cc6a4124-b7ba-420c-9051-592a82042b65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687152485, "uuid": "75d90534-a8ea-42f2-a04d-3e08983037dd", "value": "24576:5q5MRc2X2YjZI1S5LA9eFJUV3Rg46eI4vkW:5HmYjZIs5LA0jUV3RgDeI4vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687152485, "uuid": "ddef8bce-ebfa-4710-b2df-cfef538610a2", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687152485, "uuid": "6c19d44b-0cf3-4598-887b-2496f7b6a7af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687152485, "uuid": "570c76d5-08ce-412f-9e63-7dc682eb032f", "value": "SHIPPING INVOICE DOCUMENTS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc091c92-0eb4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687188044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188044, "uuid": "c1615828-bacf-471c-a31e-e9fc03b2cf91", "comment": "Malware payload (Mirai)", "value": "83ad19a0cd397f8f4dc0238ff7fda765", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188044, "uuid": "b751ba3b-927b-4a4d-bf8b-2b453b12b98b", "comment": "Malware payload (Mirai)", "value": "80747dc89adf8ad24cc106cd1a6278a2e5e9c47086ce259c561557b7af3e3d35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188044, "uuid": "deafaddc-ebf8-4b4e-91ee-47b1dd222762", "comment": "Malware payload (Mirai)", "value": "4cb7261402afa279c385a82844abd92285e4b7e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188044, "uuid": "eea8c3a6-b4bc-414f-985b-3f119d3a42bf", "comment": "Malware payload (Mirai)", "value": "acfc2e04d9639b6d8b6a2ae4041fc003819dc04789f9efc54575ae9b4e2e1d90211bd2b792dbac5d685fb4c9e0f9a7c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188044, "uuid": "162c71b2-0705-4a6a-8c8a-20c4d363a5e7", "value": "T1DBC33A46BC91DA22C6D122BBFB2E118C332613ECD3EA71079D245B6837CA56F1E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188044, "uuid": "55b8efe8-7444-4f1f-9bc9-0f27ca6df248", "value": "3072:KaqlOouQpjgJY4fr7Zp/h1JXxPxYa+87iemP:YOouA0Dea+qpmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687188044, "uuid": "f3857c46-7ce0-43a5-8d8a-ac3bdb61c11e", "value": 128600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687188044, "uuid": "0dd1a28b-00a9-493e-a772-7c171b25b99d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188044, "uuid": "cd3a99b4-d2ce-429d-b8e1-e4e5315eda8e", "value": "83ad19a0cd397f8f4dc0238ff7fda765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77219af4-0e79-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1687162534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162534, "uuid": "779da19a-8ea6-499d-a0a7-882232890593", "comment": "Malware payload (Smoke Loader)", "value": "9babf546962a147ee1c5b50d0313fd38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162534, "uuid": "1651a86d-9757-41c8-867a-de10acca6b8c", "comment": "Malware payload (Smoke Loader)", "value": "8113159e0ac7c44fb49f3231ea9541e2d9ce9fd06dee9887037349e3370e6e73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162534, "uuid": "4ccc8b94-a196-41c2-b1e7-c4c023860d0f", "comment": "Malware payload (Smoke Loader)", "value": "2a3926bd9f3440ba9780e60487353c5419da0701", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162534, "uuid": "7991736b-15a1-4d83-b32d-bdcc0f2f5483", "comment": "Malware payload (Smoke Loader)", "value": "cb1ee34b3ae15fc66d9a36b335e3e1dda0a15ce971f7aa3cdccd8614b3dfb6502333dccdd00f27aef71938a2ec01cf5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162534, "uuid": "76c134f3-1994-4954-b178-c071cab4fd73", "value": "T193349ED272A0EC70D1251B724D2EE6F92A5DFD708F24679BE2087A1F19BC2A1C572353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162534, "uuid": "9a3c5dab-31fb-4ca8-a44e-edbfaa7f4bb2", "value": "e22f6bb2be4e12044608fc1a03b29b46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162534, "uuid": "f759e3f6-c20b-43ba-8e6a-e463e6640092", "value": "3072:Sy0j+8JYhONZkk00oT1QqQk33uU2sKsXFNn+hYNIExQMW2oAYwj5:qjzKhONCk0f1QqNH52iFN+SN/Q2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162534, "uuid": "f260439c-1788-4b68-af31-d09c8c698d07", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162534, "uuid": "7aeaf1f3-9eec-4334-a9ed-8827384fe05b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162534, "uuid": "7c278aec-bfc6-448a-81c9-229374f0cfa6", "value": "9babf546962a147ee1c5b50d0313fd38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc882e0-0e8b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687170354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170354, "uuid": "0d6da725-2a6e-4c0a-9d26-d060c0bcf5d5", "comment": "Malware payload (Mirai)", "value": "8168bd53435e3d4ff7278f4f05c6f6b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170354, "uuid": "e0ebe525-6b06-4d01-940b-9d5bdfd2e59e", "comment": "Malware payload (Mirai)", "value": "8114aaec6dba3dbdb163fc143a1d409b94062cf3ca7761414b9771f40de789c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170354, "uuid": "1c73205b-e95c-4125-9c08-2239b02ae9b9", "comment": "Malware payload (Mirai)", "value": "b68ae60f45092a1b92ebab7b03aad921315dd954", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170354, "uuid": "27f2d3e4-8593-4a91-a164-3378103db684", "comment": "Malware payload (Mirai)", "value": "bfeb396d7ec37378a1ff6177fea0900ebac5e63d3c245094dd17bdf978eeeaac46d47c10fd7df2fdea7f99fed9cbfbab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170354, "uuid": "1ff9c27f-e61e-4deb-b468-16eae7807132", "value": "T1D8C2E16285FACB17CC63437E2928157360685C55E30DEE3D1B2BDADC53884E62BBAC53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170354, "uuid": "fe3efcdb-07d7-4705-aaca-01f086e7ff54", "value": "384:MRG99WXUx5+bkbRaliVErjrL9VD9jPwrSaf5bwIB5/8x2BYFydHY0sNDZvzbSNHa:95+Kcrb9VDJef5Q2PdHuzb8HoEPboB//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687170354, "uuid": "07161216-3588-402a-95a3-0cc58dff6665", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687170354, "uuid": "843322d5-01ed-4473-91db-9ab35a1b6602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170354, "uuid": "90952ca3-0e21-42a0-9220-115fa0a7e05a", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04532a26-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165348, "uuid": "0b12ab4a-196f-4f6d-91cd-006f601ceb26", "comment": "Malware payload (Mirai)", "value": "aa6eb03b419a6f55e8e0b9a613e6f6b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165348, "uuid": "8d232bbb-0854-4722-a529-ce76e200f1ac", "comment": "Malware payload (Mirai)", "value": "81807b31f7042c5e1fa03b1b560b30fe0fe7c6eac66fd0aca9636dd6351167f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165348, "uuid": "efaa32e8-dac8-464c-b90c-5f7dc624cde5", "comment": "Malware payload (Mirai)", "value": "1cd896f0787b16c887aa12c16084b6f97c4cecab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165348, "uuid": "83af3f42-bc85-4fc3-9d4a-50858bc0f426", "comment": "Malware payload (Mirai)", "value": "4111f182a69d7f4ac273e56c83e6c24b904121d199de236da82e1d2c3dfa7952c91623bfa9a5873e2b8ef64e10a4ffef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165348, "uuid": "5d7e6207-cdac-4bc1-80cc-b09387ece689", "value": "T1EE04871E6E228F7EF768873447B74A21976C23D627E1D684D2ACC1141F6039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165348, "uuid": "b22b5a00-db67-4270-9cca-3f8dfb3da78c", "value": "3072:KrokPQqIECXYkj/pKIGDTSIg8XxCcT8/jayF:KroNb/sTFhXTT8ba2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165348, "uuid": "fc51ec56-e71f-414a-abaa-c90562b82820", "value": 190052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165348, "uuid": "1ffbcd57-bd95-47af-905d-58223708053f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165348, "uuid": "02cc5135-17f5-4474-b852-ae56c895e62c", "value": "aa6eb03b419a6f55e8e0b9a613e6f6b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf8a37f-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687175293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175293, "uuid": "30d23014-07cf-492e-bd2f-28d853506bd0", "comment": "Malware payload (GCleaner)", "value": "bc1c07e7c6583559904184917824ad3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175293, "uuid": "ed044aae-1962-40bc-8378-1aeefd5ffbf0", "comment": "Malware payload (GCleaner)", "value": "81aa6f305a4a0c17212ae8774077a4ae0ff1b150f4a61ea2badb0af9929c5ea0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175293, "uuid": "482a5b38-b20c-4387-a0f4-7ae5551dfcdb", "comment": "Malware payload (GCleaner)", "value": "fac5dddb1021fbc2d0dba32e04900b6f739bba70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175293, "uuid": "0e998de6-51d1-4669-a595-155b84836422", "comment": "Malware payload (GCleaner)", "value": "00ee185aee700373cd4ff22cdfa89e19dec8098e9671f24faca0ad41b6fb99ed92522ee040b17235d24e74b66905b432", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175293, "uuid": "d1f8c4b9-7d67-4cae-b77d-c879980f11f7", "value": "T1CC849D4396E17C65ED254B32CE2FC6F83A1EF6504F097B962228AE2F45721F2E532741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175293, "uuid": "9ef8c261-7336-4044-868a-b67c74070209", "value": "150aa66f30a50bf11025173723e96a3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175293, "uuid": "d47b2230-696e-421c-b534-78af3caec8ec", "value": "6144:e36DIWcKxkQ6RF7re/uptS+mm2qfZCf4Z+eZ1J6:tIuuQW6GptRm0fEK+eV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175293, "uuid": "4816d0f7-d774-4ed0-8808-dd3d77d6f794", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175293, "uuid": "11cfd9dd-3b46-425c-b05e-208de3153515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175293, "uuid": "7506b0c0-5720-481d-91cd-1bed17733de0", "value": "bc1c07e7c6583559904184917824ad3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd38f84-0e62-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687152476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687152476, "uuid": "1ccc84b4-26f8-42d4-a308-e8f3f6e7af3c", "comment": "Malware payload (AgentTesla)", "value": "5963e12130ff087312945a5bd0eae97a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687152476, "uuid": "26cf5a0f-8cd3-4694-9fab-b98fee33a43b", "comment": "Malware payload (AgentTesla)", "value": "81bf78e44a79563c740a6ff3562742e0152a4717b2d7eb38e11395c4dc3c6713", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687152476, "uuid": "ecc74306-9a7b-461b-83df-b87336ff18ef", "comment": "Malware payload (AgentTesla)", "value": "8f5be81533e07d75fa2ceb7d5d3ac764411a9e31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687152476, "uuid": "797378fb-e9c4-4ff9-b198-ff139a26d3f0", "comment": "Malware payload (AgentTesla)", "value": "93457a478d3aa3afd29eaee9b4d04493174324935922ad714fb7f67962a1791317fca12923e060004501010f0dfd3120", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687152476, "uuid": "e069c183-56d6-49a7-a59f-6c5ab534f2ba", "value": "T116E433B41B2EEB4C98D5576BA9F278A73EC6F440A5A0648D16630E17CF8025EBCD05F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687152476, "uuid": "e1b5754b-7c49-4ca2-b0cb-30a7c5efce37", "value": "12288:joIle/XC/iWpfbqGi0bXBRCpLFYQ17InYWLdco6VfyAvF1FRXAc5q9x4Ik9Z0Up9:RsfCaWtxxXBRKcY3VbF1P5q9+D9Zzpxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687152476, "uuid": "3fd95e18-fdf6-4ce1-bbdf-a6d6872afeb1", "value": 695023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687152476, "uuid": "94701607-d069-4e87-b37d-ba682daffa3b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687152476, "uuid": "f632a1be-e772-4de6-91d1-9a3789e69e5d", "value": "SHIPPING INVOICE DOCUMENTS.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fe98e2-0ea9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687183227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183227, "uuid": "d0926bc8-0260-4c43-949a-195440dfa473", "comment": "Malware payload (Amadey)", "value": "e50641d2cc5030790df9e6d947cb81f9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183227, "uuid": "f4480a98-9c1b-4c55-8bf5-f07e4f033d07", "comment": "Malware payload (Amadey)", "value": "81e4052267df42be6607edf4f3fc7fd09a6816c31594e6887ace11da41963673", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183227, "uuid": "91f074cf-892f-404d-b7c9-fc33283974e1", "comment": "Malware payload (Amadey)", "value": "f513558a8842e66ba53896a15c9a66e83f610dc5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183227, "uuid": "654e3023-c47e-4b09-8be9-2ae701536bd6", "comment": "Malware payload (Amadey)", "value": "affcd97f7fcb299ae126083851aea716a36399b21e30557b835e016791c2c28501c6a1d50256cd0aeb3501247f203d68", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183227, "uuid": "74581e4c-55e1-44dc-a009-e96f9a0ba9be", "value": "T1D6052223B3E95472E8F817B054FB03D30F36BC218DB8526A2745A91B9D72A94913673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183227, "uuid": "78dee309-9e76-4673-82da-90b2f76311e5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183227, "uuid": "05242eba-b065-42c0-9ea7-09f4148284e8", "value": "12288:/MrZy90meBh4YKKlAdzVJHj399iYoZXyHSUi4eWrn8n2Cu7GY2t3C1ir3Jm:2ypeBqYKKl0xd+Y2oenluCzt3jrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687183227, "uuid": "b70c8004-b731-4806-9959-7232c7ce7bdb", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687183227, "uuid": "f8e808ee-87b3-45ad-9e5b-061a891772e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183227, "uuid": "bc8f3b01-f560-4e06-ab15-18fd6eeb62fa", "value": "e50641d2cc5030790df9e6d947cb81f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46da51e6-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165460, "uuid": "28b7470f-da17-4ed1-b860-b1a1d7cfc4e2", "comment": "Malware payload (Mirai)", "value": "61973b176f7bcc837a490b0379aa0bf6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165460, "uuid": "10192511-a262-4d5d-8587-edd0e8474a3d", "comment": "Malware payload (Mirai)", "value": "820f57622717422325261b0291a7a2f91fcb8789a1358184f6dee07dd7ae233d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165460, "uuid": "0b9be1a7-48a7-47cc-92fa-2973ac6ab7d2", "comment": "Malware payload (Mirai)", "value": "c544a697ae38fbf88d90652f28804f826438f0fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165460, "uuid": "ba2b40bc-d1bc-4ac6-a5eb-16165d0da67d", "comment": "Malware payload (Mirai)", "value": "52608ec5ac692c254c01df83c4665ccf740549fbabce01894096ae0232fe343a782449bd5d3e552146e554da4e4811f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165460, "uuid": "763f374f-2e94-4d92-822a-a3c304bc1d75", "value": "T17F03D651F8825A27C2E1127AB6BE4A8E332073E982CFB617DD214B103BD551F0D63F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165460, "uuid": "f9b80e1e-a100-4dff-9e9f-89d0fffe4bb3", "value": "768:hqILBdhxPh9deftcG5dm80LyFBWEu/tOr4MkKvlw9QSo8qMaHE1Jom/Zm/NkwZ0X:00z+f2G5dmSBWjV8kZbJqK1RmDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165460, "uuid": "6c74e23f-6142-47ee-95ae-ef912fc15d69", "value": 38116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165460, "uuid": "b00aaca7-01fe-40a8-9be8-e3834ff07631", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165460, "uuid": "afe9a013-3afc-4499-bf8b-d1408d178f07", "value": "61973b176f7bcc837a490b0379aa0bf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ad1385-0ec0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687193031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193031, "uuid": "5119bce6-6832-41e8-a59a-8480b0a568fe", "comment": "Malware payload", "value": "23959126b62d675c8fce384d5aa127a7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193031, "uuid": "fa55412c-046e-4755-8771-5e1257e9950c", "comment": "Malware payload", "value": "826e1858858d3ea6add4809370586c488cdebc4f810ae88cc28ee2b71adea8d5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193031, "uuid": "4f04391f-0563-4e05-a508-1c7355a52246", "comment": "Malware payload", "value": "37c74e8ee7cf5c06bd145e9b6b7a6f7110ad3a12", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193031, "uuid": "e6be1565-da29-4478-9220-925e6450c76e", "comment": "Malware payload", "value": "3cf3f1559b97fdceceb8f77057451ace96c691b8410cc44a82659661fed75b699279b86df82b17bf1251a58b8998cc05", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193031, "uuid": "ab7802f1-5fae-497c-a809-bced1576a7ed", "value": "T1C31633105FA92E2D07BC832C70EE6F1F19F04F11D409A99B63E494C6166FF81597F8AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193031, "uuid": "11a5a285-e068-4ba0-b4e5-6c87b89fc0b6", "value": "49152:pOOYMByVzc0zc3NCLyc8l845WFzrKy7zTEJKUtNfZhu0fP4x:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193031, "uuid": "2addc525-fe88-4d13-b666-8340865c2613", "value": 4188683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193031, "uuid": "f0050e7d-6387-4603-9707-1e428232b2c4", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193031, "uuid": "d1fab728-e4e3-4c86-bbdc-99a9c6eb91dd", "value": "Uzlrz_SC.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a774740-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687174083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174083, "uuid": "83162691-2d23-4c89-9920-c6f988c0ac2b", "comment": "Malware payload (SnakeKeylogger)", "value": "ae6ce9e081ebcad0f1a822c8bf9e8811", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174083, "uuid": "24d53892-a95f-41e6-953e-ddebd533369a", "comment": "Malware payload (SnakeKeylogger)", "value": "82e5621ef317c7895d35697136aba7ac7f91d39ad89570da1946c06df5308c59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174083, "uuid": "844e485f-d442-47c8-9a70-d8c7e5474abe", "comment": "Malware payload (SnakeKeylogger)", "value": "49ab6087e0a643c3ce918e1d32ed8cf9a3bdbed9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174083, "uuid": "702687d4-8013-4403-9750-8784763b0290", "comment": "Malware payload (SnakeKeylogger)", "value": "f9243f51cad02715323c67a4ad56af9b78c5cb993f7bce6927581c92eba10b273273477f2f0303aef4f8543ae5fb1d80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174083, "uuid": "8b04a4cd-eb4d-4e68-b724-cf531aebc531", "value": "T10405E0203AB90B56D47D97F80552A23517FAAE2A783ED3184ED3F0CB1A92F451E52F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174083, "uuid": "bb98426e-4fd2-43a3-bc5c-c9224ec1ec0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174083, "uuid": "42bd17de-9e75-43aa-97eb-46948c0ed9f5", "value": "24576:CQYqtm8OqKszy/KpMkw3hvb21jVgz8to0bHARX:/+8OO+SpMkYhjqgOVHMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174083, "uuid": "da646dbb-393e-45c1-8e37-5346708e5e48", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174083, "uuid": "3c11de31-580f-471b-9001-75239438c397", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174083, "uuid": "228abcbe-1542-49f4-b7d0-3760bed05383", "value": "order6566546663.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1c8564-0e66-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687154412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154412, "uuid": "c4216457-dba6-4b5c-9fc1-18754fbe48da", "comment": "Malware payload (AveMariaRAT)", "value": "486b6b4afc83065bbf9dd0768d0d4ada", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154412, "uuid": "f1f8da25-6ef0-4126-9d62-bfbe55a3918f", "comment": "Malware payload (AveMariaRAT)", "value": "8384d93906d4eb8eca32036235be4fe3f1f7c5c810207a3e9edbc9c30b0d4d22", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154412, "uuid": "a0382707-acc5-4763-b682-0163713e6edd", "comment": "Malware payload (AveMariaRAT)", "value": "d7c0e46766bf801795e3c55bbe45c4579f576f08", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154412, "uuid": "d16a19c6-e73d-4794-94a1-0cd5083cb5dd", "comment": "Malware payload (AveMariaRAT)", "value": "b195b2adba67151fd796830ee63e4490feb8c8071882f2e08d677d124fe14e11b503769b8c9d2f12b218a11566c8d4f2", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154412, "uuid": "6d642a49-6077-4c3a-add2-7941f910c607", "value": "T18F0595B925D026B79435D592C16234C9F2BF631272538D6839D2DFC782A298E37EC80F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154412, "uuid": "bfbab344-5f55-462d-ad8d-43e93357671d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154412, "uuid": "575c04cc-420a-4e0e-aeab-52f656b6ef30", "value": "12288:QFUJC/XbDREe0P+veD7AW4xcOnJxjk3cWq0:wRX7veDF1OnCcX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687154412, "uuid": "7f9d257b-2306-4b78-8b8b-b08e6f2f2f56", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687154412, "uuid": "5e1bc9f5-dabe-453d-ad70-b144589c5bdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154412, "uuid": "e2c1094a-3714-435e-89a3-7feca6ccdfa7", "value": "Purchase Order-Scan 10030022266 - PI.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fceed292-0e66-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687154598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154598, "uuid": "3ed3211f-48b8-47b2-9913-ca96152f9cfa", "comment": "Malware payload (AgentTesla)", "value": "b95a5f3ae661665a4d6b6e52c23990a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154598, "uuid": "087f2672-22ae-456c-9610-3b96edbb7abc", "comment": "Malware payload (AgentTesla)", "value": "8448514c45a1dcc2ddd860c71d806d0da55f35c64dcb8a0afdfba910623a3dd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154598, "uuid": "bc44eae3-3138-4b02-9804-443307e15850", "comment": "Malware payload (AgentTesla)", "value": "210a4c6656438fedf19554cc63d6bc960c2b754f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154598, "uuid": "0f8cb2cf-7503-4384-ae70-aeadc1212fb6", "comment": "Malware payload (AgentTesla)", "value": "de088c7add922c7fc90417edffb8f1bf481d1d697db7e67612750dcbe34c359d385ccbcf82b3a08ea8ab9c3083992498", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154598, "uuid": "33b9d332-9193-4d5a-8b6e-07c3a7fad544", "value": "T14F44234A593893749B575A320AA48BE7B6D920506E3701E865520DB0DC3C7C93F91EFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154598, "uuid": "4235e044-cf94-4755-8632-507df78bafbf", "value": "3072:3sCvb+taFayCWNG1MCuqogSwysb/yYex49ye6tIV3oRcbkoOFZRXcKSsxazsC/Vu:TjCnq/RloyIy3tIVdb0ZwsEFNnzauRwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687154598, "uuid": "385d430d-b1bb-44af-aa2f-1748ac375234", "value": 275198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687154598, "uuid": "8270fe7b-0b80-4d3c-95c7-f708ba811375", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154598, "uuid": "b5da06da-e975-43f6-9583-556af4ed2743", "value": "Request For Quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce4650b-0ec6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1687195776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195776, "uuid": "e97d8c63-70d8-483d-8d40-74b98e76cf41", "comment": "Malware payload (Stealc)", "value": "7ecace070cc8dbab33e967481cb97abd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195776, "uuid": "31aa219d-c5d2-4458-a96b-67b7d5ea2fbd", "comment": "Malware payload (Stealc)", "value": "85225ca4cf9032852692328683a265b5181ecea8287f349ee8078ea74c04d628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195776, "uuid": "2dc791e3-ff17-43ef-97ec-0ed4db843959", "comment": "Malware payload (Stealc)", "value": "497d6d59f0553b8a19d3e2c0b3add9b6b71645e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195776, "uuid": "a755266b-27ad-4ee9-93a8-48193dd1547f", "comment": "Malware payload (Stealc)", "value": "208ee327c2489d597bcf63482318eb333145b06c35a657960d0b20807701df8551e8ea05f6e2e0dc24c9c2e3fc06d134", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195776, "uuid": "edd2756c-090e-4e33-823c-d77ccc7f39e5", "value": "T1636338386F8C5927C66C9D78B1EB022FD3B0AEB73A02E74B9D9171541A367F85C02647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195776, "uuid": "1370f1fb-68dc-4b78-be2d-9b40557114aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195776, "uuid": "17ec0517-4e7c-4f00-be91-1dcb24c58403", "value": "768:2tiCFPCD1YcRSot4tb5ay+lLIqE0y6FsuHYn3CwBrpVLfWsSIoXG:2tzFPi25J+lUqZNFsYY3Cir/faL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687195776, "uuid": "926ccc09-a575-467d-8e97-388ee434cd7a", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687195776, "uuid": "ed2b6b70-459c-4913-bf7e-62543820000e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195776, "uuid": "b320abfd-24a2-4eb2-b891-a79c092fc270", "value": "SecuriteInfo.com.Win32.TrojanX-gen.9046.9577", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfad8d7a-0eb4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687188050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188050, "uuid": "55d81e63-3a98-4dcc-88c4-d1228dfe6002", "comment": "Malware payload (Mirai)", "value": "2bb022fbf29780ec7be601a3e78b2700", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188050, "uuid": "97535de4-f863-4953-beb5-1469e1e864b5", "comment": "Malware payload (Mirai)", "value": "861b834e6cff3c3acb0ea6109255285aab6edc56d857d9e79e748169fe1bb0a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188050, "uuid": "26876091-86fd-4cf3-a4a6-85f11d57fcb2", "comment": "Malware payload (Mirai)", "value": "9e009f29301bea0af29ca531269109d073cbf2ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188050, "uuid": "58ade9e2-8cf1-4197-b24c-21a4fc944fbf", "comment": "Malware payload (Mirai)", "value": "fdf489c2ffb02c81a0b60bee5e3ccf9f2d3bf75553f98d9dfce0ee216073f0caf1de6b0cfeb3b43656838b8bfcc1847a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188050, "uuid": "376c2902-0c49-442e-8444-af3c44290731", "value": "T199C34D42BB580A87F9534DB5293F1BD063AEEE9021F0B684798FD60E8271D772546ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188050, "uuid": "c06e9965-ca41-4031-b429-5d5fdb65e284", "value": "1536:AoqeLRTcQMV70juZLt61gwydrM45PGnj1/0jZVww8eeweQfIt3a+8tNp1COg+v8:AIZMVHtyydHuYZC2eQfItK+oc9+v8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687188050, "uuid": "0a15698f-a90f-4125-83b4-09d1521802e2", "value": 124600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687188050, "uuid": "47b16bb7-ab2d-4b45-a0e7-7d5b4a336c3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188050, "uuid": "8e637eeb-6ce6-4196-8abd-a17b1735750a", "value": "2bb022fbf29780ec7be601a3e78b2700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027a37bb-0e95-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687174364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174364, "uuid": "80d0b2c7-98ad-4f5c-8e63-2e141bafa557", "comment": "Malware payload (Formbook)", "value": "b9165694ebb28de8fb2365b8931b0c32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174364, "uuid": "8dec5839-05be-4d76-8379-23b93ae1a0c4", "comment": "Malware payload (Formbook)", "value": "868c32e8f0d323bf24fbb9c6d073198cdb50a072905ba1f43f3725dceac6863d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174364, "uuid": "4c2a4364-a9ba-458c-a02a-289a887a164b", "comment": "Malware payload (Formbook)", "value": "4b3a1dda39d3b29eed344e002fb93322926b8ab0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174364, "uuid": "c28ada45-8885-4fe2-941a-579bfd1e095b", "comment": "Malware payload (Formbook)", "value": "47d89a0f473c09fae559afffc351569b31f6dfda7efbc436517b240f691308ab6d2f33f7ee134c240a0baa839358fc01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174364, "uuid": "6af8e5b6-8310-4096-9e43-5bac208531fb", "value": "T1A515E1243A791F96E47D97F84552B63107B96A6A783ED7180EC3F4CB2A62F400E91F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174364, "uuid": "eb579d53-0486-44fa-8497-441c038a1eda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174364, "uuid": "e17d1814-21b1-4eae-9261-f97162f4a8af", "value": "24576:AQYqtm8OqK/C8xDoi/l+16zy95RCAPFO80n:x+8O88ewgEgRCAtO80n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174364, "uuid": "fe2111b8-37ed-489f-a913-e4818030b54a", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174364, "uuid": "d966aff1-1a8f-429d-81c3-56ec201a85a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174364, "uuid": "7ac4712a-f108-4a48-b31d-c7188024d795", "value": "34XL7kNrGxnJQId.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48eead2e-0e7e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687164604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164604, "uuid": "68aa9d85-3feb-4fdc-ab0b-f7eeb4dfd0be", "comment": "Malware payload (GuLoader)", "value": "65f94c1c1f147361c1fc1aca505181b2", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164604, "uuid": "14162611-a76b-45b3-9f9c-bb7852a68d59", "comment": "Malware payload (GuLoader)", "value": "87911b480adb77a5d93343d568a4f0ed450b61457373a08f7cded450ae8edb87", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164604, "uuid": "4b6931ca-45b4-4b64-8911-0a9b9ed8d5ac", "comment": "Malware payload (GuLoader)", "value": "776924c2b15494285a9c79ad5615a6e5aa547d10", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164604, "uuid": "bd2b3b34-ccfb-4221-bce9-20e72bcc9d5b", "comment": "Malware payload (GuLoader)", "value": "f60b825d25ec6bffc0451961f649d248f5f578ca6ccc18a94d85cc6b581978cb2da8a2d1e0454ee55ceba3d4d9413db0", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164604, "uuid": "3062fb81-182f-4cc2-8487-e41858c3bb3f", "value": "T189D4237AAEC279068B2E50B1FEC0C6678725B21127151287F7EA60C9C37BC7057AD9F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164604, "uuid": "fc4fbc4f-491f-42f6-98ca-9feefa8e6101", "value": "12288:mHvVT/qLWvUXaPfXdL1SLwXPA/SL4qzLrQb4CbcPaPWdQsFZLbt:OVV9t1bfA/0zLre+dVLbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687164604, "uuid": "8ebf83d3-deb7-4009-b1d4-47bf8c57d2d2", "value": 620724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687164604, "uuid": "cbfbedca-b5d0-495f-a348-fd74103f01fc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164604, "uuid": "517d5a80-1567-446b-a460-aa81b08df21d", "value": "Export SHIPMENT Docs No-285380XXX AWB_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ecb5a1-0e72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687159499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159499, "uuid": "7e514b46-8711-4a5f-ac57-a04ae9cbe945", "comment": "Malware payload (RedLineStealer)", "value": "46bc9e2a70edd134a6420dc4c98a3668", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159499, "uuid": "d22ebe3d-55f0-4862-953f-9f206fd9a092", "comment": "Malware payload (RedLineStealer)", "value": "8794abaf3a4964f9ffbcc0f75bd96af30b4b6b4e307c048eb497ae2dc4458c27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159499, "uuid": "05f00f9a-6d75-478b-a57b-ed1e7f4d255c", "comment": "Malware payload (RedLineStealer)", "value": "2a3341ab80cde0d14be3e701a7c6ccb6b25077c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159499, "uuid": "36755787-e275-4a0a-9015-9ee1391f6c0b", "comment": "Malware payload (RedLineStealer)", "value": "35847da8c440a3cc2c45b3f7cc516db42c5385110fca593f702c1e9b52e25e7d88ab27ac81efb4ce178b604a5fc580a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159499, "uuid": "d6b09615-06a0-4ecf-a2c7-4e5aa3f71279", "value": "T111C49D127980A831D963D038CE37CAB0E16AB6706BD976C7FBC8196D5B219C0EE35735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159499, "uuid": "38b3367e-fb8f-43ed-8d19-5bf1187ac215", "value": "367ec698363d9c97d916349e5b0aa543", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159499, "uuid": "86f79b8c-d15d-40fd-a832-92ae109bae76", "value": "12288:L0BaH7DjoFcnpVvRLxVuPb7w2fGBtoEHLH9vzo90:LWaH7foFcnphsPbc2uBtoEHLH9boW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687159499, "uuid": "fc0cd4cf-a52b-4772-af46-790fe2077059", "value": 569392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687159499, "uuid": "a285a753-3705-4faf-94e2-9a5312d34e42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159499, "uuid": "cbe5d541-c01d-41eb-ab3f-037cd9df07af", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eadc653-0e8d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687171029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171029, "uuid": "782f311a-bd75-4e2f-aa44-814b9b2862d8", "comment": "Malware payload (Mirai)", "value": "2d4f0a11a61d28b8121a5f7f8c2a4256", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171029, "uuid": "89d54c27-2dab-4b32-bc93-9c2bd876ac60", "comment": "Malware payload (Mirai)", "value": "87ca6c78233ff78b1475f2937285d9e507c18fb1a8cc48b03385e93cc7a93cb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171029, "uuid": "a56ced10-fde7-4127-a38b-56675f336852", "comment": "Malware payload (Mirai)", "value": "29a91827313b03419a9a46d3d2a740f6f5c1bad1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171029, "uuid": "e05be80d-a308-4fe4-afa1-9e869b5732ed", "comment": "Malware payload (Mirai)", "value": "194f112f3242bcb90a00e38873adc6f2efd83299eabdfbd5bed2b49267fa04785a339d66f513d536c3bbfbe0f6e9b798", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171029, "uuid": "36706b76-a234-4b9d-87cb-5caf0555034b", "value": "T11733F1B6829BAD71C57056BB1639A49D20062378E3F6F10366614470EACB1F34AFE7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171029, "uuid": "8492ba72-bfd8-45aa-9f5c-602e93a7b6de", "value": "1536:3CoqsGR4eB3g0Vmh1IxIpC8JzL9VE8amFZP7R3/:Soqs2Twh6P8JzLJ9ZP7R3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687171029, "uuid": "8fdb3b1a-7ec6-44e9-a687-bc572c626bb6", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687171029, "uuid": "c3d51ea2-09e6-4132-b552-9ae88adf0279", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171029, "uuid": "d15e2336-7561-4a6f-9bb7-6674f39361a0", "value": "2d4f0a11a61d28b8121a5f7f8c2a4256", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c81564-0ed7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687202957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687202957, "uuid": "6164f838-bcd6-47d2-8aea-799bad6b5886", "comment": "Malware payload", "value": "b931c647143cebbbc702d0ebc229c84d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687202957, "uuid": "d1c947f0-fa6e-4bbc-aa0c-2c6733091476", "comment": "Malware payload", "value": "87f13c0b7ccff74037b4b147a204e0afd850c1af751ddd94a97a809826ed2455", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687202957, "uuid": "7de5e230-d3b5-478c-809c-88296fb3fa7b", "comment": "Malware payload", "value": "255d263994a5effcaed4da6788626b695f88d058", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687202957, "uuid": "3c30e5c6-b6ef-417e-8d87-d10af36eabf4", "comment": "Malware payload", "value": "dacb778f17172a0b0c70eb1d4ca04a97f61d37ae6906af023d6323dc136cdf2fc8cffdaf8005010ec5ffbc023a0cfdce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687202957, "uuid": "0230d3ee-f101-4c66-81d0-52116c8d884d", "value": "T11BD633289D703493ED092F36F9CBEA7FEC58AEDD3C0B55031C3976064A79B066C2645A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687202957, "uuid": "57e06d38-fbd8-4b37-93c7-51efe3294052", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687202957, "uuid": "6fdcdb30-8c23-4097-96ca-acde5adc600c", "value": "393216:IyHnQK7OmtILmr48+z9oVTmwgQBAkVV3KSxeKtt:7nQK7Ttrt6WViw3BAkxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687202957, "uuid": "fa97305f-8f5c-467b-9dc1-9456772e62f5", "value": 13687808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687202957, "uuid": "bd211cde-ece5-4efe-85cb-a9ccb655e092", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687202957, "uuid": "a0866d60-089b-4cb8-a7db-9c305885b556", "value": "SecuriteInfo.com.Trojan.TR.Dropper.MSIL.Gen.18699.4906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2cea50a-0e6f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687158366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158366, "uuid": "08fa8a67-5a7a-44ef-ba73-7f8cd6a440fb", "comment": "Malware payload (AgentTesla)", "value": "4a0c38978e277596499f7bb5461b5d6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158366, "uuid": "cd4ff91b-86c5-4994-afab-3ea2dd05f23a", "comment": "Malware payload (AgentTesla)", "value": "885a126d8abff2e4d272e8df02fb03d836ba078053dc55257860780b0b4b05fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158366, "uuid": "62b725ef-ab6a-44b8-adbd-3b4b711421d0", "comment": "Malware payload (AgentTesla)", "value": "62ead013f5286f1ec319a23b3d939671195f4f3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158366, "uuid": "ef67d402-8db8-4245-9fdf-5e4baf10e810", "comment": "Malware payload (AgentTesla)", "value": "6ed97f2f7feb042a4cf53970b73839cc00f8685023d26821752111f5f2743d58301a2fff6c584c3808e4e778e88beb4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158366, "uuid": "3d463482-1220-4115-a77e-55e56ed83f2a", "value": "T16035F63D1CBE453381B4D6A6DFC5D821F550D1AB32229D3A62C385854A1FA832DCBE7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158366, "uuid": "de51e127-fdee-4f27-b5b8-f8239f33a293", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158366, "uuid": "b58946bd-1395-4901-8ae0-808a00f734db", "value": "12288:clDiGvTq4H+vh9IaBTQTGUH8xa5/3uy/OI/C/1i/lh/bn/mG/Gf/24/4d/Is///X:qota5FuQENLvuQzGqz4Od+I/YY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687158366, "uuid": "3631fcc5-f5b9-42c9-8271-51939d57f629", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687158366, "uuid": "cb718656-4624-4d64-bbc4-9540c35681ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158366, "uuid": "53afa7ef-1a39-433a-a974-c3a6f254964d", "value": "4G0xbEmwg31JViE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0042cf3d-0e9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SpyNote)", "timestamp": 1687176508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176508, "uuid": "dc6bad09-e829-47bc-aa82-7845b662fd30", "comment": "Malware payload (SpyNote)", "value": "1fa7c8046ca2fdfe0c015854d05425ef", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176508, "uuid": "61596a0d-ebf0-4e5d-8da4-5abcee033481", "comment": "Malware payload (SpyNote)", "value": "891c399ec415868c202c0a2314a6e1c79812866735b3961134c4383c880f4aa4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176508, "uuid": "383d0415-d88c-4c34-8ff8-9d4d70082689", "comment": "Malware payload (SpyNote)", "value": "cb50ce574c908ed3d9adeaef9c419bfa93609cb5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176508, "uuid": "ff70305f-2dfb-46f1-ab32-8f639dc1da1f", "comment": "Malware payload (SpyNote)", "value": "dacbca5012574ffb2c460e885628ab1f6a4de22268d435c9edecf41bc8a89bceb84d51ed0b3c678c536618117210683e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176508, "uuid": "82e94520-0783-4889-ad42-7eb9f397359d", "value": "T19E56CFC3B710D4E2D5AB953347199392603B3D698E139AC32E4BBB2C6DF66D05B06DC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176508, "uuid": "d7311a18-9ebe-4a57-8de8-5d583f1f7285", "value": "3072:mWKIyi2Y/3ylzbd0a6No70GGx5W5nH5EtOBzBhqRsVrV+ICO9MYdSk+vwUBqcd6+:Lb/3yLJYGc5W5nG8dVrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176508, "uuid": "1d7a0b35-acf5-46f5-b796-d78da9a82545", "value": 6324602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176508, "uuid": "10276120-7bb1-49f4-acf0-c5344a5f9556", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176508, "uuid": "ad19f350-ae10-4027-8506-5ea7520e8d2c", "value": "SelcukFullHd3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a91845c-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687174163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174163, "uuid": "76bea9a8-604a-4013-b61a-84890d3dd3ea", "comment": "Malware payload (GuLoader)", "value": "d746909bd4eefe8ad41fd21d9a5f6a39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174163, "uuid": "78b95b1a-6417-4ce0-b6c2-3fd90ce38ced", "comment": "Malware payload (GuLoader)", "value": "89991a697d8dc678af18d0eb76eea4f8aee2cb1cdd085f0fcdd77698fdb0d8ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174163, "uuid": "50b44ee3-845c-4291-8b58-98e85bc689b6", "comment": "Malware payload (GuLoader)", "value": "7a2034751aef80bcdf349f84fbd70a74c9222fca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174163, "uuid": "d6705055-710a-4c1d-9bcb-3550861d9286", "comment": "Malware payload (GuLoader)", "value": "cba66b4074745a10a1f1c923f51e4835644d91f4f8e42609d398f85ee397b647b12838d8482c42566061aa690d7902fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174163, "uuid": "f7f4e309-3bf7-4e75-8a70-8a0845373cce", "value": "T113E423A861D542DBD8C481332DFB7F96DAFBFA3711F0C22E17880C6979D112A706A752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174163, "uuid": "b3d2f22c-85a5-4dc5-b269-908be91029e8", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174163, "uuid": "7f1e5d3c-5a8f-421d-9878-db8cdfa600f8", "value": "12288:gMwR+3KhVKrZ1mxAQBScGAhBJEwHzMmUpUZsujDOA6vyiNVPaas:gMwR+3WsWbBScGAhdxyu/n6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174163, "uuid": "2a4d2ab9-5a8b-4f48-a831-83329c5dd6fe", "value": 708795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174163, "uuid": "50de6d28-0e16-45e5-b0bb-1556b70b921a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174163, "uuid": "64949afd-01a9-469d-9017-23837ac117bd", "value": "DEKONT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bed73f6-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165388, "uuid": "f664a2c3-23b9-4cd5-ba3a-ae82aa9d832d", "comment": "Malware payload (Mirai)", "value": "4c45de4fdde9681fb9fa23aceee1d095", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165388, "uuid": "a9e95908-ec69-4076-acdb-c68fb45886a1", "comment": "Malware payload (Mirai)", "value": "8bb692941ae5c30ffaf8756500436918c7d6269fb365559bed55a0977d370556", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165388, "uuid": "a12b39cb-4f71-4837-871c-4829f0712f56", "comment": "Malware payload (Mirai)", "value": "dd7a97fc8eae7b8e8e39389f0b8a3e13d9a6ea9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165388, "uuid": "d8e971e0-0558-44cc-aed4-8cc92d33aa87", "comment": "Malware payload (Mirai)", "value": "cbd7b2d7bc46e20ff11966bd096422148faf4153727a344f28224758fa15487246cccf0a081ae972537740931b65c800", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165388, "uuid": "0f757351-308d-4fad-87c5-f6d0f58d1171", "value": "T18543F855F8818B22C5D4027AF92D118E332367E8E3DFB2139E106F647B8696B0D37D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165388, "uuid": "1e7842c7-0890-4744-92fd-c572e7b8bd39", "value": "1536:BJng2Ke3tTQZoSgLyURLaZv3ezTIMiZ3RihZJZ:o1edT+dCGP3RihZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165388, "uuid": "ba885792-330b-414f-a24f-18648224b751", "value": 58676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165388, "uuid": "eac14b50-353f-49ec-9c8a-2a9ef1e0c645", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165388, "uuid": "4bc3917f-7c45-4f0b-830f-506eaa136b3d", "value": "4c45de4fdde9681fb9fa23aceee1d095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d649f8-0e51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687145278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145278, "uuid": "04a92ad6-3ead-40a0-b2a8-fd334c15357c", "comment": "Malware payload (Gafgyt)", "value": "858b6ca5e2c42f4c0b49443e7f68a65d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145278, "uuid": "792671b2-cd4d-4f5d-920c-378e623de1f2", "comment": "Malware payload (Gafgyt)", "value": "8c57f3391fb6a5a24b1a01582a6639cbf1ca31f9cb0898a5dfcbbcc71fa46fd6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145278, "uuid": "1dfbc96f-185d-43a6-8d8a-5a1a3e54c75a", "comment": "Malware payload (Gafgyt)", "value": "4dbeda6b56a6c74057a501c7dcf362c475ee9f5e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145278, "uuid": "f428431e-f478-43af-a215-763c33237056", "comment": "Malware payload (Gafgyt)", "value": "cba51edd3b1e3ee4d814cc270ac576028393f09b30fc117575457671997a457c2c89758202d80de19d8ecb84f4432166", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145278, "uuid": "ed924800-f766-41cf-af64-471f22878465", "value": "T12FB34C2365A1C67BC48766F92BDB8261D413FC3D1B36620673D87DA92F758C82D6E302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145278, "uuid": "93d46cc2-e16b-4044-b00e-3ef0fcf36a72", "value": "3072:6k0bNgFJz3KzjcwbIoPiKGdso+lammFdPiZpdbXJNU:d0blIiNGYammFdPiZpdbXJNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687145278, "uuid": "190445ea-58b1-4145-a77b-e61b556c30cf", "value": 108894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687145278, "uuid": "ff40fb82-765f-4083-8fde-1458282c7593", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145278, "uuid": "d31f4467-dbe8-4722-b186-ded4b5561c3b", "value": "858b6ca5e2c42f4c0b49443e7f68a65d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97f0752-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687168256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168256, "uuid": "4368c729-c80e-4213-ac9a-a397464cc738", "comment": "Malware payload (Mirai)", "value": "4655f5b83b9e992db1edc637b5d6bd56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168256, "uuid": "686fbf38-7064-4960-ab1e-4f3f838ec8db", "comment": "Malware payload (Mirai)", "value": "8c5ccc12baa8ab66c91e95a6ad279f500284da329e6902e184cdcc44c240b539", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168256, "uuid": "0f0ddb8b-4628-45d8-8803-e93b4e0a5819", "comment": "Malware payload (Mirai)", "value": "9c74be09cd92ae4db633c92631de22238b536d71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168256, "uuid": "110e9638-e6dd-4e9f-bd64-7b2bbf9c68fd", "comment": "Malware payload (Mirai)", "value": "b5edce9644bbf3851600991f6f1f94685c8337cc60ae7cf5a4801387f5716c3de37d5ee069591ce26f548768e846f9a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168256, "uuid": "751e1bc3-e372-46f5-935b-75e45d0c935f", "value": "T10FC34B46EB818B03C4D5177ABAAF42453323D754D3DB73069928AFB43F86BAE4E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168256, "uuid": "bbb1c095-8a03-4121-ac6d-31e05869725e", "value": "3072:+UCN2qRfY+awiEn8BPPYsde9LlQyz/QLM/9Su2U7:+UCtfR1iEn8BPwMepLz/AM/9SPU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168256, "uuid": "d6ca13ef-05fc-49ca-b129-f1aba8437ddc", "value": 126751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168256, "uuid": "3f91cd44-5ca7-479a-bd03-c85ac2e41cf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168256, "uuid": "ab663fe1-1bdb-4049-b2cb-6d92e0422d6d", "value": "4655f5b83b9e992db1edc637b5d6bd56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9d1605-0ea9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687183025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183025, "uuid": "90897c9d-bf46-4ef1-8add-26c43df78b69", "comment": "Malware payload (AgentTesla)", "value": "901a8b668a797004226658495f79f9c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183025, "uuid": "809bacb6-9019-4cfe-b54b-d4ccc56563b5", "comment": "Malware payload (AgentTesla)", "value": "8c87e92f4606b57b1292de938a18cc24e181b521092b17800f8909eb9e135c13", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183025, "uuid": "bc15e764-282c-4ac6-a098-999d8ca2b41d", "comment": "Malware payload (AgentTesla)", "value": "04e2d3790fa8c0eee9193cc680c5ad6b63e0624e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183025, "uuid": "05a7f59e-153e-4c1a-af93-bebdd64ecc34", "comment": "Malware payload (AgentTesla)", "value": "87e2f1505e3c96da5b229b668b8c7b20dfaf520fb22bb416413304c2b8cd40624858e8634bbbaac66b0c21eb85be0fe5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183025, "uuid": "e8165f64-1237-47d6-9e63-5d268b04a1f8", "value": "T18805021026A9CF2AC43F0BF9851010318376626AB437D71B0DC6B5EE6E52BD3955FB8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183025, "uuid": "11e01fa1-8251-4bfc-b26c-d24bf6606b7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183025, "uuid": "f45dcce5-f2ec-4647-8367-f7f6facd8647", "value": "12288:BN6fNa2iNx5LbzIu9+r932acXnI7UJ6eqoifRv1ZmOTKQL2X0E8da2bg4aQ:ga1j5LA9oI7UR9WZmOTKQL2X0pLgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687183025, "uuid": "ee111346-a444-4476-87f0-186163d8461b", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687183025, "uuid": "d6aa1be1-a5b5-4ba2-b75e-76d530fa3a2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183025, "uuid": "0c269bae-758f-46ef-a9af-101b6d7b8e8e", "value": "3EI-QTN-2023-615.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c95091-0ed0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687200039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687200039, "uuid": "5ca01a4c-1e12-4cd0-a0cd-24ebeecaee74", "comment": "Malware payload (RedLineStealer)", "value": "af0ea84e9f5e0e807e2e22972ced75a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687200039, "uuid": "03cc866b-0434-45c5-bf15-a0ddcc878617", "comment": "Malware payload (RedLineStealer)", "value": "8cda7a5efadb2cf190c80bc68ca1847de46c502aa7f7516c84b899a50eb4f89e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687200039, "uuid": "9154d975-5f3e-425b-82e7-a71cc0c8f540", "comment": "Malware payload (RedLineStealer)", "value": "77623b5c529a09c9a45201aa7c85d35696430d60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687200039, "uuid": "a7cc79a5-492d-4973-91b4-c693c72751e4", "comment": "Malware payload (RedLineStealer)", "value": "fa5c6a07533e1df629313cb6f6b792c1dac8b40078cd0bf511e5a5c52bf803736703dc27addf371efe9adc7cbc1fbd9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687200039, "uuid": "30d1d090-a04a-4bef-b6e3-450f15087260", "value": "T1E9052243F6C54477DCB56BB098FB13831A357C605A2843AB2B9B982E1CB32C565317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687200039, "uuid": "09e077f9-159e-4c51-a4e4-289369040b69", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687200039, "uuid": "c29500a6-d72d-4ff0-bbb1-935db2b14bc2", "value": "24576:+y6HMsc5gxgZ4rQ8+XL4mtBK015VrRlEmo:Na+5ogZl8KLZd5Vr/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687200039, "uuid": "cab07336-dfaf-4e46-9434-8f53ce5c46e1", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687200039, "uuid": "1e31cf3e-9494-47ba-8363-5f47f92efca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687200039, "uuid": "13da9dec-66a7-4d2e-86f6-d25a89c0ced0", "value": "af0ea84e9f5e0e807e2e22972ced75a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af21557e-0ecc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687198276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198276, "uuid": "1cd11751-1af9-4822-80b2-e5e987def777", "comment": "Malware payload", "value": "be701a6374595e18df449fc8cbe5d19f", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198276, "uuid": "1a24076e-a426-45bf-88c1-ef26312799c9", "comment": "Malware payload", "value": "8cfab1a4c573103b5b39aed0c2cb8fbcd76d246d7bc106fd0ad1fa6adeff91b9", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198276, "uuid": "ecdbfe48-8aa2-405f-9fec-134ad1d33a56", "comment": "Malware payload", "value": "31d3b11b9e9f2d0f7b51223221060779a3808b6b", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198276, "uuid": "fe7753c8-13e6-44cf-b0e2-37a3b387c6c1", "comment": "Malware payload", "value": "c3b45f4bb7e58a8b1ac366f32cb999f8f3e44437769c1d616f451e982a952f67f7b487159e93dc15ddf20f0bdfe433b9", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198276, "uuid": "b848c6f3-c150-4f24-9493-f4449cf76082", "value": "T158E5AD09B6A6DE67D3D8BB3EA06B51188731C6237712BB1F1B7D01753C927B409423EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198276, "uuid": "36a75e3c-529a-4a2f-9547-b081ffa71ae0", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198276, "uuid": "645703da-d7e5-4f45-8f13-6b25b0a88668", "value": "49152:pD23daq+vtnwypuexkF1VLtVlKAfltLsE28Nv0qnvsol5L7/lXT:pDpwypuexOhtrKAflJMwU81FT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198276, "uuid": "cc62f3c8-0436-4e88-af9b-48bae42fafcb", "value": 3245568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198276, "uuid": "172c00c2-2d27-43da-96c6-3c29ea701133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198276, "uuid": "052b75dd-e214-479d-ac9d-b44f7197e686", "value": "168719827527387cf82250aacadd769835302d474642a03ce46adaa90ebbfbd74cee449cc9838.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ffa0cf-0e67-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687154857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154857, "uuid": "043acbee-319f-4563-a786-cf0d99e93f86", "comment": "Malware payload (AgentTesla)", "value": "e487685270e95e5d3eb242bbcd6afb1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154857, "uuid": "c595d691-19f1-4745-af41-9c9ccf8bc226", "comment": "Malware payload (AgentTesla)", "value": "8dc3d9b99acd1d95d821aadb8ffc1b2e0796fca16e39a6abfe7c50fe32770b69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154857, "uuid": "bd2c3a48-0a5d-4326-ab9d-a6fde327da93", "comment": "Malware payload (AgentTesla)", "value": "ca0b12ffd183badb83074b346bb6cce43f3c37a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154857, "uuid": "81771ae6-da85-4226-bdac-60c703f2acab", "comment": "Malware payload (AgentTesla)", "value": "63964cfd6dc41ab8baf7e8f34d365e83322d77eaddd409808ed02519925a004a86a6529bb9027df304294d7a28447f33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154857, "uuid": "af1eeda6-ec54-4289-9995-5f8095e3ea80", "value": "T11315DF5071989F53E03F87F59192203083F52A23F5BFE78ADDD325EA2D66F918A81583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154857, "uuid": "c0db8b9a-91a9-408b-802b-95744cd6a051", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154857, "uuid": "c1426b63-1fb9-439a-9639-c767616f6cd4", "value": "24576:FxYkZmxCXjZT1S5LA9e2vlnx2siR5/HLZ5:FbXjZTs5LA7vlO/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687154857, "uuid": "304fe89a-c5cd-43c1-a67b-13cccd4e87ad", "value": 891904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687154857, "uuid": "ef48b84f-7898-432d-9810-c459e3891502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154857, "uuid": "b1f39291-60da-4de2-aa7f-3e39c9fb63f4", "value": "8099421157.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28f9294-0e58-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687148487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148487, "uuid": "21d6b613-7f55-4fbc-8064-89e2d3e2ffa7", "comment": "Malware payload (Mirai)", "value": "8379f3d87a9e73a3735a6a8dd23e3907", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148487, "uuid": "ca73a487-2ebc-4570-a857-a5dfb8b5108e", "comment": "Malware payload (Mirai)", "value": "8df0dd92e59e0577d1aa9e2529e012f85355d1a2d0fc208318a5d1b7ad1cf8c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148487, "uuid": "0a9e9caf-0277-4ce4-bcc0-a0127b7a8ba7", "comment": "Malware payload (Mirai)", "value": "1d59a065ea99555126778b00b56c80fae2641a6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148487, "uuid": "9dd17e32-5ac6-4799-b859-809e3202d28f", "comment": "Malware payload (Mirai)", "value": "9c2313252304ecfcfbfc1c5a1197d997a81380f61ec910e061b9450b63aa79c9656712c53ac240e0d1a5ecf7d2e4b1cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148487, "uuid": "00395e8c-99e0-4d2a-9d8c-d8492f8135fc", "value": "T10FE2E179E655B8F6C5B06D72F02E0101E6239BBCF0D1307A26A0ADAC667055C7CE72C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148487, "uuid": "ba2f8460-e1f9-4f82-a328-619d54b0b33b", "value": "768:W0NkiIarqe+RbFWNbud1gmYdWE5CXRSNdQY3UQwv4:W0GakjWcWdWEC8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687148487, "uuid": "028fb0eb-bf9f-4c95-a8c1-089981396ff4", "value": 33896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687148487, "uuid": "6f6799ad-df32-4667-b767-fddebdc4602e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148487, "uuid": "48565e72-6ae2-4f59-ab07-0de269ebd452", "value": "8379f3d87a9e73a3735a6a8dd23e3907", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79ff07f-0e93-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687173836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173836, "uuid": "ba4a8d7c-e84c-4e55-ba3c-374cdabd253c", "comment": "Malware payload (Mirai)", "value": "a61e26900f10c5b978f4aafcfb4bb3e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173836, "uuid": "4969f29b-1528-41b7-9680-79868f9d750e", "comment": "Malware payload (Mirai)", "value": "8e539b06a746b4b246287fd6dc45996fb10e720560097c1b7042d53ba635c9ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173836, "uuid": "29087335-302d-4a90-921b-5f29f73cf94d", "comment": "Malware payload (Mirai)", "value": "57b8a712ef81508402e13c002ca0dc04be96448d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173836, "uuid": "76ffa280-0179-4e4c-af5f-31b4ae7d86da", "comment": "Malware payload (Mirai)", "value": "805eb9880ecf21bc477919f54fe414d563944bbbc686bdbfec1c1d22b873b2a5e63480a53a66f0be5500a01761948090", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173836, "uuid": "fa9913ee-e59a-46d6-8797-fe322c02f1f8", "value": "T1A5A3C419BF510FF3E89BDC378AEC1B01388C959922A47B767574D829F54B24B09D38B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173836, "uuid": "098b41ee-2084-4a00-a102-5acf54cba462", "value": "1536:n6LqZVnoyBqU2hH43+kB4ZIq2B/LodqqRfzZp76/LXaRHwbZnn:n6LqZVnoyBD2hYOk9odqafzDBwbZnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687173836, "uuid": "07611a8e-046f-4f42-a291-506e0fe0f983", "value": 102552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687173836, "uuid": "d50e1d04-fe37-4f74-aa72-74e1a5b6f784", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173836, "uuid": "92f97caf-2a53-4321-b520-192f21071b0b", "value": "a61e26900f10c5b978f4aafcfb4bb3e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da451490-0ec3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687194483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687194483, "uuid": "76319a9b-fd07-4608-871c-eead21d5403d", "comment": "Malware payload (Mirai)", "value": "016834ca448ada0798c86191bd71abf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687194483, "uuid": "33575485-36a9-40d1-9691-431cf981cdc5", "comment": "Malware payload (Mirai)", "value": "8f3dc506a8501c6e52c02572b79d50e024438e0848b94a00f1d1bdc6baefacf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687194483, "uuid": "d686b252-19e0-4622-a538-32790ac482ca", "comment": "Malware payload (Mirai)", "value": "d4d67534ac81969f765da0f15a4eaf14df369681", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687194483, "uuid": "e01bf2a9-d1dc-445f-a5c1-fe6f8226932d", "comment": "Malware payload (Mirai)", "value": "7ac780df4137f379d39e7ddc079c3a22859480a233f721611139e08fe32d97496db7f8d91c7ac1ea80aef0ecaee934ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687194483, "uuid": "c3dac641-1001-4947-ae02-bc4082ea2642", "value": "T116434BC5A593DCF5EC2101742077EF328A77F07E216EEAC3D7C5A632E942902A61729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687194483, "uuid": "6d37f4ff-f6a3-45be-87ac-fde4f9af4e09", "value": "1536:eEyakhCw2+Bem7+y4dB3TkKCIuQc8xqLsa/MLc9h/:khCn+em7+yiIzIvTxKTqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687194483, "uuid": "eee65cab-4bea-4096-8b4b-c9d060d3eb47", "value": 55412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687194483, "uuid": "71b79a2e-6f67-4e3f-b80e-0492c8cc8866", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687194483, "uuid": "fda48e3a-d948-4e49-8237-d76118beef72", "value": "Josho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8c3385-0eb4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687188097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188097, "uuid": "7ca1d388-d334-4543-ad46-68b06dd27df2", "comment": "Malware payload (Mirai)", "value": "247d08aba1c6162d1ac271f0b4cccc04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188097, "uuid": "61005aa0-5bf1-44a3-b5e4-7497594bbd3f", "comment": "Malware payload (Mirai)", "value": "8f5b0b69954ae43fa4dbb5ea5b662e28dbb5e534cb099bcfaf9fcd6e8bddafbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188097, "uuid": "38875426-8824-4baf-ab2f-8d69e7f8152c", "comment": "Malware payload (Mirai)", "value": "2dcd53de8a92fe3b2689657c2ac7351829595215", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188097, "uuid": "6a37fe41-a2c2-4703-bf8a-d7ef7db4afdc", "comment": "Malware payload (Mirai)", "value": "db6e710807f468cc70c70c0d7cb1d291ba8490cd286339611ca5f7abba093bd3a9d079da01171952ba10c8221c9d3e18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188097, "uuid": "250118d4-ba2a-42f5-b0bd-4b55b33d2a99", "value": "T1D6A32C46BCD2DA2AC6D023BBBB6E219D332253E8C2DF7107DC24176C66CA55E1E37641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188097, "uuid": "d5528f4c-a9aa-4550-813b-4845c54cbff6", "value": "1536:7wpncaSZ5LXLQh0JKVyUb/j59Vg79uGhhzuzlnU5db8JHnSaWjdE/NhAWweMp+E1:EoZpXWbjtzWnUnCeHThMp+EZxGWXKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687188097, "uuid": "f73d17da-7a8e-4003-99cf-586ebd6c413e", "value": 101412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687188097, "uuid": "1eadb455-372b-4321-a197-305457de50cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188097, "uuid": "a177f9e3-e2b3-4b65-bf8a-8006538da3d1", "value": "247d08aba1c6162d1ac271f0b4cccc04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa5f5f4-0ea8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687182628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182628, "uuid": "8804dedc-19cc-44ba-a4ca-c0efed6ed2a2", "comment": "Malware payload (RedLineStealer)", "value": "6b277fe9554541bd2fc20b891c8f573d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182628, "uuid": "6a93c812-e1f5-4040-a598-8df7d29c77fc", "comment": "Malware payload (RedLineStealer)", "value": "8f8efee21ad5113fd3fba4b5307a34e637bdc2baa5d1831115ec76a77340324d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182628, "uuid": "d0d3634c-d22f-44f8-a044-df677f153f39", "comment": "Malware payload (RedLineStealer)", "value": "cfa6d5d8e0ea97311faeedac9ef644bbf9f999da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182628, "uuid": "daf09e24-df05-43a1-b8db-661515a7a4df", "comment": "Malware payload (RedLineStealer)", "value": "25630d76715a5c3bab020ebed9c6761c548afed0727cb3e666b1f6f8b4b42aa9b175af3ad4c27dee76fb6be0d3b51265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182628, "uuid": "57eccdd9-ff14-4e7f-b60c-b9838ea76039", "value": "T186D41216A6E45073DCB41B7099F603C30E367CE04C759B6A2709A96F5DB3890B8B277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182628, "uuid": "885f06b0-a25e-47c8-9117-bf9a5983cd57", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182628, "uuid": "48c47f98-967e-4d16-83d7-32b3de166474", "value": "12288:vMrhy90N6EoP5G+4NCo0gFUXWgQcVGQtgbxpz9ZMUakJi:uy/2fCo0/mgdGQCpRmUFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687182628, "uuid": "ff4b9f2f-7f45-4a3e-a7ea-3bb4e912c24a", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687182628, "uuid": "82581648-abe1-4464-9da3-76c42930095a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182628, "uuid": "9a2ef259-b8cb-4494-8cc7-224d295a9f46", "value": "6b277fe9554541bd2fc20b891c8f573d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa57fb1-0eab-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687183827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183827, "uuid": "bc09dfeb-a1c5-4ca8-bc76-7f7a3ca23e50", "comment": "Malware payload (Loki)", "value": "f81ac74e9b4f6699fe4123701c300475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183827, "uuid": "de75d3b2-4096-4b93-bc2e-db5f636e8782", "comment": "Malware payload (Loki)", "value": "9020a50d5dfe5b11c0bcdd1d2c73347de27510eefe67d4d0f37d8d50fe8f40f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183827, "uuid": "9110efa9-76a4-4ce5-8480-d85235453194", "comment": "Malware payload (Loki)", "value": "4e003d1ce2495a7c27c14d8c9e893f87840eb5e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183827, "uuid": "b7ab4184-468f-461e-9316-6d601764cec5", "comment": "Malware payload (Loki)", "value": "95afbc914a5b15cad9e68ce8ee53ad9427dd2507696a580862611f18670890dec6f70c287d597119a96f019a37dfdff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183827, "uuid": "582fb297-04ac-4390-bf3b-db1d11702522", "value": "T1A452A401FBD5E9F3E3758BF89CA332404A647140A851FFAE1C8A483B49B47C14172BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183827, "uuid": "2289091d-9669-4c50-8f1d-19ccddcfb982", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183827, "uuid": "d4092628-661e-4efc-a2da-50842fc8709b", "value": "192:dcyeYOFKOpyhWnE798uUAuoB28GNPklM:dcbYeyhOE798uvs8ikl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687183827, "uuid": "be47f1f5-7d16-4750-9acd-d69d8ba7ae12", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687183827, "uuid": "28215970-4da7-4a57-ae09-cd1eeaa03806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183827, "uuid": "d0d8822a-e2f5-4b2b-9a55-ec3ff0e20959", "value": "_CN01 _REG1 _RSPVLN2 _333.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3ee060-0ebb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687190729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687190729, "uuid": "492f3ae1-6279-4153-9d52-581e1d505db5", "comment": "Malware payload (RedLineStealer)", "value": "e3d3c8d0922463ddd899be6bfac3fd90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687190729, "uuid": "0ec0d2f3-ee5b-4d0b-9b05-b8df528a9f14", "comment": "Malware payload (RedLineStealer)", "value": "90531a072264396851ce29352bf7dd57b4fa45bf4046d99feb45bba12785f44e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687190729, "uuid": "487bafac-059b-47a2-8d93-38607d98910b", "comment": "Malware payload (RedLineStealer)", "value": "488b8c7a14bc96d6d5a28fe0516d0fc270264e87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687190729, "uuid": "ec0ded46-68f2-48b2-accd-e69e89a62199", "comment": "Malware payload (RedLineStealer)", "value": "3f030c227d430582947d466dea42cdfa68adac87df172d4e16d251cf1dc5e25f1154292f9846f8325e3987d33b345e3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687190729, "uuid": "1b0ac490-e9c1-4e8e-b533-de3243517269", "value": "T10ED41253B7D89472DCB227B048F702C30A797DA04E3497BA3644AD490D73698B976B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687190729, "uuid": "48091ce2-49cc-4d85-bc8d-6edb241e5348", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687190729, "uuid": "c923cda1-317a-4065-8349-89983996ff13", "value": "12288:EMrfy90Cwave36rjiNoU7hdazxkCD9LXs/ThFJGmb96smA:zyW6E3dkx5e/Tb0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687190729, "uuid": "9f368beb-05d5-47a9-a054-1acfae2362e7", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687190729, "uuid": "9435fd67-695b-4881-b9f8-b0cc2d0a750f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687190729, "uuid": "d77ff79b-9f20-4449-9184-65a974fd48be", "value": "e3d3c8d0922463ddd899be6bfac3fd90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fb3b2f-0ec9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687196783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196783, "uuid": "661d70b1-4d82-4773-b92d-3d95148360a7", "comment": "Malware payload (Mirai)", "value": "5e5842fb1e312bc96738ca05db1d0dff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196783, "uuid": "561b977f-97e6-413d-b3d9-0b8dd73de316", "comment": "Malware payload (Mirai)", "value": "90ad975de41eb17ae47ffde5f8e584a463a2522f339e4e375b44dec6eb1b794d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196783, "uuid": "43152b9f-0836-42ea-ba31-5d0ebae33fee", "comment": "Malware payload (Mirai)", "value": "a15b6346dd66b0bfbec9b1b3527feddf16b5daa9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196783, "uuid": "50f9dfff-a1e5-47bf-abb6-0097025b4efa", "comment": "Malware payload (Mirai)", "value": "367e8e3be24919300601aa80f03303e274c7929a59e4312178856fc8aecf5bdd4858e858d882e8124a4f73eb6f9ca893", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196783, "uuid": "caf6a9f5-358f-4352-bc2d-f71d7c341743", "value": "T10C83D605BF611FF7E8AFDC3749A92B05288D661B22B93B35B934D418F24B25F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196783, "uuid": "bc97ba83-28a2-4132-be9c-a823b9dfd38c", "value": "1536:5KsnLHUvpGvY3ll6GMTcpCdGZLHryZ1I10u:5KsL4pwYpgG1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687196783, "uuid": "e618ac41-feb4-4555-bd12-4fb2cf6c51dd", "value": 81400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687196783, "uuid": "e50fe668-7db8-493a-b1cd-fa848c539b78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196783, "uuid": "6b315297-1860-43ad-9944-30e7f0ace35b", "value": "5e5842fb1e312bc96738ca05db1d0dff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60889938-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687175381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175381, "uuid": "9973792b-667f-46b2-a073-76f43cfaa894", "comment": "Malware payload (Loki)", "value": "160564d2769f8c20fac79dac04770f0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175381, "uuid": "18ef7882-e1f6-4c0b-a139-f45ad8396a4f", "comment": "Malware payload (Loki)", "value": "91321c08c110e660a62e8d49e19a6f501d1cc617ddf6abdd88ae7e15b443d242", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175381, "uuid": "41d29f9a-3bf7-41f4-9096-157cd8b26782", "comment": "Malware payload (Loki)", "value": "ea0d59f43e60bd9e8f132cdf7d778603dad95177", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175381, "uuid": "3be9a2e4-9cc1-46ab-9257-50f9bb5f8c5a", "comment": "Malware payload (Loki)", "value": "14cf3d8ea6f205612292eef21dbb0f9866b98c972eae5af9ffb66dd5dbdcdb59199ff35b2ddf9816eb914484492beb42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175381, "uuid": "f29b9e14-08f8-4abb-be7c-6c5984f22a95", "value": "T17E05E1207AB90F92E47997F44155B23107FA6A6A743ED7184EC7F0DB1A62F450E82F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175381, "uuid": "990c74cd-1a0e-465d-8857-86cc96a22ba5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175381, "uuid": "691d905f-7f88-494d-a91e-6ef46e19a2ea", "value": "12288:rNcOFYtYq7J3At5iHOq+ZQC6Z+99Tzj9AMcyejIJi8zvqDbFa3wcvrY9w4:1QYqtm8OqKr6CTzqlZjzTdAYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175381, "uuid": "a3a7497d-5524-491c-98b2-29e059c3237e", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175381, "uuid": "d73032b0-e59a-4b4a-87cb-9fcce673eada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175381, "uuid": "3dae0114-065d-4479-9111-51003ab93d63", "value": "160564d2769f8c20fac79dac04770f0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c6e01a-0ebe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687192199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192199, "uuid": "e705c262-755a-401b-ac54-e38eee947133", "comment": "Malware payload (AgentTesla)", "value": "9f267c0ba6f34cb308c56de832132f16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192199, "uuid": "1c409028-341e-48f4-9fb3-b657f8f79d84", "comment": "Malware payload (AgentTesla)", "value": "91e338abb8128082665e15d9a5e928ba94eb65c29f69956c69c8a450146be279", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192199, "uuid": "a6a81d84-f278-4e6e-b5d5-275918956401", "comment": "Malware payload (AgentTesla)", "value": "52344d39095b9d534bb458449571f7586b230d86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192199, "uuid": "966a938e-c662-4df3-93f3-bc2a12e50405", "comment": "Malware payload (AgentTesla)", "value": "ff7a66c1c7f47f3e82b96f3ec4c97e5dbdacb0a034774e510afed40c5488a55f83f92b3aea6a8e1213205204367c7c74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192199, "uuid": "e43fe643-04d0-445c-be80-712b5baec5d2", "value": "T1CCE4124B1D52B712D4460BB399246ABC062F0EADBCFAE2578D4FB1E8D773B801421D67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192199, "uuid": "d6d6dbef-85b0-42be-8331-46cb85bb07cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192199, "uuid": "3a92dfb1-dd6b-4376-af63-9b4832e20720", "value": "12288:T5LbzIu9+r9haUfNCO/u9rKll+JO4LTVwbbZu5ddKk:T5LA9ha79YS9wnZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687192199, "uuid": "4107877c-61ee-404c-b0c2-e6958c7e5ab5", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687192199, "uuid": "ce42a003-ba27-47be-9cbc-4c995b8add96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192199, "uuid": "b636716d-b428-41c6-8b0f-24b88e138b2c", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d8c7b4-0e38-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687134474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134474, "uuid": "cbacb463-7c05-46e2-a59d-07ebdaaa7f5a", "comment": "Malware payload (Amadey)", "value": "dfed765124e2ea34356f8c06804b16d5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134474, "uuid": "d394a5c0-4a95-4743-8825-928869781e56", "comment": "Malware payload (Amadey)", "value": "920c92ca857ff279701f4af7fe7d039ff62ccc29afd565cda438feb05619aae8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134474, "uuid": "95f85019-2294-44fc-b80f-cf7b7d0c5536", "comment": "Malware payload (Amadey)", "value": "51797c082338a5b1f36f3b9b8bba5a56e82dcac0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134474, "uuid": "9d8ce6a8-901a-4c21-932f-548a5f33c20b", "comment": "Malware payload (Amadey)", "value": "99d8b28be928b65e1d952d72bd803b7f253881274b394ac0908f39e1d9148c877e6fd302ae4d71905c5466bbe6e0168a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134474, "uuid": "d47d3902-9420-41b8-84a9-58ddfbe151dd", "value": "T1E4546E125CAEF7E0F406D83E654AC107E97699717E7486C22F820EF2057AF845FBC9A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134474, "uuid": "39b5385e-1452-456c-8f61-e24f6e803916", "value": "b88ff38d8a9dd531263365f3574a285e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134474, "uuid": "5433806e-721d-4f6e-bbdd-bac15f8b8ddb", "value": "6144:IGYZatOVBV44zWAdPPzLqsGLWA/DwtDq:I0tOfV446AdPPnGCA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687134474, "uuid": "7407f3ba-3668-48cb-acd5-1224b2e09fbf", "value": 291842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687134474, "uuid": "18592114-4a79-4dab-ba74-347135f52f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134474, "uuid": "ab89854c-815a-4027-9ece-64041cbe3478", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9e2496-0e8d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687171003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171003, "uuid": "ff7faa62-bb85-49af-b7a5-12fbf537a885", "comment": "Malware payload (Mirai)", "value": "85967214c9a4291fff27bb3a8ec607af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171003, "uuid": "b4eeeb11-7163-4f88-af71-8f8c4c854903", "comment": "Malware payload (Mirai)", "value": "92f5ea680694c9796c6ff0c18178c4c4b8ee60db67d75cbca87d43bc3b15e75b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171003, "uuid": "53fac594-6c1c-4ca8-9f55-814e2e1619f3", "comment": "Malware payload (Mirai)", "value": "fe367f82d47f789a8bd7a9d0ca746a35316ee992", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171003, "uuid": "03b2c015-bdbe-4ad7-a97c-691aa11d90f6", "comment": "Malware payload (Mirai)", "value": "028b9a30eca180a0518fc879156a196019cdff5031d8e1e64bca80a7ce99da5dddeb45fccdbdff491b9bf8ec756daed8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171003, "uuid": "c211c209-657b-42fb-a12c-7351cd148bfd", "value": "T19B538D75D12DAEA8C0424AB4A9598E704F13A0C046733EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171003, "uuid": "382ea9b2-7087-4965-9d30-6f5032d82669", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687171003, "uuid": "81ff8891-7c7e-45b6-966a-19e4b59be983", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687171003, "uuid": "f2b45fb8-b86e-4ba5-bcfc-3f84a3757348", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171003, "uuid": "1e166318-5f34-4ace-89b3-a758ef3b4e44", "value": "85967214c9a4291fff27bb3a8ec607af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e7fd48-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687175263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175263, "uuid": "0efa1166-8c6c-438b-ab1b-a49f8d1f3a00", "comment": "Malware payload (AgentTesla)", "value": "09eff523a00021c1218fbe4dd7e8484a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175263, "uuid": "b4f14e53-927b-48a0-b4fb-73b48c7ee7ac", "comment": "Malware payload (AgentTesla)", "value": "9322aba6565a41f6866f5641f577fc6f7605b131a1ef15d737bb42e029743fa7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175263, "uuid": "6fe8da18-a4c1-4e98-a0d1-d6d260f9db60", "comment": "Malware payload (AgentTesla)", "value": "1211953d2b3404eeb1ff1fabaaa24d4f393c13a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175263, "uuid": "6fb5b3b5-adf5-4a9f-b982-0becb948a11d", "comment": "Malware payload (AgentTesla)", "value": "a4a1e5e09520bfcf5b6c9afbed6ae29262c3e6601b34e0b7385321ce7f655f70362ce1cc8361eb0a7e4d5bc1fb68be38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175263, "uuid": "2092093d-4ec6-4adf-81b3-6400ce015948", "value": "T19805A6B929D026B7D435D592C15234C9F6BF631272538D6839D2DEC782A298E37EC80F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175263, "uuid": "3750b958-7168-4694-bcc3-2a665d91a945", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175263, "uuid": "f4eeb39a-d2a9-4392-ae7e-7f4cdecc18c2", "value": "12288:dXBZicXe+GZpkWyHcKPTWJhFmg66STqdQQpvRE2:RSP1aMgQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175263, "uuid": "f13ad515-df1c-4c84-9e62-96a98795727d", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175263, "uuid": "d3bc6757-1931-4c02-af97-a0d909692b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175263, "uuid": "62cf9783-2827-4612-995b-94d8dce47da1", "value": "09eff523a00021c1218fbe4dd7e8484a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c51d70-0ec6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687195768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195768, "uuid": "6ea5cd00-4df0-4531-99be-7d58f67a1d46", "comment": "Malware payload", "value": "1bc0f83cee094c71669abc46e224c7fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195768, "uuid": "91cdcb24-e761-44a3-96f8-14f993d87df6", "comment": "Malware payload", "value": "9365d597ca0963c7828bceb3f849b29e64bb064c3aec53036d8a551cd9608a20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195768, "uuid": "f2f9a1bb-cba7-43c9-bdb3-65c7bc50e6d2", "comment": "Malware payload", "value": "3a657b2f5a4609624ba05d5f77ae89e6d287b023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195768, "uuid": "462a3655-ec55-42aa-b43b-5dbbfcce372c", "comment": "Malware payload", "value": "a1696faf412cf1b5e161994996f17636170e5e574f3637228d258640f045146fd02dee4f83b38df904aa7573d138afa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195768, "uuid": "ff6a751f-8aa2-4e75-8528-7834caa8fa0c", "value": "T129D633DC47F855FDC2CC9AFAD68D34008B902DB15E97DBC8A868906905F4AB1241FE9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195768, "uuid": "a8f4121f-59f7-421e-8ae6-7e56a325c7bc", "value": "196608:uIYMfZexq8CtQT09lgDbfJJ7l8aoO2kU2AHUGONW4Puk6+tg0NIQa5RwvFpIk:uIhxSqgulg5JBLoJkDNGIW/V06SNpIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687195768, "uuid": "fab98b46-476f-49d2-91cf-9768915c30d4", "value": 12678656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687195768, "uuid": "2debb647-cc1c-4f11-9e1e-b40834198704", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195768, "uuid": "4f74299d-432e-4c8a-8610-48e3e6a1f1e6", "value": "SecuriteInfo.com.Win64.TrojanX-gen.30334.27956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77654462-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687174131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174131, "uuid": "f46c0753-9aee-4229-89cf-3557902b6e83", "comment": "Malware payload (Formbook)", "value": "6331c9fe72be8b908696264f2d18413f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174131, "uuid": "cc7896f1-a0d8-4229-9bf3-82fbfd0b5dba", "comment": "Malware payload (Formbook)", "value": "941f029da26d98f5005bb47b1c5ea697ef97ec2e179b106bd0b40dc52ba32583", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174131, "uuid": "aa4bc34a-43cb-4175-a96c-31188ca4b064", "comment": "Malware payload (Formbook)", "value": "e49ea0059ca2f6b663eb9639a7e275956f6f44da", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174131, "uuid": "734becaf-7ffd-4ea7-9757-7da56c86edaa", "comment": "Malware payload (Formbook)", "value": "5b16baa794e0e3b87e1e0920da92ea09d03000dd064b5cb63fa74e70e96d6b6f21b8bcc1a57e34c1958931615ae5b2c4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174131, "uuid": "50cf4413-93b9-4e9c-9833-db06be1665dd", "value": "T16575AFF876047DD6666F176BCE96ACED13B616239ACBA4CC80647BC305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174131, "uuid": "7f2b51db-5d68-4d9f-8de0-5ff966fac2b4", "value": "24576:qf4uxGjH2kQ2FlVPTuVf60E5IlMRSUxavdRRd5fqAQEFRR2OVyGK53gg/mHojL+6:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174131, "uuid": "7ef6e61e-b0ea-4df8-8584-23998f8680c7", "value": 1602335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174131, "uuid": "33694a82-3692-47c3-8c5b-2a767b543a8b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174131, "uuid": "a7b1ad95-424f-45e3-9e99-9cb245e9985f", "value": "RFQ-3252010628.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b2ff63-0eb7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687189193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687189193, "uuid": "da24b0e3-3ec4-4246-931e-49639b68dedc", "comment": "Malware payload (RemcosRAT)", "value": "9c8e8620335c7907b76eefcb25e5d1c0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687189193, "uuid": "42f237be-acb6-4944-a7d0-e0e661c34fc0", "comment": "Malware payload (RemcosRAT)", "value": "9483e96760c36e3321a8ccba6968aa4c1707f0cf91fd48fbb7d8afca6006e91e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687189193, "uuid": "82e998be-d024-4bb3-a7c9-5e95e56311ac", "comment": "Malware payload (RemcosRAT)", "value": "554363ba858d87eb268fcab8b9fd24b4eabfed99", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687189193, "uuid": "47014330-8049-4c6e-83cf-244476851e79", "comment": "Malware payload (RemcosRAT)", "value": "6a39fea272f54f8bf013f2f456e35add07910912283fc5b5684b6a7fe5f0ee1153e9980f40cfd9429eeb2beb3ac8ff07", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687189193, "uuid": "c2e40afb-0af6-40a8-a53e-d5d1c8424012", "value": "T192E44F6056EE110CF6E2B7871AE83CD6CE0B72169D3A91EBA54847170F67F427D22732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687189193, "uuid": "933289c3-ec5b-4aa5-b7c8-a4f426132887", "value": "1536:aQvgYcpa5U+ogsUJW4Wrle/PhG+/kery+bGWh4y1+M0F+MS+hnk/QtlMMESOgjAt:9gYcpl+og0S711+M0WQE/GZqem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687189193, "uuid": "e5e40a01-5925-44c1-87ff-ac8aed65283f", "value": 669222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687189193, "uuid": "213e12a9-a1fb-4cce-8316-5c06d4459b81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687189193, "uuid": "ea9e5c92-188e-4343-89a7-90ed2ba3a1bb", "value": "JKTR002238591_ppwk.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afed04b9-0ea4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687181098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181098, "uuid": "64462050-4d6e-4c75-8b97-d08e226cc04e", "comment": "Malware payload", "value": "a854052ac245c7cd3448501c04123f16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181098, "uuid": "ef05cc61-08fb-4be2-9151-de81849b91ce", "comment": "Malware payload", "value": "94d83a6c7b331500b58597d9fc609b250a6ae3edf9ee62b5d0e87a690e69e492", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181098, "uuid": "484b8410-46f8-461d-a7c2-b67e6602f25e", "comment": "Malware payload", "value": "d45ee7fb6e60bac471b2823611594e0ca7d3776e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181098, "uuid": "ff606a60-179b-42a9-a08f-ba6f1444e172", "comment": "Malware payload", "value": "34ea6604e8adbb724dbe46e418c13a88bef1615feb99e14f5a7e00f0655c660f8a80bf83859afbb98c25d9575a1801f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181098, "uuid": "9c57a323-3718-45ab-905e-7839c7a4d924", "value": "T18B854D047FAA4611D822563C88A6C274A635BC901F3D86DBF2C57E2F7E325E06E32757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181098, "uuid": "f086f99e-fb0d-4cb3-a807-070494f8fed9", "value": "1e36deb42b4a97dda659ddbe9b7dfbfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181098, "uuid": "c21be5fa-7b41-492a-bbc3-f5a399722f99", "value": "12288:nm8C7Z5TzsdOOTVg2ssUma3o5xhUEaYxNRYAoHuTCWjYOnZyvaSXKPXPiXuHNHG3:m8gZ5HsQOvsi5xhvzRYbHMCaYOnZyv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687181098, "uuid": "9481c778-c4d1-4ea1-99a4-16e131f02b78", "value": 1818624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687181098, "uuid": "f943b05a-3306-464e-b4df-3eb047755d91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181098, "uuid": "dbcf8c90-9e5f-4eb2-af75-a3b779bde33a", "value": "999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1bbcd7-0eaf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687185628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687185628, "uuid": "caeabccb-33d2-4c3d-9bc3-f42f6457a89c", "comment": "Malware payload (RedLineStealer)", "value": "96982b99f1aa1a4965802db1db9bf35c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687185628, "uuid": "49b59e1f-06e2-4ae8-8f70-ee4719e0c2ec", "comment": "Malware payload (RedLineStealer)", "value": "94ebb573c419aa5212d6bb085568c0c0f63dfb98fc01b9296ef233d2d3e8ed09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687185628, "uuid": "7a630f4b-1647-4427-ab38-5183a2c1a844", "comment": "Malware payload (RedLineStealer)", "value": "7878bb3139e388a8e822cf06e87c4789f37c4928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687185628, "uuid": "b9cba4c0-cc98-4bad-a977-eade71ee10c0", "comment": "Malware payload (RedLineStealer)", "value": "0d833807dbfb88674cb1dd763d4169be1328b0a28d7c9a3c493f9404bcabb6734e0e88fa34410459231b7385c1a9d99a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687185628, "uuid": "271a54f5-4dbe-4087-bc54-9b6435f6ce92", "value": "T11F543A0FB5C50336E471103D2BB02956ECEDBC910D34EDB73A6CC369156ABE2A9690DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687185628, "uuid": "0d3c0d56-f0a0-4ec3-b5d0-848a8e225069", "value": "d91fa928c738702455bfa66ac3685503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687185628, "uuid": "e0577c51-9045-4108-88ea-dde9d3653ba1", "value": "6144:FVO+r2HQ0FKHgKNRBH13TLxNP9T0x+SRMN:O+iQzgMLxNFYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687185628, "uuid": "c1a6cbfb-bfd1-4673-9054-70adaff0f11b", "value": 279042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687185628, "uuid": "9ac49420-d575-4a83-b53b-413b1a22d89f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687185628, "uuid": "c83217e0-0261-49b9-aee6-bda33d02185a", "value": "96982b99f1aa1a4965802db1db9bf35c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734ede7b-0e65-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687153938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153938, "uuid": "7b5c8e9a-19d5-4814-8c28-66b98f13ef36", "comment": "Malware payload (AgentTesla)", "value": "6b92d1c63c108259a3bc6c234071a57a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153938, "uuid": "8a0090c2-60c5-4c78-a3b6-c193127b9b7d", "comment": "Malware payload (AgentTesla)", "value": "950550a4e068a1811cafb2c591903f86299a5674aa18aba3afe9bb3eccd3a200", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153938, "uuid": "5b5c1bec-c928-46fb-8b51-ebc3f8ff89d3", "comment": "Malware payload (AgentTesla)", "value": "d2e52addf6391e1c9e4ece84e6f3e6313ec67813", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153938, "uuid": "c5704902-f9e5-46db-a8e8-46d85267cae2", "comment": "Malware payload (AgentTesla)", "value": "c26bcff28056bd91715740875bf5334e3af0bd720d2eece9384f6bd1e511d4dacd7ac70d9d8075f02bc9009c825f4c98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153938, "uuid": "a21595e6-07f1-42c0-b59a-1b72614ff17e", "value": "T17735C33E9CBE42376670C6A6CF94B866F094D3B731121D39A4D35289862BD4B3AC713D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153938, "uuid": "d961b199-6873-498f-94d8-d60faac832a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153938, "uuid": "f294fa9b-a89c-4709-8de7-26468c7f5b34", "value": "12288:rfUJlWxR5T31xWKBvxTdFBFp8NnBvlr0:r8oR5TlYKBtdvXMnBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687153938, "uuid": "26cd717f-6beb-496f-b05f-d54a6e2a1885", "value": 1145344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687153938, "uuid": "ff758fba-9acf-4a3e-a9b3-f337ac6c26e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153938, "uuid": "a2ac7053-f482-4092-b470-b7c18002909c", "value": "6b92d1c63c108259a3bc6c234071a57a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be4bc18-0e7a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162891, "uuid": "6706e5aa-9535-4f49-a567-fbbc6224e004", "comment": "Malware payload (Mirai)", "value": "d2ce0cb009638a7d35ef9c0bf2c52aa3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162891, "uuid": "d4843071-fea6-4c07-b9e6-bac2a701cd94", "comment": "Malware payload (Mirai)", "value": "950d85afe9dbefd16e035226a693534c55d8246944a2d22d81ba8f063e75a69e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162891, "uuid": "4dd828a3-5a54-496d-bd29-e79ba20c870b", "comment": "Malware payload (Mirai)", "value": "ddb86237c335f87787eefae037d50b5716605d76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162891, "uuid": "1ae668c3-37f4-41b3-910d-2aea360848bf", "comment": "Malware payload (Mirai)", "value": "ebd227f3b1c366f0b1c48f5cf331134ab139723c643626f76d3a3495c0bc91b2e2c3e4d14e36965c9a1895e031743183", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162891, "uuid": "e8dd2f13-2c63-4782-81a0-60dafbac4a3c", "value": "T118436B25BD762D27C0E1A07911F74B11B9B553CE26E4861E7DB20E8EFF256402A03EF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162891, "uuid": "1e9c6c9c-3a08-44de-a520-271fd573de7d", "value": "768:SuoowlEgStBq6HATin+GCCpw8K2sBvO+TAyZwmJh+0V0U8Yfx9K:Su/wlrStBq6HATin+GCdBTumfjV04fC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162891, "uuid": "a8d99d7b-85ef-4dcf-aae8-413c90e61f78", "value": 59792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162891, "uuid": "c10ca32d-79df-450e-bca7-9888744c862e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162891, "uuid": "67919c40-61d2-48d1-9e9b-125c61a2df71", "value": "d2ce0cb009638a7d35ef9c0bf2c52aa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3214de3-0e73-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Cybergate)", "timestamp": 1687160112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160112, "uuid": "bd2461eb-13c1-4954-98d3-c3d21d31acbf", "comment": "Malware payload (Cybergate)", "value": "b1d44434ea98598a0b5ebe609c5dfdeb", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160112, "uuid": "6387ce68-4f9d-444e-9073-0511552e0d55", "comment": "Malware payload (Cybergate)", "value": "968575226d09ba5d3d0b02b3f68aeac03c7b132738bd8f86e7b308f7a19567a5", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160112, "uuid": "3e202734-0134-493e-a52b-ac7c270b8684", "comment": "Malware payload (Cybergate)", "value": "de504a3912477d59e0ad74244cbc9009e7dd144a", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160112, "uuid": "2385f7f0-a2ba-4bfe-8249-09b97ed16f70", "comment": "Malware payload (Cybergate)", "value": "0ff705416efdad8fb739667668473e209f602b90ac21357df4a720e18a4662c5084e0c2cc9a9aac5c66604dde42d222c", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160112, "uuid": "0bfe5ff6-1134-4db2-addf-145068ded83b", "value": "T1B7F3128364887587E6E2FC3B475E85D88993F0681B11B61B5A37C381167BFC924879F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160112, "uuid": "5b1e6972-d014-437d-92b4-9d5cc46ae0f0", "value": "af3a53dc2c98a991ba1dce2892f83a77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160112, "uuid": "d66f0984-5545-4600-9930-1e930a90531d", "value": "3072:UvisDdyaMVRzm1zBkvbuVIzI5WOqOScOEwBNzG1Phri:UjyaMVRWXL5fScOPBNCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160112, "uuid": "bd721b5b-d586-42b8-8331-04a4834bfaac", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160112, "uuid": "40ba252f-6e0b-4130-b36d-d2f84dece551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160112, "uuid": "593a1fae-d3e5-48ec-aff9-3ddc6231cf70", "value": "b1d44434ea98598a0b5ebe609c5dfdeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c67fc41-0ec0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687193064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193064, "uuid": "d3d3aafb-7a12-442f-a022-d857052f01a2", "comment": "Malware payload", "value": "8757405d9bfef11c286ba4112d55f0ff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193064, "uuid": "01b6ea36-1880-4d42-8401-9e1824bba1bc", "comment": "Malware payload", "value": "96c602f7cdbaba1e36f2527f6947814892abf4d3d7ef4d937088feb5e0fd0c3f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193064, "uuid": "33ca3d08-c95d-48ef-a361-754b87f2cef7", "comment": "Malware payload", "value": "698c77d2b444afd608931078b3fea8c76a4a74c3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193064, "uuid": "765faadf-b48f-4ae4-b94f-dea503368d05", "comment": "Malware payload", "value": "cc8b37862c1a649cf1848ada94fbef143d53a1fc58dea3739a2a1ddef4827a22972784718e1b4d1de477a506e977b8c9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193064, "uuid": "006dc264-e44a-471f-a502-b42747cefbc9", "value": "T1657412409E977DD397786218F16E7BA93692687A53C48CAB19F88083CB3F55E1B80F50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193064, "uuid": "fcbfea10-08d5-4e69-9029-b81592654829", "value": "6144:v+uhVhi1suxMERSBpSy9zzNlDwAaWpToO6oIpH1UomMeQUkiH0/rl3d0aIFv:2ulG9RSyEfDwlk6oIpeom5zkRjlWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193064, "uuid": "70f78e6d-3cf5-44fa-aaef-6571be0530c7", "value": 358755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193064, "uuid": "d8c4cc38-5bfb-44c5-afd0-055281daf101", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193064, "uuid": "eabfcf07-acf9-4610-b3c1-13bf2cd14da1", "value": "Amadey_SC.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2aff7a-0eb2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687187128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187128, "uuid": "b0d032a8-7951-4d58-b77a-dd68953c4df6", "comment": "Malware payload (Amadey)", "value": "88f7f25645f1f0ba5366d3d4218bc21b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187128, "uuid": "469f71b3-57b4-4aab-9d9b-24841651850f", "comment": "Malware payload (Amadey)", "value": "96dfbeb4b1e3c2102d109dec4e932518c76f9d4fba55b8593ec5e27db10d4e8f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187128, "uuid": "2873ecbc-c9a9-418b-9293-4df465730ced", "comment": "Malware payload (Amadey)", "value": "6af295d3e50cdc2f3b880030eed855fb7ab62fb6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187128, "uuid": "9bde5c3b-79f0-4a26-880e-6b97bc635f76", "comment": "Malware payload (Amadey)", "value": "11ca7041d7c6d1288b2ea49961865978eb8e8a58961a279bd8f1300010b8e00f8f1dd9e1f8d132e7fcff67966172d5b7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187128, "uuid": "8f3802ce-7f55-4be2-b42b-99447ce801a8", "value": "T1EC05125BB2D844B6CCF42BB059FB03471A367C7109B482AF37AAB60E0DB2694643575F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187128, "uuid": "1863c286-e934-41e1-9b44-75f4fe1ffbe0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187128, "uuid": "70d25638-13c9-4d57-823a-d5eb6d2bf88a", "value": "12288:TMrky90SFPV48V6A+UTkaGjEDVhXtfg37HhbBOyVpxhTxsg4Pmjg0Y+aqPkkZ05J:zyXW8x+7aGmhXtI37FbumMx+GltGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687187128, "uuid": "1f892c3a-9095-4577-9ec0-9e70f1beab79", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687187128, "uuid": "beedfae1-8b2a-475d-b044-86c9d5298d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187128, "uuid": "3e2c2ef6-b248-4972-ab15-bb4c4a4c16f8", "value": "88f7f25645f1f0ba5366d3d4218bc21b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5487dba8-0eb1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687186528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186528, "uuid": "a5358efd-b5f3-4607-a3c4-d0c982599aa5", "comment": "Malware payload (RedLineStealer)", "value": "fa8f577968d8fb7546413e8e33a4e055", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186528, "uuid": "703c1a64-0850-4a63-a306-b78d439fe137", "comment": "Malware payload (RedLineStealer)", "value": "96e45d33cf7e671adafb99d4e650d51930eff09ba7397b0ad0b40f8b796f27a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186528, "uuid": "f5e3cc62-a63d-4e5b-82ea-9b1e691c6654", "comment": "Malware payload (RedLineStealer)", "value": "2b2769e3a18d727fc778f517509424ba9e8959f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186528, "uuid": "254a0a3b-ecf0-40c8-af23-e712c1470feb", "comment": "Malware payload (RedLineStealer)", "value": "21c6048a6af4c882517c91090680414e6e80d5da74e4b966838cd98dd5b8ac7cbfc637f4a1a117ec128197a0316a520c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186528, "uuid": "9da56597-6a1a-4db3-bb6b-a2e3d7899d41", "value": "T1AED41246A3CD8473D8B527B02DB603C31F367CE66D74427B2A91A86E1C33784A9717A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186528, "uuid": "274a252a-8e73-4ca6-9135-58c47f0f18ac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186528, "uuid": "2c495e8c-26d3-4b6b-8b8e-9d2060e46b52", "value": "12288:mMrBny90+ctqFgzEPiLmotysqNCmU1aLRUakQRz3W7iEzqn:vyRrkmotyzlXRUakubEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687186528, "uuid": "16878d8d-62f0-4255-a2cd-ff4bc37d8598", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687186528, "uuid": "64dcfc0a-efae-41c7-af92-5ad9a0504457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186528, "uuid": "307f94b8-089f-4463-be1b-54d6a9a1369c", "value": "fa8f577968d8fb7546413e8e33a4e055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a574634c-0e68-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687155311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155311, "uuid": "c9b3568f-0c81-4b96-9452-882934a2dbab", "comment": "Malware payload (RedLineStealer)", "value": "9a22a6bd6362a9457d29c7b9ff216d30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155311, "uuid": "6874711a-0f12-44e8-a7ef-546d17b1e2de", "comment": "Malware payload (RedLineStealer)", "value": "96fa761d563bae8ae4e1f0d5c6c4fafb69ef05a30843c1fc732eadd81ade56cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155311, "uuid": "04430622-bfa8-4409-baab-e0a366fec032", "comment": "Malware payload (RedLineStealer)", "value": "38a748807ecb7238755f88dbd62f92b6eb436889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155311, "uuid": "3cdf9225-ac9d-4323-8e59-3ca23d68d183", "comment": "Malware payload (RedLineStealer)", "value": "920f2df7fd6db9db4ea870fd85d8eaf401f80fa2cf5f0b391132241d8c97a37b8321f14fc3fc2d5cdfae938afef3b0bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155311, "uuid": "afa9f084-3d81-49a8-b9c6-a3e3b841d564", "value": "T1F1D4AE126690927BCEB2303C8B5C96EC496AE0680F1914DFE7DC855F0A271A3B53EFD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155311, "uuid": "8099b63f-b19a-49fa-af56-d67d3f168f13", "value": "367ec698363d9c97d916349e5b0aa543", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155311, "uuid": "5eee9791-4360-45da-882b-9c9ee0aea323", "value": "12288:LdVaH7DjoFcnpVvRLxVuPb7w2fPDdflbURWxApwEqo9t9D:LfaH7foFcnphsPbc23sRuYfqoHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687155311, "uuid": "8ff1857a-7255-473d-ac81-b8e622494ea9", "value": 609208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687155311, "uuid": "39096526-7505-4eb9-9443-d5ad61113b61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155311, "uuid": "4e7b9b71-d720-49a8-bd5c-fa569273b348", "value": "9a22a6bd6362a9457d29c7b9ff216d30.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2bdac9-0ec2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687193898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193898, "uuid": "99e5c0f9-6f93-495a-975e-5cba3c6a0c35", "comment": "Malware payload (AgentTesla)", "value": "99a77bd8f75fd2652edaa880ca1bae26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193898, "uuid": "4824a599-fc40-434e-bbe6-5482829b83b9", "comment": "Malware payload (AgentTesla)", "value": "97289b7b81716c422ed44dc42d80db0ba56989bff3a879d31a28b935686475bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193898, "uuid": "4563c2ae-0cc5-4057-9221-a524c9f26d3a", "comment": "Malware payload (AgentTesla)", "value": "e47b3ae787fdb6ba78965b8eaeb4aed7d27d6d09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193898, "uuid": "0a9017a3-5970-4148-a417-934ef26eb023", "comment": "Malware payload (AgentTesla)", "value": "8cc9ee42f389672886a4344ce256d029c328414359ee00a2eb47608362819e26e3d600a278adaf6cc1cb6b47109dfd6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193898, "uuid": "46ad8af3-c4c5-47b9-826c-f5f610142c0e", "value": "T1B605F1887520B1DFC85BCE7589643D74AA2925BB670BE303995325D9EA0DBCBCF101E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193898, "uuid": "ad7101ab-c34f-466e-85dc-20744c57176e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193898, "uuid": "71708d5e-2da9-4e4e-be1b-5ced1e6d0aa4", "value": "12288:w4QXgtYq7J3At5iHOq+ZQgBi4Y7bWm08xtlHR9/NHpcs42wWq5Dy/K2ticd1+ekw:w47Yqtm8OqKVGSzOF7N2R2wdoRti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193898, "uuid": "567454b9-4394-4cb5-ac60-c0bca8fc3fd2", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193898, "uuid": "2282cc5f-cbd5-4445-a199-c232925bb9cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193898, "uuid": "9f9436b5-5bbc-4835-b6d5-fd328acf1c27", "value": "Modis list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a59568f-0e81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165788, "uuid": "a1a14738-3340-4a44-a3a9-0021b6e78791", "comment": "Malware payload (Mirai)", "value": "f584f2e2829b5735397b3604744f2f66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165788, "uuid": "f929d208-3f84-4065-a8a1-74534922489b", "comment": "Malware payload (Mirai)", "value": "984c175a59b5324b837387c4a905398a79e56218755bddeac4350784b8083e99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165788, "uuid": "431315ff-c70b-4887-b64a-1ea5a624244c", "comment": "Malware payload (Mirai)", "value": "584160a188d371e669814c43b981f062b0182bdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165788, "uuid": "ae547ad3-ef84-46f2-99d1-9f3c129ed4ea", "comment": "Malware payload (Mirai)", "value": "b21eb128dec06b50a416f4ecff433dd7009e1bd32bfa1be03e175112a57234348c1f44e465d9403431a1eccd22015697", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165788, "uuid": "748ee5f0-1d76-4833-be70-66da27cc7971", "value": "T19CD30845F8519F23CAD512BBFB5E428D372A1768D2EE72039D256F20378B85B0E3B146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165788, "uuid": "871c4ada-1111-483b-b5b9-06fbd06b31c9", "value": "1536:BN/6/Gf7wmBL5a9S1vbU8Ow4QFVAO3x4VCgkhoTFYlP9GCfazxperPZl7xwywTiw:BN/6/y6SlGwdFVf4QmZYlP9Ip4WDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165788, "uuid": "4b042c89-9f3b-461e-92a7-fc83bd62131e", "value": 142124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165788, "uuid": "64aa4745-d3f8-4671-8ffc-a8eac1babbbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165788, "uuid": "1a7c215c-0d3a-478b-99ec-f7d03dc229e9", "value": "f584f2e2829b5735397b3604744f2f66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c70462-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687175289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175289, "uuid": "380be0ac-cb9e-4d51-8e62-0b6793d10c63", "comment": "Malware payload (GCleaner)", "value": "69cef88c855f1c5fcc25653b2a8ae84a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175289, "uuid": "50d13103-76dd-4aba-96c7-ea1e6e7a9253", "comment": "Malware payload (GCleaner)", "value": "985b88797ecf30c9ad70a565cdd1d42c3ff3e8a55ba2c94b0edd5fb57bec4d92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175289, "uuid": "50c3b73e-004b-48b6-b40b-6198e307e463", "comment": "Malware payload (GCleaner)", "value": "250983761fbe9e117796ec69f23bd062b2734cc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175289, "uuid": "1944d43e-364d-416a-893c-950b00425835", "comment": "Malware payload (GCleaner)", "value": "d91aaa9b7edcbb66b9d6445e90472bbfc352a3ccb8316faaf2c2cd1e90280d19ac0e752775c18d8ad69662c25bfc7e17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175289, "uuid": "559dc8a0-3250-444f-8f0e-0ae9d60a6173", "value": "T1D1749D4396E13C64ED258B728E2FC6F87A1EF6504F093BE622189A6F45711F2E633351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175289, "uuid": "74fa943f-96d4-49e1-9f64-f91204c1451c", "value": "90a8b2b6ad978d000a5ba3658ad3f7fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175289, "uuid": "18f65ff5-d285-4b68-b5cd-37bb59afdfe2", "value": "6144:lGHP24tpUnTdBa9o2/bvmzle2uhbDASsBLOiGgBHqLQ3:EbUnhBaN/bvm5sBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175289, "uuid": "792f7b70-abbf-42bf-a804-d50c6de71213", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175289, "uuid": "7274605c-f2a8-4cd7-8f8d-68bbb6c98439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175289, "uuid": "6bdf9919-94f0-417b-b8db-fbd4249d950d", "value": "69cef88c855f1c5fcc25653b2a8ae84a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b1acf1-0e68-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1687155343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155343, "uuid": "061d19f0-945b-4e99-86a7-f5e8a363d609", "comment": "Malware payload (Smoke Loader)", "value": "62d9c0b55691f707659ad1f18ff2c03e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155343, "uuid": "f4a6bee9-8986-41f7-bc49-7d55733a8ab4", "comment": "Malware payload (Smoke Loader)", "value": "98b27b7cbd09060529a96314c59b8f91d5f3e0887eb126f1e7e81972c96fa67c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155343, "uuid": "8d75d9a1-172c-4aa5-95cb-83ce3cd48c5f", "comment": "Malware payload (Smoke Loader)", "value": "50a89639ac8a2360b9b8a39f345d10985c5a415b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155343, "uuid": "070d6fd8-2101-4bae-8d31-8c4622c9a3c4", "comment": "Malware payload (Smoke Loader)", "value": "3dbadef47a11e51fd6c4afe43b9464ceeabfe03c4723cec4bce1184fee1a55cd90933ede05a6fc0a3b35af2d106fc1a1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155343, "uuid": "43e0990d-8173-4344-863f-d30468ce98d7", "value": "T117827D6D8A885429D38BC1F55110635CE268FD32C17F3F266A70E2EC4DB14DA3B31A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155343, "uuid": "f23ad5a9-3ea3-4276-af30-870aaac1a642", "value": "384:cQ5nD0qNBCGx+xQxa7bohBCf/368Qk50av+5QnXPRSRB02j:z6ax+xQxibr368R06EmXPRSAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687155343, "uuid": "37ff5d80-1d2c-48dd-a0d1-4be050d29987", "value": 18636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687155343, "uuid": "bf5956f5-d2d6-49de-a218-fb982d0d466f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155343, "uuid": "7a1febca-fc4f-48c8-b440-a7be6c42f3a8", "value": "Suntrust Bank MT103847594826190623.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8855ed71-0e79-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162563, "uuid": "f59a8355-f763-4908-983e-73fdffa5641f", "comment": "Malware payload (Mirai)", "value": "a96e372ed5f8f9852fa21d99dd3977fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162563, "uuid": "dca07e72-069d-4b58-b519-950f59735168", "comment": "Malware payload (Mirai)", "value": "99c21f8e53aeea54f4d2b86ab1ac5e80b444404c29791ed9062ed3bbd91d4ae2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162563, "uuid": "ae8bcbf5-52fb-4fce-9b08-d39af615b3e6", "comment": "Malware payload (Mirai)", "value": "3ea392df0ddd3c28655d37b6225cd24bb158629d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162563, "uuid": "2b5666c8-3e15-4a14-b7d8-5e2ed69d16bb", "comment": "Malware payload (Mirai)", "value": "77dd71a5be8942c5ee1f97916eda4efd1c615fd1e408bdaab14ef0648cdcf2dd01c585d34a3621af07e4be200fe6c6ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162563, "uuid": "143adb1c-8975-44f9-b900-c5dae2cb4b5d", "value": "T1A3336C36E029DED0C6560134A4E88FB51F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162563, "uuid": "b4119fe8-90d2-4673-bb4b-4072f7906750", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9Zm3CZQoV/bnmCozw:Oa4U7G7SvT6ftBcm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162563, "uuid": "24b12744-7ab8-4b44-8a26-a7a25b08e199", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162563, "uuid": "92b426e2-883f-404e-ae1a-6ff0b74091c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162563, "uuid": "815b0b8c-baa7-44c5-8351-db60955fd336", "value": "a96e372ed5f8f9852fa21d99dd3977fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26619966-0ec9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687196759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196759, "uuid": "16c07482-637e-4c3f-be0d-1285d7ebb3c8", "comment": "Malware payload (Mirai)", "value": "69031e61d4942dc3cb0c1d77687ada41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196759, "uuid": "63883f97-0278-401b-b1f0-9ff8936f806f", "comment": "Malware payload (Mirai)", "value": "99ec49d7490149f19539c2d67bb96d410cbd03f584f3a9970a15c31b7c35743a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196759, "uuid": "b23b7909-d518-44f4-a181-67b9fe7906ad", "comment": "Malware payload (Mirai)", "value": "f140cf9add71f03543856142c6ab38a1dddee96c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196759, "uuid": "60ab0b23-7fbd-4be3-a629-e581a3fe2942", "comment": "Malware payload (Mirai)", "value": "886e2fa34386344babc6609476429be3b53cb80f091ff1668f54248888cc17fefede153dd4ee6e8304dc853a434b99cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196759, "uuid": "c28dfe35-9d19-4107-8250-3404f175deb4", "value": "T1903329A1B8D19A2AC2D013BBFA6E919D332173E8D2DF3213CC141B546BC951E5E77B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196759, "uuid": "98bccbba-ea3b-4b94-9d96-3e12597ffd1f", "value": "1536:MCDPg+5fZw3/W2K5X6Q/eqyahW7C0CsI10+:dDPvfLp6Yeq9h4hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687196759, "uuid": "6db40b17-3160-4dbd-a8a6-5a5a65054cb8", "value": 52280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687196759, "uuid": "32362e42-ea03-4fa7-882e-997511ddec48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196759, "uuid": "d670453a-8ba5-4136-b71c-5d221932e702", "value": "69031e61d4942dc3cb0c1d77687ada41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7063ea-0e9c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687177520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687177520, "uuid": "e3c8b64b-2111-4e55-b8ce-090f3b31e994", "comment": "Malware payload (Amadey)", "value": "564c2a4df4d47876643931597ec9570c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687177520, "uuid": "dfc53294-86eb-419b-a548-7b65bf1a2e8c", "comment": "Malware payload (Amadey)", "value": "9ab55d3242777bc911d575af8f1a91d891d4fce2f979eabfdcff158a8a78d6da", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687177520, "uuid": "1d8dc2e5-f67e-489d-a54a-2544ee63447a", "comment": "Malware payload (Amadey)", "value": "5c2b2b753f16c2bb8ffd31870ee02912c26a6b22", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687177520, "uuid": "ff3fd4a3-7eaa-46de-8a8e-8899e46a9012", "comment": "Malware payload (Amadey)", "value": "948d8e189ec49567ce8feab05f0498d88f986036981a224885b95b647bfb3037a3a526cad09bfd3abe965710664074ee", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687177520, "uuid": "8f6215e3-2d4b-40bf-a152-48664717f4d5", "value": "T102D41283E6E84032EEB217711CF703C31B367DA289798397238A245B5DB25D59935B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687177520, "uuid": "07404243-b349-4380-a57b-9f8640d43329", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687177520, "uuid": "7f55e55a-8cd6-4b9f-a4c2-9306aca19be9", "value": "12288:FMrfy901oy/G0KejPGNILgyv2jiwWJ9soh+Gk7pXYIWM:yyVL07bRgyv2WL/ToGAXYIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687177520, "uuid": "07f97543-61be-46a3-b860-0bb187e03b64", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687177520, "uuid": "0a67a5c6-8258-4b4a-b4a0-408b0dcea208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687177520, "uuid": "f2120cf5-28f2-4006-9404-2e5915cb4743", "value": "564c2a4df4d47876643931597ec9570c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1844cb-0ec0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1687192926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192926, "uuid": "9b2a2d9d-9bfa-447c-a69a-100029b78308", "comment": "Malware payload (STRRAT)", "value": "aab0e96ae1075cead7040e56c7e907e9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192926, "uuid": "9d4c55f6-1ecb-4a63-a052-457b55f00263", "comment": "Malware payload (STRRAT)", "value": "9abdb3f20f276e4ad06483b19ce8f6c0a29e6f0802da7436a06e6651ba3f7490", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192926, "uuid": "25f90e4c-1235-4c75-bddc-9b1da1b1beba", "comment": "Malware payload (STRRAT)", "value": "7405ecaaacea052c97a5d8b06a86bc7ac0c855fa", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192926, "uuid": "f46221d3-9bc3-4d6f-a788-adc5633e6c4a", "comment": "Malware payload (STRRAT)", "value": "9af27c6890cf954ca5a9ccdc70ca96eb95fad1c1aa3d9b338b2b538b46fc6b41f52714ed6d8f27a62474c2386c30284a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192926, "uuid": "acbe1696-7793-4ae2-a6b5-c05b9bc06eba", "value": "T19624018FA9B942F6C1ABD632124E9233774D4284F549E03FE4EC1195EEB0D6D5D8288F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192926, "uuid": "5af4d1bd-58ce-4cf8-add9-91a88e8b584e", "value": "6144:j/ZqtyAW+u8cX2qQUaC01ZDuwcMGLMg5TBwW:jUtjM8cX2qmTP8M6B/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687192926, "uuid": "6796d538-15ce-4c21-b9c7-4381b1c36baa", "value": 223167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687192926, "uuid": "cfc9c8be-9f27-4a3f-a7a0-a24841eca405", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192926, "uuid": "313216c1-56fc-4c32-be9c-f24e69c5bd3b", "value": "3PU004731 MPR D2000 WK 24 BERNULY SUPPLY CO LTD.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83243f9-0e9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687176870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176870, "uuid": "983c8cbd-6dbc-4aee-87b6-9805bd8b01e8", "comment": "Malware payload (Mirai)", "value": "4f3e6836b17683e30bde9fbd46bcb59b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176870, "uuid": "3e6c1126-3074-4be0-9ade-7997a37c1840", "comment": "Malware payload (Mirai)", "value": "9ba00eb800045eeb8804689aba34f98ec5b89648cf1eab3376b1a06193f38efe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176870, "uuid": "ca2ea49d-3e0b-4350-a60d-eb095e1da5fd", "comment": "Malware payload (Mirai)", "value": "a0c56696eecc7b6a6f6f9c7ddfc55959e8a6c02e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176870, "uuid": "027d903c-afc9-474a-8235-adeb6f1eabe1", "comment": "Malware payload (Mirai)", "value": "7336c248b7de029b1f9d6065b74aee8a67e40cd16435010484fe34db23a7820b3a5ea4e81c42d2affb11225938f0e926", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176870, "uuid": "58e0bf63-3eca-4d12-8304-ff6e0dda2228", "value": "T17933F956FC818A12C5D412BAFA2D118D33132778E3DFB3129E116F24778A96F0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176870, "uuid": "2c6c055e-a5a8-4049-a92d-d278691aab4b", "value": "768:IRnUfpyHHzt8G+k3nqmceoK9S5Nwzq4SyQUsaGUbfum7L94IvLLio4mKvvAXqgV:IRnUkHD+k4KW88yaaGaP+I/io4ZvvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176870, "uuid": "0bee133b-5286-45d2-b1df-acd95ca48212", "value": 50380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176870, "uuid": "ef60c131-c2c5-4f6b-80a0-a3652ecd2dc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176870, "uuid": "f5b6d14e-8f24-4c00-8c91-e9954ea12a8b", "value": "4f3e6836b17683e30bde9fbd46bcb59b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885bd082-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687168147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168147, "uuid": "0837d8b4-4166-42e7-a4a9-3c34cfdb6503", "comment": "Malware payload", "value": "d73d564352a7b073131b14fa334e51d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168147, "uuid": "7007b448-11ac-4ffb-80b3-f91122fdd27c", "comment": "Malware payload", "value": "9c727a905bcb757da8d5117f775d50dbc3133b962cb2ea422d8ea4ed25611b8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168147, "uuid": "cc67dc2b-2c45-4ac4-83b3-e21897bc1d0f", "comment": "Malware payload", "value": "bf87c9f21a8f4e8137d5d8339d802db650b13f5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168147, "uuid": "fef41fc8-67da-4193-8771-4ca02bec7aef", "comment": "Malware payload", "value": "05e95e1fbddb3f773972378398e2b2b14375f845ab83d3ae74847a9e914181758f1d4e301a7383e67e64efabc05c451c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168147, "uuid": "ae9593d7-0762-4108-9b8f-d82ac1a25a2e", "value": "T1C98523310C1728A391671A04C2968EC3BDBD31631AF2E97165E41BFF3687B94F9E1167", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168147, "uuid": "23305c69-c30e-4b1c-a8f2-ec5dea1eb34c", "value": "49152:7aDJQN0rrAeYQAj9g7Jx9k+jOBAO/R64I7koRcNy4fg4I6:7qQYrAVefSKOxbI7koS64I6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168147, "uuid": "c87bef9a-088d-4745-b42d-c6874ed7654f", "value": 1816799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168147, "uuid": "32331beb-8e84-4744-b7c4-6173ef5a36f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168147, "uuid": "d00032bb-fd8c-4cb7-9eff-7c379437acaf", "value": "d73d564352a7b073131b14fa334e51d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d39f4f-0ea5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687181455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181455, "uuid": "d7cd7198-bac1-478f-9e7c-5746499b0c95", "comment": "Malware payload (Formbook)", "value": "0b842e5ed7c7ce391f6ae0fad582e86a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181455, "uuid": "bf3eb638-4de4-49f5-ad92-270964df9694", "comment": "Malware payload (Formbook)", "value": "9d9e8ec84f674a2484716075dd29db7677057598a3ef9b1d0f8dd4addfac24da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181455, "uuid": "74f22f43-47b5-43f9-ba41-e4a774be3bc0", "comment": "Malware payload (Formbook)", "value": "8e79884bf429cf615822d67af8040f67b1bc9e3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181455, "uuid": "9fe005d2-0a48-46f4-8fd6-f18c55867e9b", "comment": "Malware payload (Formbook)", "value": "65659b73170f2ed58eebcb083f8b38a1a87cb9a3ec4d613937b4f920f46b1dc83fd1ccbb1dc653c296d58bcdf4d2f67d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181455, "uuid": "efd4c18e-c329-4db4-ac11-83790709099f", "value": "T1401512463110490BC27A7BFA8F11A2B433FF57CE7A1AE3CB1D5BA1859CD6F4A1710A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181455, "uuid": "99962d10-4d32-40ec-9846-c81c2dd98435", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181455, "uuid": "411ced04-3b7e-42eb-88ff-e18014804714", "value": "24576:XTgG1tCueiW4p4RWAiMz/dq0WZSYiQj+dwZX:DgqtCDiWxRWhi/w0WZ1iQJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687181455, "uuid": "742ea6a2-31aa-4975-bd92-05b57fc0a289", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687181455, "uuid": "4db3daaa-d3b1-4381-9f02-70309667d7dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181455, "uuid": "b43a77a6-6dbb-4968-96a7-0d12b54ff74a", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663c8eab-0ec0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687193000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193000, "uuid": "66890ca2-dfbf-422b-b3bc-7b87ddf59fe4", "comment": "Malware payload (Amadey)", "value": "2a4f1b025428014f0217bf88463bbdea", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193000, "uuid": "08b9a718-0a85-4a02-984f-f29c42e123f8", "comment": "Malware payload (Amadey)", "value": "9e8117a83d4bf36a81551ad646feea4aa9bb990e7633f48cb062847155177935", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193000, "uuid": "464a142e-81fb-4494-9eb4-ef9ebf3a399e", "comment": "Malware payload (Amadey)", "value": "3941603eefaeabaa047f05c4e465885757556623", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193000, "uuid": "7f2ea801-4501-4f13-b889-b7060334e506", "comment": "Malware payload (Amadey)", "value": "07c37765735beba634f512e427e8d08e0847ab18b8cd25402a81aa2d0f12f071c7da029cd4cda0dc5fbcbba71729895a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193000, "uuid": "b0a3a3eb-4503-431e-8fe8-8b3df73144f2", "value": "T194F53310997A5CBD0639D33C7D7F1B2F6B908AD89159E3CB93A16186138FFD211338A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193000, "uuid": "ab68d21a-7f28-48d5-98c0-73241f57d4aa", "value": "49152:BN0LB6KQivP7wHdz8lEtjodNtLBIpqJ9alAkak3bkW87Sj42R:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193000, "uuid": "28b9a5ba-1ab0-46a2-98dd-32c2615a5242", "value": 3504213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193000, "uuid": "105d27b3-cc5e-44bb-868e-4be0a28ae316", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193000, "uuid": "58d85e6f-b8db-4ad5-9d4a-87ead06c72fe", "value": "csg20.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6f1c84-0e65-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687153931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153931, "uuid": "3e5f7c6e-ee0e-441b-b288-4cda8950012a", "comment": "Malware payload (Mirai)", "value": "b0232f1fb3de3332d48c5f6c7d3993b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153931, "uuid": "4d2992b2-9a90-4483-a0bb-a4db8dd3676f", "comment": "Malware payload (Mirai)", "value": "9eb0d02e997ae68918849e98a881c0304dce20c247e6fcaf2b1faa7a56a2a6df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153931, "uuid": "1f736d2d-a0cd-4a5d-a794-0d3973fd05db", "comment": "Malware payload (Mirai)", "value": "25ddb9d984466c35226a8c0088c0a42741cac8f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153931, "uuid": "bbc97927-0c95-4325-9690-8f9c4ed0d6e1", "comment": "Malware payload (Mirai)", "value": "8d35b21a537e30ccdbc84a9d14f2fb260f50a6da227de28b63e84540c508d73215921453ea13bd813601da8beb4fa746", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153931, "uuid": "d456637e-e0a5-4485-9ae0-262eadf19bcf", "value": "T1DCC2E1A285FBC607DC7343791838196360685C58E34DEE3D172BEAD813884E72AB6C93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153931, "uuid": "9a6e2e3c-2e15-47be-b60c-305e51e01cf7", "value": "384:MRG99WXUx5+bkbRaliVErjrL9VD9jPwrSaf5bwIB5/8x2BYFydHY0sNDZvzbSNH9:95+Kcrb9VDJef5Q2PdHuzb8HoEPbVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687153931, "uuid": "eec412ad-b013-4d23-b765-b1f6b964f2a6", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687153931, "uuid": "9b9af2e2-ff73-46d7-8741-d291a2aee096", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153931, "uuid": "e7e9bc15-6285-49eb-917c-c972c146635d", "value": "b0232f1fb3de3332d48c5f6c7d3993b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fff7bc4-0eab-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687183836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183836, "uuid": "5490a794-1c30-4b3c-a01f-1c388a2d6060", "comment": "Malware payload (AgentTesla)", "value": "0aa04f249eaece97140ad4ff7bc00420", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183836, "uuid": "5e60b7e6-9ad1-4929-9dc0-4d5e7101ed74", "comment": "Malware payload (AgentTesla)", "value": "9ed9d37ed2bad5f93fe5f80d396c6a075be44a60312ea033a8d4eb3be772b4f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183836, "uuid": "ac197e7a-a56d-48cc-9d9d-e495e48027ed", "comment": "Malware payload (AgentTesla)", "value": "4cb79679a05b197ba21489fc362e0d91ae2c3b06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183836, "uuid": "a5b06874-d3a2-48db-a655-0f7b485429f1", "comment": "Malware payload (AgentTesla)", "value": "e123c9abaac7b8dca13e62d1cd1a4d7eeae1c63c79fadfd88d4f80684ecee41e6bcf130ae5e57c3aca94a931545de505", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183836, "uuid": "ba8e967a-3f1a-4a50-90b8-5dd271278e97", "value": "T15252B430B3F4D022D5AA82B48A9AC07053F26C7CDCC5C66EFCC6256A5D727D016171AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183836, "uuid": "27209b63-c671-4eca-8823-5551ac07865c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183836, "uuid": "83c8c81a-4b60-44f2-9f49-da9caf73ad7f", "value": "192:k0OejvqLK915glsNhYkCeXicN+gp7cCBR2D9UFay:klLaTglsNvCeXicNrZO9UFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687183836, "uuid": "7286dec6-9233-4017-925b-db15a6272440", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687183836, "uuid": "f5ba0629-6a3e-4f49-9526-02c7a2b44d09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183836, "uuid": "94c2f8ba-bb15-4548-9819-2d5492760566", "value": "DHL RPA GRBP Template.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3fa6a57-0ecc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687198392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198392, "uuid": "436b07c9-6fb5-4252-97ed-874bd4ad62bc", "comment": "Malware payload (Formbook)", "value": "eda1022afe1dc9b41921387b6f68ec3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198392, "uuid": "646976a6-275b-4529-85b1-50d4bb16a04f", "comment": "Malware payload (Formbook)", "value": "9f1420487a2b2524edd7c0f411bae2edf072bcc44dd97374cc5cb3e8163e319a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198392, "uuid": "12108adf-38c1-4768-8b39-05b50d6a63a4", "comment": "Malware payload (Formbook)", "value": "2e786bc0df81185e84e47b832c85bc3eaa21b81d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198392, "uuid": "a09877b7-e60b-4ea3-b8ea-5484cc7dbdd1", "comment": "Malware payload (Formbook)", "value": "ffd0af322c9d143129fba2ba02113e33c0a7faccf097bc6e6d2ae9ce84f323c2f8b5a318b9a88e0c5865ed255be2dbb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198392, "uuid": "771b1fe6-7ce4-4f7a-b1b5-28f363581651", "value": "T13E44121761E4C1A3E9E30A311D3E1BA73EF9E12220A5B7677B901B0D7D12592CA4E3E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198392, "uuid": "eb1f291b-c3c4-4038-b148-68d5d8411510", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198392, "uuid": "73252deb-6af3-49ee-85d9-53b95aaa35b2", "value": "6144:/Ya6pTojl28rwBk5f2+f3geayurSejrMVcDyCnRbUE8:/Y7ToJEW5e+f3gq6rIcDyCRYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198392, "uuid": "1f064425-cf0b-4cfa-ae73-ac514eec4b49", "value": 272496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198392, "uuid": "01efb9e5-d188-4480-88af-931bf5ce299b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198392, "uuid": "b4fc29eb-a5d7-429b-b3ac-a63a73adbd44", "value": "z1M96230600360.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec0e185-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687175351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175351, "uuid": "9b796602-d027-4e3d-811e-45439158f666", "comment": "Malware payload (GCleaner)", "value": "5c9a0ef5d64e0e41cfd134ca656a5d1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175351, "uuid": "95472763-4dc5-4737-b08c-83c2e3e18661", "comment": "Malware payload (GCleaner)", "value": "a00ea2a8993a88702d4a5e499edc9a9cac99750bd8ec2c1dda942e0676c4ff94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175351, "uuid": "c159dfac-5bac-4f18-a648-388509f5d2ba", "comment": "Malware payload (GCleaner)", "value": "7728f4da2592ebf5b9b74b5ed5a17f66d5d1a36c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175351, "uuid": "914051b1-de23-48c6-b76a-973e22437119", "comment": "Malware payload (GCleaner)", "value": "3f2d95e8bdaef3485cb6f4b478f194bd90637baff50422a18aa8303f29270db0cf79d781adb13d515aef14c17a852408", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175351, "uuid": "6e0b87cb-28cc-4fdb-b137-6d5fd83e5288", "value": "T17F649E43A2D03D50EA25DB72CE2FC6D8765EF2504F497B692928995F18B12F2C273F81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175351, "uuid": "d8100b75-aa1e-4f8c-983d-aa172cf6568e", "value": "784ca6913c3638641dc8eb34aa0281df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175351, "uuid": "d6355b34-4881-44d3-8345-a2b170f8dd87", "value": "3072:f3KAWX3sIDdjLp7yXa6t6y8nNje09Rb5LB3GIjYu/z3v8TBNLBOjVK06T36/QuRU:PKAWbn6t0nB9B3GI1vcQjg0y6XXRUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175351, "uuid": "9307099a-049e-4028-a150-47b57ef2ce96", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175351, "uuid": "7de60626-05fe-498e-b9a3-df65fdd7c852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175351, "uuid": "fcfd6565-32bf-437a-8262-664d44c43633", "value": "5c9a0ef5d64e0e41cfd134ca656a5d1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2150b77a-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165397, "uuid": "0fc70126-55e0-4909-9b7e-34f1fbfe3e79", "comment": "Malware payload (Mirai)", "value": "17fdf3454a94ae49f28edc979ffad5ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165397, "uuid": "123d0790-5ca5-4ee7-868b-98bd38f7e4b3", "comment": "Malware payload (Mirai)", "value": "a08e96e3332e2bf8599bce3c85dbc3345565e6fc7dc5e7df69aa4abc64f421bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165397, "uuid": "fd46df76-d2dd-4f3c-ad05-e2988aa53124", "comment": "Malware payload (Mirai)", "value": "a70bed6a642197dd70a29e2c68a95be11dee39bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165397, "uuid": "f7d53720-b074-4939-b6c5-4b254d5e21fb", "comment": "Malware payload (Mirai)", "value": "2056ce656415e0c681b03840b82ffb5ff765201acadd9b4c7a2fc5ecabfa0663e4f7beb8e84e01827e9364ca30fd23d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165397, "uuid": "4d245810-91e9-4d66-9a6f-bd61f8afb650", "value": "T1B93301B4F0AFD4B2D6B11D33C52C114393661FA69222F3D5B52AC4E0B9C32E996EC617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165397, "uuid": "b5196bb5-df89-4ffa-bc65-712feebea661", "value": "768:sU4CLFK2gQ3AgxS92f/uYEhM4c2A4eUK5l/k3tx/YzfN1q3UI8TSWymG+Iz9/kQm:yIKgtLfmYMM3xRU4kf6A8/5czlkQOa09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165397, "uuid": "4ced7698-5ee1-4264-9607-9b4fe8b837cd", "value": 52216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165397, "uuid": "1640216b-d977-4297-88ec-2ddc496e287d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165397, "uuid": "efa3382d-4db2-4194-915a-93c684dfb139", "value": "17fdf3454a94ae49f28edc979ffad5ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89de1d2f-0e6e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687157841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157841, "uuid": "0aeb7d0b-805a-49ec-998b-5b3758312616", "comment": "Malware payload (AgentTesla)", "value": "0390dd238f4a7b1ab03592c7a19192e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157841, "uuid": "9baee191-177f-4028-8aa4-90224f56f3fd", "comment": "Malware payload (AgentTesla)", "value": "a0dc94e3b1ea74938b94c0da32365ce014f9bfc38114a4939a61e27004684c34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157841, "uuid": "451b6d8b-9d77-4df9-995d-8db7d8c0f6e5", "comment": "Malware payload (AgentTesla)", "value": "8fa10f128e648a11dc3cb6d1e866b464037a6069", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157841, "uuid": "d1be9a14-272e-431c-83eb-4a08be7d1c4e", "comment": "Malware payload (AgentTesla)", "value": "c3612550632202a1ea41be6ce23fcf669eadf6777746994191284c2a1bd6d6024d61134a6bae866e66ebc07a522df5b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157841, "uuid": "f297b486-2fe5-4988-aa26-1dba488c84d0", "value": "T1F545393D28BD053BC170DAB2CF85E421F650D5AB31129E3A65C39589461FA832DCBE7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157841, "uuid": "59963980-5f72-4796-bc66-c60013634d55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157841, "uuid": "30764401-6b88-443e-a766-a91f9b0ae785", "value": "12288:l2BSSa8glU0FZWE8Yu/OI/C/1i/lh/bn/mG/Gf/24/4d/Is///Bug/y/T/5/f/ed:/P4ENnCAK40PjAT0klfnRVXXoQoS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687157841, "uuid": "b5299116-64fb-403e-a7a4-421e4f958f6f", "value": 1264640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687157841, "uuid": "a3990062-dcd9-471d-99ac-d1198d8db1aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157841, "uuid": "81b80e0b-e9fb-4bdd-bcef-82fbfe3c9490", "value": "Purchase_order 276636.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f09597-0ec8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687196434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196434, "uuid": "97053dd2-1581-40b0-a98a-01d71b4ade89", "comment": "Malware payload (Mirai)", "value": "8e5b240ddc1388cb27f5f5d8ca17ea55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196434, "uuid": "cdfeb6c8-eac8-449c-bde2-2d4f50e2857f", "comment": "Malware payload (Mirai)", "value": "a12a2f70e4104d269d802a9042f6b89dee0ee846eaaabe26b0bd4b8b0e7b2865", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196434, "uuid": "1788a76f-78c1-4205-aa53-ccf38a89c188", "comment": "Malware payload (Mirai)", "value": "9efe70d99e2a938e8d0b17f3f4cbfee2088f2fae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196434, "uuid": "ad5912c4-068d-46bc-bc75-cae5bde9f61f", "comment": "Malware payload (Mirai)", "value": "ccb5b9c632d89e1f47ab0c9462119d5004b8dea5c6aa2cdb2ba5580cb04ca9e494464e35e9a00a800da586f6f2c0358d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196434, "uuid": "ac454678-56c2-4069-8f7d-417c5dd438ca", "value": "T11D43AFB6D4AD6CA4C44C43746422CE782B63BA08D5531FF6968686D6804BFFCF21E3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196434, "uuid": "e6896e6c-913d-44d8-a112-1e480640fc80", "value": "768:1RadYqEwtieE7e4fxfEe5+qDFEJlSfeBwz0PgCboQF9/XqCWHsZK10UaZ:nadZEwtitMDqe6eBHgL6VqCWHsI10b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687196434, "uuid": "e5b0d222-2760-40db-b393-77d5ea0cdd09", "value": 56188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687196434, "uuid": "b151363c-f22b-4f7c-8cf0-e0d294402814", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196434, "uuid": "2d88c709-066b-4a64-91ad-78f75afbadce", "value": "8e5b240ddc1388cb27f5f5d8ca17ea55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f47c7b-0e90-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687172496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172496, "uuid": "8eb1b912-d577-4e7c-a520-7765de0f6a3e", "comment": "Malware payload (Formbook)", "value": "0e3a09a736a93983edf8aedc03c1964d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172496, "uuid": "66ad82be-de2f-49bf-8057-6c38d12866c3", "comment": "Malware payload (Formbook)", "value": "a1d8a89e81432cfe0c04f896cfdfa69aea54901c145460b4a0ba680a64da5800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172496, "uuid": "775c1a57-a94f-4525-979e-69671691544f", "comment": "Malware payload (Formbook)", "value": "c02e69092ea6b2dbd94645942e3a7eb68164f71b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172496, "uuid": "586e42c9-06f1-4701-bd15-96f77f57f96e", "comment": "Malware payload (Formbook)", "value": "d9bfc763d18d7349c689d92166dc766a9c7dc6759228d7bbba47ba482864227a18b335e3a6f97182ea9877f481f9b154", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172496, "uuid": "9b95c50b-0866-4b70-afe6-d77e2b60ec79", "value": "T17F5412187694C87BDAE12EB10E321B639FF8E6151074935F2B3877897A32491AD0F736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172496, "uuid": "6327f884-1a25-4b61-b627-3357dae4a054", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172496, "uuid": "89af5955-6f8e-4c47-8049-0bdb7f5164c0", "value": "6144:/Ya63oPOnYBsKj0MlEjrg3OUUGaTqloAmlZBzFoj:/YtOOnYpJWjryfdopxz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687172496, "uuid": "7f5c0a5b-d904-4f0a-b36c-66f5f2d456ca", "value": 279998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687172496, "uuid": "f71c9e4b-e9ac-4fdd-83e9-6e647ab59bb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172496, "uuid": "d9f0e815-e1fb-4686-a158-78a3d4b0969a", "value": "PO.19062023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaec4a89-0eb4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687188069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188069, "uuid": "d1b6a991-cdc4-4dac-bf11-09caece1ba83", "comment": "Malware payload (Mirai)", "value": "4dcb3cb0d79e55fea1bca423153e8ff7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188069, "uuid": "47dfcae3-30f3-432e-9c6b-7e7838e14a00", "comment": "Malware payload (Mirai)", "value": "a1fa5d476c4da6c4c4b4c5e6bf985beb5933b1fbc0c46fa34273bbf133d3780c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188069, "uuid": "2716b314-9784-40da-a692-eb8f383d6867", "comment": "Malware payload (Mirai)", "value": "38193c3645c2c6cc285417723c0770cec4250409", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188069, "uuid": "14c7ec94-9f99-4e4e-ac3d-c766ad357261", "comment": "Malware payload (Mirai)", "value": "c606caf34b5a7cfa3a21d54491958da9566f5b41ee8d789dc1f1e536b5b8972d322e26213a222f2f247b9ae1eead325a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188069, "uuid": "544ad0e9-63b8-4cb1-946b-8dc5c6356daf", "value": "T1C3D32B86B8D18F11C6D522BBFA2E019E3326177CE3EFB1078D245F2427CA56B0A3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188069, "uuid": "2ff471bc-ba54-4402-ba18-0be154b0c740", "value": "3072:mQ3J3987dkNXICeyUhpoCVkvVR7ak1U3a7RnRbv+mK:mUJ3986eyimCw7agU3+2mK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687188069, "uuid": "66a4faf3-5650-4909-ac3f-21385b7b48c3", "value": 136792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687188069, "uuid": "a2dc8743-0a6b-4924-9ca2-55053afb90e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188069, "uuid": "852bf6d7-7537-46f2-8aa8-aa7944fb7f23", "value": "4dcb3cb0d79e55fea1bca423153e8ff7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9f1c33-0ed5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687202215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687202215, "uuid": "99897af2-c169-4ced-8d6b-8b9d2097cf13", "comment": "Malware payload", "value": "673a1f3904a40a0f5fa40dbbf1615d78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687202215, "uuid": "5d3c0056-2b4c-4620-a8d4-b7467bafe14f", "comment": "Malware payload", "value": "a22aa1ec704f30611dd6942c5d79c92e3a1cb62f88d8ff7731368f1789c401b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687202215, "uuid": "40f4b09d-aaa6-48fe-892f-eacb8e58026e", "comment": "Malware payload", "value": "87c818d4f4926e0cbeca0542cf31ca678ac9f795", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687202215, "uuid": "05241779-8ab3-459c-8f54-b61ef32629cd", "comment": "Malware payload", "value": "f692ec81121c48b478c70fb82b6ec5b9f3a5b9a779da20b908d07ec550e46acbf6626e7d8329505b66d4927787ac8802", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687202215, "uuid": "0a680844-c132-43d5-a02d-a0146e722fa2", "value": "T17104D758364BA97EC96F883D9C600CE0677CAC662246A7079D8EF0E43D3B7919F051F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687202215, "uuid": "3b37e2ea-2399-4a86-a47d-1053a581e30d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687202215, "uuid": "6c8b4ab8-e77c-4cc3-a73e-f351be9195c8", "value": "3072:fuAeB08kZ5+b4OxNUMiZwZJn3/28e8hb:fuJGc49uZJn3/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687202215, "uuid": "9c5bb90a-0b14-4798-9834-5c9b29524cdd", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687202215, "uuid": "28c65571-8526-4cb5-8e16-bf421d5d7795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687202215, "uuid": "4aedb999-1ed6-437e-8849-87c2aa8bd2a6", "value": "673a1f3904a40a0f5fa40dbbf1615d78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf43a5c-0ea2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687180316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180316, "uuid": "ecc38d14-219d-462a-b055-5f9a8d4b7cf1", "comment": "Malware payload (GuLoader)", "value": "3d4b36f562038a18fc835188470973c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180316, "uuid": "f14e451d-ff38-4741-a9ea-cb547b07888a", "comment": "Malware payload (GuLoader)", "value": "a2bc07beb239b5aeec5037cfa95a781675cb00ff9495bfc2af439a15b3ec518b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180316, "uuid": "7558dd47-085a-4c1b-b270-eeabf1df62a7", "comment": "Malware payload (GuLoader)", "value": "87903032e3e89af0eb1f966370222bf06e91731f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180316, "uuid": "e1b07c1f-5b57-4b47-aa7e-24ef66766db1", "comment": "Malware payload (GuLoader)", "value": "513afa6b644512f6902db77e4ec9f17a5511d77a528589d5e2f66fb82ed26dd86c251a6c6fcac9b30a618f1344e5d428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180316, "uuid": "9923c20e-aa03-4853-ac96-58d022a4e95b", "value": "T10E9412914525D4BBE4664E71CC5B99FA18FA5F52FD609F8B2B407F0CBA33980832E346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180316, "uuid": "167e493a-f540-4410-9cf6-f9ad8cceac26", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180316, "uuid": "2762af82-9ab6-4a11-847c-acac41b725f7", "value": "12288:i0+FrXbGM2i28hs/P9cqwMrPoDOVL/KtBHg0VtQ:i0YraPL/CDMzLhKtBHLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687180316, "uuid": "53e50293-a061-4ba2-a8fd-c02f2fbc94ee", "value": 418360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687180316, "uuid": "e2cef7b4-731c-469c-b905-0be3c28656b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180316, "uuid": "62b45fc1-9a3f-4fd6-a648-f1c3fc1c85cb", "value": "EYG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626e383d-0e65-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687153910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153910, "uuid": "537f89db-c58a-4ebc-9e02-ad06de82b756", "comment": "Malware payload (Mirai)", "value": "7047bddb6eae4db48a891ffd8583597b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153910, "uuid": "32945691-49df-4dff-918a-f8724d4ecd46", "comment": "Malware payload (Mirai)", "value": "a2ec7b251da904538144f8bd13cb602cb4bc2519ac572b79182570b5e1d5c665", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153910, "uuid": "33643fa8-1017-4346-a209-f7500c49495f", "comment": "Malware payload (Mirai)", "value": "745bb4d22a88f45bff2d90a7afa17b0e8436ed88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153910, "uuid": "858d3c6f-f37b-4a8a-8e31-b50969bc56f2", "comment": "Malware payload (Mirai)", "value": "c160593c0eeb525bc9d0fceb0cd2e0ae11b1a6a6327fea03ee7ad527146674561006dac8a0698f8349464256e1e9f38c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153910, "uuid": "9276f814-7fce-469a-9308-07feb5dda711", "value": "T1B9538D75D12DAEA8C0424AB4A9598E704F13A0C046732EF7DB9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153910, "uuid": "6e9c62c9-6bb9-45a4-adc8-a0d19159f390", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687153910, "uuid": "47e128af-f63d-4b64-ab48-b4e5a9cbf963", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687153910, "uuid": "f57900da-ac20-474a-b3b8-00dbf37785ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153910, "uuid": "ee50301c-1a27-49ff-905b-96023008dfc5", "value": "7047bddb6eae4db48a891ffd8583597b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865527b4-0e6e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687157835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157835, "uuid": "9fe43a11-82bb-42df-8109-40471dfc5165", "comment": "Malware payload (AgentTesla)", "value": "0610f6ae31141bfd1029d59e404b8a18", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157835, "uuid": "c3cddc0c-c50a-4e16-8a4c-e1f1db748d04", "comment": "Malware payload (AgentTesla)", "value": "a5e4ac1626e9c8ac13bcdd69e10915c9f2c030c967046040899d842325f29d07", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157835, "uuid": "5433ce9c-0d58-4830-aace-e2782133871e", "comment": "Malware payload (AgentTesla)", "value": "0a790e7c01c4598fff1c6e844a52481671fe1e11", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687157835, "uuid": "8ed45727-5666-453c-bb10-5414801d9a78", "comment": "Malware payload (AgentTesla)", "value": "37d4df7ea071445fca7589cd4577cdb83ff8eac6a3bb07dd42bbcc4434c5b4825233e498141fd2c002fb087aff62b32c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157835, "uuid": "327932cc-c064-49e1-ac7f-16a7a51955bf", "value": "T181E4335BDA0BEBE910452D727CBB5BF11D221A8EDA48736DEBC4116A3074C5B838F08D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157835, "uuid": "818a7069-e927-4e2e-9c32-bad768f9b318", "value": "12288:e/scRrXxnVY1yGYZGxuCukem9RJVw04A3kv3DA+C0QVA8zAj7TwL94VRFjlNQzpb:e/sMrBn8ZYZBcA04A0bAG6PzAkRsXNQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687157835, "uuid": "be384df6-4a8c-4a98-9711-7531372b75ee", "value": 708560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687157835, "uuid": "6d769fc0-e077-4751-8ebd-7d16a7149fd4", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687157835, "uuid": "0c80f9c3-0d1d-4239-8b28-6a40054436a7", "value": "Purchase_order 276636.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cd5ab3-0e72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687159526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159526, "uuid": "e79e857c-96d1-4d25-beb6-46afa37f3c75", "comment": "Malware payload (RedLineStealer)", "value": "b5ab758095caa295eae0dd07401a944c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159526, "uuid": "72013789-d4af-43d9-925c-21f0920e3902", "comment": "Malware payload (RedLineStealer)", "value": "a63139a21058e0e9e39b22c8b293f409d4382a66b6824c2ab89c1172daf16e3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159526, "uuid": "7f8cd20e-47c9-4145-beb7-18966418d15f", "comment": "Malware payload (RedLineStealer)", "value": "fea81919a7063d143cd94706ad02940ad57651a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159526, "uuid": "677b13ba-4607-40dd-aef3-0158727ae93c", "comment": "Malware payload (RedLineStealer)", "value": "972f2282826a613f99882ecd1706e247e0806377b8124837a88ff22f8c9ee2698787a7e36b15299953d1b226015a6e7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159526, "uuid": "0ee9253c-4f01-4b26-81b0-6a1b3b21c419", "value": "T180D4AD127980A832D963D038CE37CAB0E16AF7706BD976C7FBC819595B219C0EE35635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159526, "uuid": "b6e01c76-3c7b-4993-b8c7-34e2304b30cf", "value": "367ec698363d9c97d916349e5b0aa543", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159526, "uuid": "65ced618-d7d8-4130-ae8d-e5aad1f40db7", "value": "12288:L0BaH7DjoFcnpVvRLxVuPb7w2fGBtoEHLH9vzo9t9D:LWaH7foFcnphsPbc2uBtoEHLH9boHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687159526, "uuid": "ce02cfb4-bc16-4051-b7e5-38a7531b078b", "value": 609208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687159526, "uuid": "ef271e5b-c059-4ac5-b48a-3aebb0f1736e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159526, "uuid": "be1e8309-0cfc-4a1b-8d3f-7f84c5ff603d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fd93f7-0e8d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687171018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171018, "uuid": "afcae993-5719-4af4-8fc5-572c27c441ce", "comment": "Malware payload (Mirai)", "value": "96da72dab607bdfd6502e175c732f78f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171018, "uuid": "37791ce8-9971-40c6-be3a-0eadda25a2e5", "comment": "Malware payload (Mirai)", "value": "a690039ec956767915910a53f5213c5df57fa52302095dff879f25a436a6683c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171018, "uuid": "15eb492a-d36d-403f-bee3-b7b74b49352e", "comment": "Malware payload (Mirai)", "value": "b624a047bf7bfff8144fb850b733458f1743c72b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171018, "uuid": "1e585649-a67e-4c4a-82b7-a8d5b1753957", "comment": "Malware payload (Mirai)", "value": "111e0a263fb8a4fd0c202cc3c979fa700550c5f52ed6c44502f4ff751ee647e861f6107f179b0ebb1fba7240ca97b0fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171018, "uuid": "626e99b6-0454-45a7-b5ab-8e7122f64292", "value": "T13BC2F1789228D472B1B44836FDBF01035736CEF8DAEF362662144734E097C26A6B5B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171018, "uuid": "5d577dd9-9d5e-459f-bcfb-942bbe60ffbd", "value": "384:KBH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plN8rhymdGUJ:byNUQUfhQllxlaH0MFjlOnGsQs3Uoza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687171018, "uuid": "a5b0b4dc-947a-41e3-87bc-f99e96a3c543", "value": 27344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687171018, "uuid": "82bf02ad-3a13-4e7a-a1ff-5892862cb25a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171018, "uuid": "2342b487-68e6-480f-8215-77f608195d91", "value": "96da72dab607bdfd6502e175c732f78f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5ef47a-0e37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687134226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134226, "uuid": "d3438554-7695-4750-b43f-7049d77ea9b3", "comment": "Malware payload (Amadey)", "value": "aa3d57ef187281d9fe3f58d13a6a1dc4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134226, "uuid": "9c028a58-2b00-4526-8826-e99524027baa", "comment": "Malware payload (Amadey)", "value": "a6d7f1c5ee2d2b1cb8f83885b9e89e013c4206771c26a2ed1f1bf9fc9d93537d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134226, "uuid": "d8c66361-9f51-48be-b2d7-13343532fd0b", "comment": "Malware payload (Amadey)", "value": "ac7e29f629168f8acaecf14b71fe6098d34de90c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134226, "uuid": "421f295c-86f6-4615-b47e-4fe71d3df53b", "comment": "Malware payload (Amadey)", "value": "646538e74767ca5c14862e99c6961a4ef9d227cd0007f8c169c082629316f59b15375ecf30af30680981b99ffb4863e9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134226, "uuid": "95679512-d5e2-4e22-8c94-3c5def841b7a", "value": "T183546E125CAEF7E0F406D83E654AC107E97699717E7486C22F820EF2057AF845FBC9A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134226, "uuid": "9e96f24c-ffd5-4d2e-936f-ac6b0b54d513", "value": "b88ff38d8a9dd531263365f3574a285e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134226, "uuid": "67ce712a-9b82-4c21-97a4-6f200c66e914", "value": "6144:IGYZatOVBV44zWAdPPzLqsGLWA/DwtDq:I0tOfV446AdPPnGCA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687134226, "uuid": "ea484e98-6261-43fd-ab5e-e7d10e6ad2c1", "value": 291844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687134226, "uuid": "0623bac3-b3f9-4284-b676-cfc8605334b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134226, "uuid": "3ecd0e0b-2a5e-47c2-838e-066439a54053", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc82f6b-0e72-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687159671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159671, "uuid": "7ce30db2-c71b-496b-ab1b-ad8b01d5738e", "comment": "Malware payload", "value": "8b0a97da1b5d4b3818913b4ccbfcea75", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159671, "uuid": "08c9ec11-b28a-42de-9f91-4a54651ed7cb", "comment": "Malware payload", "value": "a73e24915338a536027536458e8957ccb5348bdab681bed3cb1205c33713c6dc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159671, "uuid": "974e6750-4d1b-4ade-aaf8-f70540979dd0", "comment": "Malware payload", "value": "580a72a803ab87a454f750aa7b740e863d6c82eb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159671, "uuid": "5f0d60cb-cffb-4952-9bc5-3f249cb04bde", "comment": "Malware payload", "value": "c15c697bbb905ebbda322534e8aaecea43508621c2ee19ef2542bf49af7ac56a04f5c813e886a7ccc5a5c3c21d1f18d6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159671, "uuid": "dbe3ff8b-e5a7-408a-ba66-042d5e08fa0a", "value": "T16677337CD0A1238A1D7B5831B5F1B0EBC86681B18D535E2792BDA633DBCF3E19178089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159671, "uuid": "06d56e70-f631-4219-83bd-31bd688fa71f", "value": "786432:wtfTPmBTW7E0YaoUO/pGXW9twEva/+B8qeOhvYS96tgnJLx:KCTqzYRUm3B8pUYqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687159671, "uuid": "29687724-59fe-4e72-becf-3ef6effe55a0", "value": 33233666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687159671, "uuid": "8ab96a10-568d-4546-825f-a025078e45e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159671, "uuid": "57cec162-2c44-4861-ba8e-ac5017eb1cce", "value": "8b0a97da1b5d4b3818913b4ccbfcea75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a2c45f-0e79-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162559, "uuid": "03f2b380-6e5b-44a9-94c9-d0e877be4e24", "comment": "Malware payload (Mirai)", "value": "59d432f024ee948bcc56d1634904d0d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162559, "uuid": "a6d2e5da-3786-494f-a050-9fef6ba64442", "comment": "Malware payload (Mirai)", "value": "a743086c355c2937ab1d98910b951c5e43b10f0418dedae2e32467fad3218b93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162559, "uuid": "1938e9a5-0c86-49e5-92d0-92f6c680b1e5", "comment": "Malware payload (Mirai)", "value": "946df85a201b079b5adf8627f5f900a7f4465c46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162559, "uuid": "7e8f17b5-e759-4ea8-b179-20db18d9f0c7", "comment": "Malware payload (Mirai)", "value": "cc45ba2cbe163adc07599ecbc9a3cee5b28e6735c0e000bc2b30a930820bf734273e4eec8d9b50e3d485c07ccaf85bef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162559, "uuid": "f4423b1a-064d-47ff-a13b-3346d9af5e86", "value": "T1114339D6F801ED3EF84BE27A94564E09FA3063C041820B2773F7BEA3AD720556D16D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162559, "uuid": "c45d3d68-14f7-440b-9e23-0968ff5ded80", "value": "1536:2TKuQRl1CvF6n8c8a/ktNhxWrXof1LPvqW1:2mH2vsQfIrYf9qW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162559, "uuid": "5f8ab0b4-fed7-4d53-8177-844ca51b14e4", "value": 55792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162559, "uuid": "360330e2-9d2b-4f66-b9d3-1363825b4a45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162559, "uuid": "778b3cb6-872f-40cc-832a-d936f48174ec", "value": "59d432f024ee948bcc56d1634904d0d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c383077-0e90-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687172421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172421, "uuid": "885faeb0-25cc-4b8f-8800-a9dec49f56c1", "comment": "Malware payload (Amadey)", "value": "68091fab668e9123625613c33bfc4a5c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172421, "uuid": "4b1f921d-0e18-4c2a-9991-afc94e2a0d20", "comment": "Malware payload (Amadey)", "value": "a79b8258e643ea11f9bea3941310c7958d75b12c9fefe7d2a8b0bf261663446c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172421, "uuid": "138da29e-2433-49e5-8c32-18d1fed7cf9a", "comment": "Malware payload (Amadey)", "value": "6ec730f7c47017cd587886debbbdd16aea2c219e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172421, "uuid": "9da27204-ba0e-45ca-9302-2477813f162c", "comment": "Malware payload (Amadey)", "value": "59bea37cf570e4d72c0f802224042dc43f7cfa7dee4bb4d363ea1208fcafc033d66c8fde46da2c547c6020129f8f9a1e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172421, "uuid": "407a3998-f6d1-4331-883e-8c02d494feb2", "value": "T1DB051353B3D48432E8FD177044B602931B36BDA19E79837B17DAB94E49B2284787633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172421, "uuid": "9c2cc2a5-452a-4667-9881-ec1b1a92100b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172421, "uuid": "b2873b2c-fcc1-4845-97b1-cecf754235a1", "value": "24576:KyYywWVE538waLbU9ZV1qU18co+0Nb8TpO:RvVEewq071lCcD+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687172421, "uuid": "96d520d7-2a7a-4674-a183-c3be1aac7d34", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687172421, "uuid": "8911bd09-1c48-4beb-8ad8-43042e2ddb69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172421, "uuid": "7f2327bb-5667-4e17-995f-a8d5270dff31", "value": "68091fab668e9123625613c33bfc4a5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fa0900-0e69-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687155845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155845, "uuid": "9b26eca0-99c2-434c-a49e-fa2e591f8dc1", "comment": "Malware payload (AgentTesla)", "value": "c0310fd79048a698e18f4e730255023c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155845, "uuid": "2cf73788-e4e9-46d8-8fc3-1228466d7b26", "comment": "Malware payload (AgentTesla)", "value": "a897a017db43bf5b216b1a2735e34597a087c305c6152637884b2701e37215c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155845, "uuid": "d2e3aeae-e3bd-4483-9c4b-5e640cf3ca27", "comment": "Malware payload (AgentTesla)", "value": "5312477a63d4c7f4fcabe658694ab485452365bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155845, "uuid": "860cfcbc-9f45-427c-bb65-f2427d64d13b", "comment": "Malware payload (AgentTesla)", "value": "ae4e78b800d910b3e26043e3daaf6056b609d98b12370171606048faea23848fa25cb5a78f068a40dfcf4b001c8118e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155845, "uuid": "397efc29-acbb-4c37-b459-90f12db378c3", "value": "T1781533B62C83D396530ABE53D48A4DDDB7636BF480C6D672634C420135B1AEF2D2EE19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155845, "uuid": "ce79a1d7-81fc-4bf0-8637-3f28faba2e40", "value": "24576:akKTTma7uKEYmycqEj7CUgH3G3F+rxfY5NCO5:ISa7uKbWqEj7ZordY5Np", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687155845, "uuid": "db9a445c-8af9-4f5b-8937-07b5dceea023", "value": 881798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687155845, "uuid": "765c4e8f-302e-4abe-9d90-2830ebd67fac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155845, "uuid": "90c217fc-8d23-4bbc-8138-d509e78ddca7", "value": "080523-FM 06-01 WSF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82acba1f-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687168137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168137, "uuid": "e6b7473e-1730-4a5a-807f-2415faa9dc81", "comment": "Malware payload (GCleaner)", "value": "d98c9515d543f336051bb51168cdc068", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168137, "uuid": "6aaceffd-5e7d-4bbc-93f5-c16bb27ca958", "comment": "Malware payload (GCleaner)", "value": "a9a3e6176cc8b8638f2bdadebeea743e50b758468c019530bb4d72cd70a66009", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168137, "uuid": "e13daebd-f54a-4a88-a0eb-5964d0b1588b", "comment": "Malware payload (GCleaner)", "value": "9b5809b45e503055bc247d1677ceb72c6c5dce08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168137, "uuid": "6ab40eaa-353a-4b98-88f2-9f022b54a46e", "comment": "Malware payload (GCleaner)", "value": "cebdfde680e53bf9bbf72ab4ce84b2a903e04323a3e9ac2dd081168f4090bbe54033d027671c993842888b08fcc88f90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168137, "uuid": "df44ef97-a51b-4f3d-946d-70c22bc9788b", "value": "T140749E8392E03C64ED255B338E2FC6E83A1EF6508F197B9712589A2F89711F2E173751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168137, "uuid": "920f50d3-507f-4153-86c9-b3d615569aeb", "value": "91d43b04a4de8668c2f5f19f2f87ab90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168137, "uuid": "cb71d1e4-52e8-4371-875f-0da9fc87b795", "value": "6144:HaHTO4EkxPGpnt3l8KnLZUBKb9Q4O5xMziLTo8YvP8t6skS:CsUGpTnNUBEOvMzifk8t2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168137, "uuid": "f9fc9eb7-8abd-4412-ace8-e71a234c2235", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168137, "uuid": "b94b291d-d086-4117-927c-7622ee2ed698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168137, "uuid": "107da7b7-af05-4a51-94ba-1a246036b987", "value": "d98c9515d543f336051bb51168cdc068.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b51dcd-0e5e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687151117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151117, "uuid": "058e298e-eff7-42f4-a0a6-2ce00ef0895e", "comment": "Malware payload (Mirai)", "value": "d8927b9b8b9c7f4ae5d86b139505632e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151117, "uuid": "3a8616d0-5a12-412c-bd0e-d740c985ef14", "comment": "Malware payload (Mirai)", "value": "abfbb7366c3e0993542f9b4755e498f2ed7f28c4f8490a8d31260e366165ca41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151117, "uuid": "d42d2e2a-00b3-473e-bb07-c9256e92685e", "comment": "Malware payload (Mirai)", "value": "be0c4ef9111307cc37b0fea743dfccb50a61d2be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151117, "uuid": "5c7d8cff-f228-4b28-bd6c-540dcd2d88ea", "comment": "Malware payload (Mirai)", "value": "f593b187915a5bae7d8425ec2173ac4ef98a15831089e64f3cf5f9b1e634fcd7d8b030ce60dff880b01abc86a2088004", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151117, "uuid": "fa98717f-4b98-4370-84fc-1e1d4d472699", "value": "T1B8E2D04D4C1068C2CE9D31F6169D56A27A4A745034F3C77E52308A4AB0E9D6BFADFCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151117, "uuid": "b9733941-6060-439f-a04f-d99b38c11120", "value": "768:VQuZjgB7wxfQlvNIWomF31WwXOI2hvP5DSq8X4WGPOv:VQIi7YfaN1F3Z2h35DSxX8P8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687151117, "uuid": "5d409017-2ac4-46cf-b35c-e0df7116a4f9", "value": 32484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687151117, "uuid": "32bc46ef-0b10-4e1b-94ea-81dad6bec5bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151117, "uuid": "5d6bc616-0ad7-4f57-b195-a7a2bb3d3827", "value": "d8927b9b8b9c7f4ae5d86b139505632e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0356714a-0ea6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687181667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181667, "uuid": "6b5d6f4d-c645-4f31-8915-18890fef1623", "comment": "Malware payload", "value": "9aa44dea64a5b73e45eaa865637d6f35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181667, "uuid": "876b37a0-e3f5-429e-aa04-56f7d5ace7c1", "comment": "Malware payload", "value": "ac2776e3263b66f68353ec62113742e5b045f92da733866a7952673df4b1c45a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181667, "uuid": "97f8cfcc-82df-41d3-a245-245ba1be8af2", "comment": "Malware payload", "value": "e8f3fe039fd6ae0be2bc7d5a5f6e6d79462b49c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181667, "uuid": "e9589ec2-c537-45b8-a5c1-66ca40865e32", "comment": "Malware payload", "value": "bba573ccfa3ea7ed7e4bbb78ae32d701c5880fc1a1020a42047fdef89d5e7e27049fe4133e364c8fc8c67f3a38dac484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181667, "uuid": "0dbe9c54-2752-40a1-a40b-82795223f658", "value": "T1B4462341F392C4B0D46A85B888828766CF773C2257B1C6EB5BE4695E5F333D09B32726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181667, "uuid": "4afb2784-bf72-4848-9c54-6e3c29719dec", "value": "1ff847646487d56f85778df99ff3728a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181667, "uuid": "412e589c-697f-4986-bfc4-4035fe5559c3", "value": "98304:O06FOznLo0+Dd6uxcobmpTncTYS3l72vu2X74NXoXYCOcWBOIn24vEWu:O3F6n80W6uGOao7urSoXYCOQIn2JWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687181667, "uuid": "1341e1d6-4a5d-4bc5-898e-5d1fe28834ca", "value": 5773163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687181667, "uuid": "49a5f81a-1ffe-4931-83b4-7034b2cb9fd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181667, "uuid": "e5a3c6f7-e54e-4018-bb06-29b2e3080317", "value": "6\u6708\u5de5\u8d44\u53d1\u653e\u7ed3\u7b97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa49b26a-0e47-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687141145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687141145, "uuid": "d6a534ea-4630-4c36-8f1e-61901f662d31", "comment": "Malware payload (GCleaner)", "value": "3686d26075fd7ac2ed2a3ca76417a92d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687141145, "uuid": "d79bb05f-dd7d-4265-b235-d8427708b980", "comment": "Malware payload (GCleaner)", "value": "acc4bd04efa0ea9b006d92d09066632036ed12e4b8de30d6dfa0be61fa67aa50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687141145, "uuid": "223e708c-0e13-48e5-a3cd-5f135962288c", "comment": "Malware payload (GCleaner)", "value": "523b2c2df44ec7ec311c025ebb0ea179ad75edad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687141145, "uuid": "a55b5212-fc7a-4a2f-af5b-5e70e3b68974", "comment": "Malware payload (GCleaner)", "value": "b89307724db4fada90c4d30eecbd25b3451bb1cbb88f4f547f46c29bc64dd45df85261c52ea426cf650cd8c23f8506fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687141145, "uuid": "4447658b-1e9e-4cc5-82b4-39c2219a898e", "value": "T1CCE502416502A824D6224E79ADA9C470B3261C170F38952CADD1BF57B77F8FABC0A17F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687141145, "uuid": "9fb586da-4d7f-4179-b5dd-b987eb575e33", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687141145, "uuid": "3616fba6-6d2a-4c32-99f4-aa4983a67877", "value": "49152:v6dUvLdsxlZOd7MOzun96PW1QBxzOnWQOjgqRa9VVRLXzbL0NKrWClTqw:ydUhsxxOzunsW1Cxz8ojDarVJX31vlew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687141145, "uuid": "8812c1cf-857a-4c52-af4b-4d50e0dfd071", "value": 3192779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687141145, "uuid": "77e1943e-3911-4e77-9495-94472ef4601f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687141145, "uuid": "192d23f3-ce0f-4da3-bbef-50b124210e4c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7faca2-0ec6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687195779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195779, "uuid": "5a2f8164-2457-477b-a9b7-da3525a411ff", "comment": "Malware payload (RedLineStealer)", "value": "8060660e51370b7f2663a6c91d86b256", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195779, "uuid": "42f267bd-769a-4415-b7e2-6ab3046c2ea5", "comment": "Malware payload (RedLineStealer)", "value": "acd2370b7bfcb5d2ff424076a25b6868b7bdb6f80f2468ed8b80611102122602", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195779, "uuid": "88a932ac-a781-4ac5-a54e-0659ad0131d8", "comment": "Malware payload (RedLineStealer)", "value": "64eed8a22a4cba24fe02b3a7428ac227440cc0a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195779, "uuid": "55d2f95c-b4c7-4eac-ac47-df765413d2c1", "comment": "Malware payload (RedLineStealer)", "value": "5b915b1bf4d34b8d16183010faa5db99bb0a9c1a61ff56cdf77098caeca970f48f7fd2f58239b6edd72ab1f73110d47a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195779, "uuid": "e1fbd732-a0ea-43d4-b9b3-c4292c4e293c", "value": "T13813170C6B8C5B76DAACD67C86F2610457F5A2FB2603E78FCEC421551E93BF56402A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195779, "uuid": "4847820a-3af7-4b3b-9c61-b5f74c49f9a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195779, "uuid": "6b76185a-a65b-4607-b956-81499434c162", "value": "768:hmshgB3g4jG75Qfao14tb5ay+5LE0yi9aD++R2uch8CwL0rpKl:hmSu3g4jtW5J+FZza6UDCtrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687195779, "uuid": "cc4e54ef-4903-4c1d-a9aa-8b5785a908b8", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687195779, "uuid": "05e14b3d-8e2a-4cec-a2dd-6758d9c05133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195779, "uuid": "68f3b852-cc5d-4f1f-b995-ba06564c3aa3", "value": "SecuriteInfo.com.Win32.TrojanX-gen.14640.13863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad52b15-0e67-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687154756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154756, "uuid": "9fe53e82-0928-4b29-aeaa-cbb0888d36a9", "comment": "Malware payload", "value": "4e586f0181c113f7e5ee906b8dbf1d24", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154756, "uuid": "ff15b92c-7922-43bf-aaf6-96b15a7efcc0", "comment": "Malware payload", "value": "ad4e7c52c03e9f28ec7f215d7f9982df69e070e675d5737cbd8ea412ba3f9eaa", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154756, "uuid": "584a2e7c-6d65-490a-a18d-a5461d32fe00", "comment": "Malware payload", "value": "d672a54a411cc5677d4a7c3fcc3a61d284363324", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154756, "uuid": "d92f0866-0f3b-47ff-b9f9-b0595fa7d086", "comment": "Malware payload", "value": "92fdd96f466c4af3ccc4536303e4fa4182db3fbd58d7c8fffaeff2af8ca746655d727f35204d36916e7f87a9d6c4b4b1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154756, "uuid": "d8f9da40-e3c4-4510-830a-dda924e680eb", "value": "T1D4E42364C2EE1621FADCC5B6AC2D730556BF3886B846AB14C7BBD40D1E330F48A4579B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154756, "uuid": "2847a7ea-ddbb-4f8c-8779-79f26caf2204", "value": "12288:P4o8o/L6XMA85RxfQDpY+dMDNCs8Rb9qEXEQNRzmy2CbHYhscLMk64OJ/HoMCLw:zjiuRwphMCs8FMKfzmq4hsEXwvpCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687154756, "uuid": "30ca1b1a-8c9a-4a0d-a65b-b8ffb05d9112", "value": 717056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687154756, "uuid": "91de806d-c821-4cdb-8da1-bcd1ae4d204c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154756, "uuid": "e1dc7c0a-3034-4f06-be52-912c0693ed2d", "value": "DepXsitos_426252378.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26889e7-0ec6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1687195785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195785, "uuid": "dd3e24f1-680c-45f5-a534-8c95241fcaef", "comment": "Malware payload (Vidar)", "value": "0646b14ce61a59e4a12f16c673c07f8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195785, "uuid": "debd2cda-68e2-412b-a037-d85a1ace74a1", "comment": "Malware payload (Vidar)", "value": "ad51cdfa2cc922fd645879135d78c450864c4fd31e7fe809f99ec02be8a113e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195785, "uuid": "2c4a6066-d469-4179-808a-239a9b158560", "comment": "Malware payload (Vidar)", "value": "432759b584e648d2a27a99a9898110958346ff6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195785, "uuid": "580a1c68-2960-4d82-804b-63af6311d635", "comment": "Malware payload (Vidar)", "value": "835d1ad18f05db3c794065fd426cf254990eb40eb4af87a14d90d06629c03ecd82af45c49f3b7a921f8c4de78fb5ea30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195785, "uuid": "ec63f7c2-c36d-4bba-9eed-2287a0e092e1", "value": "T10AC633992F789A21DD7463370CA375D6C01D9D52300BC76AE22E1E3926D1BF34A1B9E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195785, "uuid": "6391914b-e9b3-4396-b1d4-8a4c4f9aa18f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195785, "uuid": "899520be-832c-4579-9f7a-5d376b5a8ed7", "value": "196608:T4E2PDejsG4m/3bxtPNwc828R182unDNc6Tq41BypjQUutecid+eQVMX5G:cEKtGDPbF/EXpunBcsQQDViYeQ6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687195785, "uuid": "21da8514-d95d-4a2c-8c9b-c4ca2a6da173", "value": 11585024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687195785, "uuid": "929cdddc-979b-4a47-9637-18870ec229fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195785, "uuid": "80f4b2e6-3291-4459-81ce-d0652416e9b8", "value": "SecuriteInfo.com.Win32.TrojanX-gen.7277.26609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da266b66-0e60-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687151963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151963, "uuid": "8a126c57-173f-4f2e-ac83-d3fb850f0889", "comment": "Malware payload (AgentTesla)", "value": "6637215f4488d09c178c8fc956c1e282", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151963, "uuid": "79aaf267-159c-45ad-a006-771d8bb6c741", "comment": "Malware payload (AgentTesla)", "value": "ad742072fb4452b030471fe8d2fc33422a2e683b8320616da6ee62c999a76961", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151963, "uuid": "64230dc8-e536-4d7d-b345-22cc6ab421d6", "comment": "Malware payload (AgentTesla)", "value": "994f3d508c4ca20ac527b70b5ddf75c48804ad17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151963, "uuid": "dc9f1e45-5318-4d3c-90f7-ce79e217cf56", "comment": "Malware payload (AgentTesla)", "value": "b24e7390cb187c26528eb9f269b0b8f78d912f7d5f70266d5e0bbf1511be1189ebe11ef9028b553b7e29134eda5da89e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151963, "uuid": "0273073a-a35e-4b71-a76b-2f49bd280124", "value": "T1A8E4E0DC725176DFC827CA728AA82C74EA5235B7631BD243941322ED9A0DAD7DF101F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151963, "uuid": "a29e56a9-d153-485b-b4e9-82e84273b391", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151963, "uuid": "7b1b9875-f2c5-4b25-965b-b5069cd56038", "value": "12288:mozmQY5LbzIu9+r9fVoWvDvJ5Wwhb0S7qSdeg0DLAYfBocKH5w4VUqSldom0n3Ls:zm95LA9Zvz2wB0Idd0JtSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687151963, "uuid": "37c39fed-4041-4a87-9e1b-ce9c9fb955c7", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687151963, "uuid": "7699ed88-420d-4229-9b95-44cde35b817a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151963, "uuid": "9202c3c4-ad79-4aa7-ace3-c96181ea9e92", "value": "RFQ-1579.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7a5f08-0e8d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687171217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171217, "uuid": "b5c23658-dc20-4e02-afdc-8e66999c6cd4", "comment": "Malware payload (Mirai)", "value": "3174bc384cd46e89997b1db14334da5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171217, "uuid": "4d95b743-b68a-4b3e-bc22-6b4ed8ca1c2e", "comment": "Malware payload (Mirai)", "value": "ad965fd02e28a4fb0434a6cb74fcb93ece0862af7131674d41396cd71adc25a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171217, "uuid": "83b20ac5-2b47-4dbf-a70c-3c6d5d472a05", "comment": "Malware payload (Mirai)", "value": "58ad4884c89258551b0bad7d60dfeaaf6fd5b1c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171217, "uuid": "e970e289-d43d-46ab-b378-975689c13c14", "comment": "Malware payload (Mirai)", "value": "3d732be4b6bbf765831324e57c5a8066e98c52561947ea0cc035dbf469d0c842f1152de5e7e8ca5c340fae0a4136a687", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171217, "uuid": "e7b0a0a8-c0d6-43ee-8db2-72d6ab7dd0c8", "value": "T1ED3339C9FA53DCF5DC570170207AEF369E32F1E52218D653DB759A32AC52A01EA06A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171217, "uuid": "728dd62a-b0e1-4ff8-97ed-e445684c0ee2", "value": "1536:v/+4zLw36I+rSHPfxUGK6dox1WxcKnLpYHhrI5:v/+4zLw3mmvfxUsOrOTLCH25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687171217, "uuid": "0522009e-6768-4fd5-9cd9-8c337d7077a1", "value": 51504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687171217, "uuid": "e4c8c6bd-53ea-43ef-876e-2aebaa65bdde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171217, "uuid": "5200c6ea-153a-44f1-8968-c98a73da4d93", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bd6c70-0e81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165800, "uuid": "12c5e65d-d83b-4ac3-be30-67cfc716d37f", "comment": "Malware payload (Mirai)", "value": "2603fa95ce837887ef862728a7eef133", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165800, "uuid": "fc1ba198-51c4-4773-97e2-25e73061344e", "comment": "Malware payload (Mirai)", "value": "adf67b289c262705af6f5c76a3b10f2d120a426478ca392a2d55965877046514", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165800, "uuid": "9d93627e-7bb2-4cfe-bbcb-e31523529eb8", "comment": "Malware payload (Mirai)", "value": "795ede80c8c05eae2cf4d2b023f33cd7d7abd165", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165800, "uuid": "d60d2a67-0d7b-4e7e-97d0-36121f5d4186", "comment": "Malware payload (Mirai)", "value": "f7153809ae5eecf5ab10e36d85fab884fd52ac5e2007b00e0382233e661b74adaf28b37771a1e276eede761470b0dc0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165800, "uuid": "8235d84a-d201-48bf-ad12-ebf4b7dba9bd", "value": "T149D2D0EFF8C4688ADDCC5F73D0EE0692CA48E5C0306A274D9354DC4D93A6947A56C4F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165800, "uuid": "907ba5e3-9de7-4f89-9559-d75fa01644f0", "value": "768:9Ez7ad/RmLET/qiGTi/f11lJRyhMKyzebwSqiK7g5xNWMQ0:yz7ad/wFdTi/nRySKrZZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165800, "uuid": "1315c2af-a820-4327-8c5d-6191eb45c9e0", "value": 30648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165800, "uuid": "711857e5-08fb-48c9-a861-2b2688c48785", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165800, "uuid": "5c539c76-8f63-47b0-ba1f-7709560c392b", "value": "2603fa95ce837887ef862728a7eef133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b630712-0e67-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687154703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154703, "uuid": "f495b7f6-a404-45d1-902b-eb6db1f6296e", "comment": "Malware payload (Formbook)", "value": "e71046498e2c52e595d05cedf76d74a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154703, "uuid": "fc0673b4-2db8-4e41-a294-6393663e88e4", "comment": "Malware payload (Formbook)", "value": "ae9d5f45631bfbc0405e41100e77538f052fd1e609562ed63dde144f2b022a8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154703, "uuid": "0180477b-855a-4b20-9aea-3d6559a553e5", "comment": "Malware payload (Formbook)", "value": "6a947c210d54342f92cf6c4d68c99d48e8027fa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154703, "uuid": "cfa0d52a-db91-4cc8-9fee-3b75f080c964", "comment": "Malware payload (Formbook)", "value": "36ef38c30c3df27dc8e62943d5fdbf1181248d7920b3561b9a9a4ee1387aed53fc4689d7b1dee2e48caadf7aa48f15b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154703, "uuid": "62da7325-eb3c-441b-948c-812314ab4dae", "value": "T14E15CF0132180A57E66E79F9846572B027F6CE57727EE2E59CF2B0D944B2B07CE2424F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154703, "uuid": "c3e58323-f657-4038-94bb-89dd329cfdf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154703, "uuid": "be572008-6d5e-4077-949d-acfcd3380acd", "value": "24576:pW1jC96lcv9VAoxDK1/M88M4uNUH0nU7tA2Bd:M1jC96avYowVTlvnYA2Bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687154703, "uuid": "1407e8f4-9e4d-45f9-8e8f-83f29914f44c", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687154703, "uuid": "d21e0f89-55e5-43e2-9405-af4d33ccce64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154703, "uuid": "e0d3cb66-98b8-4bfa-a2a1-bb45e911947a", "value": "INV00388282992.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cccac1fd-0e9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687176851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176851, "uuid": "c16faf8e-26f7-43b4-b135-da9c3612e4be", "comment": "Malware payload (Mirai)", "value": "8ff6486b9ba498452f2db3b3557e37a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176851, "uuid": "2d85898d-5170-42dc-ac28-f5c65a90de30", "comment": "Malware payload (Mirai)", "value": "af7303b45cd16510ba2c77a0f9970031ae8060f37f4cd5eb1850df60625a2b3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176851, "uuid": "c852f23b-f123-40a0-a957-d26b3439db34", "comment": "Malware payload (Mirai)", "value": "d5e7dee924da2dd32be9177caf1cdfeb43d6197d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176851, "uuid": "5ab666a9-9794-4aea-843d-0880abeba285", "comment": "Malware payload (Mirai)", "value": "2bb63488de634aad830697deff36c5154d7a0ecf18cfa76153be1f8d5aa5045f2816ec486545f1d312c599b2947fafe1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176851, "uuid": "68910b2e-624c-42b4-bfe0-8442744ca35d", "value": "T114B33B46EB418B03C0D5177ABAAF42453323E755A3DB330699286FF43F86B9E4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176851, "uuid": "e38633a9-340d-4a20-91e2-842629bbff37", "value": "3072:TPACUG7HX5lGERqKgpq3Lz60oM/9FMVZrp:TPArGTplGERq7pAz6bM/9FMVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176851, "uuid": "ae3cf295-a0e9-41e9-9a56-767c1d1c1860", "value": 110892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176851, "uuid": "6db63f43-c1e9-4e58-9115-26e68416e894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176851, "uuid": "1c57bd8d-febe-4681-9c60-1c64d2687927", "value": "8ff6486b9ba498452f2db3b3557e37a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e50120-0ef4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687215224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687215224, "uuid": "df38a899-00ab-4b9b-a47b-b046fe5476d6", "comment": "Malware payload", "value": "acd82a80283bd3d7b39141dfcc2d5849", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687215224, "uuid": "df10e5df-2a3c-4c82-8b37-c3a1b58b0bed", "comment": "Malware payload", "value": "afadfea05a60c5090213324056b71ac29d7175dee54b35d78ed0854b872778e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687215224, "uuid": "5808df34-5616-4e37-9fa3-5191a6488898", "comment": "Malware payload", "value": "0b9f99840d32efdaf7254435362e443a3766bbc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687215224, "uuid": "4034b735-d786-43e8-ab3b-5705f5114ac5", "comment": "Malware payload", "value": "cbfff1ce9a7ae3166ec7c1232aa373605a592dab7bce6dd30866305b751ca3ad97ab3fc02e732ffdc753d4d6e22d8991", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687215224, "uuid": "9aca584c-06cd-4389-9b8a-ca0e96ae4a78", "value": "T174656D22F1D2883FC4733A7C9C1BA65AD8257D102E28A44A7BE45E4C1E3A7433D795E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687215224, "uuid": "e2e777e2-13ed-4248-baea-d62925823aba", "value": "78c9e2c31285b4ac9148c2d16bffeed7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687215224, "uuid": "d3965b00-e295-4f38-9775-d8a7e12f601a", "value": "24576:uUiyKZ0BdB81j2s7vF2/nmCX6j1xHyTbfbshp:xIIdi116msrbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687215224, "uuid": "1c57dfb5-3a22-44f7-a7ae-68f30fe34d88", "value": 1442816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687215224, "uuid": "8e47ca43-3aa4-4706-84e4-2ea94bc5b759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687215224, "uuid": "e695ff0c-344c-44ca-b325-a9d58803c1e5", "value": "2023_vp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb25828e-0e58-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687148475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148475, "uuid": "edeb8010-ad24-42b4-896d-926a4392d443", "comment": "Malware payload (Mirai)", "value": "99d0bad4b303e7843eeb7fc99f85765b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148475, "uuid": "5f2cb51c-fbbb-4c12-8ecb-a31ae3bfd297", "comment": "Malware payload (Mirai)", "value": "afb4adce27f98e1ed18a554c0c9b144d44969b750440562578f0f9ffea2014ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148475, "uuid": "aefb7215-bf8d-4b9a-af38-bf25f64e0894", "comment": "Malware payload (Mirai)", "value": "305c2b8b75f15ccebda7dbbd4b97e4bdc9afc56c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148475, "uuid": "55c8a7e8-0f75-4692-a734-3c76a9596f2f", "comment": "Malware payload (Mirai)", "value": "b6a71aa47745008d552d7f984751aa0b661325b79dc519a787eeac83811daa696a3e9cbcb904fd5879feb4cdae6c813d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148475, "uuid": "b3d2714d-4aeb-48d5-8e83-8bd9f33f73c9", "value": "T145D2E0B0C52344D9E1AFE569EE4CE7C93B40594B36A34F8AC619BB2EC613824F05B7C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148475, "uuid": "5de7129a-a7e1-4539-8754-21049ec97ce0", "value": "768:pd/5S34JdhkLzjOBrSfD97vHCg1bVJ6pG4uVcqgw0t10tLyV:pF5A4VivOBr8D9jHCgbL6pG4u+qgw0th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687148475, "uuid": "1a61577a-6876-436f-80d9-40ed8643222f", "value": 28804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687148475, "uuid": "cdace98b-1ee3-4ce7-a946-e341521b5b19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148475, "uuid": "2912d063-d1d8-4542-9959-e21293b1c527", "value": "99d0bad4b303e7843eeb7fc99f85765b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d851d691-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687168281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168281, "uuid": "d2ef9dff-c576-4a94-9165-5e956150eb9e", "comment": "Malware payload (Mirai)", "value": "5433a5be90363f44ef85984481ec0fd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168281, "uuid": "fd5bad11-1900-4704-8c40-3693a4d55105", "comment": "Malware payload (Mirai)", "value": "b043221bdd59bc386578c00d8190225441745012a8b177f640870acc44c5b767", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168281, "uuid": "63b58e3d-f0de-4fd6-8f5d-4420f15d1d0d", "comment": "Malware payload (Mirai)", "value": "125c507abb79e7f85ccbd6decb23271c318b0070", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168281, "uuid": "df7c9fa2-e620-455a-8927-6f3c613fa7ba", "comment": "Malware payload (Mirai)", "value": "f515ca5dbf7ff5f8436351babb8a48e65a5da90b813c739c699a6c5ec705690591bc4434fca576dea3b8307adea73609", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168281, "uuid": "9f3b3d2b-6acd-4c66-be51-5ea266a5e229", "value": "T17B333B96F701AD3EF99BEA7F84134A0AF13077950093073A63B6FD935D322949D16E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168281, "uuid": "b9798158-28e0-42f7-9eb0-9f37f3f0067f", "value": "768:y2eNjCsDZxwjuhgzMo1RrpwWQqYctRI8uCQwrxJbBwjG/cT88bEOuL7:PQjRwj9YuR9vLI1CQ6JbBsG/O88mL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168281, "uuid": "ad2fbf86-bc90-40f2-b8b1-c2db2b945973", "value": 53164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168281, "uuid": "f4a5bc95-7d05-4fff-9b65-d82644add288", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168281, "uuid": "8e218498-b360-42cc-a9cd-4fcaf3539b26", "value": "5433a5be90363f44ef85984481ec0fd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29028ac0-0ef0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687213513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687213513, "uuid": "8be6c84f-e2ae-439e-8ae8-8ba581addafa", "comment": "Malware payload", "value": "24cace504260224aa85c476a684bb04d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687213513, "uuid": "b62d82a9-933d-4350-8089-67b020f0beb2", "comment": "Malware payload", "value": "b16e20de16060f3a4d5f0e4fb0248e9f7522c5b4f0e83b62ca5c91f65e847d30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687213513, "uuid": "77e3fa71-f627-494e-ab90-d2e6941f5467", "comment": "Malware payload", "value": "748d9a8fca8cb543ef36e4a04f6d16997e05ec87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687213513, "uuid": "cccfd0d1-2f18-4cdb-a55d-0c766205f397", "comment": "Malware payload", "value": "fc8270b9fd9ab904cd9ce36f9ebbbc9b98a6e8e697b8966cf746d0e8bd66a2e6fd9720613b828614a2014b4c7ef36893", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687213513, "uuid": "7a3e5d44-56d0-42a0-b28e-2a09f20a1375", "value": "T11864CF1372A06C30D92E9B32CE2FCAE8775EF9518F197B9722386B1F09711A1C572352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687213513, "uuid": "82536027-46eb-4c64-9d96-d0c73ab81b2d", "value": "68fdcfb9187c8890bc2889c7f70b139c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687213513, "uuid": "1b35e7a3-8bdb-4f52-8ca1-123e58884f93", "value": "6144:bydsOl5hmVHENWZtOep7FSuTRfG1dw20iXtzlodeNzqWn:b8rl/mVdZtOepB/Ff9QgdoNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687213513, "uuid": "af2758f5-f921-43d7-b382-d8b860375747", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687213513, "uuid": "c99b4b36-b3f5-4b3e-8d73-9295e83f2e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687213513, "uuid": "451f5a65-cc7d-478b-a79d-d26c781bdba0", "value": "24cace504260224aa85c476a684bb04d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5a4ff8-0ec8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687196425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196425, "uuid": "1d7f55c1-c0c6-4373-99bc-87e531179177", "comment": "Malware payload (Mirai)", "value": "e2e5ccf84bfef8d3d0aaf9ae0f6efd4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196425, "uuid": "6e68643d-b2ea-41b7-8ac2-b12db524eec3", "comment": "Malware payload (Mirai)", "value": "b200bcbe7b865e55a442bb9c84539686f6e00dee7d398d0f9859b503185ffcf8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196425, "uuid": "620fce08-6a62-4f7f-ac05-b899722f4d50", "comment": "Malware payload (Mirai)", "value": "4b57913a7f37219f7156cacf076e847a774679c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196425, "uuid": "8eb1e0f7-a9d6-494e-bd6e-b6f7255a216e", "comment": "Malware payload (Mirai)", "value": "efcf8de6dc5c9f7010eb247dc7a21f60e2b731f6ee024bebef385414faac7bf3cd8e2e553bbf1388854ae375fe6e23a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196425, "uuid": "1fccfd22-90e6-40f7-bafa-01b2a31a95b2", "value": "T141533BDAB805EE3CF84EE27E80130A0AF932735156530F2767A7FCA7AD320955E56D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196425, "uuid": "73b06ff0-156c-428e-b2ed-625c5012db50", "value": "1536:rtQdOOsYDLzSiALjLdQ843y7Qb8vheLB7:rtQkOsY/zpwNu3iQ1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687196425, "uuid": "11c21dd2-9090-4c9f-abb5-70ffc762257d", "value": 61840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687196425, "uuid": "f6a9be8e-125e-4f81-9364-f393f7cbc591", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196425, "uuid": "dde31a42-55db-42c2-9fa7-cb9f3e1703e6", "value": "e2e5ccf84bfef8d3d0aaf9ae0f6efd4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da06cd97-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687160553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160553, "uuid": "7168a8a8-9bcc-490d-a547-95a9ac9f58ed", "comment": "Malware payload (RemcosRAT)", "value": "cd77f36ee986b08005cc2044bbe2cb87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160553, "uuid": "18d8dd35-be02-4d27-ac53-d26dfa287e20", "comment": "Malware payload (RemcosRAT)", "value": "b2397a2aaec3b27ba8d1fa6747dcf9504e8ee7081bf3edea5e382db804656cae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160553, "uuid": "e6600ee6-e4c3-434a-83e7-f76afbaf2e19", "comment": "Malware payload (RemcosRAT)", "value": "58fc4adf1908c03b357293f3986c12403875692e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160553, "uuid": "4ac467a8-33cc-4d65-8b1b-8c8272bf7c7d", "comment": "Malware payload (RemcosRAT)", "value": "14717632bc4fd4817094c1de9f914c11dbebd0291598a807b94c747f42d2848c7164a73347c46bd5469ce997bfc6490d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160553, "uuid": "e3ca27b2-3390-485f-9955-5e4d4e107d9f", "value": "T1001552BC5D07E5DBDE39E27695F02307B3711817B65EB98C2ADA3B460DA39C122D060E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160553, "uuid": "c430d419-339f-40c7-9a18-77206a7f1ffe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160553, "uuid": "cd8a1b8b-927e-4895-83c7-564bab46a5b4", "value": "12288:hW0PwJ9wr+J1TBYycEH2TFdOWyNCDpsEAmD:A/tujEWLOW++2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160553, "uuid": "1e67e883-e379-4df7-b217-ca1c70a152d6", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160553, "uuid": "75f488d1-bcc5-4853-a6c4-c06b53ffa753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160553, "uuid": "92a21732-3df3-4756-ad53-50f93065620e", "value": "GST Debit note-May.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548a842f-0e70-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1687158611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158611, "uuid": "b40851a1-134c-43f7-b8b5-5aa49e53fadd", "comment": "Malware payload (DCRat)", "value": "aa9f5b566fbea335270439660090b02f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158611, "uuid": "68242400-70f0-4ea5-b0c2-dec7dc33de00", "comment": "Malware payload (DCRat)", "value": "b2964f6e242c6cafbe891598375802aac7688cd35463dd22b475e17f0824ace1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158611, "uuid": "3d8363e2-ab0d-4357-9a56-ba6aaf10f531", "comment": "Malware payload (DCRat)", "value": "8bdbba6af9dded659dda5394138849b1cd1a0bff", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158611, "uuid": "60358e4a-1694-429e-9d67-d6f388dcf338", "comment": "Malware payload (DCRat)", "value": "e0f01279a64210d769eb9bc13a81df2deb3b66ed59a3705080266716541eafa30e28316dc470a7c5310d34bc4f76c30d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158611, "uuid": "1c0bf73a-1836-4a59-9209-0795830124eb", "value": "T10BE4F7E50ADC8320F61A53BBEC53BDA943BB635E68C0608DD62091E85E7D7FB2D06153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158611, "uuid": "73496215-265d-46e5-b85b-731ab0dc8fca", "value": "33fd8ddc8a438dbe56369aa29a741a6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158611, "uuid": "a1cd23f4-9c0e-403c-bc79-8c006167ce96", "value": "12288:IPXDBRLkAfIx/M6z6I4Sbs9z4mdwcGzMF0GI4KaGitjp9s/hbqMb0qM:kXDBRL9fIN6TSo9NaRqzQ5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687158611, "uuid": "b6dedc36-dcc2-49d7-896b-ffa7ca48e6e7", "value": 720188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687158611, "uuid": "de487f44-6cfe-4166-8ce1-81137691b753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158611, "uuid": "f9f84658-9908-4838-8b2f-54f3d2be99a6", "value": "aa9f5b566fbea335270439660090b02f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9271eed-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687160551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160551, "uuid": "e7a82e84-2717-428b-9698-19c50062a1a6", "comment": "Malware payload (GuLoader)", "value": "cb7285473ec493c585f41ef91ecc5ddc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160551, "uuid": "dff664dd-4ffc-4839-bac2-b50670783076", "comment": "Malware payload (GuLoader)", "value": "b2f2f24807774136eecad515645c9f897d7039effe1e120673987bce887259dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160551, "uuid": "6eb8e274-18d7-4e5b-a2ca-1b9874da7aa2", "comment": "Malware payload (GuLoader)", "value": "cc3a9621c584982a9168c6fc582707a03dedf502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160551, "uuid": "a672e561-353c-4cc5-a59f-1c122c8ebd93", "comment": "Malware payload (GuLoader)", "value": "80c1b3d6202259468fe68e85faccedf3f0e48f60b3ce2b55dc9b60107881363eb1d28e6a75d9346d45b026e7a2100d71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160551, "uuid": "a7e4046b-bb41-479d-a960-f8337cfc73d0", "value": "T1B5052323ABEA64FEEAE34D706CB8270D8D59BE3B44B01A1F0799E7113F625531484763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160551, "uuid": "d305c3cd-20e1-4f14-b65d-a476319edd44", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160551, "uuid": "d40e3481-e386-4724-8cee-b4125742ac6a", "value": "24576:r9SCdylwJhP3OF9z6RCt1jR5Rw/gJUmDh0Xp6E/daJnk87:QAPueKH5SgJUmF0daD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160551, "uuid": "9f510ced-c258-45b8-b121-454e51f16dc8", "value": 825047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160551, "uuid": "df5cbe10-38be-459b-ac2e-0f2e3f6bdef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160551, "uuid": "3ba45177-d8ad-4cf8-855e-3d55fdcc195a", "value": "GCL-06-12-2023-Rev-869433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc415f00-0ec2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687194111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687194111, "uuid": "2f624909-7924-44d3-b43f-09ce1edb9659", "comment": "Malware payload (AgentTesla)", "value": "ce598eec36e295497c13fa0ec932d3e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687194111, "uuid": "1f2562d1-41d3-468d-9a19-57aae15bc00a", "comment": "Malware payload (AgentTesla)", "value": "b3161d6c62db417a3a11365b32297af6d5d108953d11f9e5a48dbbf03d69146f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687194111, "uuid": "92416df8-1bb1-4860-90e2-ad04f6478a4c", "comment": "Malware payload (AgentTesla)", "value": "64913c7786a3de66dfbb8f5b9669e640878ea021", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687194111, "uuid": "2f5b299b-bfc3-497b-be23-9be5acdbf73c", "comment": "Malware payload (AgentTesla)", "value": "c8a2257aa0b495399ef1115a80a8035a4d28cc0e3e820ee778da3d2ec1eb63a1b34cb0bb98b00d78508e91c3f7bce724", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687194111, "uuid": "1fa6d14e-4a4a-4903-a082-0313b33f3f91", "value": "T13605E0887520B59FC457CE7A8A543D74AA1569B7271BE303A95321DCEA0DBCBCF102E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687194111, "uuid": "77d5df73-0989-4f15-a5f0-fa3775062746", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687194111, "uuid": "c17697d7-6bd9-4da7-95ae-2f68ad7b736b", "value": "24576:YlYqtm8OqKFVXBEjXrXx08z3LwgfosIHzw2:8+8ObVXBQXDSTgfosZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687194111, "uuid": "70f55947-5a04-414f-a1c3-4a532425c54b", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687194111, "uuid": "ab8a648f-2822-43ea-b959-0c9d5c64c350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687194111, "uuid": "5168f058-bba1-42bd-b04d-3a370c24b908", "value": "TRANSFER SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2d2a40-0e93-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687173847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173847, "uuid": "90feb1b4-de25-4b44-9b41-21875cebb20d", "comment": "Malware payload (AgentTesla)", "value": "b559e2f8aa0df6e07429859121702a4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173847, "uuid": "db4d31ad-5a1e-413a-b5fd-d322d127205e", "comment": "Malware payload (AgentTesla)", "value": "b5294830d0c872aff02498de88a9d56f8523571951b2394ea27d57763265ef9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173847, "uuid": "131943ae-7216-4029-8d62-d451e8289a2a", "comment": "Malware payload (AgentTesla)", "value": "84724474a6ef22d61a14137d10aca68339738fc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173847, "uuid": "fb88b3ce-b4f4-4317-b189-6888f734511f", "comment": "Malware payload (AgentTesla)", "value": "7f19b1e2411c22415f738e290df5b428f140f74a92690671dc6422990937cd2dee43f8436d774be010df0d89031a5772", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173847, "uuid": "f6afabb6-a3cb-4a76-bc7a-752981167d5e", "value": "T13005A6B925D026B79435D592C15634C9F2BF631272638D6839D2DFC782A298E37EC80F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173847, "uuid": "f0762684-8620-4b44-b843-560f2b264e35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173847, "uuid": "38b8fdfe-ac5d-4414-9903-2d09302b2b25", "value": "12288:/q5KJy/XURREbw7Iiek3DevnqaIxSg4sDcqm:i5XK97IuEa6sDcqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687173847, "uuid": "89b35734-dbaf-416f-8c1e-d9bfb4d39ee5", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687173847, "uuid": "6ff3ec9c-9496-4cec-b6fe-d51bd7cacbdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173847, "uuid": "2ba100cf-b646-4750-b2c7-38ffecb28ff4", "value": "b559e2f8aa0df6e07429859121702a4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06f7ba2-0e9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687176857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176857, "uuid": "e888c60c-3329-4dc1-834d-6edb4d248a59", "comment": "Malware payload (Mirai)", "value": "d765a373fd8f9a3b331f6d56fbcce504", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176857, "uuid": "530bc21b-801d-4f1c-b862-c2235407b24c", "comment": "Malware payload (Mirai)", "value": "b53d37c834e25e250da33c74694476ac3d4bc60708a6d7ba8d6fa8f7b386674c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176857, "uuid": "0d2f086e-b495-4184-86ee-3990eefbb5a8", "comment": "Malware payload (Mirai)", "value": "103f780a587d640403d1dd0ad4ab67b4ecf56218", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176857, "uuid": "7dc79f1d-fcab-4464-b6f4-bb46d62f8bb4", "comment": "Malware payload (Mirai)", "value": "524eac119df23366daec02a92b80d6b78958e4f292417ce2455c881d634baeba63e7e1f1210e427cfdc0b876bb4e37dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176857, "uuid": "106f40c0-da07-47a6-b04d-130d18921106", "value": "T144132A31BA7A1E1BC4D0A87A62F74729B2F6061B65A8CB1E7C730E4EFF2194055136F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176857, "uuid": "9f277e59-c208-424f-9d17-27ed280b26ed", "value": "768:UtqoXOoI5Vq9RDjDjYQZ4Sxy8VqjiU5mO+QceSZ1G3:WqII5VSRDjDEQZ4S5nU5kQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176857, "uuid": "4f85c336-738e-4126-83fc-408cf6e79f6b", "value": 41884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176857, "uuid": "16781abc-a7d5-4c0f-89e6-6d31b3f55b2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176857, "uuid": "13910589-b6fd-4826-86c7-7a9ad6f32356", "value": "d765a373fd8f9a3b331f6d56fbcce504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d96f96-0e8c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687170914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170914, "uuid": "3d1ed164-07c2-4fe6-bddd-cab5de1b7135", "comment": "Malware payload (RedLineStealer)", "value": "e410231f9daabc60a1fb61401bf68396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170914, "uuid": "eb253cee-a366-47a0-99a7-f9ad95b04e41", "comment": "Malware payload (RedLineStealer)", "value": "b5b127766fb45a877023e9bad1ce2ff59232d6e57a0aa901855bec7de2ae64dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170914, "uuid": "34848874-2db0-4279-b0db-fbb498932241", "comment": "Malware payload (RedLineStealer)", "value": "fbf39cf5d02704504856481039b09e5b2bb35d97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170914, "uuid": "da73cc00-68f3-415b-8b9c-590d2f550713", "comment": "Malware payload (RedLineStealer)", "value": "33c0c2c05bc9b1ec7cd4a71d15ae38559409f429669cabaccfa3ae29051b4a9f5ff146a75f453d8032f89ce8a2a8dfcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170914, "uuid": "2eb01642-9dee-407e-8a69-aff877a46447", "value": "T1A4D41213A7E88073C9BA277098F643DB0D36BC718D74876B3284945F1CB35A9A43676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170914, "uuid": "af752120-f976-46fa-93c1-d2651a319bc5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170914, "uuid": "ed94e5ed-647b-47a1-8cbd-f9a67b68bb9a", "value": "12288:6Mray90RuzaKZjfwO4quvJ0SQWwcm8PWFlCa6i3sY4xAmiylXNK:Yy8uVZsOjLVpcIF6/Y4xh3BNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687170914, "uuid": "65e613d0-53e2-4e01-a53c-eef1d0577b82", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687170914, "uuid": "cde12a4f-6d38-4db8-a95a-6906949969f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170914, "uuid": "f0528c00-e210-4906-92b8-9a8f78dfd88b", "value": "e410231f9daabc60a1fb61401bf68396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482e52fd-0ecd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1687198533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198533, "uuid": "e18f00a7-ecd7-41fe-881d-501d8598bf49", "comment": "Malware payload (RecordBreaker)", "value": "c05b090d5a0a0a04af916a53ee6c0132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198533, "uuid": "a2407b91-aaf6-4d78-9b9b-55b90c85a36b", "comment": "Malware payload (RecordBreaker)", "value": "b5fed3d09a1c70a954e0faa46c3371a471f48a16ac3db95800f70d56e6e1a23f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198533, "uuid": "a7117105-976c-491f-9b6f-b396d922c114", "comment": "Malware payload (RecordBreaker)", "value": "87cde9e608ea7d99e8c214d527ed501c2979d0b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198533, "uuid": "9f9eb339-eb65-4500-babd-b7f1bbd64590", "comment": "Malware payload (RecordBreaker)", "value": "0aea0ceafe641bc192b12d59f0aef212095d8c532f303a5ebd5bb300eb0c10fa6902bd334beb953e0a5437f745228e56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198533, "uuid": "85b0a1f9-df9e-4fae-9d18-b2bb9a0e8f57", "value": "T167347C2362907C74D92EBA72CD2FC6EC365DF951CF1967AB62386B1F08B01A1C5B2711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198533, "uuid": "60c62451-8423-488b-b43b-40e097091897", "value": "c1947b9846baf229e0c776cadd6d408b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198533, "uuid": "370dc88c-5b55-4cb6-8015-02643f721ffc", "value": "3072:+9lnZMwO6xUAEU6siiiiiiii5rJ0AGPDVHF4yDcBx6cITWMkvkjAs1B4:2Z2wO6xU3uWDb1SyDOx6FWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198533, "uuid": "a3f1074c-e16e-46a3-8b45-360de4ddbbbe", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198533, "uuid": "056ddfdd-2e12-42b5-805d-d708b72b68da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198533, "uuid": "3f6779ba-2fbe-48d8-83e6-96214191a4ee", "value": "c05b090d5a0a0a04af916a53ee6c0132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9ed91c-0ea9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687183158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183158, "uuid": "a6bff6f2-f0a8-4a6f-ae1c-e583c791987c", "comment": "Malware payload (GuLoader)", "value": "601325c72030d93334059be1394ccf0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183158, "uuid": "306e3c91-da3e-4787-b7aa-0e12f17a9f0f", "comment": "Malware payload (GuLoader)", "value": "b648a39d90b072f6ddcc51c4385b91c6ccf8f09f07cff7214468efe096315d91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183158, "uuid": "5ed5eb36-4563-4d7c-87b2-a544b1dc649c", "comment": "Malware payload (GuLoader)", "value": "ff4861d068e67cc11046923472e24df4e10f2709", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183158, "uuid": "70a056ba-9513-4c92-b960-24c3f9998108", "comment": "Malware payload (GuLoader)", "value": "afa5f88926042166d6423983c0ca367325459e6af0b7494f39b6886b71ca5c837568c90be7aebc8525e9984189195278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183158, "uuid": "ecf631a9-df2e-4785-abce-0799c9b18650", "value": "T1939402A2F25488E6FDA6077454378D262097BD2DB8B0E31F6BAE73146F73382144B51B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183158, "uuid": "b324af8d-61f2-4b1b-8fe0-53bf20466543", "value": "003a54a0fe3c2a4dbf64143004ff22d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183158, "uuid": "373d2cb8-a3fe-433c-8995-b2e71f362e83", "value": "12288:M1nWS46CFHhbIM/j6dZd60ErYI4wo10n0ICm8:eWj7F9/jCkYEoI0ICm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687183158, "uuid": "e35a2894-2011-41e2-8f04-f1297dc2355c", "value": 439535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687183158, "uuid": "04cbc2c4-d990-4b6a-bcf8-d6c82b7ba76e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183158, "uuid": "b4e92a81-e29d-4cc7-a254-aef51f0b8506", "value": "LIST1101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbd419f-0ea2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687180260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180260, "uuid": "dd982c01-1af4-42a7-9366-e26f428d9e91", "comment": "Malware payload (AgentTesla)", "value": "e29071e256f0f6ac8fd0ca7382420581", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180260, "uuid": "cb3efb0f-0861-492f-9e6e-712c546efbfb", "comment": "Malware payload (AgentTesla)", "value": "b78bb52dae394f692c9648524bca8cd0b7d1743f3c61f364c4875c56bd1b93e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180260, "uuid": "380b93bb-7322-4acf-be61-9539221bd367", "comment": "Malware payload (AgentTesla)", "value": "505f622052a07600a84a4fa74d997e2e2cb006bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687180260, "uuid": "edbcb328-1d55-44ec-830b-cd4f5facae76", "comment": "Malware payload (AgentTesla)", "value": "55b96f33cd7f20c1fa3ea48ede8b769dfc608c9683ac91718132219042cd2b1f6017f1fd27faf3d79c810b38936b5982", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180260, "uuid": "061d2deb-e789-42ec-971a-e3a1f4581fed", "value": "T11364010DBE408D46C4730270482A5B261EA7ED2598611D9633F3BD5EEC73DE2ADC92F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180260, "uuid": "27cbb8d9-ec54-4359-ac82-3e0375c6dffe", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180260, "uuid": "f32b8147-d6d9-4cd9-b44a-907e3ae2f995", "value": "6144:gYa6U5MSNZJ0bvOvgRjNY1fAouG5isjVshGdxauNUrdk:gYm5MS76qvg9CAqjV0GWueZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687180260, "uuid": "25f0fe49-1617-486a-a3b8-cccc1fbf42c7", "value": 321389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687180260, "uuid": "c5fc95f4-6413-4cb2-8546-4c440b59c6b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687180260, "uuid": "ae71dd23-ec78-46eb-8498-64b22511ce58", "value": "REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64add4f0-0e70-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687158638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158638, "uuid": "515a8461-e7ce-43bd-829e-6eab2740471a", "comment": "Malware payload (AgentTesla)", "value": "5171fb55a60d1750b66a36ff3d7cc54c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158638, "uuid": "12761735-da2d-48d1-94e6-f288cdcce4be", "comment": "Malware payload (AgentTesla)", "value": "b955c65a85ebaf78c88abefba4d5162d65ba4d3d3a99c19018b5232da1f81b38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158638, "uuid": "fb529842-a26c-416b-8303-e74de2b77845", "comment": "Malware payload (AgentTesla)", "value": "910002ee540fdc619a62434c6834950e80245186", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158638, "uuid": "e1b95691-bee9-4518-9c37-265610d0ed85", "comment": "Malware payload (AgentTesla)", "value": "03f0e50195bb03eb314872821e4832ea95f5f91ae81a05e1f2d64c226861076fd54db133b4bcf4a46922d4d00a624878", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158638, "uuid": "6a66fdf4-d8b4-4d10-bccf-b28e977253cf", "value": "T163D42367AF6D96BCB6DA23295D86F9EE42630F87D8C5F7539CC246849609CC4E0B3301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158638, "uuid": "2bd88f51-818d-430b-b97c-f5666b79f4dd", "value": "12288:Mfnou9X0nTqTmgpPTTJ6259YXIk2wvkDt9VRW49SzDQ0OZG:MfovnTqTmgFTTJ625AIO4t/dS0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687158638, "uuid": "6941ad91-4246-4a7e-ae26-7af4fc943e39", "value": 641838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687158638, "uuid": "cc6e34d0-614a-4800-b549-3fcfe82de41a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158638, "uuid": "4c3c0d58-049c-4973-aa6e-7e770966adbc", "value": "JQ234102474.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979e5fcc-0e7c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687163877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163877, "uuid": "fdc6ffe6-ee21-4d15-9c6b-ed900f27701e", "comment": "Malware payload (Mirai)", "value": "9c61c5157a1d18da8efefbadc81423c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163877, "uuid": "5a84600d-0a3b-48f9-b3d5-e573d9ed66e8", "comment": "Malware payload (Mirai)", "value": "b9851c4a32b3f66f49fb4e8e52ec80c93c7ae54e3c323bb77aab5bb40b476115", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163877, "uuid": "ba234943-2a11-48f8-867a-97add347dd3e", "comment": "Malware payload (Mirai)", "value": "31221bbb5b9572edb519e4d7abb1ae305aa992d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163877, "uuid": "fc725a5e-082a-406e-8a23-7cfcd38b7643", "comment": "Malware payload (Mirai)", "value": "e996e54edeeb99cfafcd2d68b6fd7730acb100df42a5cd4a5d23e383092575237eeeb82d64ccdd28f64bc581e7cf9b28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163877, "uuid": "ad6c1b18-dd5b-48bb-a4d1-d4025fd376d7", "value": "T1ABC2E1BC7EFB6F47CE1B0035A958EE2781B0A5A5D36B7697B34441026C031E6BA27CC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163877, "uuid": "4803ff99-adb2-45f5-87d3-027bc55ff559", "value": "384:MB1DMwk8JPyGNoDZsEXVZVBS6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjOY3E:0Mw4DZdFbBS6x3K/KdWnH5NCpc0NI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687163877, "uuid": "97208a07-247b-47e9-9235-5da04da77bbd", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687163877, "uuid": "72f18cf0-e24e-42e1-b63a-daf501de138a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163877, "uuid": "c27ad761-8b93-4a2c-8f8b-9155aa758426", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401f72b1-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687175327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175327, "uuid": "14f66865-2b04-49b8-9e16-c90d6da6ff50", "comment": "Malware payload (GCleaner)", "value": "104d38fa67134b650f4bea3f5169fd13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175327, "uuid": "beef9bdf-485e-4ee9-b7d5-78c769b0667f", "comment": "Malware payload (GCleaner)", "value": "ba1d6f82498056c5825ba3b60fe2ddf5dec27c44d8015d898c0e8a2801a4a567", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175327, "uuid": "6dcd4c12-b479-4721-95ce-beba95c34506", "comment": "Malware payload (GCleaner)", "value": "8b43eac44326271c8591face980befebc62a10e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175327, "uuid": "36a96478-908c-486a-8c4f-104a87d8f0a1", "comment": "Malware payload (GCleaner)", "value": "2953cf6c3e0631ba051226a9778a64e927600121af36d7f89e74166d89f12699fdd6cb3de81d83b5001d62c9cbbe5796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175327, "uuid": "9afcc5ef-d4f9-46f9-b416-bda5897c4b26", "value": "T197649E43A2A03C50EA25DB728E2FC6D8775EF6504E487B6D29289A5F24F13B2D173F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175327, "uuid": "ca7e921d-433f-499d-8898-39c2c32aee23", "value": "04b17228a03b1d4a739b2c7487c1a1b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175327, "uuid": "71babe6d-d0fc-4eee-8c57-3ce7ec7e8bda", "value": "6144:oCC14shlCdKXu8pxof4XiK+Y61W/ZDF3YlgtyRN5:m1mdr4E4SB83YllRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175327, "uuid": "3f697a75-49c7-4c0c-b5b6-5a038fb9e624", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175327, "uuid": "dee4948e-17a2-4a48-bd30-6cdf40c0a65b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175327, "uuid": "53e875f6-a025-4cf4-b9db-63d12a576e1b", "value": "104d38fa67134b650f4bea3f5169fd13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cca9ab5-0ea9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687183052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183052, "uuid": "754ae996-44ae-458d-9f48-7c23d4d6b9e1", "comment": "Malware payload (AgentTesla)", "value": "5389c552cc9985369878dc9b5c0eee64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183052, "uuid": "aef3a36f-ca6b-45b1-a064-01bfbe598d29", "comment": "Malware payload (AgentTesla)", "value": "ba3ec8b96be2e012c552cd27793838f8c52b5785587f9d81cec4bcb9213e25bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183052, "uuid": "d2372ac8-25ba-4bcf-9bcc-f3819c16ff26", "comment": "Malware payload (AgentTesla)", "value": "f1969830f199503b44a1eb81d345d39640ec8f37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183052, "uuid": "0543ee93-d640-4a8d-9d91-13919bf8844b", "comment": "Malware payload (AgentTesla)", "value": "d2d940e1027f5442da695cfa6297ea5d9a108f0139f73f894dab101483d208b09a7fa6de9cf7a1e6c2c801833edbdf97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183052, "uuid": "a9169bfa-7b67-4b39-ab81-545ce920bf8c", "value": "T18A7412409B90C9A7D8B1AA3549738B7AA7FE4D062974CF0713103D9B2D593E6DF0EB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183052, "uuid": "bc9b32dc-8d16-47b0-a4d1-ad02a9d26522", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183052, "uuid": "8a8af0ea-575b-450f-ba34-76fc86806a10", "value": "6144:ST4Dt2ehAcPnHUJSuEVWAec6AP5mifDByAWgFXkig11hLXiTKZ:STgAxwgi6AP5mifDBLtk9LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687183052, "uuid": "7232a30e-c0e5-4401-8001-b0c95b3e1174", "value": 359840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687183052, "uuid": "2591671f-eeb2-42d8-8712-0c4a523032b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183052, "uuid": "70e0c25d-bd89-4cee-b192-1726a0a40433", "value": "INV-149044701 xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e338c293-0e72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687159709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159709, "uuid": "fa8a19db-4a7a-4786-8c8f-5b186f9d53d4", "comment": "Malware payload (SnakeKeylogger)", "value": "b071067aa4383d262a72fc75a8d7246a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159709, "uuid": "13c6b7dc-c5b2-4164-a197-8b02bd464f79", "comment": "Malware payload (SnakeKeylogger)", "value": "ba49eef9b65812272e8c980669b13587a4030bb0372c9308299b2cafc4e51376", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159709, "uuid": "27a5545d-ffd8-48c0-928a-acf0c2b40a42", "comment": "Malware payload (SnakeKeylogger)", "value": "e5ab098c021e2c4d1884b3f827c6bef5218f624f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159709, "uuid": "c5dcfdf1-ff76-4daa-9719-e0e898bed882", "comment": "Malware payload (SnakeKeylogger)", "value": "c998142ba63c548dab1ad644d7e4e17c7fb521dc2e578d997ce9575f090467c0bb0ce55096c0f96fa467732f6b7578ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159709, "uuid": "3115d231-fca3-414a-a2e7-75d1c7484749", "value": "T1C95412007670C177E5934B310936E1E77FF9AD152898EA5B1B600B2ABD717CADE0D392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159709, "uuid": "716b9c88-f67f-468a-89c0-cdd97c2ab2c4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159709, "uuid": "93be3912-d66f-4215-b73e-17b55931f5d5", "value": "6144:PYa6LDcK6xol+lJ21O5EJhjTfkGGqXIQIXqTYdLsMaJU981e/k8Kw2:PY5QhxRS5D/su4QWLQQsezp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687159709, "uuid": "5f26bf00-d097-4df4-9c41-6b350f63e9cd", "value": 297640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687159709, "uuid": "5c48399c-2e5a-4240-8c73-ff01bc687531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159709, "uuid": "74cf50c8-4f9c-472f-ba50-1a5dc0a5c587", "value": "Order New 10F-10512093-OP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281e3437-0e8d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687170992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170992, "uuid": "cf12d782-853c-4ea5-804f-be922cc987ee", "comment": "Malware payload (Mirai)", "value": "99512979c09b9cba62a0d466326af2ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170992, "uuid": "cb8cba24-5a90-406c-a8ab-87be32e5f41c", "comment": "Malware payload (Mirai)", "value": "baee3e86c163fe0ffb3e9a562b310158b6658bf48049e063b639a68415b37037", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170992, "uuid": "489fa11e-3c9d-4638-8418-416bbd497e1f", "comment": "Malware payload (Mirai)", "value": "f787e0368e9665679a24314420510b5118ac2233", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170992, "uuid": "d026c2c3-ca88-480d-b3f2-cfc1873351ca", "comment": "Malware payload (Mirai)", "value": "c0ed142855c6c41f9512016af123aa44d102ba9be6f650fc847301c470aeb4f740a46f73c9cb18612232172ab27123e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170992, "uuid": "56ffe7b8-4bd9-45e4-a9eb-a56988ed2874", "value": "T166D2D0AEE57442C5FD8D5C3E808C3FA11E19E681231BDB9177218C8D5B36C5BF26A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170992, "uuid": "8c4a5483-288e-4f3e-99f8-2a0b08032b44", "value": "384:Q8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orj9BNPL1RWGVCz0NvF:FMYHb62x4ahQ3CfdwLjOHfWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687170992, "uuid": "413bbba0-185e-45cb-a8cb-8ebd3a78b704", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687170992, "uuid": "ac21e21b-457f-4e5c-98ef-27a1eae39d72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170992, "uuid": "eb61fb77-a047-4dca-a154-4043c8ae7f2b", "value": "99512979c09b9cba62a0d466326af2ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc6a687-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165361, "uuid": "8e2c2c1f-574b-4de0-b7b4-d8e0714a610d", "comment": "Malware payload (Mirai)", "value": "76bf765fbeb93d26dbde860cc9981bf2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165361, "uuid": "47d69cda-858b-477b-b13c-1bf0cce96088", "comment": "Malware payload (Mirai)", "value": "bb51d3c9d64c0281fbaef9e9c8da467fe6881a6be1736639e302fa0af2c396d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165361, "uuid": "33785d5c-f1a5-4736-9f88-95e227f9724e", "comment": "Malware payload (Mirai)", "value": "5105afe770a1f05b6c0ca9123999053fcdfbb043", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165361, "uuid": "512d9d54-cce1-45a8-a067-35a0ca85d86b", "comment": "Malware payload (Mirai)", "value": "bc1445542594e3ff68b0e5e2d61ece8106df9c7a834d252b7e0a894e8f2fd63391ef24953a99afe90773814de826a034", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165361, "uuid": "6f9a7525-6d47-400d-a3de-42273bfbe2c1", "value": "T1F6E2E10190839A12D7B148B5ECBE15C3B21C86F521FBF8A2782C76DCEE9994875EC5C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165361, "uuid": "dfd29d8f-9e4e-4263-ad95-eb81a8405063", "value": "768:JJenDtCgN3C9ndVO4Z5HBv3AcA/AxVwZdBpuq3UIGE:JiCo3SqCBPjYAEJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165361, "uuid": "1c2b1b12-4f27-457b-bdfc-abbe2388e8e8", "value": 31952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165361, "uuid": "7ba95dc2-9d5e-4f7f-9c33-fc08f7adbc50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165361, "uuid": "95e12278-edc4-42b9-a576-891bdf7f4366", "value": "76bf765fbeb93d26dbde860cc9981bf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4793a62-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687160543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160543, "uuid": "7a3358dc-a52f-4663-b574-16e24d8fea55", "comment": "Malware payload (AveMariaRAT)", "value": "7fc5f29a5289b1f5d0ee1051f5dc682f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160543, "uuid": "0a6e1760-3624-45fe-9c70-87d9efc2b073", "comment": "Malware payload (AveMariaRAT)", "value": "bc328eb0e9ed41cce25d10b35e678f90b5f0363b59a48ee467b52d2dcdebb169", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160543, "uuid": "f2f7e5c4-839d-481f-9d4e-4e1a55e5909c", "comment": "Malware payload (AveMariaRAT)", "value": "8f9ad01cb21630756a834caef46be63c9d17d8d7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160543, "uuid": "f59c1537-ff47-4872-a2ce-559dc99b17c0", "comment": "Malware payload (AveMariaRAT)", "value": "3fe559bf0438bd94e54d50244cbb4f8415303764e6f955aa87e7e6b4d430f8f970cfc57b482cc02b3c57c1757feb59f4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160543, "uuid": "50de7935-3ce4-4a26-a50f-915dadbe570f", "value": "T1F1E37C327BE188B9E6F6013109F53F39CB7DF93111208AAB63905A468D37ACDE955783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160543, "uuid": "85de2187-4106-41e1-baad-c3af30fe88bb", "value": "b9494f92817e4dfbe294ad842e8f1988", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160543, "uuid": "f6e5bb24-483e-4232-a0a4-f62d5a6f6323", "value": "3072:4NLOpnhTdOw9YAJOzIY9gVl01T2ENipdDg0z5:4NLYdT97JSIFl0QENqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160543, "uuid": "b65489bf-d691-429a-af98-85f4a412c3b6", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160543, "uuid": "7cc5c078-d75d-4af6-b924-1fcb5b566254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160543, "uuid": "b87db403-c7f3-4f5a-8eb7-36d806064b09", "value": "bc328eb0e9ed41cce25d10b35e678f90b5f0363b59a48ee467b52d2dcdebb169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b53b4b-0e9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687176620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176620, "uuid": "8ffc0610-a705-4376-b8a8-78b0d9ed0ec9", "comment": "Malware payload (Amadey)", "value": "9a27daa34294cae86ebffba26e05986f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176620, "uuid": "611c4e9e-ce28-4e93-8944-002a49cd0cda", "comment": "Malware payload (Amadey)", "value": "bd5eefb71c71dcf1dc8c90a4607417ab1be8e947b399baac1721b40e7cb7cb04", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176620, "uuid": "76b94efa-9c41-4aa2-b247-318a73b13c8e", "comment": "Malware payload (Amadey)", "value": "08c1fdd81d237bcb72a8aeb0396e7ff2529693c3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176620, "uuid": "66a77028-8a31-4cc7-b50d-abe49bc00e7f", "comment": "Malware payload (Amadey)", "value": "287cebb2f475b537e26f5bb3135242f080abde579930abd654bc53e48ff1b8389ef62f67d6a47dcd7bdea49e2be1699a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176620, "uuid": "0519ba0a-9700-495c-9690-c83c7ba424d0", "value": "T1B5D41212A7D99573E8B0173258FB07631F32BDA24E78C3971B85981E0CB37A4957236E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176620, "uuid": "787d8606-76e4-43d4-b06d-05810507142f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176620, "uuid": "ffe88686-9077-46cc-a064-270a925205f1", "value": "12288:gMrRy90rlY80eHFpcvS2k+AO3wJM4gUR08S6mgEllt:hy+iWcvS2ke3wweFEllt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176620, "uuid": "cae88786-d039-40f4-8a67-8ae55ba52561", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176620, "uuid": "c651f050-f11f-46b6-9bc0-41ea5c6e21b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176620, "uuid": "7d075a1a-afe8-4772-9213-8f4dab5c3796", "value": "9a27daa34294cae86ebffba26e05986f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ad5e67-0e58-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687148469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148469, "uuid": "767f7586-8b33-47f7-9a38-5d99cecccb77", "comment": "Malware payload (Mirai)", "value": "1753dfa39e274fedaeab44316bc0a3a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148469, "uuid": "b05ce895-1391-4e74-8bc2-29c5eea10f13", "comment": "Malware payload (Mirai)", "value": "bd9e3d5d3745fef5bb333609b24a1c9aca0c18cfa7de00508817598c72b5a79a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148469, "uuid": "e2005883-0b33-4a2c-b634-88c5051531e1", "comment": "Malware payload (Mirai)", "value": "f07cdf403aa3bde1841f96d3f5fea59330add5eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687148469, "uuid": "30308e1b-7ffb-4708-95d4-591ff6410cbc", "comment": "Malware payload (Mirai)", "value": "d9515c1f58215ed2da9ededdceb7e7f01bc45855f874704c44d62d59ee2a8389d6f02f105fc3225f3fb7c300278f7e75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148469, "uuid": "f7663184-8407-41e0-a5cb-a150ebf24f2f", "value": "T15B732995F8028D2CF95FE9B954620E0DBD31638152830F2B26ABFC93AD721667E13D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148469, "uuid": "971cba52-d395-4365-8014-e6efea504337", "value": "1536:VOov3mG2jfOo0pGGNyOyGqTN8CRTf1ifoUS1bPef:VBdove7CZT0foHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687148469, "uuid": "fb69a306-e403-4f10-9134-26e9140cbd07", "value": 74700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687148469, "uuid": "d2ab6465-bd3c-430a-b936-c3b2afea9624", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687148469, "uuid": "776a0669-5459-43e7-8356-1f919292d5af", "value": "1753dfa39e274fedaeab44316bc0a3a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac05761-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687175318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175318, "uuid": "bafe97c4-a4c7-4b9e-b0c7-5d83fd4f7c8b", "comment": "Malware payload (GCleaner)", "value": "ffc567c79a25dae88be40db6866465f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175318, "uuid": "124f4773-7dc0-4a07-a5d0-28049c09199b", "comment": "Malware payload (GCleaner)", "value": "bdac8e418c5a3b11378095915d2e65622a9ad955d615e1290544ce7dd9273496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175318, "uuid": "6888e0a5-7908-48fa-a06b-a9220c530d6c", "comment": "Malware payload (GCleaner)", "value": "e9d2a042bb0295dd65940e572027d331b84150bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175318, "uuid": "5e53c76d-bbdb-4c8f-bfb2-6ce33331dcb4", "comment": "Malware payload (GCleaner)", "value": "7d1792a23807afd86f9c5fcc07508f2f457180dfa90df1d175a467093d84db5130657c78b734b5173615ed0dba775762", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175318, "uuid": "61945cca-e5db-4afa-865d-9c557fb4af28", "value": "T152649E43A2D03C50E925DB72CE1FC6D8765DF6504F497B6A2A289A6F14F12B2C273F81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175318, "uuid": "850e2848-6852-4bc0-bb60-43a794c449fc", "value": "7444f526e1fbbb340adaca08db3fed51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175318, "uuid": "8010db31-96c6-403d-86ab-3a28d75d0d6e", "value": "6144:SCDalSWxJWEOxDx+8eEAiT1Z3NJC/DWLH04uR0qs:ySmW1Dx1JT1o/DwHSR0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175318, "uuid": "6db0f1b7-8a23-488d-8d58-8db3d77126de", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175318, "uuid": "ecd01e4d-1ab1-48ee-984f-fc6fe1bc8f9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175318, "uuid": "97b35ac2-97b7-4484-bcbd-f9e949308516", "value": "ffc567c79a25dae88be40db6866465f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36436e47-0e49-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1687141810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687141810, "uuid": "60693119-c67c-4e54-9c4e-544e32de9014", "comment": "Malware payload (Smoke Loader)", "value": "0b2e4f6fdda3755ee1ce4e26de6d1014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687141810, "uuid": "6ab9fa09-5253-4caa-9514-5f95c2bd4a82", "comment": "Malware payload (Smoke Loader)", "value": "bdbc8b6f35f23bed42ae3b9724beb5bf550aa0ede86ccaaa610a11185230f1fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687141810, "uuid": "ac1637ec-b61a-4834-b26a-135732ce41e0", "comment": "Malware payload (Smoke Loader)", "value": "5bacb0b0e2ae51666eb427639361d212663f975e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687141810, "uuid": "83027f85-55a0-4de1-aa8c-53bffe298d8d", "comment": "Malware payload (Smoke Loader)", "value": "95c7268af941c75fe2adb892bc0c8a4b2281f645e381b7fa320a5bcd5e9d3ecc70164446f20e197112b71d44a5e11eeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687141810, "uuid": "f99ce94e-4997-40bc-8a2b-bb1b6bedac8f", "value": "T1E7344C4392E1BC51ED264B329E2FD6EC7A3DF6D08F4A7B6612189A1F44B11B2E173710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687141810, "uuid": "57d43c97-d84d-4bf0-bc64-9d2500184ae9", "value": "0e48d5f6d89199cad77b21fdee68f524", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687141810, "uuid": "2bee7469-5531-4468-9f87-7ab9716658e5", "value": "3072:suvNYtncZRoQEV9Vj8Wgl/4ylpcRIk+g/itdT7vB7p+4GkL1FRr+szK:syQcZuh9aWglATSLSEhxpskLNvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687141810, "uuid": "20515f65-5470-4d71-9fa5-7891a28bc4c6", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687141810, "uuid": "6b392de3-d25f-4cb3-b84b-0c023f170cce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687141810, "uuid": "cfab2b75-338f-401b-8a8a-892cd9e44501", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068e9a98-0eab-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687183820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183820, "uuid": "cfb59952-7c38-4918-814b-cc60b7174704", "comment": "Malware payload (Formbook)", "value": "05448a55f9ad1b0ca58b32bb01c371b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183820, "uuid": "ee95d3eb-e12b-4785-bba0-c3f32e795d89", "comment": "Malware payload (Formbook)", "value": "bddb79b43d9173dba1eaa807096a8d2f09fbcec0f9adb9c7f5f5fbb97cc82b48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183820, "uuid": "23429835-331e-4dbb-baba-6129a96b1b00", "comment": "Malware payload (Formbook)", "value": "a150fb7d510f2802a72c7bf94c200f9d4dc2e3b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183820, "uuid": "874a6eb2-a2ca-4732-837f-6f1fa4e5d066", "comment": "Malware payload (Formbook)", "value": "7c6a335945a144ee1d53f667296fe3ce03705b3f823dbee744efde7323022c934a8e5a59b4aa43ddfebe14ba6e61b0b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183820, "uuid": "a84c40ff-7a38-4bd9-bdc9-946ec5977bef", "value": "T1D3157EA6B2F29833C26635348D0757982829FF601D28794EFAEC390DDF3E2947909757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183820, "uuid": "9e4088a1-351b-49af-b07a-5c2182a48024", "value": "10208bb07d454e47048be37ee7fc6e0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183820, "uuid": "9764f22b-9284-43f1-8ebd-01a3a84e5c19", "value": "24576:DqdXPn4tl29UFPWmKoyk4TLmgvky46i95nwkac:DqdfXUFPjKoNw714x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687183820, "uuid": "2f1e0e7a-e1e3-4b39-8054-519f02198f79", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687183820, "uuid": "c912fa60-056f-47a2-84f8-5f0fc4607d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183820, "uuid": "db8c0d93-08c4-4fde-a825-928efabf635a", "value": "Yofmdizwhylbef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330afedb-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165427, "uuid": "26adef26-b87d-4e7b-8b02-975011441904", "comment": "Malware payload (Mirai)", "value": "f2567ce43697625c6d64eb4642c4ac6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165427, "uuid": "823fc8fd-5cd4-4cf2-b424-b1c3a636beae", "comment": "Malware payload (Mirai)", "value": "be1db5e299b30635e7074b7aa7142940516acd423bf358d1ab87659475b3d85b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165427, "uuid": "0ce20c20-5c78-4cde-939e-604fefe41033", "comment": "Malware payload (Mirai)", "value": "624408df2271dc08c176c6d36f5f0fc39e37c3cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165427, "uuid": "79ab4ad5-9c00-49a1-aab4-483b252d2e29", "comment": "Malware payload (Mirai)", "value": "309e9d26d0f3c3b77859040d7948b966d8f70e51fcd057774b786bdea6ba6bf8193fc781fdd12cc243be8e0ec3720dfa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165427, "uuid": "02f15fc6-f7e9-481b-8f31-53a80ed372d8", "value": "T177030782BC9299ABC6D063BABB3E169C336677D8C2DF7313D81417146B8695F4D33A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165427, "uuid": "02bff8de-5c97-418c-99d0-a24c93a338d4", "value": "768:rzfeONapdgI5j67aUG5pK8qaCST5z014LPaVzUUNb4vB5uoO0G/xkMPngz3Y7:rTbnI5e7tG5poDN4LaVPNEvB5gpk8ng0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165427, "uuid": "8d5d1641-3955-4d9c-aebf-9c1584cc3ad9", "value": 39524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165427, "uuid": "79fff70f-d957-4a75-b906-36ff19906aec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165427, "uuid": "587d8f13-97f8-4a84-90e1-a579055a0b2a", "value": "f2567ce43697625c6d64eb4642c4ac6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fae2f62-0eb8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687189526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687189526, "uuid": "0c569f3b-aeaf-49dd-ab4e-3978d37b8a91", "comment": "Malware payload", "value": "42bfe4fcd4fc7d011e2b63e2649378fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687189526, "uuid": "33dd542a-f80b-4b0a-84a1-b8f2d0a2805d", "comment": "Malware payload", "value": "be4f845872690794a8e1b1d86f5def1d30a5dda7eef1f26ea593e0c814c928bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687189526, "uuid": "15c73460-b4c8-42b9-b2dd-82c9cbc766c4", "comment": "Malware payload", "value": "8c0161f50bf851ba45ec87b73dc2b0f87e63cb4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687189526, "uuid": "44e9a18f-6724-4622-a797-cb1b5f273498", "comment": "Malware payload", "value": "b5ca715be68ca89fde8b1d87a678099c7b375d571bebdb5748569566de82b850bb2520fd330f5e77d72a2dfec4bc3866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687189526, "uuid": "ad5fce50-d514-442d-902e-95fef8a11041", "value": "T1C6721904E7DD5667C2DD8A7CE8B2030903B1E73778C3E38F5DA8A555AAA33C058911E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687189526, "uuid": "a64baecd-4437-4286-acb8-60a628b8c8b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687189526, "uuid": "8218745e-b8a9-4638-8888-0f8bcfcb1460", "value": "384:kxAPkRgq/q2HRjNtQ2UxKKKK7K5KKKKTHFDkwauvvMol:I1rHRjTeKKKK7K5KKKKnHMol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687189526, "uuid": "cb561556-a587-4973-9f26-68d76aef19d6", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687189526, "uuid": "f9833e1c-27ab-423e-ba9e-e0afb04bea8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687189526, "uuid": "44598465-f7c4-403c-b750-db5a11b9fd41", "value": "Novaflex Request For PO-230102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe4b856-0e48-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687141685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687141685, "uuid": "97b6adaf-8ef9-4243-9c80-df68d2e32b41", "comment": "Malware payload", "value": "99bb62df1b312451b69cb9636ec427a9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687141685, "uuid": "335d6ade-d4f6-4477-8c56-d7ca6115b166", "comment": "Malware payload", "value": "bf08f3a1fe8c03765a84b38a0324733f1e884ab6549429313f85e08fd266a28f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687141685, "uuid": "5d66d578-15a0-4877-9f31-aa1d661fab16", "comment": "Malware payload", "value": "0bb47cfee9830fb7b671b8ffc431a144f0746736", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687141685, "uuid": "80d38edd-b7f5-49b2-811f-6e5d524fdcb3", "comment": "Malware payload", "value": "c8279fa7d11e1f8edaf21c0b8acc507b9b14b0ab2dcd38020c71ee45949c6e56e6696d2c68c1fd98e861bf93a513e088", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687141685, "uuid": "f7561b56-91d6-4672-b9f3-d17b2afb6679", "value": "T17E64BE60F4D0947AD5FF253AB0A1C7D7C66CAAB08F017CFFAF01256B096E680AD23556", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687141685, "uuid": "bc9c6008-8c48-407f-8893-acdc1312d14e", "value": "991d694093de0921ba6b1433538ec93b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687141685, "uuid": "686c74b8-dbfc-43e8-96e2-94b08105bc01", "value": "6144:VmcdTINfA1lXI295sYzY7EPbs+9lA0tvn2qrwDldCIFVwFm9DwAlutjrjPA/OgL5:VmcdTINEIGsYzS0A0tv7wDVmMxwAlUrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687141685, "uuid": "6bf3bca8-ccb3-4ad5-86d2-830622fa6350", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687141685, "uuid": "1ee48f33-45af-4a77-85c8-c1b9d6631752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687141685, "uuid": "70f24d74-ee13-4320-b564-5a4b4f81f12e", "value": "SecuriteInfo.com.DeepScan.Generic.Trojan.Genesis.Marte.A.91E2684C.13689.18205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92e9ecc-0e9b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687177221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687177221, "uuid": "72470aa2-a867-42e5-b522-0f69bf44fc1c", "comment": "Malware payload (Amadey)", "value": "a3a440d89b26d371368ea1abdd6655a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687177221, "uuid": "9e7b84ad-ce09-427f-93a7-1b5f19ba2472", "comment": "Malware payload (Amadey)", "value": "bf7e8c75401e50468206275ab59c8b3a35a075ab45f7e7f253f6d403454cf694", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687177221, "uuid": "fa3540d2-b499-4641-84e0-55da6aec3a4e", "comment": "Malware payload (Amadey)", "value": "6da20492b9264f9516b0d7a103892254c42ce2c1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687177221, "uuid": "0b3f0b1a-e75b-47d9-bbd7-9e2f8130d041", "comment": "Malware payload (Amadey)", "value": "e56e7c9f36f5690431c8e95d2f475544d8c8c3c08c9b62dddee3c625dbe9ece8e49bb21eae613a1915e66507c6b2a4f6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687177221, "uuid": "b3d4aa48-1a4a-4c48-b556-21a0aa4fee72", "value": "T19B051252F7C54163D8B023302CFB03871B3ABDA6497813AE7B45BC1E5D63A81A47532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687177221, "uuid": "27b968fe-256c-4acb-80be-834459a746de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687177221, "uuid": "a60634e5-4a10-451b-b2de-662095662563", "value": "12288:1Mroy90UNQGeN/xYNeeu5jYEbClRX4xA6/yhGwFYE+iUaXYwBTApwq1A:tytNK1nxjbQIxA6E9UaXYwBTALA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687177221, "uuid": "77aa5c5e-bac6-4b9e-b059-82dcd25c5f03", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687177221, "uuid": "92572b30-590c-46f0-8c71-05480753c4fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687177221, "uuid": "2054aafb-d3c9-4e71-8c82-42384839d1dc", "value": "a3a440d89b26d371368ea1abdd6655a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24de2cff-0ec2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687193750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193750, "uuid": "1d5638f7-2994-4e6a-a127-f8c6e78209e9", "comment": "Malware payload (Mirai)", "value": "a6c1b37ab3d5c9213a91bdd3484a2cef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193750, "uuid": "19a64573-f461-45b6-8c50-122168544ac5", "comment": "Malware payload (Mirai)", "value": "bf8d6addb39ccffb35dc5c3e8534d895e91f01889be21df7866e753578dde0ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193750, "uuid": "ac4ac70e-1626-4d61-920b-8759f8bf8d64", "comment": "Malware payload (Mirai)", "value": "499901436bf97a0602856022e4a2251161c2a457", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193750, "uuid": "32fc910e-e52a-40cd-a6b2-bc7c86fb46e7", "comment": "Malware payload (Mirai)", "value": "cae22d7ed2702061230e73e919bb7d666a3209e584404185ef76fef70a43438dde9c1ab2dcefb89d8fb48179b2a65ad9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193750, "uuid": "7b46e90b-a303-4848-a079-259a3299004f", "value": "T11A23F1690101D971D0F13974AB1B4764E2EC5D79C8BA3096ED2A1ED3E8CF852FEA8731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193750, "uuid": "4cc7b803-b239-4f62-9f00-06cc1e947de6", "value": "768:SjRCdfvtmQo8uorpn59fB44l7yef1SpB9msMM9okttBDchhfp8nl4Q4m7tq3UIwO:SkVIQo8uot5RB44lWqSpBEsMUokajf24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193750, "uuid": "2918ba70-0907-482d-b2d3-ae0eff4f8736", "value": 48748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193750, "uuid": "1042db63-857b-46f1-afbc-443d9bb18c83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193750, "uuid": "d6545bb0-fa3f-44ab-898f-f0664adf95d9", "value": "a6c1b37ab3d5c9213a91bdd3484a2cef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9b60d3-0ea8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687182624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182624, "uuid": "1f76660b-7cd4-406b-a0b5-a4844ef272a6", "comment": "Malware payload (Amadey)", "value": "4e4c03ff828b6b1fe8eaeaa6739957dd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182624, "uuid": "e7357680-5aa3-4509-96b7-40dcc75117f5", "comment": "Malware payload (Amadey)", "value": "bfab5dba968ea32cfebdfa250f4a7e46e6340f9d45761fb896d970312cc292ac", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182624, "uuid": "e3e216cd-e69d-4f88-98c7-acaa89b45a20", "comment": "Malware payload (Amadey)", "value": "1786cd805d5e012617f89d838a1f707c6901d9a2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687182624, "uuid": "01ceef3b-2589-449b-95e5-9adedc018e64", "comment": "Malware payload (Amadey)", "value": "e4df64078e0d1710a928ee62c3c15624a8ed6d539e0a8b1e6fa5611dcac7ddedf08924c5dce96fc9d04111228b00ec4b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182624, "uuid": "0f93e79e-5667-4b74-a8fc-495645f78efd", "value": "T169E41213E7EA0172EDB93BB414F303831B337D950A68975B7B42599A0DB3694B9313B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182624, "uuid": "e4f34392-07a9-42cf-999b-7c6f8b223e1e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182624, "uuid": "7dd23e6d-8cab-49ee-a661-56b341857ed6", "value": "12288:qMrey90oZQGgz8tpodr+UjBTn0oXGK87P8tn5vTmxaJIJZmbzoi:4yYSpopXNnv20N5rmo6JZsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687182624, "uuid": "94d5047d-0503-4a78-844c-85d9aef93397", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687182624, "uuid": "b704bb9f-e570-4876-bf2d-8480273e2496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687182624, "uuid": "d4f0fce4-6ca8-40d9-9435-e2272c8bf301", "value": "4e4c03ff828b6b1fe8eaeaa6739957dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e735519a-0eb4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687188063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188063, "uuid": "984b2e8a-2e84-4b4e-9c05-f5f059a6b71f", "comment": "Malware payload (Mirai)", "value": "46f3339eee3b6ef336fb555d75ba4c7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188063, "uuid": "650410fe-1da0-49a6-9559-c91c81667d0c", "comment": "Malware payload (Mirai)", "value": "c02decd679d327f80c550f8b619672aa2a6259fd988e18ce4a32e94d6a1ab66e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188063, "uuid": "0b1afc64-0ec4-49cf-a1e4-f56e548a424e", "comment": "Malware payload (Mirai)", "value": "7e2164b24f94e528f53ce6650b65026436db0e41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188063, "uuid": "502271cf-3f6e-4a7e-a51c-ab7c48b455b6", "comment": "Malware payload (Mirai)", "value": "7b40c7c537e94b183ab301ba49ace02656d4360d06a4a0b08c0463b9bbe6530dd0b1eaf3b76e9f97798460c336845207", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188063, "uuid": "d306d27e-4f28-4025-a3dc-07f7496cd019", "value": "T1ADF3C70E7E318F7DF7AD863507B78E24A358379622E0D285E16CE9111EA038D641FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188063, "uuid": "48137975-7de8-4a81-8e46-c2c9dc387cfd", "value": "3072:4xS4nanSp/0NyGe9+WIXWqifdOCaWlQ1vqqULMuec6L9abNH6IjBEl:4xmSp/0NxKlcvqqU+dL0JjBEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687188063, "uuid": "585023af-3bf9-4b75-ad71-548165b281dd", "value": 157844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687188063, "uuid": "c778fc3d-fb98-41fd-9d69-4fafc42a1699", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188063, "uuid": "99b3df95-3162-4464-ab86-7e420e487d23", "value": "46f3339eee3b6ef336fb555d75ba4c7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0887abbb-0e91-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687172657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172657, "uuid": "6b521f82-9d41-4b28-8755-b1eeab59ee12", "comment": "Malware payload (AgentTesla)", "value": "d9501becbd9477487252f0dba1c9c2c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172657, "uuid": "50e1cbf7-fbe9-4f9d-aedb-0da4d87237d3", "comment": "Malware payload (AgentTesla)", "value": "c10c5389ff2136ba1c998b3d68e57c85aee9f83440cc06ca872135d354a3ab6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172657, "uuid": "69b4042d-335b-4de4-99b2-766823c75971", "comment": "Malware payload (AgentTesla)", "value": "8f2d8903df45d5c1df3f729bd83aa9b2000bd0cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172657, "uuid": "013b1486-dfb4-4425-8f0c-13ea1b71bba2", "comment": "Malware payload (AgentTesla)", "value": "2797e0121915b182a297d0473e1c1fbc97930640697574241ea71902476b520b49dfa1de1c9373d5db3a6025ead21703", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172657, "uuid": "5735e49d-c688-486c-a6e8-3bb4a557a95b", "value": "T11364125177B0E163DAA35BB52F7726320FF2EC152889591B23906F0DBE42183E91D793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172657, "uuid": "06f22973-2290-4093-a317-9cc8ceefdd3f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172657, "uuid": "954ee039-0ffc-49b8-ad6e-db2120247292", "value": "6144:pYa61XJYjNzheLOiax9ruv/3WMcT9vSbxeh6IiElM1:pYTJYJzheLxEVuX3WsA6Gq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687172657, "uuid": "05a6efff-dd00-440f-a7c8-2938a1ae2544", "value": 315341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687172657, "uuid": "58110ff0-77f8-4f46-86a9-58d49e0510c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172657, "uuid": "54dcbebc-14b8-4c0a-b0ab-00e67b298ba7", "value": "[#10859027] - RE Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a32d461-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687175344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175344, "uuid": "7615bad5-666c-4145-8691-c6e50b384ffc", "comment": "Malware payload (GCleaner)", "value": "a3e3541db0cfdb991759bd70d248feef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175344, "uuid": "9adda254-1fbc-4440-af2a-b734b1d78d04", "comment": "Malware payload (GCleaner)", "value": "c117b6b236e569bc98e9b3c6f6b5823dc7fe349d568f015adf509d63e6596ccf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175344, "uuid": "a9827a50-7dfb-4834-b2ed-253d6fbb8957", "comment": "Malware payload (GCleaner)", "value": "f6d2030eaf13d06969299bce4b1ba4c8ba749d67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175344, "uuid": "b6e63f16-25c6-48a7-b516-4f332e1774a8", "comment": "Malware payload (GCleaner)", "value": "977b12a21974971aeae51655373c56ce0ccab51a360b54571da12cf7c6a6adc3928e2fe5a694291cdce20b1555eca3cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175344, "uuid": "ddb14901-700c-4359-83b9-4591cc221a2e", "value": "T1FD649F13A2A13D50E925CB32CE1FC6E8761DF6504E497B692A2C9A6F14F13B2D173F81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175344, "uuid": "e9678fc1-8372-4af0-8437-dec08dc99a23", "value": "04b17228a03b1d4a739b2c7487c1a1b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175344, "uuid": "edc2439a-cbf1-40f1-b4c2-03dbe8f423c3", "value": "6144:Q1/w74pGWGLIPYi+PX2zjAPtFXYQyk5ejRRHQ:Ew7GGGd+PXIjXQERl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175344, "uuid": "ddaf4be0-d139-4233-b5e4-f3de25d5bacf", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175344, "uuid": "abcc1537-289b-436d-8ad9-425bf2333c2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175344, "uuid": "97059e3e-8b0e-496c-89c7-a9bf25a9ed56", "value": "a3e3541db0cfdb991759bd70d248feef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753b0fdb-0e79-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162531, "uuid": "0cadbd31-0528-434b-9ac0-8ad3db2423d5", "comment": "Malware payload (Mirai)", "value": "876cf46a3263c2fe2a56ed4935135c39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162531, "uuid": "a98d65a2-6399-4c75-8b4e-641f8ec7a4c4", "comment": "Malware payload (Mirai)", "value": "c1a6ef3d77aece3c712d2a614c897e0da10ee0de415b9f867256dfd6487686d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162531, "uuid": "9c61c74f-14b9-4f53-a697-0c3711667573", "comment": "Malware payload (Mirai)", "value": "51c18c5f1bab8d86949d43914a3535a9621b4374", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162531, "uuid": "380d2465-222c-4878-b9e8-448c7cd89fc5", "comment": "Malware payload (Mirai)", "value": "92a4028df900918bfffd467acfd35c3dbc36db25e54bec3c469cbd0f50fdbdc26ee538e93984eb89e80ce0fd11239721", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162531, "uuid": "84582859-7161-417d-b7c5-700d2070a882", "value": "T1F7A2D124EB54BAF4EBAD9D745AC2A2C3772845C37349D1E342A78F06B413847794CEB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162531, "uuid": "ad18ef9f-06b1-48ca-a544-946d8f6fc1f3", "value": "384:M/JywWc84Tp2YshxqlDPSPSzC3aN22b1pk9+tYlQprTzwl801M4uVcqgw05VxJw:MRxsSVsMDPUvE22xpk9+tTpr3wla4uVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162531, "uuid": "91f25102-35d7-4bca-ab0b-2dd6ef45c51d", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162531, "uuid": "9ecd25c2-a034-4eb5-acdf-19d1ce0af55e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162531, "uuid": "6408743b-d46f-4644-bc54-6a4e33c7bdcd", "value": "876cf46a3263c2fe2a56ed4935135c39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a354f3-0ece-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687198851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198851, "uuid": "8088e4a4-d8d7-43d5-9349-88251a43912e", "comment": "Malware payload (Amadey)", "value": "e390076ca9c568398954e04dffc1656f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198851, "uuid": "6812652e-0412-430a-a757-e8e28b75c9f8", "comment": "Malware payload (Amadey)", "value": "c1d088856f128aa9dbd120f2a727fbb33ae1567caf85d612426345d5e34545eb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198851, "uuid": "443ab5d7-dfcd-40ec-b557-42e0e32047b2", "comment": "Malware payload (Amadey)", "value": "9c8edb5163cae3790c89c4d8fc7dff8dc9c07b8c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198851, "uuid": "8e227119-5baa-4d21-850c-78390237fe9c", "comment": "Malware payload (Amadey)", "value": "8fb1b94e95c5ef0af023ce8fd2cfef7793c00f7f374b84863468d57d7b06f7b44f5fcad4164b22075e929860cee8da8e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198851, "uuid": "7d65ba02-8f5d-414e-a639-c6d4f152c7f3", "value": "T18C051253BAE9D133CCF52BB009FA529319797C711C24838D3B596C4A0E73B89A47276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198851, "uuid": "9956add9-2a8d-4dc7-9310-6a0a40264c23", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198851, "uuid": "8a447fb0-a528-4ac1-948e-f286d7aff2aa", "value": "12288:EMr/y90ZXZB8xVasgOOx47axboNKbU3V3MBFA1YahR2Kpjdc5GKwhtq7:DygD8Lasw7by3VczKYm2KpJc5iht+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198851, "uuid": "1923fdd7-567c-415f-8436-19c8cb61b0fa", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198851, "uuid": "3e662b20-6a1a-4740-88aa-f300ef718dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198851, "uuid": "3a836d33-d50f-40bd-bd27-d58c3feec37a", "value": "e390076ca9c568398954e04dffc1656f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19bf098-0e37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687134286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134286, "uuid": "6304198a-ebac-48bd-8774-db7e1e2d97d8", "comment": "Malware payload (Amadey)", "value": "d279ea7ab0cba45efef2a9f2f440524e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134286, "uuid": "333f8b56-d2c5-4cd5-b140-6d359e99d959", "comment": "Malware payload (Amadey)", "value": "c238520d436c5d8f2b77a21e5472161540494daeba6e2885ebce194db0e2e1e2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134286, "uuid": "267cef25-0154-4ffc-b5d0-4c2f0c023cc0", "comment": "Malware payload (Amadey)", "value": "58bea2ed1c0b15d16a4396b1d6330fca091995ec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134286, "uuid": "3efdf5f4-7a03-498e-b27f-33cf98fae096", "comment": "Malware payload (Amadey)", "value": "d9b9f118157c9167340b1d3ae76aa60483616144822502c418349425b108095372190b217dde56be9d3c36024711efbd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134286, "uuid": "06b79378-881e-4467-8d3a-58598696b377", "value": "T118D41213ABE88036CDF91BB01CF617D70935BCA16D79832B3785999E4CB2684A475337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134286, "uuid": "c78221ca-cfde-4773-bca2-d3b113837f04", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134286, "uuid": "597e3086-f49a-41f4-bdce-a7dddc95c20b", "value": "12288:5Mrqy904zHL0cet+OTnNgImjZGZi8oQ3u3DoDLRKfoP4JhqF:byp4N+WEIj+TovRjPiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687134286, "uuid": "b9f0a795-198e-425d-9469-60de03931987", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687134286, "uuid": "55f32515-9412-4ef6-8a8d-687b853c5f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134286, "uuid": "7b654c5a-c746-4db7-bcb4-65d1fce661b2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4baa91-0e81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165796, "uuid": "4978b906-7e2a-4054-b640-aa15ff116130", "comment": "Malware payload (Mirai)", "value": "0a668b10591a1361543bc8d19f2c890c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165796, "uuid": "ac9f18e1-b7dd-4514-8ee8-1e6758184e17", "comment": "Malware payload (Mirai)", "value": "c243e829a3cd1f694a3841a569847a3d85f56785ac37cffe3a6b71fc51f0c0d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165796, "uuid": "0135a188-1852-45c5-806d-6ac754844a3d", "comment": "Malware payload (Mirai)", "value": "545b839b36be8ebdfcdc3cd24106b1e345875b43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165796, "uuid": "2e2108de-ee5b-4af4-afcb-4646836ed81b", "comment": "Malware payload (Mirai)", "value": "15a13c29c487e6b6cea894ee45370e3aa09400c3e6043eb0a88f6f01b9cf59107e8720126e89a53be5e60acb1868d2de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165796, "uuid": "0996bfd1-139c-4ab6-984d-965dd115deea", "value": "T138732C95B4029E2DF80FD5F994154E0DBE6163C11A830F275BABFDE36CB31A66D02D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165796, "uuid": "158128cd-3788-498c-a45d-6c0c3b5aabe8", "value": "1536:9t/Zs3ubT7Q+j3CjWFziBGD+tLNEsiZoK6vUM8gGNaJvrNI8z9sGy7yzG:9t/ZIOMGSaqUGTJNzBsGy7yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165796, "uuid": "dd819c00-1863-4e93-b460-59d6a0581265", "value": 73492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165796, "uuid": "fec7af90-ab6a-441d-b151-f24a0c35beff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165796, "uuid": "0b2772b7-a1c9-4270-aeb7-8dd9ffbf14a0", "value": "0a668b10591a1361543bc8d19f2c890c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd3fbb9-0e99-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687176320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176320, "uuid": "fdbacf4e-f703-46b4-ab37-5d3b85da5b23", "comment": "Malware payload (RedLineStealer)", "value": "a5fb2fd61a1af240ec7f74171e857f3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176320, "uuid": "de0bdbdf-552c-4288-a0cf-7866407add94", "comment": "Malware payload (RedLineStealer)", "value": "c2638a87bb13c43789a46338781509e9cc98aa23d98b7d3d446df2bd18ef954b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176320, "uuid": "f00fae6a-9c78-4f5b-96d4-6a11dcf2929e", "comment": "Malware payload (RedLineStealer)", "value": "1ed953794abafd2c4d629b44276a7430fb323680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176320, "uuid": "2873aa6f-abc4-4be4-a67b-8b36fd3d4281", "comment": "Malware payload (RedLineStealer)", "value": "6c02637667366406587fada6fd65bff2eed847173cab51951517720fb181678d85e0119c21b96ddc1594dbe385e838b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176320, "uuid": "5c56f9b9-21cf-44f2-aad6-d454659ba699", "value": "T1AC05234266D89063E9762B3098FB13831B36BD62997C53BB26D7AD1B4873740F03536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176320, "uuid": "a6c10e07-7752-4fa0-9f7a-65a2b28affc2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176320, "uuid": "be8a39ed-bb41-4c9a-9c89-3c41b833a6ef", "value": "12288:7Mr2y90/Gz1lhOwcJsCy/GTsxXNOTQbj2HrjUlZRPITLVczLIf2lbfMWye6dk:pyLdaJLy/GTsNe8cGSLVcXIfmgw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176320, "uuid": "bf76a2fc-d4e2-405f-8f25-fa659f2ae3c5", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176320, "uuid": "9461cde2-340a-4d73-bf36-d1d796d16fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176320, "uuid": "f124ea69-3ce7-4c83-8cae-963722800a0d", "value": "a5fb2fd61a1af240ec7f74171e857f3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40b3147-0e66-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687154583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154583, "uuid": "a31d6a48-f4f9-4380-b75d-a514ad43da99", "comment": "Malware payload (AgentTesla)", "value": "e98f068b28153bf89736f1a42cfce69c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154583, "uuid": "30a7780a-53d5-4ae7-a2f0-5905be7c2107", "comment": "Malware payload (AgentTesla)", "value": "c3706faf1e9a38c879ec449a50da90aafcae01787b0e56962519d3edac1d6b42", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154583, "uuid": "a8ce7a22-249e-441f-aaf2-19a73ad504d0", "comment": "Malware payload (AgentTesla)", "value": "f2c19fefc0690ca1753ebb519d8c6e2fea8dd45f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154583, "uuid": "345b4c67-08f3-46b0-9621-187333595a88", "comment": "Malware payload (AgentTesla)", "value": "4957b96ebb756e9285f522864f8e363b38cfddbca0f035a00fe65992e4f28a421510145756216c7edf40529c55e16ac1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154583, "uuid": "42f41f6c-5d0a-4252-acb5-5009e15c0d6b", "value": "T1DFE412486915AB53E16E27FC49E0337817BF6FB97D22F31A0DD3B0D8AD25B820620653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154583, "uuid": "8c5a18ca-f322-4bd6-bc62-24e1db3172fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154583, "uuid": "ba4970b4-5339-48ac-9aad-d121da65a537", "value": "12288:Y+tYq7J3At5iHOq+ZQYy0TQLbFexC/WD+iKArVuZIwAZiKCvcpYfE:Y2Yqtm8OqKM/F9e+l6ouwci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687154583, "uuid": "70329325-4b2d-49de-9e9a-d32047bcd87b", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687154583, "uuid": "c42b910a-dbe4-43eb-98de-82f0ec7450e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154583, "uuid": "778daeb6-b9f3-44e9-9201-b61424b66da4", "value": "tQ7OudTFtelfzjH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12dbf992-0e8f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687171815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171815, "uuid": "b0a4d482-ec53-4e13-856a-4b36714dd80f", "comment": "Malware payload (Amadey)", "value": "2d07de120064b8029b985a5da54bc64f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171815, "uuid": "5d4bed3d-8466-4c8a-ba1b-347267e45dfe", "comment": "Malware payload (Amadey)", "value": "c395ab46544736a708b046b5beb3e71f51c7703e212672af581e056245444f84", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171815, "uuid": "b86b4ce8-e9b3-44c6-8963-1f46e2d964fb", "comment": "Malware payload (Amadey)", "value": "721df04a7fd06150159e8e82eaf5613ffb753309", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171815, "uuid": "f2aeeec8-9f74-4975-846e-b7291a7438b2", "comment": "Malware payload (Amadey)", "value": "2b36c20d354bd6be7108d84101330f44514d28ae7a763db703aa4b949904e39103383e7f129bf2988a60d681eee72644", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171815, "uuid": "476bdc8b-fe05-4a44-9968-e380e642960d", "value": "T15E052213B2D5C472DCF95B7108F603C70A38FD6098794BF66A16AC6B0E73A89947136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171815, "uuid": "f3556865-b42f-4e39-a408-82936f9baefd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171815, "uuid": "3fe34fe1-507b-4901-8a82-28dd857e1875", "value": "12288:yMrry90yt1E1MjjsAVshcGaeRUJ0OIsrBDx3Sn7N/aYbod/nh7QZ0Wfl4+:lyPpjhshcGZ2iU7387Xbodhg0Wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687171815, "uuid": "925fcfea-8756-49ee-8428-5b0a0c2e0aba", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687171815, "uuid": "e7701f49-6b4f-443e-a90a-9c3fdb67a683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171815, "uuid": "1672e4d3-2bef-404e-8e2a-04a150ad6b94", "value": "2d07de120064b8029b985a5da54bc64f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a32ebf-0e5d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687150605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687150605, "uuid": "d7fd396e-def8-4410-ab9c-1a61e0ea1e3d", "comment": "Malware payload (GuLoader)", "value": "b2a2a44fd3ca2e98e9c153b2a039f7b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687150605, "uuid": "b5c194bd-002a-4048-9c0f-941af528b7af", "comment": "Malware payload (GuLoader)", "value": "c415ca0d6d8e3bde3e3b0c03d5fbe95148cf9d6748f2db7ad4126fc342fc2f77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687150605, "uuid": "3b1497ce-9605-402c-816e-2fe78ee0594c", "comment": "Malware payload (GuLoader)", "value": "9a40e08a4657518d0a78f0873c1070ac3a0d6f3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687150605, "uuid": "d4483b18-5e1f-49fd-91ed-5c90c925fe79", "comment": "Malware payload (GuLoader)", "value": "290b9df736ef9f538f18c66da7436a309de8866cddd25820ec41bfa229dfa47e758ff6b716cb6d38323bc9ea757d3b4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687150605, "uuid": "584940f2-1a44-4595-9831-bd03f72293cf", "value": "T1F2A4DFC1F51085C6D4FD0AB37D9A712636F47E68E5F0263B42A6329AB7F32D1252ED08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687150605, "uuid": "6004bea7-ea21-4115-86ee-8d2a59c33a0a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687150605, "uuid": "0584cf30-a4f4-436f-8fea-87756be8e97f", "value": "6144:5VGdx6xeUgDBLCPGJPaUPQJtDF0JlUJ+HbQ63z9WpqFj95xigt9yckTFBN51W6og:nML+GJPMJTOlBQ63wpqFj953bHkjNXF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687150605, "uuid": "89a04b57-4a9a-4d81-ad22-65b276c3fd09", "value": 491480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687150605, "uuid": "c2893c96-4b8f-45cd-ba63-f61e3feced13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687150605, "uuid": "e3bf0aff-7e76-486f-9f33-1806bbd752ac", "value": "Retrot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cdd1de-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165434, "uuid": "22d4be83-6e44-4cda-ac74-815f0bcdb558", "comment": "Malware payload (Mirai)", "value": "a1cfcf8e34727606fa366da22188b87b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165434, "uuid": "48b56f75-99ab-43c0-967f-0af0014cf46e", "comment": "Malware payload (Mirai)", "value": "c4a97f085e501f807cf372613dedef61159891d2ac889dfacab8bf1ba5a2a3ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165434, "uuid": "effff710-db63-465d-8ec9-f860047edace", "comment": "Malware payload (Mirai)", "value": "8ea4125f315b272db899181b28f54f5aa941bae3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165434, "uuid": "9d89942e-a9f8-489b-8fb0-8783ce01dc36", "comment": "Malware payload (Mirai)", "value": "fa36895b5e41bfacdc96e96f4120b702e543a3baec254d28d8c3c9b006b1fc9668bcd2b4b7428f467c925a92b7c31e5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165434, "uuid": "e53455a6-38de-4977-8f9c-0246f1a1f6d7", "value": "T12D735C3576392A13C0E1697E21BB4B14B6E127DE26E8C61E7E730E4BFF616501903AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165434, "uuid": "9d59d763-2297-4cb6-8de6-0ade2ce60237", "value": "1536:muvSjTZRosoVBGd7BF7z6eF0ARVhLzILwDkEDnHAta5UeHVk2cHGY3YcE:dqjcs976lUhLz6WUsVDcHGY3YcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165434, "uuid": "bf3babeb-7739-479e-a52a-9b6ab7bbe398", "value": 76048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165434, "uuid": "78ea5a60-93b9-4003-86d1-948d9db9a9ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165434, "uuid": "bd11bade-d1ed-41ae-8fb5-a161d509102e", "value": "a1cfcf8e34727606fa366da22188b87b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d0722a-0ec2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687193998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193998, "uuid": "f70ef2de-f8fa-4e10-94ff-729ed09f0f59", "comment": "Malware payload (AgentTesla)", "value": "c0f4a787d81ad92a7cb5e2f33de3dfc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193998, "uuid": "cb83ac05-2272-4110-8bb3-65ef1f059a15", "comment": "Malware payload (AgentTesla)", "value": "c4c9edf6afbb7299ed861464f6235508fe155c28df677fc2c25f7b2ff47d0131", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193998, "uuid": "5d5f26bd-b5e3-460b-9e14-b723579b20d5", "comment": "Malware payload (AgentTesla)", "value": "6e615aa18e4c64bcbfc9818e0afe10665efdc50d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193998, "uuid": "3441fbd6-e87c-453b-b7fd-3340655c30ad", "comment": "Malware payload (AgentTesla)", "value": "47d9ec4a85b64540e3663be556f11c931a6f675398dd57bcd135d895c8b6f65f93c0a550cca77291a24657a9607270f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193998, "uuid": "8737675a-cbb1-4b17-a9ae-1ed37c177218", "value": "T1E5F412588AE4522FDA736B789B51BB7D572EEE507633E32E1D80B0D76C22B144B013B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193998, "uuid": "1efc5156-3be8-438b-b789-4ae220154ecc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193998, "uuid": "5d3c6184-b26a-4e6d-8dd6-4fea2c5a5994", "value": "12288:AHlKKO6Ec63MnWccLyES9ZyXkmg88gurHJxyt9bItYq7J3At5iHOq+ZQM:AH/VPKCWLLpS9ZhmDXjyYqtm8OqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193998, "uuid": "05d1016e-a213-4db0-bb0a-5ecca7d97e2d", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193998, "uuid": "b9ef0ccd-b6bd-44bf-b487-7cdafd9856c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193998, "uuid": "2aedfbbc-fed4-43f6-a193-0c9ee6f92421", "value": "RFQ-61923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d160d40-0ec0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1687192931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192931, "uuid": "eff2c77b-a4d1-4d36-a6eb-18595565d6f1", "comment": "Malware payload (QuasarRAT)", "value": "90e6a6cb38ff2a0b219f1caf29b5c4a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192931, "uuid": "3714da88-c68e-416d-ad23-b7b29eaeb010", "comment": "Malware payload (QuasarRAT)", "value": "c4cd074c486e0c4cdedbc4fb8f94c97db5eaf4e56f027421d8922e0b02f3ef18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192931, "uuid": "8a0c2461-57fd-423e-8b46-ba3f8cbdb3ba", "comment": "Malware payload (QuasarRAT)", "value": "5a6886ff0dae0710ced3ea06587d058fa0090ab1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192931, "uuid": "6f1a49ea-d4b7-4813-8821-8443a2df53fe", "comment": "Malware payload (QuasarRAT)", "value": "13719297fe9fa0b13374707759ee02d3f82c55287555d69f932bb737a9ff6475fd06c4ebfb2860d062e31c3b2df4673c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192931, "uuid": "f84eba1b-6012-41c9-a070-e7855e78d956", "value": "T195B46B4027FC8A1BE2AE57BAE87154205BF5E417B267EB8F4548B1FD2C667028E40773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192931, "uuid": "e6202527-b0dc-4dc4-87a5-b3583dc4d615", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192931, "uuid": "49b65690-0561-44ba-8ad6-f09135ee8945", "value": "6144:pTEgdc0YuXAGbgiIN2RSBpylcdGAF7JXVwvUTcEf3b8F9KCE9RwQEcTR3K:pTEgdfYsbgQcT1v02R0cdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687192931, "uuid": "2c8ee76d-3b19-4794-b12f-7736f92e1657", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687192931, "uuid": "71e29680-3a89-4ba6-ac55-78ed9ec47bf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192931, "uuid": "1c0a392b-ac3a-45a2-8b92-fb675e9c2790", "value": "aaaaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c6dadb-0ece-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687199145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199145, "uuid": "acbc4bfa-6a1f-4432-8c63-d279d0c134c0", "comment": "Malware payload (RedLineStealer)", "value": "94ff3c95a428330074448807b1d1a4a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199145, "uuid": "4380b29d-213a-44ec-9a87-6360850f6f7d", "comment": "Malware payload (RedLineStealer)", "value": "c4fd7505597f3cc67d4b52ddbbf03a5a53b60a318abb2b35e5a9cc97f592eff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199145, "uuid": "6a37015e-86ca-4d37-ab48-4f09d9d1b9f4", "comment": "Malware payload (RedLineStealer)", "value": "9ba4183d6cf5aeb98a1e8d042b89a15b07778f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199145, "uuid": "f9e17cc7-50f4-465f-adee-f8576f46e983", "comment": "Malware payload (RedLineStealer)", "value": "732a8a95490fb9faf1064ac06fbf3909d990f3613ad5e1ac14c7a8f63ed16231426e04b1834ea7203eba186cbe1b7480", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199145, "uuid": "d14c0744-125e-4073-b042-9191a7d7f817", "value": "T117E41252EAE89032E9B467B851F711930B35FCB64C34872F2249996E0DB3194F93673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199145, "uuid": "0803c253-46fd-43ea-afd9-6999efd6e63d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199145, "uuid": "21be699f-b844-4baf-a9dc-fcd4131c6be0", "value": "12288:aMrCy90MPxL+F8X2mByi/HT5XEKyxhW6BhV244GD49lkpIMlex33WLyJpbhv:UyXR+qTbyxhFBhV2E09YIEex33W+pbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687199145, "uuid": "a989fb24-ca26-423b-b092-a770b3749aa1", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687199145, "uuid": "8445f92f-5f38-4a4b-9ffa-55493589a595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199145, "uuid": "11c71405-4f7c-4438-8b02-1a7b7a3bb0fa", "value": "94ff3c95a428330074448807b1d1a4a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27a1131-0ece-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687199141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199141, "uuid": "aada6b1b-a168-4c74-b28f-def3bc91ef8c", "comment": "Malware payload (RedLineStealer)", "value": "7833f6dd4115e7d53f5dd84fd48ce3ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199141, "uuid": "f67e1919-3a26-4c30-a549-b7ce68b08483", "comment": "Malware payload (RedLineStealer)", "value": "c56e4fccecbc961669a5c7c1ece545b0d37f3dd9f72d210cae2662c38664953b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199141, "uuid": "c67c4bed-88ef-4f86-b6e8-b6ed41ab3a3a", "comment": "Malware payload (RedLineStealer)", "value": "dcc38eca8db3404c4ac23a5ee83d838cf98d8648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687199141, "uuid": "2204a71b-ee1f-4e7e-a75a-7211a675e434", "comment": "Malware payload (RedLineStealer)", "value": "16e6e3465c87d420ce835feda11a1f766078136a9fca8810cc255ef1eccc8b4cbabdaeb5e5cd776a3c579fb66c98db69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199141, "uuid": "64bd52c5-c402-431f-9cbc-c210047eaa3b", "value": "T10DE413037BDC8463E9BA17B02DF602530636BCE19DB4C35B3786A9591DB36C1A932763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199141, "uuid": "1e5715b6-a3b2-4f99-bdd5-48b7587d0746", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199141, "uuid": "57ed1703-1731-4c89-9f39-0827986b1728", "value": "12288:LMrWy90wCETKW5dIEkDzcU0HKWXMa24LHZU8DGnp7OEK2245PwIQUbSXi:lyJcDzJEKoMKgkO245opHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687199141, "uuid": "111c3e62-579f-47da-8561-c3f99eac3c68", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687199141, "uuid": "9be9428c-40d8-456d-8eb9-350230f9a107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687199141, "uuid": "04b4813f-4396-45ab-a6e1-2a44dbbaf126", "value": "7833f6dd4115e7d53f5dd84fd48ce3ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4add6d-0ec6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687195775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195775, "uuid": "fbfef7db-afa6-4273-a656-16a3bf551db1", "comment": "Malware payload", "value": "f75c56db14c39c608dd83af6deec4454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195775, "uuid": "71df1ecf-26f9-48db-8124-ca4b14884f5d", "comment": "Malware payload", "value": "c6dfb0fd354958a3a5d2590f2e2f9e2701bb951eb87487b74a5ea04cfa7165da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195775, "uuid": "e7763939-9530-40b8-b8b7-34f4ccca81c2", "comment": "Malware payload", "value": "5da4b32ab3ec9a1e33aba38ea7577c439c64c532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195775, "uuid": "6b09cd67-a754-49d8-8082-567de5032acc", "comment": "Malware payload", "value": "a5d1a9b3b27a3a427aff6697277f205aec2cdbc1ab9e8b841c1dbfec1fedb9606fd5c03e6ab0c069f51a9533f028cc48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195775, "uuid": "78b2a526-66e4-486f-9545-82b510f5195d", "value": "T123763353EF4F0E30DA4CA17B3A09A79CD637172646D897BC5288C8DB12B691DEE110B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195775, "uuid": "15898e17-3730-443f-9a2f-4aa476356e1c", "value": "196608:J8NfD8R3kiO5OkvJGW2nFhwqO21N11QmWrEpjFJ:JOv5OKL2rwS1BjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687195775, "uuid": "022ff78c-b239-41b5-94d7-d4b04ec38cf6", "value": 7378944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687195775, "uuid": "2409815c-36f2-4b89-82e0-76507f4807ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195775, "uuid": "e1466b6f-7ce3-477a-87ba-a561f7a183dd", "value": "SecuriteInfo.com.Win64.RATX-gen.27338.21856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec59b925-0e67-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687155000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155000, "uuid": "051fec0d-7122-47d0-aff6-aaf2b30d28eb", "comment": "Malware payload (AgentTesla)", "value": "2ac22545e32374cc0903293498fafe11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155000, "uuid": "799c8293-0de2-43f6-9442-c7c44b225176", "comment": "Malware payload (AgentTesla)", "value": "c777b34dceae03414ca247b555517f985d291b051a52b9067d70b936ef251612", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155000, "uuid": "d8d2c626-4224-4cc4-81a7-1b93b33807d5", "comment": "Malware payload (AgentTesla)", "value": "2c7ae141086b2c93faea07ba112a3669b35a779b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155000, "uuid": "4f1640c5-afbb-4203-b401-b2cdfb38eab6", "comment": "Malware payload (AgentTesla)", "value": "7792b1bf3279b844ffb7fb10f8a97e257d97223c068d32ae373ce10de8d27a7e5b116b937cc6d11d0f61f29b2444e786", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155000, "uuid": "2d04dc23-d593-429a-aac1-5a8b8b8f54c2", "value": "T13C826D659881365BD38FC435D14463DCE178A682836E2F166A79E3AD4B73ACB0EF170C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155000, "uuid": "45872455-0991-47dc-90f3-453da4dc1e7d", "value": "384:v97Cp0bmBCJxNxfxZ7bjwBCQ/368Qk50a2+cQnwPRSR40WC:1HzxNxfxZb+368R0D5mwPRSVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687155000, "uuid": "510a63d0-9b53-4558-95f2-99965d9ff6c6", "value": 18636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687155000, "uuid": "106d0f50-18bb-4dff-b97d-43e4f4a33e47", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155000, "uuid": "e4b81093-d9d6-44c1-bc2d-6fe3c4c64039", "value": "INVOICE NO. 1164667916.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9734013-0ec6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1687195770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195770, "uuid": "dd7559b5-a60e-49b5-8a38-8d079528b057", "comment": "Malware payload (Stealc)", "value": "83cd2eb4bcba18e2dc927e2a12f1bef7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195770, "uuid": "56aa990f-4c0b-4826-b97f-e238fbe64812", "comment": "Malware payload (Stealc)", "value": "c7d7f008d864bdd24dd4e6dfb1feb65de9670f83f08f451615e3a6aafc577ea0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195770, "uuid": "f908f079-e410-471c-9f12-1942729a745a", "comment": "Malware payload (Stealc)", "value": "5712f4fe8aab8132c7a6d9f13a00bf4777e25c52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195770, "uuid": "7db5a339-e296-46d2-bb4d-b08e3780f476", "comment": "Malware payload (Stealc)", "value": "3f07fc47d182073cba72fd7f55990e711c90d7206f77bcbfd31918ac5b597e4ce8d0fad2f77dc1f927d4ee8e0db8e64b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195770, "uuid": "5d9f2e4d-5fdb-4ee4-b390-ad5aea516c59", "value": "T17F76330AF10C86D2CD438976C4777B0E032DB5A4EA23EF05519A63A5361B3D7DB6C8AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195770, "uuid": "f30ea449-3425-4930-aed3-6dfe0d47ac94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195770, "uuid": "f6bf445c-6430-4e35-9d55-a877c515c8cc", "value": "196608:O7g1YsaUxSNm5pY87zGOUpCrPMr1Hgva4:OMEePhLMr1Ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687195770, "uuid": "7e7f2f1f-b50c-483b-ac06-fc730a2e4ee1", "value": 7394304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687195770, "uuid": "eefaec0e-7f23-4b27-b6da-b7edf6b7870a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195770, "uuid": "eda85167-014b-4529-acd3-143ff441fc6c", "value": "SecuriteInfo.com.Trojan.MSIL.Inject.16108.22598", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a78cf9-0e9f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687178723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687178723, "uuid": "6a9d42b6-8598-4af4-8213-7368b07f21a8", "comment": "Malware payload (RedLineStealer)", "value": "5bc1f10cbee3de0637a781a4b007b029", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687178723, "uuid": "4c83d5a1-8e26-4baf-94ca-99545300671d", "comment": "Malware payload (RedLineStealer)", "value": "c89226168e9dd1d256d85a72bb252cda314b6c8c4aad45a5cf30c63ba899518e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687178723, "uuid": "89220ae2-60d7-433f-a8bf-72045569c94b", "comment": "Malware payload (RedLineStealer)", "value": "e8fde476c189997cbca431448ceabde939019205", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687178723, "uuid": "93ee39fa-3ad0-4e8d-9355-d61751cfa481", "comment": "Malware payload (RedLineStealer)", "value": "50ec0c0f585965ab4274168f8acfe1c895cf8ae8287cfd50b9cd03f191a2f85cebf7919395c48fbfc7376e296ef86db0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687178723, "uuid": "bfd9c22c-e637-4710-bd24-aa26f5828a34", "value": "T10FE412136BF84163E8B91B7068F707C30B35BD71ADB4C3572786685E48B2E80993679B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687178723, "uuid": "91ac638a-fd1b-439e-a079-8196f618f3c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687178723, "uuid": "44114377-874a-4fef-9766-ea220b2462c8", "value": "12288:BMr2y90FiWDbG5ALdmxnmc6rdY03+tkiG+MceiRXL/5EbIi0ith:7y/W+Bd6xYpkiG+MjidL/WbkUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687178723, "uuid": "6ac959e0-81d6-48ab-b261-80e67c7fead7", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687178723, "uuid": "add1b726-abfa-4999-a3d8-c9c8ea346cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687178723, "uuid": "7dda4c36-f1ed-4960-90f1-c6903b078aaf", "value": "5bc1f10cbee3de0637a781a4b007b029.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd8f228-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687175266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175266, "uuid": "b0d0a471-00d2-4384-9420-5b02722ecf60", "comment": "Malware payload (GCleaner)", "value": "df1d697f7c50986f78d7984321ea02b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175266, "uuid": "459bab60-c895-453a-97df-16a7ae3b7037", "comment": "Malware payload (GCleaner)", "value": "c925b4175f8bbb8626a1ea2369864912e701aff2307addfd195535f85a31785b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175266, "uuid": "44b176be-bb77-4475-b9b9-31c458288795", "comment": "Malware payload (GCleaner)", "value": "660ac21dee78d00e73c20b89d82c98efe1ac3be6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175266, "uuid": "0eb7ba52-65ee-4e50-a2e9-69078dfc2f90", "comment": "Malware payload (GCleaner)", "value": "2e91c6d689f935ea83ba8182acf22dbc3727258aadf1fe4dc6b7d9e94c0885bc15f058948c53d9b2f911b3ca632a852d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175266, "uuid": "b421b830-3344-442d-8f81-7638f1fcf113", "value": "T12C749D4396D13C61FD254B728E2FC6F87A1EF6104F197BAA22189A2F48721F2E533751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175266, "uuid": "6c52c9f3-6464-4e5d-ac31-c54d832aae20", "value": "493c0587242c6f974644a1959b9764db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175266, "uuid": "b5181d21-0e1a-4af6-8d24-e19839f8ae83", "value": "6144:XF2Xb9HN4mQk7mO3Rj0jzNmBhpzAIsF39IGG:XMN4+7BRj0joBhxAIs59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175266, "uuid": "21406b30-c2e7-4c38-9118-7f7816256a05", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175266, "uuid": "d1b52dae-9856-4b75-913a-b13e558c9dad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175266, "uuid": "e8f245aa-2d55-4204-bd79-37335f615124", "value": "df1d697f7c50986f78d7984321ea02b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ecc718c-0e65-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687153904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153904, "uuid": "35729c99-5288-4e1e-8e45-2d8c1549be53", "comment": "Malware payload (Mirai)", "value": "b9cb793b342066c0723fa280ced9f0c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153904, "uuid": "48838644-786e-4be0-81c7-8a0573405e79", "comment": "Malware payload (Mirai)", "value": "c992b43ac347231ca15da8d317070039528ba4559c8841a1ce12823777fb38f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153904, "uuid": "fcf3b60b-1fc0-4a40-ab6b-16d13a582eae", "comment": "Malware payload (Mirai)", "value": "d356e4e8851b4108db794a1c615e058df8858aea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153904, "uuid": "30a28aad-2061-4392-817f-708aa3d266dc", "comment": "Malware payload (Mirai)", "value": "7cc87fad702913a0bc712cf7ef66f9ac8ab4130b611f1d52f87359468597a86c844337279c7b00518181b402467af966", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153904, "uuid": "a8ab57b3-392e-438c-b5a4-855950e9747d", "value": "T1D8D2D0AEE57442C9FD8E1C3E808C3FA10E59E581631BDB9267118C4D5B36C57F2BA4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153904, "uuid": "9858f889-2c76-4ed5-b8f8-95fa34dbe809", "value": "384:Q8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjEu0n1RWGVCz0NvL:FMYHb62x4ahQ3CfdwLjqOWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687153904, "uuid": "74fc3a07-ea03-44d5-8f54-bab69f488016", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687153904, "uuid": "b58e187e-b2d9-4acd-a690-558b35f30804", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153904, "uuid": "57b02fad-c48e-45d1-b358-ab7a7f9c974c", "value": "b9cb793b342066c0723fa280ced9f0c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fcac24-0eb5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687188109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188109, "uuid": "4a68f3a1-3bf9-4509-a380-d8234be5c3b0", "comment": "Malware payload (Mirai)", "value": "1104c58ddf5fbf1700c381472cbf4b0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188109, "uuid": "ee4101c3-c360-40cf-893d-74f69ed1fe09", "comment": "Malware payload (Mirai)", "value": "c9c238e0c233db1dd01865c7d5113846bca9077e85e10d3054cf5b8819d3e46a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188109, "uuid": "38a8dc40-09d1-4741-b377-badbcce7e840", "comment": "Malware payload (Mirai)", "value": "b48fe0bdc0780f9c9df34e58188ec9e6a78bedda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188109, "uuid": "04df3e0b-2b07-439c-bd59-dba502fdc573", "comment": "Malware payload (Mirai)", "value": "e9d3f24c89a326b34697a55d9506748fd89289a5cf0cff810fcf8bbc038359ade5a7d11a87b3bbc7846af1d4b33cf02c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188109, "uuid": "7b056948-46bf-44f7-afb0-4da166f32c76", "value": "T180B36BC5AB8394B6DC0146B930679F328AB2E47F112BDBC6D7ECDD3B6919921800739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188109, "uuid": "6deed6a8-00e6-4497-bb13-804b1b985acf", "value": "3072:Ozbk5zDJ8XJsnuJLsnn7E0CVg+9cY8RVw4uLl:u8zN8X6nupsnUWKLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687188109, "uuid": "d69729ab-3521-4938-8aa2-c7500adbc9c0", "value": 112016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687188109, "uuid": "09b67474-83ca-498b-bfc0-c2ff63b58598", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188109, "uuid": "48b009e7-67f0-44d7-957c-09a75d525054", "value": "1104c58ddf5fbf1700c381472cbf4b0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fce2944-0e84-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687167112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167112, "uuid": "a5f24f1a-eaa3-403a-9455-a78baeaf02c6", "comment": "Malware payload (Formbook)", "value": "7f0038353ad5e4e4c82fc3ed30769de7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167112, "uuid": "1836ec98-2b82-41a9-9463-8b61cb1b73ca", "comment": "Malware payload (Formbook)", "value": "ca2d9eced06bad4e3de7e6a49a603a0dbc8d6eb7ee2af9ccc68222db8aacfc94", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167112, "uuid": "b07eecf5-746f-448a-95f8-cea3b7b54251", "comment": "Malware payload (Formbook)", "value": "a842e93df3b9aa9d823274ecb0abb31d8bcaffa0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167112, "uuid": "d0a15350-da7a-4e91-8e36-b430e10168e2", "comment": "Malware payload (Formbook)", "value": "19496140cf5db658f7b4e86044d91287968f022586b2a609efcfaee3f97f7e4c307ca7cd1cdcd1744434b61f6ec27fb7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167112, "uuid": "7ad2756c-7564-4135-8b7a-f8d1441dd2f6", "value": "T17FA51221E480957DFD4A0B715AC78496834DBDB27D4ECC0A768B3B1F26737A2D87628C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167112, "uuid": "e008e2b0-1b37-4882-8dfe-470927b74971", "value": "49152:muhG0mVkU9uQR0mVkU3l1jGdfeNbrf5sI:modemdQP6dfQ3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687167112, "uuid": "375d10ea-8696-4825-b695-e77125ac8388", "value": 2098688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687167112, "uuid": "50e531bd-1c3e-4bf1-a737-4094c7edb345", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167112, "uuid": "cae95ecc-d8b2-4944-8501-9c52b2e08a4d", "value": "\u0546\u0565\u0580\u0574\u0578\u0582\u056e\u0565\u0584 \u056d\u0574\u0562\u056b \u056b\u0576\u0584\u0576\u0561\u0570\u0561\u0575\u057f\u0561\u0580\u0561\u0580\u0561\u0563\u0580\u0574\u0561\u0576 \u0571\u0587\u0568.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9686b6e1-0ec1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687193511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193511, "uuid": "569ff5e8-1afa-445b-bd70-9ac545967e0d", "comment": "Malware payload (AgentTesla)", "value": "48d684d741207a82d53b92719e976f48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193511, "uuid": "b662471c-6e53-478b-aca5-4eb83cbf2957", "comment": "Malware payload (AgentTesla)", "value": "cabf95d039d6326b10b93a2c729eb209c3d64ab01c0583af929e55f31f4c70ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193511, "uuid": "bea0c0ee-429f-4a96-bd94-0bb06e422f52", "comment": "Malware payload (AgentTesla)", "value": "a7204887b3dd4abf58831b71de0d572eb0851d4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193511, "uuid": "86e0bbad-ae32-4af0-b6de-7a5dd6f0e168", "comment": "Malware payload (AgentTesla)", "value": "4976d16f0a78170c3c2a21d5a10a059263f779025dc5f9e202a301416b0476057f28a294c30e63c868f0dbf77c0588d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193511, "uuid": "1543e620-6d77-498a-9ba2-85d28a87ac78", "value": "T10864120873B0C627CAF20934AAB64B75999BFC11A46E470FC3542F5D7DA30D2B92E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193511, "uuid": "c303c42a-64a1-47ea-9d0b-cb1b9b89642b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193511, "uuid": "dde77d04-e1fc-4000-a369-86222b925172", "value": "6144:vYa6cJaQIn9o2pEuyzpnCj2aGQRWtveqOPqL/ylYJ:vYSJaQI9PpIzs2aGJtRzul4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193511, "uuid": "1dfe4dc7-571f-45e4-b664-eaa1f7e613be", "value": 309575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193511, "uuid": "e4cdf1b6-2b28-4698-8aae-11b5188294be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193511, "uuid": "edd2eb64-7073-4324-9517-cdc402e263f6", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d810bf32-0e76-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687161408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687161408, "uuid": "d8f830e7-f4c4-4380-abe5-e15de71dd8a4", "comment": "Malware payload", "value": "c24cd0dfeb7ead78cc963802f8dfcfb9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687161408, "uuid": "2ea39288-9c3d-4785-a26f-68d53d477e9d", "comment": "Malware payload", "value": "caf0a39318cfc1e65eae773a28de62ce08b7cf1b9d4264e843576165411e2a84", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687161408, "uuid": "bf1eac04-76f1-49e7-8605-8ff0c34ca2df", "comment": "Malware payload", "value": "2b448233e6c9c4594e385e799cea9ee8c06923bd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687161408, "uuid": "f91dad33-3dfd-452a-b63d-5d7a1f8cc051", "comment": "Malware payload", "value": "3cef6dfe57f5606e61881f13eb7f2eea3653574d1d1361946f3110520f13b94614a428485d2a5990ea5dc149ad16654d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687161408, "uuid": "3e4da412-2606-4fd6-bad0-8c4a69794e52", "value": "T12B8723D7B3D8E81AC5339077C96A11A635DB4CA59E53CB532918BB1C38F75E08E09BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687161408, "uuid": "cc9f7f17-f315-4d90-b8be-4e3692e39c7e", "value": "786432:8OlxsCM0rkGrNcme9cHRFJOUbXV+NmcDRGgqvjFp37L+:8OsCHkGhHVUscD4g2jFp37a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687161408, "uuid": "033306a6-1075-4f09-87ed-efe0c5925e12", "value": 36233841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687161408, "uuid": "de188b3d-3d8f-4026-ae2a-7e174e4c22c7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687161408, "uuid": "f6e01818-0fcb-4862-9c69-7ed4f663fe1b", "value": "caf0a39318cfc1e65eae773a28de62ce08b7cf1b9d4264e843576165411e2a84.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a4c612-0e51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687145297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145297, "uuid": "0ff218f4-a457-466d-8d88-4f791f40032d", "comment": "Malware payload (Gafgyt)", "value": "8135ce620b2fa14383b7fe3f9ccb0647", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145297, "uuid": "a43446cb-6ae9-4277-b744-512758c5f949", "comment": "Malware payload (Gafgyt)", "value": "caf83eb80e2df92f1577d49b348bbb56089dfac5d0ad48e9d26510b6846830bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145297, "uuid": "70efd96f-e76e-4ea9-81c5-6abd0a020eb4", "comment": "Malware payload (Gafgyt)", "value": "5efa1cfdbb083500417cbea507ad319a41dd22db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145297, "uuid": "af600246-d5a1-4e7b-9a35-40f3a7244c27", "comment": "Malware payload (Gafgyt)", "value": "6c0ac2daa5719adad7e3b9575d0fdbf95ba468b12eaa33a32f4f059a19d3cceb72860bc0b1b758ab72e6caa43ff1b79e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145297, "uuid": "21ed7423-8af7-4229-bd39-aeb89d42a1ae", "value": "T15CA3174799669FB7C152ADB129BB4A700753BC111F5F1A89752CBAF4033B5CEB80EB20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145297, "uuid": "b7c4d849-da2e-411a-adb7-62d9c05fa8ca", "value": "3072:68Nvc63anXjoSbU2SgAfXEmMkuCE7TXY9Nb:68NEyhMEgAfXEmMkuCE7TXY9Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687145297, "uuid": "8216735d-4e28-49d7-a4c6-69ac8f751596", "value": 105377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687145297, "uuid": "48698c04-93e3-43b9-8e7a-a9530d4311df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145297, "uuid": "73587c40-a83b-4968-8d2d-ad580c5683fb", "value": "8135ce620b2fa14383b7fe3f9ccb0647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007261ad-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687175220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175220, "uuid": "d31f58ba-329b-42ce-aa11-d92618e0bdbb", "comment": "Malware payload (GCleaner)", "value": "7267cbc9efec4d13b36ac5bbac0d52d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175220, "uuid": "e7db3b93-3d90-43ad-8388-cb9dfb5144ca", "comment": "Malware payload (GCleaner)", "value": "cb63e80aab5dc4237f44d077c0b7f81ca5e7d816752544421f91f7549f9c4d14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175220, "uuid": "70739ec9-9f7b-4e63-a669-a4dc9ef24978", "comment": "Malware payload (GCleaner)", "value": "bb88aca3bc9fabf2b269e8cf7c389bd1cd996773", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175220, "uuid": "2c092e10-158a-4eda-966e-c4b9e443d5df", "comment": "Malware payload (GCleaner)", "value": "5d98092812f739ebc166874428fcfa7f5131b941f1d1a8f74113891ce1c6f4a8155c5598587e9296ea66a20e39c28a02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175220, "uuid": "3ca17394-372a-47d7-9077-052af3bda0c0", "value": "T19664BF0372A3AC64D561D7729E6EC6F86B5EF550CE58379B22186B2F09B03A3C572343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175220, "uuid": "1201ea22-066c-40d1-96ca-a18c8f9081dc", "value": "908fbf99c3f8c44c371239c262bab2c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175220, "uuid": "e685eb94-d12a-417e-abd7-8e2458e5fae0", "value": "6144:lOmVJOZyxuoUPpWjCD4sMsXDnL0FYNwVsEZm:lOwIZ8/UBkCD4sMaDLqIwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175220, "uuid": "306f8693-1524-44e4-be11-b8c53de39896", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175220, "uuid": "7b4caaae-8258-447d-9f88-b0a0422c8283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175220, "uuid": "6c13e6c5-77aa-42a5-8e95-f323b2a9b35c", "value": "7267cbc9efec4d13b36ac5bbac0d52d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4693b7c9-0e98-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687175767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175767, "uuid": "c68ab24c-87c9-40a8-8c38-3050acf0f2ef", "comment": "Malware payload (Mirai)", "value": "d0303f7bdd441e4268464a641074afa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175767, "uuid": "800df31a-bc18-4d28-ad62-65b656dfad60", "comment": "Malware payload (Mirai)", "value": "cb919432ba45c10cb243ef2ffea095903ab1253b8f35aa7ccbec3ebf4b16d1e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175767, "uuid": "e08326d4-29b2-40b1-8543-3a674a75c0a1", "comment": "Malware payload (Mirai)", "value": "b88b521d66ed1bafa00765a662f4a233dc63e1f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175767, "uuid": "accb3f87-f081-4398-8aa7-a9a22a6fc5ba", "comment": "Malware payload (Mirai)", "value": "3c71f8a988881c576c4d1f74b25aa3d970a5aabcdd900acfcde01b8013d2593bc43baf9968136367ac5d3008d9476cdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175767, "uuid": "72665bb3-cacc-4c88-bd02-92b80af1cac4", "value": "T14EF23AC0A403D8F9EC16057521BFF7725F7BF07A2159E987C7A9D922EC92D01A60729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175767, "uuid": "f48d5ebd-ff8c-4e37-8103-f0401ee5ae87", "value": "768:oHgyvysaQIthHVLEknaWdeQJni1K4moDt6dTV2/Fi:ofvysaQIth1LEc7dLZY1VZQTV8Fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175767, "uuid": "e05f84f5-3c5e-4400-b2bd-b8a220a5e7ea", "value": 35056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175767, "uuid": "a17ef5c7-c526-4883-94f4-e6ee9cee9f91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175767, "uuid": "fc797448-7bba-4889-bceb-0e8106bd49af", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478d7a6e-0e8c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687170615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170615, "uuid": "bc2d95af-91a9-4319-947c-d7fc9d0e44c3", "comment": "Malware payload (Amadey)", "value": "a39b19150728755719fc9da4227e6e73", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170615, "uuid": "d0194f8f-21e4-49f2-ba53-2f18858b5290", "comment": "Malware payload (Amadey)", "value": "cc51272d75f089b207bb35bdbd3dd824183094731a090316c1176bbbf3621b0f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170615, "uuid": "7ac8fb3d-b2ec-447e-bc1d-7a8eeadaa33c", "comment": "Malware payload (Amadey)", "value": "a95758ea5292756474d9a1159bffcd12af8dadee", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687170615, "uuid": "30c42b8d-a470-4746-8881-68c869bb14e0", "comment": "Malware payload (Amadey)", "value": "c297dcac255806e9f6aa135fd6279a53eb3ae9834dbf6f04ad8f228767d43ad1fc4ad00f25d2831b6911b0e5de71901a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170615, "uuid": "ce1c62b0-303e-413e-8860-654805c8331e", "value": "T18DD41216ABF89073D9F627B018FB03A30B39BCA159B9837F1245685A4C726D1C47277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170615, "uuid": "5ed6e315-6a77-482c-929b-fe995f9bfaa9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170615, "uuid": "a5f23f99-65fe-4df9-a91e-b6903135b008", "value": "12288:tMrry90kLrCcZM1qYD0D2oouOP6FHGmIQEhtMxsvJShF6I:iyn2ymCNOP6FHGmJEht8sEhFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687170615, "uuid": "12009678-8b52-40a0-8650-862b29161dad", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687170615, "uuid": "689e09b0-689a-4b8e-a32d-f749aa574cc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687170615, "uuid": "20629cc2-e342-45c0-96af-527cc8fb7b8e", "value": "a39b19150728755719fc9da4227e6e73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378c5e8f-0ec0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687192922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192922, "uuid": "e7b8cde2-179a-4a0f-bdb1-17c2b6484e8e", "comment": "Malware payload", "value": "ad0f1f3418da5e70c0e898a6546128ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192922, "uuid": "d6fc7fd7-3ea7-4df4-b143-384a19c8e907", "comment": "Malware payload", "value": "cd93805d6fee60c8139820c20aca0872881a71f34218f0cb8de68b722cc128f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192922, "uuid": "08d629fa-7dcb-4f0d-a187-e35385b0a6d4", "comment": "Malware payload", "value": "b4a2ebcb99da6106f549e02ae2f0e707b8506872", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192922, "uuid": "5bd23043-33c5-474f-b63d-5d8c07470b77", "comment": "Malware payload", "value": "bd7fb7fc6d25d25670888774e2292f100b05df65b73dec20671bfc12bb14967689c918ef9a13e41b98b16f61bacd1d90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192922, "uuid": "71370ca3-69a1-4585-b038-dd22885a4bf5", "value": "T19A9262373A589935E25DCBF10C2386EC9926BC322A008D1B798D3FAE1D751426DE173E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192922, "uuid": "c888b1d1-3fb3-473b-adad-7219c21a1518", "value": "5a1d35404fe0acce8936f67cc51ec4fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192922, "uuid": "17135e95-837c-4c15-8b07-716b900c5000", "value": "96:afqAebOyg99JjlslDbL9CCmnpooOUxdPzPyuj8MpEJAI5xwg:UMDW92PAjioOUxdPDxESqxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687192922, "uuid": "8ef895fc-abae-4ec7-b177-a41336e22b52", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687192922, "uuid": "a84a8bd6-e726-48be-9363-ebee5a0ac5ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192922, "uuid": "0a80cada-af01-4305-b4c1-83dad3c6a98a", "value": "game2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78ec8f0-0e88-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687169112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687169112, "uuid": "7ad15c80-c5c9-4ad2-9786-0684bfcb4678", "comment": "Malware payload (RedLineStealer)", "value": "fed5a76d0d67d201cdbba12a1f21a217", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687169112, "uuid": "4673c9ba-77b9-45d3-80b9-12b23abc675e", "comment": "Malware payload (RedLineStealer)", "value": "cf8ca893e75ee9e7274f3d4ac7b2547f3e8bb6b1caf789804787f3884bd40dca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687169112, "uuid": "1bff76f6-657f-4b7c-a799-32ea07fc4bab", "comment": "Malware payload (RedLineStealer)", "value": "b045fe548f7577e5559b074476a7374802361d97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687169112, "uuid": "a01870c2-bc99-43f9-9a41-9217f5e2d3b3", "comment": "Malware payload (RedLineStealer)", "value": "5fdf877c3dc3d60e6ae9dd5c054d2f038de838d0bbbfc716efc33a4473737b57cfcc88948c5916f89115c3700578d6d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687169112, "uuid": "2e75cbbc-5cd9-44c4-a783-0b6b8d361ffc", "value": "T1D344E64A2F51B538C00DE8746AA87290DF392D263B7B43762B661436AE34EE70DFC5C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687169112, "uuid": "6aa6087c-fa0d-4db2-9ddc-c13ac532cf65", "value": "b88ff38d8a9dd531263365f3574a285e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687169112, "uuid": "3da3215d-8577-41c3-8072-920dca32f5a7", "value": "3072:wi7snG1PPrwW2zay/S2auSq8f4uilEKq0piWFHjtsn4ePLOmQGgKJW:Fwn0kWiPSqbuaDjWpPLeKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687169112, "uuid": "6a491e0d-e859-4ea9-b7c7-c7cb1d920aa1", "value": 258053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687169112, "uuid": "d709441e-88f6-4f35-bb7a-db7e5880e772", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687169112, "uuid": "063f98ed-00f7-43f2-af40-57f83dc2114a", "value": "fed5a76d0d67d201cdbba12a1f21a217.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2cf2efe-0e79-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162688, "uuid": "63735ce6-2d14-4781-b139-141d2b05f877", "comment": "Malware payload (Mirai)", "value": "1cdd7e213180a777738141d9e9065da3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162688, "uuid": "9d1d2a02-6aec-4035-8ee2-cc60a3be077d", "comment": "Malware payload (Mirai)", "value": "cff5b9fa60d62408f00728b3a68447628796e15b6f7a0b451fa2c7ede95a3b86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162688, "uuid": "6b4216e4-beab-4415-93a4-eca7ee99fc52", "comment": "Malware payload (Mirai)", "value": "cad574ba498558072274c3ce7a65678fde9ea06f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162688, "uuid": "786fe41b-6e28-4be0-819c-0ecbf5d26c83", "comment": "Malware payload (Mirai)", "value": "77158aaeb44ddbc94546683592124d40cf6349bb0de4e102dafe061934474c02c41b9269ea919e0a347482e79b3582b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162688, "uuid": "13c7d726-be7f-40e3-a6b6-b47e8a8f963a", "value": "T152C2E15AB2AE158FEC9721BB557A02CFB8995838071FEDEC7E29C90623037328D05462", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162688, "uuid": "9d9c7f5e-ec8c-4140-8ee9-c96240bf5b3e", "value": "384:MYY9xzsxsnSVAEENDU6PjxpFLqJ0LRGJ1AUpwzqY483TMqrGnKhP490YKx:u9VdhxlUq9veJ0C1Av2Y4GRA9ZKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162688, "uuid": "1b9f5ab1-c840-43f0-8bae-d992510d6770", "value": 27084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162688, "uuid": "e2dd5bed-f370-46b3-8fa9-51ee2e32f843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162688, "uuid": "f80ddff8-42ae-4026-96eb-c9dc9327bf4b", "value": "shindex86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d0423d-0ea9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687183287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183287, "uuid": "42cae10f-8539-43da-918a-321ffde10c19", "comment": "Malware payload (AgentTesla)", "value": "2bb06693c9e1eaf5576f8a503495dcb9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183287, "uuid": "920cef9a-13f8-40f3-95c5-55d4cdf4fe61", "comment": "Malware payload (AgentTesla)", "value": "d020d147b7c1988c868b9c84f738ce36f4e0d0271db8cc2b3e9d314acb0940f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183287, "uuid": "55ab0550-ce38-407d-97d0-426df4327717", "comment": "Malware payload (AgentTesla)", "value": "e29c64134a68b3d58c18491f59c62428cf315930", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183287, "uuid": "2adc16cf-577e-44f6-8039-c885a2894171", "comment": "Malware payload (AgentTesla)", "value": "2b7ed4de0b26e8fa5d8c316a42d4c4a3a421978e836b6d245a4facfde91d3e229ec1c0b0a7a2ad4bd335cd2aa2f774f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183287, "uuid": "ea6ff7b6-1337-41f8-9f46-a18076b55bbd", "value": "T1AAF423693F06860ED3C96074730316BE3719156D5C1829BF8DF3E24E8647D6D8AEE1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183287, "uuid": "39aa78d1-0442-44a7-8fb4-370d216b7f63", "value": "12288:TML7nvXmvq+HR5HIrrk1C6+1uNy45XPyTyOE1w4ZUJ2IpQF4Svs+erQxQX2ptOua:6mvqc5HIUT+1qy456Tf6hZgpDrQxXxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687183287, "uuid": "d3aecf72-ba6e-4a8f-9bb4-7e7972a5a67f", "value": 744411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687183287, "uuid": "6ac24121-5e66-4352-9993-0406131b9330", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183287, "uuid": "84c62f41-641f-4dc3-9a44-7f263232b866", "value": "Pedidos.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bb32ea-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1687175279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175279, "uuid": "d26bf1f2-9dec-47d2-85e1-6946bf12cdd5", "comment": "Malware payload (CoinMiner)", "value": "6f5d1121329d0d0a7ce4f859a45ea19e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175279, "uuid": "152b3864-7a66-4254-9780-3acd28c54671", "comment": "Malware payload (CoinMiner)", "value": "d0873782fa5d4851ddd95e98767467d177e1b42a684b202cd681968ea2ece832", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175279, "uuid": "eb38cfd9-05c9-403d-b565-7cae5e0ff272", "comment": "Malware payload (CoinMiner)", "value": "6c9e310bd320e0b79b800c453face75a04c1eab2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175279, "uuid": "062eefa4-1ee8-4917-8a35-57ce3d917b2d", "comment": "Malware payload (CoinMiner)", "value": "2e501be480b9d78670c7d20ab2ac81a9134c739befea2317e3f8573c598f8cf1e28b085af1d5a7ad479268a8c66ebad6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175279, "uuid": "8b68b8f8-ad69-402d-b818-0bdd5345adb1", "value": "T10CD58C6A99E40DE5F65827343BC56791EE0BA82B58918F7E249C4CEF0CD5F901C92EF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175279, "uuid": "6eac8604-36bd-4750-9493-1187007e4c00", "value": "309a5f556f3c87ce9ff6c47cb16a3929", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175279, "uuid": "daad1a96-b9d6-4783-a901-fcec2bd22ac9", "value": "49152:MBX90Qt0bROaKW/4aboqlSEo970lLVgJEdXx8F5L5ka5LhUlIBZdPjHpBM0yyUsu:CsR5KVjqlSEo9709SJwXx8H5ka5LhUl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175279, "uuid": "a6f2a8fc-8566-4537-a1e0-58bb60c6c99c", "value": 3013048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175279, "uuid": "ee56c54b-d3fc-481c-bfe9-6e9eda930a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175279, "uuid": "f475cc68-790e-484a-bac3-cc4eb24c099f", "value": "6f5d1121329d0d0a7ce4f859a45ea19e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5137788d-0ec0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687192965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192965, "uuid": "cd0508ee-5f73-4815-bf34-2a37a4562700", "comment": "Malware payload", "value": "c1c615e51d5c742aca074e53ec802096", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192965, "uuid": "4b7c2e1d-68ae-4adc-9844-a77c6447fd96", "comment": "Malware payload", "value": "d0e7d097bb4465019ae4a1e27844f8a08363c4b169283db9c82cb9e3c4656f23", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192965, "uuid": "57fd2156-2aa6-43f9-b650-bc265b2f42e0", "comment": "Malware payload", "value": "c88216b673fbac12184bb874efde66bfca6a025a", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192965, "uuid": "9929d902-742d-4ba0-af69-12407919bdea", "comment": "Malware payload", "value": "6c2f9cdd806c5ef3cb16b2f348b4abd4008d33ff5f7f217d4f8d19401dcd28fdff2922b7907f5975932b06d677498b1f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192965, "uuid": "5b147db5-fbd3-4ef4-aa6b-65102b40c4f5", "value": "T1DCC53360FC282AFB7A78BE45FFAD224861870D40097BAD4B4237FD53197799B946F042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192965, "uuid": "cd81855b-149b-42c4-bda0-ea5e44bda03a", "value": "49152:eSf9tWl7NtPA7mnUxRn6R3IIvIIaC4QVVdJ33PPkqaBvy8SmZpM+1FeWxWMnrEGs:eSf9tCN+aUx6vwyVzJ33klg8SmZi+1Fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687192965, "uuid": "a6cad600-f8c1-4903-974c-604a270cb15b", "value": 2709502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687192965, "uuid": "92874a69-fc14-4c46-8f90-6b1fe85755f3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192965, "uuid": "7489aae3-c5f8-499c-873d-31c149d142ce", "value": "CSGO_Hack V3.15.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da08a5b-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1687174195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174195, "uuid": "ed3816ae-e789-4697-8870-ba8e3f89e567", "comment": "Malware payload (STRRAT)", "value": "24b3bf8cdfa22372827501d1c4138364", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174195, "uuid": "36e32ed6-1009-4902-9c03-726330eef954", "comment": "Malware payload (STRRAT)", "value": "d130e85809cfd63debe80dd0de273609d95a37649bac1a456042d760ada9b53e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174195, "uuid": "7398cf32-8c12-4439-a07b-82250695595f", "comment": "Malware payload (STRRAT)", "value": "dbf973f236056d2992d478fefd8f51af83804fad", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174195, "uuid": "8a667aef-efcd-47a2-9150-ebee46c6465b", "comment": "Malware payload (STRRAT)", "value": "f3f2fbe477a549c19b41b2d89d746d94ff8fa3709113bdb4bfafd96ee4b1bc37bf1c8a406f41ea93a16d1a9196378827", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174195, "uuid": "c0d7dcfe-690a-48a4-b941-7086ff38b77b", "value": "T15E24020BBDCE84D5E10B6076511AD2B69F1C429CD004A93F77FD09822E75EAC1D26ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174195, "uuid": "9bed874b-5473-44d2-bf34-f57261ac00bb", "value": "6144:ecEZYcwJbA7R0VsPVR3g7snJSgxXoo5AN:HEWcUbUzdRQgxYoON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174195, "uuid": "c1b1cbe4-3845-40d0-83d0-cb3a23941b17", "value": 224013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174195, "uuid": "7411709a-eb01-4c62-abb7-307f4489c1b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174195, "uuid": "88d5dd91-5108-4ba5-8155-3f822cdc87cc", "value": "43PU004731-1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e07518-0e76-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687161220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687161220, "uuid": "e119cca2-77f9-4f61-8ee0-8b703a23a27b", "comment": "Malware payload (RemcosRAT)", "value": "bddb20528bb49cec50b45f07d6dcac69", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687161220, "uuid": "2ac5a205-6eb6-493c-8b98-c997b513b84f", "comment": "Malware payload (RemcosRAT)", "value": "d1f8840d1239fa517d4ca6489b64e588a85b8ec7322bf9d66bdb7f1831c1b4c6", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687161220, "uuid": "125e49b8-ceea-45e2-b637-56b9431b9f4d", "comment": "Malware payload (RemcosRAT)", "value": "09eed27c5db8203257acc2a6ab02e88f9b697ab7", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687161220, "uuid": "10260bd8-a477-40e5-8625-7277de5e6673", "comment": "Malware payload (RemcosRAT)", "value": "098d7821bf3f53efaa9df993575361b67476fe6305c6a9059ee637bd81a12ac9db9ea0c569cc6632160b3b3f52551672", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687161220, "uuid": "b8c8243e-3eb5-4b3c-9c90-d4e975d071ec", "value": "T1A9253394E78531FF86CF457E11635F2EE67B8B97320A023120689AA43C8755BD2FD1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687161220, "uuid": "2beb0603-cbb5-44ad-8945-8abc8204329b", "value": "24576:X8vrDTL1aHqGfHmHeCsXSFmj7CrahIhYVi3WxqitqS:MvrUKGfHSevSAQae6k3Wl8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687161220, "uuid": "9a549415-914e-49be-91d4-4a6de3b966fd", "value": 1007309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687161220, "uuid": "a0e06bf2-6207-468b-8644-c52272f6ee3f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687161220, "uuid": "3b965109-d8ec-4a18-9535-853d8f943fc4", "value": "DOCUMENTS AWB 298892800828289.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be19e1bb-0e93-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687173820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173820, "uuid": "3138a484-2e9b-459c-95a6-b81ba865e607", "comment": "Malware payload (Mirai)", "value": "df925230c59b289cb4b252ce56717626", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173820, "uuid": "185e549d-b566-4e63-9911-668d49cba6ec", "comment": "Malware payload (Mirai)", "value": "d256b9b098dbe8753b6c4b15ed23c67e05e7602682aef1562726ab0fc40a7b73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173820, "uuid": "8283bc87-3617-42b2-b5a7-749c6f4c2568", "comment": "Malware payload (Mirai)", "value": "6fa56801a96b3c77d4e91d2369fe22bd1cf9887d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173820, "uuid": "2458fc2d-147d-499b-954a-e3ca62f44d60", "comment": "Malware payload (Mirai)", "value": "97a22460f3afa6b660d8b5c29a4aa9e28bf0bc17bfaa6586b13c98ab7ea52eed7a16e8f9b1a0b9ef523931095e8a5b6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173820, "uuid": "c5fc3943-50d9-4fb0-b5fc-d2220b0eb68a", "value": "T1FBE31A56EA414B13C4D61775BAEF42453323ABA493DB73069928BFF43F8279E0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173820, "uuid": "8df60935-7c0a-4b53-8ab3-4d5d5a03e953", "value": "3072:QW2gkGrWVcaUwGrW9/Qy/xZ2dCpWF7SAoxM/9779o:QW2gjocaUwGrW9Iy/xBYF7SAeM/9Vo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687173820, "uuid": "41a7cf2c-6866-4b15-85e7-45eaad69d9dc", "value": 146122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687173820, "uuid": "874b95e9-e2a7-49e5-a02f-8840aa50faab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173820, "uuid": "355f6ba1-5ac8-41e6-8aa4-90fa3dea7895", "value": "df925230c59b289cb4b252ce56717626", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95f1be8-0ecd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687198830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198830, "uuid": "34134a93-17d0-440c-8dcb-e68fe1bd8eab", "comment": "Malware payload (Amadey)", "value": "257ebd04dfc8ac0a3fc5efd23c936dcc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198830, "uuid": "2f0b9405-a247-4cd2-bfee-61a1bf115c82", "comment": "Malware payload (Amadey)", "value": "d2808870a3e817af46ddfec49591a8194fe0e16a18c8bfea4fbdbcb8ad01ea9b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198830, "uuid": "caf86502-94d2-408f-babf-4a933658dd33", "comment": "Malware payload (Amadey)", "value": "5fd42efad7bfa8d86cf046572ed76e8636bd2aaa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198830, "uuid": "fc8eb327-a94d-4b7a-93c0-852710e65be5", "comment": "Malware payload (Amadey)", "value": "51eda7cc4b863a7b8af8699e2783c1e914793225f7b163856ddffb9e692b69b9342cd2c752e1825da989d58797ad53f1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198830, "uuid": "0c7af886-4280-4c08-88a3-36ffd1880230", "value": "T16CD41203EAE89431ECB517B048F216831B36BDB15D78964B3759AC9F0C72AC8E43176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198830, "uuid": "5f9c10ee-d933-4fcb-89f4-328c33563f17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198830, "uuid": "cfed4cab-375d-4479-8684-cb34a6b9f692", "value": "12288:yMrQy90vPEoG142G+aTI8vXt3Qmlk2GggQr+wC1yjLt:Cy3oGK7jI8/tAmlcgYwC1yXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198830, "uuid": "926b9fe5-619e-4367-99cc-dca14c44ea7a", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198830, "uuid": "07879d4a-ba3e-40f1-acf2-a151d28a5fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198830, "uuid": "8383433f-3be6-4aa1-a27e-800e2c6112f8", "value": "257ebd04dfc8ac0a3fc5efd23c936dcc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f67f6cc-0ec9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687196774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196774, "uuid": "5b9f8bf2-e68e-403b-9599-4b1574fb5fc5", "comment": "Malware payload (Mirai)", "value": "8e5977d289b7528efa1e9e7b3c7ed85f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196774, "uuid": "4a2c2acf-816d-44b7-b351-199cbcdc76a3", "comment": "Malware payload (Mirai)", "value": "d2c02f8d0de37ddb12c5c4092627be420c321b3ed5202dd2e24a273b6386eebe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196774, "uuid": "b338c90a-c281-4188-b384-0f75bcf088dc", "comment": "Malware payload (Mirai)", "value": "afe5c893345392ded120736289e2d61e39256745", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196774, "uuid": "5f54c0b1-fa42-4c4f-8e95-bac84e62ddcf", "comment": "Malware payload (Mirai)", "value": "94ed8f108bdc5f8ae963224bb35390ad2836c89222e534eac7e1e2711c458b1381745cfc7414b16718124348ac655a2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196774, "uuid": "656dc8eb-3cef-44a1-b7a5-6ae54a5c3ec4", "value": "T16C534AC2F58B44F5C807493060A7F63FDB32D469407296AEEF899F76DA6F602821634D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196774, "uuid": "21ae5640-89a7-40c2-8711-645a6db0f638", "value": "1536:VRcZNhjumFroI2W2GnbXa1zYOCVGsQtJMLrX:V6nhj5r72WznbK1znCVGsykrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687196774, "uuid": "17025aba-2228-48f5-8017-9e7916cb1c11", "value": 63604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687196774, "uuid": "91350cb5-39a9-4547-81cd-7956910d1d6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196774, "uuid": "e192d1b7-1aab-4373-baf0-ffbaa036aa8a", "value": "8e5977d289b7528efa1e9e7b3c7ed85f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b92d20-0ece-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687198853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198853, "uuid": "c98c6f15-00d5-4e42-a510-c231fff88ea3", "comment": "Malware payload (RedLineStealer)", "value": "231d001b604ac4a3beb6f7aa70f95654", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198853, "uuid": "e91c6442-de66-40fd-bf42-ebbe6d287c6c", "comment": "Malware payload (RedLineStealer)", "value": "d2f6db105fe997f60739a7b253dc4d863d35a41105c36bfd16a7a26a5a37b808", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198853, "uuid": "b7d43c2f-e019-4605-b688-966139c8b7dc", "comment": "Malware payload (RedLineStealer)", "value": "13495847e75240648b4b1216f4c03021f092afb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198853, "uuid": "3ba15e84-e1c9-4e8d-abc0-0978404d5c6c", "comment": "Malware payload (RedLineStealer)", "value": "83f92007e0c2f1daae29c2522d7e59ac7325924f22ddd4126b7be517781678b3bb1b106d21ab28b5ea16806ff89567a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198853, "uuid": "20e998c1-adcf-4b80-8d12-014099e3feb8", "value": "T192544A0FB5C50336E471103D2BB02956EDEDBC910D34EDB73A6CC369156ABE2A9680DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198853, "uuid": "38ca52da-b55a-4185-8aaa-9dd13b209a56", "value": "d91fa928c738702455bfa66ac3685503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198853, "uuid": "f5924640-105b-43ff-9201-6fb8d7a49b55", "value": "6144:ThqMDU2OQ0FKHgKNRBH13TLxNP9T0x+SRMF:TbDCQzgMLxNFYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198853, "uuid": "4c2ff485-7d0f-4278-a85d-8bab0cf68206", "value": 279046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198853, "uuid": "46f974ab-7131-42f9-97dd-61033bd2e3cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198853, "uuid": "cbf4b955-78e9-4003-8940-34ff4dca422f", "value": "231d001b604ac4a3beb6f7aa70f95654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1706f848-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165379, "uuid": "2e6eb721-1872-42c1-b522-53cd1f3c865a", "comment": "Malware payload (Mirai)", "value": "407bd0cb42d8cee8efd3b2a63c0a1afc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165379, "uuid": "19925155-c2fe-4387-9a4f-2c1fb9ce831e", "comment": "Malware payload (Mirai)", "value": "d301aee5a6df8527d3b994a2bccf6364e54d2a1aa14f5746682511942727aed1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165379, "uuid": "06be61b9-0e0f-4173-9a0f-ee1cc33bb7b7", "comment": "Malware payload (Mirai)", "value": "769e603f5f7433f6383cbfba3353bf8190b23f5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165379, "uuid": "466e27b8-2639-464a-bf75-2e272f66cf86", "comment": "Malware payload (Mirai)", "value": "6f3eb8228d1b464a2964b33fe47b34e54e23187e70a06d39532d26c403ad3e7089b7d41f5edf048838df57993206a55c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165379, "uuid": "15be365e-39d7-40ce-99e7-4b9221d74670", "value": "T1C043851E6D168FBCFB59863447B78E219A5833D627D1D642E16CDA002EA034E741FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165379, "uuid": "d2bdd887-24d2-487f-9798-5ac887256468", "value": "768:bvaLxUxyQpPT5rhmuTrFtqmSnoh2Lt3ug+f1QZi0e4fyMnup//dujgtywlz:bvJFP1ntsF+f1l0lk16gtLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165379, "uuid": "711e1baa-fa61-4215-bdd2-a38df90febed", "value": 59768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165379, "uuid": "6b3eba9c-0e24-44d7-bb2c-ccfb0779610e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165379, "uuid": "eba633fb-d805-4bdb-a4b1-6963dd5e25a4", "value": "407bd0cb42d8cee8efd3b2a63c0a1afc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc76718-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687160559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160559, "uuid": "d3a18d53-730b-41ad-8622-3ea78bcdf476", "comment": "Malware payload (Loki)", "value": "810d0ec382daf1daff633846e5800cfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160559, "uuid": "7c734c60-432b-47d6-bd88-3bda06d28e46", "comment": "Malware payload (Loki)", "value": "d37e7216f0d8f114001b39dbf31d0723b458ebe14d2601177d7684e47c0b927c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160559, "uuid": "04855089-eb76-4e87-8a37-2f74a36e1f77", "comment": "Malware payload (Loki)", "value": "e8da8210db7c6069fc7c6167bf9159a6f67fa207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160559, "uuid": "8a547b1d-a696-4daa-b3ee-5597c04aaa27", "comment": "Malware payload (Loki)", "value": "35bb5ba2da8fedc2147217c5d9eb6cd0a52bc80460f3636dcbdcc584789843537b3ffec5fa89d10909791a9974633674", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160559, "uuid": "775078f0-cece-47ee-a962-b9415aa46d54", "value": "T1BAF4E081723D2963EABDCBF50150627093F62E5EA25EE7E84CC6B0DB52F0F814651E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160559, "uuid": "10835fc4-4487-424a-83d4-677a050859dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160559, "uuid": "a6debd33-e4e5-4b36-af11-6d23c9de61b8", "value": "12288:LlKnutEXqXdVj77qprFJFLgzYiJ5FXwjpSmrBMkIRFq:g84qXdVjEjNbNjr7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160559, "uuid": "ac9099a0-c59d-43b7-94d6-4fc072b5e0b6", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160559, "uuid": "834faf55-d63b-4592-a707-4faa43cc0eed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160559, "uuid": "b6b5223e-d5dd-4d66-a285-e070d67001ff", "value": "PDA_Request_MV HONEY GLOREY_1000572_007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd592ee1-0e9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687176825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176825, "uuid": "1a18166b-58ed-447e-8b41-a29e90fb543d", "comment": "Malware payload (Mirai)", "value": "f49bf9bf6b79a6ae4ff18491a9dc1053", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176825, "uuid": "0d6f6a0c-22bd-4b55-a0d6-d9048ba2ab2b", "comment": "Malware payload (Mirai)", "value": "d3980751d4f84754b7e48cc87727828609e9f032a35ec7e5328e2b02fb5e9632", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176825, "uuid": "08261778-092e-45e6-a21d-9f0bccdd010b", "comment": "Malware payload (Mirai)", "value": "9984902fead0a1b4ffc3522e91399d2a825a9fef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176825, "uuid": "db83c148-c3a6-4f95-b373-01a72a8883fc", "comment": "Malware payload (Mirai)", "value": "2040d2eadf26502d02fa0f93c6909c2e8a44e67d4dfd4be7f544ce20ec8104704a56723431f7b40a233ce5e3c711963d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176825, "uuid": "16dede5e-1286-4fa9-98fc-de237cf5f4f5", "value": "T17A030882B8819613C5D4137BFA6E41CD372623A8E2EF73139D222F51779682F0DBB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176825, "uuid": "7f850cab-d7aa-4796-aed7-9cf4242f8269", "value": "768:Zgd7ZVcvgb4dphtbp5twMpn/loQo/NP+ZCbVQ32L:O7bcvP5tlp/6U0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176825, "uuid": "e856b765-0cd8-4468-85c8-ef57d40809fa", "value": 39412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176825, "uuid": "d0acc91b-6f07-4682-b4b6-793169c53f6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176825, "uuid": "25310581-ca06-465d-9741-daedeae4d51f", "value": "f49bf9bf6b79a6ae4ff18491a9dc1053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06628408-0ecd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687198423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198423, "uuid": "4281360e-4275-4e70-a921-982c37d29b17", "comment": "Malware payload (AgentTesla)", "value": "4d939656953168c9c5425662145fe5dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198423, "uuid": "c6a77702-bd5b-46ee-ac6b-cf0a39ff42a1", "comment": "Malware payload (AgentTesla)", "value": "d3fa8bd6b585950b90a820e54ce4b98e306dba962498f7f098ebd811dfdc735f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198423, "uuid": "195042dc-9932-40cd-9df9-7b22b3054789", "comment": "Malware payload (AgentTesla)", "value": "163bca68d80b6231d72459e6ba9422e3c1c62bf3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198423, "uuid": "80b0ff93-01f0-49f8-8291-66f1790fa315", "comment": "Malware payload (AgentTesla)", "value": "c9733812d21de3548a1985f0770d0c08911337e4da995b5a25d492a7069009fab0fb0390041e54ff48612bbb923e1992", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198423, "uuid": "bbd88e8d-8aa0-4d8b-a8aa-625fd86755f3", "value": "T1F4F4128C39648653D47A4BB8C9A137B61BBE5BA9BC21F7D92DD3B0D8ECE1B811151303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198423, "uuid": "fc8f3777-f89f-4268-a2b4-911a9ec7c22d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198423, "uuid": "868e051c-9242-4150-aa3f-431e71fdb6c0", "value": "12288:gVtYq7J3At5iHOq+ZQUMbTKU/tJPsLhv/syKBmRIcRYpJbXzbx22Qf:gTYqtm8OqKobhfQv6mRIWYvXz922Qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198423, "uuid": "7ccd611a-ee8c-4390-a915-c88ee846a9a8", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198423, "uuid": "d95e3be0-1758-4463-aa5c-1402263217a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198423, "uuid": "aea6a02b-3e54-4ca2-bd93-49bee7bdf0ce", "value": "z2116062023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfeec3aa-0ea9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687183326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183326, "uuid": "709e8fa0-a7f4-4f8f-b620-19f990fb1ad5", "comment": "Malware payload (GuLoader)", "value": "06e72bd105ab1f647ae8b0596cf21f01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183326, "uuid": "23d45909-26ea-46c8-8f12-962f06467a25", "comment": "Malware payload (GuLoader)", "value": "d46aa970a11e338fcd8ffa41a2cbcefe69970939beb45cc74b99a29664446933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183326, "uuid": "c373069c-ffb1-4046-8371-fec6b64a2353", "comment": "Malware payload (GuLoader)", "value": "93a1c3a5278690c449722b2367c18e5e4d62cd8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183326, "uuid": "fb0ea720-1e9d-4dd5-9652-a9efadf00207", "comment": "Malware payload (GuLoader)", "value": "79e78514f3920bb31ba47da4217355c2ed5f305d03bf3378fc31ce3b6d253fd2183a4572b5350c592e9aa4b9a81c2348", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183326, "uuid": "460224c2-bf27-4b36-a4d9-84a92d85b4e8", "value": "T18744125527B5E083DDE28DB152A8B277BEB7B9023864571F23307B4839623D2EA1D35C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183326, "uuid": "9bcdfc5d-f256-4723-8015-c5a3083540af", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183326, "uuid": "835b7d88-eabd-478a-b503-0027ebd23ff9", "value": "6144:q4t6LsLDkSDBYewl9O8bYtd+2mIDmTQK92iGaUlLng8N:qkLDkWRO7b8d+ZEfixin1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687183326, "uuid": "bdc4b7fb-8b0f-4a13-9dd6-50e8545dbaec", "value": 257904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687183326, "uuid": "fd4a96ef-567b-4996-8a51-3fabdf83f8f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183326, "uuid": "6edcd041-6dee-45bf-8546-48e982f4aa79", "value": "NO.7765876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e217d424-0e68-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687155412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155412, "uuid": "47ac29e0-77c2-4394-b450-bfa31aae37e5", "comment": "Malware payload (AgentTesla)", "value": "0cb59c5a711821534c2585a9b5b7602a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155412, "uuid": "39012f16-a147-4c7a-adb2-3b66634a8856", "comment": "Malware payload (AgentTesla)", "value": "d4eb0b351ba85b39db243f72e6aa72111e9db00683f66dde74a5f7b845c89f02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155412, "uuid": "7b646c83-c56c-4398-a243-e13e78b18376", "comment": "Malware payload (AgentTesla)", "value": "38be4fca14869ca8774c005342ec960b4e731588", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687155412, "uuid": "617e5918-eb39-41db-b556-60bfa4eb3529", "comment": "Malware payload (AgentTesla)", "value": "acfd515928f3aa899495790107f7405b10daef2a578517f76f595d7a1cf78100736ca49d334ced248c7e8b5c4c881f58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155412, "uuid": "009e43de-463a-43c3-9d03-badcd644f63a", "value": "T1AC458D117A41C912C15D36F6E29720345377CD82232AE30AA9F633A61E337EFDD5968E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155412, "uuid": "b5b3a678-f0c7-4051-aacd-142f2a68da8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155412, "uuid": "716b5fae-e2da-4633-9de9-8a0a81a80908", "value": "24576:N9cwJXpR6dOyL506lcv9VAoE/H3G5zSAZYntwqvJ:963L506avYo5TMw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687155412, "uuid": "7d65bc30-4e49-497f-840c-6f9485c65662", "value": 1265152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687155412, "uuid": "f435a99a-3f76-4cc0-8c4c-272837e2c923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687155412, "uuid": "2f1f7e59-7f28-4d18-8c4f-eba61d57fa8e", "value": "open invoices-07-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cca288-0e7e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687164626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164626, "uuid": "4a97c686-fae9-4f86-8214-cc5fb5afc05a", "comment": "Malware payload (AsyncRAT)", "value": "d7217c144aa091e33feb0841f6d0da7d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164626, "uuid": "f7e658a7-d405-41a2-9e74-201e7e0cc6e5", "comment": "Malware payload (AsyncRAT)", "value": "d54b3f33ed13d8647d3c4ef388ccc37c47b478039bc4228c6414943e29124372", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164626, "uuid": "22eddbba-6e94-436f-896f-205dd2d256b4", "comment": "Malware payload (AsyncRAT)", "value": "058591afaee4bf97f2747e12fc23c96d6769f91e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164626, "uuid": "2f02ff75-b023-44f5-a2cf-ff1934f52081", "comment": "Malware payload (AsyncRAT)", "value": "ded44cd15b14b896af72a23e7cf1de44bd9f9da9fcb18e57a3dba4e9cafecd1637c53da54fc950d9432a15e3e8265214", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164626, "uuid": "cc768400-6a3d-480a-b708-c7c91f7a2e61", "value": "T1864533C5B317369CC88BDF5AE4A87D8F060DD82CEA25D521823692FC289EC0E497D775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164626, "uuid": "0c86f920-813d-408a-871c-8782e2c2b7d8", "value": "24576:vgfxiqxtTTFb4IKnX3pRH67eFaE6k1+fEh:+xRxtTTFb4dnpRHSHUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687164626, "uuid": "5d75b902-2333-4f8a-9e2d-0f3b3001d92d", "value": 1168679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687164626, "uuid": "9fe86458-e131-4908-85e3-c3b563747efb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164626, "uuid": "066f17fb-8108-40ca-8f39-b08add008cfb", "value": "Pago_16062023.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb80b4e-0eb5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687188422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188422, "uuid": "614211f4-c6a5-416f-af6d-33ba34509848", "comment": "Malware payload", "value": "5d8cd311ee01b9abb3b00ccc1be9fa01", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188422, "uuid": "f77b3669-496c-4ed4-bcff-ec5ba7db4832", "comment": "Malware payload", "value": "d5bb44fd817e16a591e3c2070cd8fcff11fd9760dfaedb76878aef9757b50d51", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188422, "uuid": "e5de4c6a-d7bd-4d40-bbf6-174030d23ae9", "comment": "Malware payload", "value": "9fe3ef83e0be1c8dfafe6b3e0acf1be6c7508033", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188422, "uuid": "7754833f-998d-4792-b187-f31e42a7da75", "comment": "Malware payload", "value": "6a4db4d1cd350297cdb8d59070b27662543c365c845a027c0184c7e427f61b080e81b7d9048cac9547df3b8777ebaf64", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188422, "uuid": "aa1938b8-1dfb-411c-bb4b-3e3013eaa0ad", "value": "T1AAB312D0072244A3680129FE8177B5AE2E1573D5ECB6F0C8DDB948F35366E6B8DD8782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188422, "uuid": "6f05881e-e998-4b9e-be9a-b3c171abd8e3", "value": "3072:nj5yv7OeSLy2vzFIJz6tIUmdzW8bZFNqaC:j46zal6D2zx3fC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687188422, "uuid": "066a6b9c-50d9-495d-b906-a3afaa9b677b", "value": 114752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687188422, "uuid": "8828c749-f361-4bd9-bffc-032cd63f7263", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188422, "uuid": "1d4ae4a1-81f6-466c-aa34-872a1d76fc4b", "value": "MLbgKyiPLDE115.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49acb73a-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165464, "uuid": "ccd2aef4-a472-4041-9330-fd6d3a8e7f06", "comment": "Malware payload (Mirai)", "value": "860ccce2f631894da7333075be2c2cfe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165464, "uuid": "b8ca02fe-cfd6-4d25-b145-a312518ff02d", "comment": "Malware payload (Mirai)", "value": "d62921fd0837b54a32dab7189ae18d2644102a8c723e0d7f5e05a450c4cbe093", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165464, "uuid": "c70b7b2c-cb00-4fe2-a4d1-4b1e00265246", "comment": "Malware payload (Mirai)", "value": "ba0d8f8e4d92153f0c3dc656578805e932cd95c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165464, "uuid": "df48db0d-e389-4452-8462-5233a61bdff6", "comment": "Malware payload (Mirai)", "value": "8789364b13c4efa4624d884278dd3ffc922bf3ef4a9eda121d2afae19792759c589ff52394e3bcc110596bb7763278a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165464, "uuid": "85011112-356e-41ee-b73f-a8ed02f35090", "value": "T137C2D02CE0FA0AE2EABFBEB11CEE6F6877C05D265D32CD6112402B5550624533915DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165464, "uuid": "a77d45d1-7e7f-4acc-a840-102555632def", "value": "768:rVKU9Be8u5oA9DI9qZU7YLTNq/J4uVcqgw0RsWXU:tmR5oAm9q+J4u+qgw0SWXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165464, "uuid": "dba0ab8f-ec30-41c9-90c0-f5dd5164a29c", "value": 27444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165464, "uuid": "ba8bfa7e-9381-4835-b08a-ee38575ff4e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165464, "uuid": "cda47d3f-7ba5-4714-8e87-9e2654e2f117", "value": "860ccce2f631894da7333075be2c2cfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cf1b30-0ece-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687198855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198855, "uuid": "60b67266-9bbe-4648-a136-f969f19188ca", "comment": "Malware payload (RedLineStealer)", "value": "0fdc7ed8326eda70d19de9a4fa860bba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198855, "uuid": "38afd394-895e-4771-9010-10644e5656ac", "comment": "Malware payload (RedLineStealer)", "value": "d70c37c5571bad06fb22bcec1ced7b9d2c34729314fb7012069ec7a3918833af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198855, "uuid": "9c9854ab-e142-47bd-ad0b-3a63330c33dc", "comment": "Malware payload (RedLineStealer)", "value": "04c848bed5c3a8f31a84deb1d0876c918a32c09f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198855, "uuid": "72b29bcc-b194-4762-bb03-23a277880628", "comment": "Malware payload (RedLineStealer)", "value": "807fbc62af43c35cf2b0c94961ebce98696e300885645677ed3bb152fc6bc0db45cd925a53d7baf2d243a6edd399f14c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198855, "uuid": "970f6cdd-2764-4645-9ef0-4e7df01d944f", "value": "T14CD4121A6FDC8173D8751B3088F702830775FDA169784B6B2B01899A4CB3784A9767BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198855, "uuid": "ccd7df4e-0efd-43b6-9ba4-08da082c8935", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198855, "uuid": "27a82c90-22a1-460f-9979-c710e2ec1e30", "value": "12288:xMrTy90IDIip9SEeFPGVLeLz3Q+JBXtMq4nWZg1Qrf1e0eX1904uFWcCxZnUl:2ybDIqeZGVWz3hJVtJgE1eZ1aOni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198855, "uuid": "cd833c6f-b6c3-4280-96a0-544056d21e54", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198855, "uuid": "d91d4bbd-4b0a-4e56-a750-50e33edea32d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198855, "uuid": "2efce647-f158-480c-a2fd-d18b9c0fd92d", "value": "0fdc7ed8326eda70d19de9a4fa860bba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f350bae-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687174144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174144, "uuid": "f298c4c9-f3ef-4e8b-aecd-698bfec1ab9b", "comment": "Malware payload (Loki)", "value": "40208edc38fb8ca34550f1674929693f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174144, "uuid": "00adec79-83b2-43c5-98ff-8af7abf86b0c", "comment": "Malware payload (Loki)", "value": "d76c2fca8b28777527708567160b1561c5038257b78a8306e8377175408a9f2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174144, "uuid": "690c954a-c28e-4640-857b-b204343e3f26", "comment": "Malware payload (Loki)", "value": "52d3c17f44790884737b7df2cdb7fdfa3c8640e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174144, "uuid": "619b0328-cde1-466f-aa03-5c2df007bbe0", "comment": "Malware payload (Loki)", "value": "187e9a896d19951aaabfa815e5488f133cbd08623bd6f4be0ee43d4c57f4cd0956c1da56c45433b9a76566b287538179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174144, "uuid": "9b7fd11c-cfa9-4371-8afc-fd4ea32a4367", "value": "T1A405CF3C76241E63C5B986F7D440217183FBD929695FE7C59CC2B0EE6BC0BA49A03297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174144, "uuid": "9c997612-98a3-47e9-a691-6664d4bc63ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174144, "uuid": "0e454aa8-0234-4739-ab92-9198db202c22", "value": "24576:VwnYqtm8OqK3nTj4H0c66uSKH2aZOAGtt:e+8OuHg5pZOAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174144, "uuid": "0f6b78e6-2d59-4bf7-9243-cad181311f66", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174144, "uuid": "d6ae8758-43e1-44ab-b4bd-619955a5f8d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174144, "uuid": "8f4babf4-2dfa-4ca4-bd7c-97f0005f80b4", "value": "RFQ \u2013 F155001-LWB8MpVp9I7dO0H-xlxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d173b06-0e65-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687153927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153927, "uuid": "0dcbea7b-e203-43e9-9c42-460277f3af7b", "comment": "Malware payload (Mirai)", "value": "39bc2ba3a33e8c26ab19230a38288409", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153927, "uuid": "63b469be-406d-4662-b49a-52de6986e5a3", "comment": "Malware payload (Mirai)", "value": "d7cb422105d6d603a8a1d04e6431c899cfb5645e1d8b4a31943b1d976180b5e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153927, "uuid": "05815718-84ec-4162-ab62-e789fb785bd1", "comment": "Malware payload (Mirai)", "value": "5ff10c95d115b6d9c0eb6f6c90d6d080ce236bfe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687153927, "uuid": "33b27756-78c1-4795-9be2-875edd62e695", "comment": "Malware payload (Mirai)", "value": "69038b5f64bc24481e9eacfb8588b8cfdd4b38b4bb8e31d59426cc6abe5afc69fc0a6cf93df8a27e6c58f74d89e433f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153927, "uuid": "2d83a093-1efb-4cb9-8834-182f7617592a", "value": "T155C2D0A1E1B62D86FB3A6F501A65C2C177A04E9EB7B7CCD2655CAF0404A32574B056CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153927, "uuid": "28fa263d-f699-40f1-a00c-e6c7280dc010", "value": "768:lG959yM0HWubJsWDYcGG14uVcqgw09S0s:tM0HRJswYcGU4u+qgw09S0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687153927, "uuid": "499cae24-7f35-475f-ba7d-642555b8bc4e", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687153927, "uuid": "dca0a534-a552-4815-a2ff-23eb75cc856f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687153927, "uuid": "3771327a-ab82-4c6d-b409-a5507c6fec99", "value": "39bc2ba3a33e8c26ab19230a38288409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f8b02a-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687174129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174129, "uuid": "26b82a68-287d-4b27-a6ae-8b1505e11500", "comment": "Malware payload (AgentTesla)", "value": "cf868ac3637e9010ff08dc9c7c3400b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174129, "uuid": "8ec0b9c0-6dfd-4bfb-b2e4-8c0cfd8b3dc9", "comment": "Malware payload (AgentTesla)", "value": "d7d8d00e506ee58be147aa786d59b31fabe3529dd2fe8f427420a58781fd42cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174129, "uuid": "e27b0609-9da4-4081-9cc9-1390bc8a3454", "comment": "Malware payload (AgentTesla)", "value": "dffc4c57ceafce8174e3c12e136dee32079df33c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174129, "uuid": "43b54698-9911-404a-9926-94d6a58b6e28", "comment": "Malware payload (AgentTesla)", "value": "9cb13f2b2eb60604250eb26dbe731a27d2ca6d0831606645bad607b6440832a4a1938916a98485acddfd2715c4a2245b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174129, "uuid": "37d3d0c5-371c-426d-8dc0-e6cb1eea3447", "value": "T17E03D35EE78F12648F511276271B1A889ABDB23EF35054B1386C833433EDC7E46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174129, "uuid": "817a5847-620e-40c2-a6fa-a7c9ecd10cb8", "value": "768:/Fx0XaIsnPRIa4fwJMQaugcq8M1WktI0Ut4jaSQ3d2:/f0Xvx3EMZuRMUksSexg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174129, "uuid": "fb22dc38-c9e6-4a98-953a-053f0de6afa6", "value": 38605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174129, "uuid": "b6de4aef-6cfb-4a30-be7d-c5e832e8c0a7", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174129, "uuid": "00f60301-a4e1-4f42-b4bc-d820e79d792b", "value": "cf868ac3637e9010ff08dc9c7c3400b5.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e754681-0e9d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1687177901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687177901, "uuid": "ec4dbf6f-871d-4c41-9919-8ae25fb44d26", "comment": "Malware payload (Smoke Loader)", "value": "5f0bc428fe376b3c9228b5698262defb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687177901, "uuid": "bca1cf70-8693-4a7d-b031-bca811b79856", "comment": "Malware payload (Smoke Loader)", "value": "d896e1c6f1124eb8cf19f29d2dec8d35203cfd4ea36636549e178a1a06de10db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687177901, "uuid": "77c32cec-0ec2-4f36-ac1f-4ef7b3aa0856", "comment": "Malware payload (Smoke Loader)", "value": "c3d6ab8461985fff5befc6c46e2c1df6948bd963", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687177901, "uuid": "f80cfeb1-89a6-400a-9327-90ab1a63bbcc", "comment": "Malware payload (Smoke Loader)", "value": "063175d6219b72ca02c1c8c7f4d1f182b4029105f149d77d86510f19b701f9cfde5e8fc64022e1f36cbf98af45e39c87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687177901, "uuid": "32f3080c-6490-4648-a4ba-df692b85e3e7", "value": "T145346D1272D3AC64D715DB728D6ECAF87B1DF5508F1A37AA121C6B1F09B02A3C672706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687177901, "uuid": "9bb9e1db-d2e2-459e-bf0a-964ea788a0df", "value": "908fbf99c3f8c44c371239c262bab2c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687177901, "uuid": "f8ba886e-10fb-40cb-b936-cda0efbc6903", "value": "3072:VSyEuh8DjVOcAfXZvwHTU67oiR51OacnaIQfMoe8uMShYIzh+PEY2oAYwjJ:AuKXVOcAfJ0h79BjEZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687177901, "uuid": "ca2f15bf-ab08-4302-b31d-6e487d3bf81d", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687177901, "uuid": "4d0e70ba-18ef-479b-973e-4b9cd100a534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687177901, "uuid": "0cf479f1-8ff7-4db6-9ee3-5595f5374c36", "value": "SecuriteInfo.com.Win32.CrypterX-gen.15400.19373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6325c289-0e46-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1687140596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687140596, "uuid": "5f5d2207-eab3-4de4-81d7-d027edefa4a0", "comment": "Malware payload (ArkeiStealer)", "value": "2c2f238f70bd38ac0ff0bd013c4e5a40", "object_relation": "md5", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pwd-1234", "colour": "#E26632", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687140596, "uuid": "d9459ba8-2ec8-411a-83d1-0edca0ce1054", "comment": "Malware payload (ArkeiStealer)", "value": "d90c43d06b684c83b0831aae86c5ca523c692e4db1e67eb0dce5ebd927bf576b", "object_relation": "sha256", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pwd-1234", "colour": "#E26632", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687140596, "uuid": "8825a569-95e9-4658-b2e8-848095296264", "comment": "Malware payload (ArkeiStealer)", "value": "c2edd71ecbee8a669a39037ebdcbdb154e63f720", "object_relation": "sha1", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pwd-1234", "colour": "#E26632", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687140596, "uuid": "f1dc39a0-9126-4abb-8d26-4efb5142ed75", "comment": "Malware payload (ArkeiStealer)", "value": "5e6e1045e17d72c511f0a5ef6fadbce809a536674df98b31d8e029de9035c1ec1cac81baa07b6323a2429265a5e3644f", "object_relation": "sha3-384", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pwd-1234", "colour": "#E26632", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687140596, "uuid": "0727a0ee-5067-4f62-85b0-01cf72ee8ba1", "value": "T19D47332150DF39CC75032C16A748E7E58DAAF0EA472444BDD38F3664A94A9F1ED3DA8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687140596, "uuid": "81ddf464-7e99-4bee-8af2-b6a6a4833ff1", "value": "393216:Z1QWpjCDzlbRBsQq/+FwPzit5Xrkkjov4wEy/hOHPJqzhczZWLWiA1yy2U5U99BW:5pWDpbRBsQq/L+sAwE8ORqiwLrA1yLUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687140596, "uuid": "2ad41483-def6-44d2-9392-ac974bbcf9d7", "value": 24794430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687140596, "uuid": "9f8db8b6-601b-4152-b450-eb4b9470c980", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687140596, "uuid": "38c36f89-ea3d-4255-adfe-f4f9a3cbdb3c", "value": "F1LES-S0ft.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8930368-0e88-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687169113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687169113, "uuid": "57714a6e-20ef-4477-81a0-f1b6ea336a00", "comment": "Malware payload (Amadey)", "value": "21186a8dea1b91cd354732194c4d32ac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687169113, "uuid": "671f515d-8f81-4cd9-a822-d13119637abe", "comment": "Malware payload (Amadey)", "value": "d92aba0f5f4c377753aa5dccf2a2dc7d64fa5fab5bf33dbc67bbb13e50a74a30", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687169113, "uuid": "db7386cd-ffec-4313-83a0-039ab247b9a3", "comment": "Malware payload (Amadey)", "value": "73aefdcd1c0da87e505caf560488435a3fe2c5b3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687169113, "uuid": "6b86377e-94f8-43c5-b606-7ca4960ab040", "comment": "Malware payload (Amadey)", "value": "5053155dd5a0db21fef387c47b07ef5c04188e8c9454a2909816e5fbc068d736a74b1baa98bbfd53575db3e9e504b339", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687169113, "uuid": "53a9dbc8-8645-4d8d-af84-8635eef789f9", "value": "T183D41213BBE88463D8A867B149F702831E33BC616E785B792351992F1DB3654B93133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687169113, "uuid": "0ac389eb-7e89-4c01-828d-bf26d7633878", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687169113, "uuid": "2610af1b-5a59-4e50-a772-3cee68953cf7", "value": "12288:WMrty90MNWyfi7UteuJ3lSxDlWWemhTFoZ96O:Ly3WyfoghlSxDlW0T+95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687169113, "uuid": "be1fb1d7-ea0f-44c3-88d5-b247b427e77c", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687169113, "uuid": "e0fdefa4-10aa-499b-a47a-050bb0ab84a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687169113, "uuid": "f0ae8899-5094-4413-9279-707c801dcf04", "value": "21186a8dea1b91cd354732194c4d32ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90276a52-0e76-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1687161288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687161288, "uuid": "39fed7b3-ac83-41d1-96cd-677fbc71e5f3", "comment": "Malware payload (STRRAT)", "value": "209bfb9452960018daeac6608deb6142", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687161288, "uuid": "8c96a187-12b3-4f16-a2b0-4df983127d28", "comment": "Malware payload (STRRAT)", "value": "d9db34433fa563ffdb740809aa3f16cd12a4830a519f75824c69d299f001971f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687161288, "uuid": "b9fd1331-22ca-40f8-8cb7-47e432d9b890", "comment": "Malware payload (STRRAT)", "value": "e76f83c1b7818f8f480fbfcfe69283272c905056", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687161288, "uuid": "9a692bf7-756c-4170-b7b2-98f79d1bf864", "comment": "Malware payload (STRRAT)", "value": "3eb9f4f957db1917541ea1281e36934e420734a0005d8faa63775feb4e71371b280f75945e007ffc486dcbc269282123", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687161288, "uuid": "1eef68f8-dd2a-46ed-b1cb-87afa4d5878e", "value": "T17524120ABCA684DDE51B8639681ED9B2F50C000AE252A53F35FE93D01D71DBC8B465EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687161288, "uuid": "659de5d5-ea9b-49d3-ac2d-7c7f9ee7113a", "value": "6144:ToiCrUuF1+GQA0sVLjvcgc3hWYFVaP+EmQ:9CrUuFsPb2/kThWjP+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687161288, "uuid": "13f81c8c-fc2c-4485-bf72-71e40ace7979", "value": 223546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687161288, "uuid": "0028e98c-a76f-426f-8910-1c79a1aa846a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687161288, "uuid": "2cf71c78-6ce7-45f6-81ce-0a0ab41ccdbc", "value": "SOLICITUD PEDIDO MATERIAL-CIF-B98532593.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133f728f-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165373, "uuid": "737c8390-d5ce-4c8a-be18-5e662d936db5", "comment": "Malware payload (Mirai)", "value": "346544d546d0c8c737c6461d19c85fb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165373, "uuid": "aff594dd-a65b-4c71-8d4b-de317a231bd4", "comment": "Malware payload (Mirai)", "value": "da3f01369fcf1fc63ad10744f2a5c4c64873531930536b1e56852cad4c979705", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165373, "uuid": "c28cbf25-a5cb-4ee0-a68d-5409575d602b", "comment": "Malware payload (Mirai)", "value": "e125cd69f88e38d4e77a65c2ae440eaa2ddbdecf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165373, "uuid": "31e3c709-c480-4bbc-94e8-2ee0d7e1d3b6", "comment": "Malware payload (Mirai)", "value": "09d047e0e9b61af80f8a36e98a8b3e173ce59dabf8a15d2020a0b1b47154200b1dd4bb5047e8052177d063f9d0b76bdb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165373, "uuid": "265915d2-178a-4e8f-85fb-04fd727657ab", "value": "T164536DCAB8119E7DF5CBE77E84220E0EB821726150931B17BB6FFC837D721648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165373, "uuid": "f9ef884a-0eac-4f64-9cef-627818c60a8a", "value": "1536:AXyRgQF4TbSX5lxLepSGYlcFnehON2PPB+qG76E8k:N1Tj58EVGOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165373, "uuid": "9e0fe966-c97e-445a-b35d-34ebb8957ab4", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165373, "uuid": "2c99ef55-d625-4e91-87ec-d0605c2f2781", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165373, "uuid": "ece7c2ff-fece-4119-9fd0-a3c76ee2f4b6", "value": "346544d546d0c8c737c6461d19c85fb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f31935-0eb4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687188091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188091, "uuid": "d77ed5b4-eec8-408d-8763-e95ca899aa43", "comment": "Malware payload (Mirai)", "value": "4343b5704180569466d6a1ce366d13ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188091, "uuid": "7cec3ff9-1cb9-498a-8f27-621ea12092ef", "comment": "Malware payload (Mirai)", "value": "da4d213bb1d7c8697ce07c9000b76d6513bd23b6b0fab126c591ea26ebf63371", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188091, "uuid": "e18e8d61-d78f-457c-b6cb-43059a4f4fb6", "comment": "Malware payload (Mirai)", "value": "79fd6938ddb49804cf43d4b740710a8077e4ee9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188091, "uuid": "5d6641c7-a414-4a8e-a29f-f7dbae6e91b5", "comment": "Malware payload (Mirai)", "value": "0a534ca7d3924f18e261a4292fc758421e5f6b7e8fc982b46f4140cc1930d7e57172575b195a05ac717eb23762f3e9dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188091, "uuid": "4d658c0b-7330-4e80-a82c-5ccb0fcd670c", "value": "T17AB3BF65D8A16DE0C191463060F6AD3D0763B81956072FF7A488C7AE904BDECF29F3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188091, "uuid": "5bf5ad11-1a81-4926-9250-facae68af391", "value": "3072:bHmqMnDd9GjtTpLJ0jAVmaHV0VBVZFPplyoP:bGqu7kZJTVyT1pYoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687188091, "uuid": "aa3c74aa-054f-4bfe-91fe-e394fdd1960e", "value": 116308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687188091, "uuid": "8e93b133-0c85-4c62-ae35-0ed9e301f7aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188091, "uuid": "7486f539-1561-4608-990c-7f67fb41f76c", "value": "4343b5704180569466d6a1ce366d13ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d228bf-0e8d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687171008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171008, "uuid": "b48e2432-3d75-4dff-acf8-61cf0711bed4", "comment": "Malware payload (Mirai)", "value": "be99b1c5ab9a9239ff966fbdc85159ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171008, "uuid": "76de441d-b13e-4ce0-be96-d7a56147da70", "comment": "Malware payload (Mirai)", "value": "dac9428506130f86721dc4dc588184f48752c65c9d8609654ba47049a5c280f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171008, "uuid": "c1230341-ff78-442a-827b-a68ba5686764", "comment": "Malware payload (Mirai)", "value": "bc91b677895ae816d4b81e8caed87c06f23677ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171008, "uuid": "6b4f1871-2144-4aab-af8f-a6b838e59703", "comment": "Malware payload (Mirai)", "value": "00884b3da7e9148f6c74b2d3abf68ab87d46ca56ac5df20bcc3255b836cab29bd827981fc192d6106e80a8e346e7e07f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171008, "uuid": "38b434b0-984e-43a5-a151-224108bfce06", "value": "T1C7B2E161A1863E62D770713AA97CC700576B97FCA0E672752138B6AC4BD2C47647814F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171008, "uuid": "51f82a59-3c6f-4bdc-aae6-8a167ff7cc61", "value": "384:MZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdVwP4fhymdGUop5hKY:nX1De9kONQG5xD+jHMDzuVwP0s3UozYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687171008, "uuid": "bf6a311f-774c-4953-bac5-642fda7ae09f", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687171008, "uuid": "15ca494a-baea-4f47-a483-d7c0e8c0333c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171008, "uuid": "e463b10c-645b-450b-867f-15f35168b371", "value": "be99b1c5ab9a9239ff966fbdc85159ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb53273-0eb2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687187240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187240, "uuid": "d34d8447-c91f-49d1-b38b-54e24093bc25", "comment": "Malware payload (Formbook)", "value": "e32b4ccaf0bffd1eeec5803b8a6564ad", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187240, "uuid": "4830a619-3164-4bb7-8cfd-ea8f48a74156", "comment": "Malware payload (Formbook)", "value": "dae35c59bb2fd72557ba68c69cb5d97e7691e57452e8b36cede7d3be71a2496c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187240, "uuid": "fd5d8aed-8268-40af-8de6-dc8433998d50", "comment": "Malware payload (Formbook)", "value": "72d2e672632004f1b9ed36f65247d5b8bb80ebe2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187240, "uuid": "10969c8a-fa40-4762-b2b0-c91cac5310e7", "comment": "Malware payload (Formbook)", "value": "073e3b034c841b76726e10b1280fc91acbcd68329b895e33aa992a86fc71fc06213ef527fb4bedeb2a3685f0f8c7260d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187240, "uuid": "e83d6051-24db-4cdb-af58-aef1b14a2380", "value": "T1CCB4232AD6975E18C162A4F95AC4D17001F064C0D8E0BDFC85E9DE29F2B3AB0B42B5F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187240, "uuid": "6628f410-7e0a-4eb6-b958-3abe69e1dd1d", "value": "12288:p/arGre+TE92tRDQTceIy/65lkFd7bEUUS9TZR0D0:p/aSKWE6QTSQclkFd7nHs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687187240, "uuid": "f687a1ff-b42e-47fc-8f3d-2632f9d9ead7", "value": 528512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687187240, "uuid": "07d7f946-9736-443f-8317-2f16e216bd28", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187240, "uuid": "f6a2499c-c59d-4a13-a6b0-9da138ed2828", "value": "55675442114.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c14a7af-0ea6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687181682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181682, "uuid": "f612576b-81e5-4676-b9c6-cd7c50674d00", "comment": "Malware payload", "value": "ad4fcf6799d34bf9ef0b20df24ae5879", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181682, "uuid": "a5293b5f-b7e1-45b5-954f-26a7f019201f", "comment": "Malware payload", "value": "dc4f19e5e4dc8fcc3c4ef23408bb2786351dbc4c6d68fd8f882bcbdf52211ff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181682, "uuid": "aba36ff5-02cc-44a1-9413-b681000b12ad", "comment": "Malware payload", "value": "9a7bce39762a8b63f816e4887fad01c918714035", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181682, "uuid": "fe50a2e4-afa0-4f73-80e1-aa616bf28433", "comment": "Malware payload", "value": "391cd5e345e2e16384935df6f760ae8c250a7714f113a099633227f5199c3eaf7c2440442f9d9b9f5e12dd441f8499dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181682, "uuid": "e1e02015-fa73-44af-ae21-7674614ce0f3", "value": "T176463345F683C4B0E8B600F9456687B15A7ABD318369D4F3AF907C2E9E703D1D632A4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181682, "uuid": "d6e80e44-3c3f-4252-bfd5-28078ecb8085", "value": "1ff847646487d56f85778df99ff3728a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181682, "uuid": "b8a23715-83d4-4534-9dc3-6c8fb5ae42ff", "value": "98304:O06FOznLo0+Dd6uxc1XsVXsRGPyYY+o1Eol+7qB9owP6IL4X9+wczwSFaFyFQjle:O3F6n80W6uG18V8RzYtoU76P6w69K8sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687181682, "uuid": "799b5461-f288-4c8c-b0a7-2e0cfc4fb827", "value": 5785067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687181682, "uuid": "cfff0a35-d7b8-434d-9ae8-00a72f4905a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181682, "uuid": "e3878ef0-d23e-473a-9f41-5c6db0c6f6b1", "value": "rave.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24157587-0e91-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687172703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172703, "uuid": "f1306740-5665-458b-97d1-dcc3d058dafd", "comment": "Malware payload (AgentTesla)", "value": "2111c777182728b1971a7b7224d878a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172703, "uuid": "87a9b74d-7ac9-4bf7-8b7c-190fa3ff3b5c", "comment": "Malware payload (AgentTesla)", "value": "dc7e7bebe05b13db9c9fb573a54be50d857a8f0a8b25ea1ce17185e2d0f43685", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172703, "uuid": "46fd4562-e94a-4c63-9956-d0571da941b8", "comment": "Malware payload (AgentTesla)", "value": "910fea0019e923a76b09015c670922d4ab2cc819", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687172703, "uuid": "0bae2763-2a12-4a57-a1b3-d069e56ec5ac", "comment": "Malware payload (AgentTesla)", "value": "5e86550a6d1f40138556817626c82c861e5b4144f8e96c14d8f59df4851ce205d6cbdd650d1032bea153d9251922b937", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172703, "uuid": "74f03b7c-59e0-4cd2-b147-a8b01144eb06", "value": "T19D73F50173EE0688F1F32E9C567A61601F6FBA55993AC29C097C690D4BF3E40C9A5B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172703, "uuid": "a702b28f-9cea-49be-936f-bc9feab380ab", "value": "1536:44b5X/AkV+4VPJv69u6uRSqFBeWpfnNz4b5X/AkV+4VPJv69u6uRSqFBeWpg:44b5PAkV+4VBi9u6uRSqFBeWpfnNz4b2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687172703, "uuid": "e6ec8cc1-b2fa-4f52-ac9a-84ef91374196", "value": 80398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687172703, "uuid": "12df471b-56a7-4a21-97eb-155e2776f314", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687172703, "uuid": "997469f4-7191-4c14-8244-004d2f6686e6", "value": "EIK SENG MACHINERY SDN BHD .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677c74be-0eb5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1687188278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188278, "uuid": "15225dfc-8cda-4601-87f1-fc0bf7721a8f", "comment": "Malware payload (AZORult)", "value": "cebbdf221c2872ef01f9d7e62beb0d96", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188278, "uuid": "d9f42b78-90e7-43e7-830a-e5149cd54d2e", "comment": "Malware payload (AZORult)", "value": "dce840b2af6d70ebc65a7a7551bc7179453036ae2fc9f0065d2d24ba982c777c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188278, "uuid": "9f40b490-df85-4c9d-98f3-dc4ee80cb4d0", "comment": "Malware payload (AZORult)", "value": "33010e2271ef7f9e8d1074b689798df78c092e43", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188278, "uuid": "ea3728ce-2c8b-4940-9359-e0a2d493967e", "comment": "Malware payload (AZORult)", "value": "2b02ee0504dfd91d6a5a6a6956fb654f89d0e79cc138e95bda634322c5a034176dd270c8b6f8f6e06257d02485cfd030", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188278, "uuid": "7e0d8655-7be3-460b-bfd2-dfc48ff6f211", "value": "T1CCE423802024C07BDB608DB2BDB643BE5F9DFDA631E1D66E37744E8EEC706169149368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188278, "uuid": "23a2dc34-7034-4ca9-aa04-f103acc28f4b", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188278, "uuid": "439fa964-6f5c-47e8-9029-96f83610b598", "value": "12288:gMwR1ijqO9qJOOGEguNSkJ4XqfeW0eThjO/OZV0nUZwxojccQIph6V5Ss0470/UP:gMwR1QHmguNSM46eWM/K0nUSBgjs0c0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687188278, "uuid": "39e59c78-b708-4fe8-a4d9-926dd4d8b43b", "value": 721926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687188278, "uuid": "d4197ee1-21cf-4d51-a2ac-10e0a6c351d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188278, "uuid": "4cc189fd-52c3-41b9-9da2-274cd38a4600", "value": "PO_H.nut#099873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a514bc5-0e8d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687171022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171022, "uuid": "a9fcf717-d8e9-497a-8c4d-645df8fa51be", "comment": "Malware payload (Mirai)", "value": "6a23a4918d87d8d7e3f3f1b1ecb187f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171022, "uuid": "ed329856-ffb4-4291-b1bb-673390317968", "comment": "Malware payload (Mirai)", "value": "dd596589b76f1d204f1d7d46effad00b5f0120ec809cf0a4a76405f5a16c6703", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171022, "uuid": "98fb9a70-3e6a-43c7-8f82-5b81d041f426", "comment": "Malware payload (Mirai)", "value": "e33bb774ffbe4fe58358377c782599084fab2afe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171022, "uuid": "d5c01510-ff2d-4d83-b9b1-acdb4df33df1", "comment": "Malware payload (Mirai)", "value": "4f5451a74c3c5fa4aa47378b27a87932eacd3421e265baa0602b5f51b8b9b9d03745a68658a0d0d76034e6252fc2ee6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171022, "uuid": "78604a3d-15a7-48d3-9e09-86600ce0ecf3", "value": "T153E2F1116A1AC47EEB30C471E4F6458777652BBCA9FEB0B64463060D9CC2A4193F1ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171022, "uuid": "a2891b93-b795-455b-9a67-b8a1e35e66ca", "value": "768:wEKkUgXAnURCr6HmDFStmYtBRrM9q3UELda:IkEn7uHEemorVLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687171022, "uuid": "b31c8d8a-1804-4f0b-a5d8-00778f5722aa", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687171022, "uuid": "961e7dac-21f3-479a-9d50-5e0083817d05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171022, "uuid": "8345225f-c89e-4964-9dd5-e3b1415a79fb", "value": "6a23a4918d87d8d7e3f3f1b1ecb187f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef72851-0eb1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687186519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186519, "uuid": "b07e9f00-8a9a-4388-b0fc-5f58543e2bea", "comment": "Malware payload (AgentTesla)", "value": "ef6f08a0cb8dfc3bd4a7846ddd55ccef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186519, "uuid": "423a0c55-937a-4d1e-8278-bcf259a021fb", "comment": "Malware payload (AgentTesla)", "value": "ddde47cccacd1004e6fea80b5f6914f9b6e4601c7d0a09bd0334a4533a04c847", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186519, "uuid": "85a8ba2d-c018-456c-a5b5-35b82f2ef9a7", "comment": "Malware payload (AgentTesla)", "value": "bbc3d256229f849eebd63a9b81133ca03a051421", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687186519, "uuid": "541282ef-b409-4585-a327-a71f7d58bddb", "comment": "Malware payload (AgentTesla)", "value": "655b153d7f2ca5ab34ebadb4a56ba6f8692ed6ac5e44375cdc6e3a42843b26588987802222bfc6e8ee0fa21a1d775383", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186519, "uuid": "112a2be9-b258-4a0c-969b-5cb4fe6bcbaa", "value": "T143F4121C4AE8921FE56B5BB8DB55F7B91B2EDA847633D32B1DA0B0CB6D11B104B01336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186519, "uuid": "90968ce6-03af-46ed-881d-27803254597c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186519, "uuid": "9a02b6dd-c0f1-4a5e-8318-424e7b55f877", "value": "12288:8cJhzGwmnphaJ7UO/QjZxVTK8g3O2xWaUC5r+E139ftYq7J3At5iHOq+ZQn:8Kz2O7bYx5K8g3O2oaj5r+039lYqtm8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687186519, "uuid": "a152f645-cc43-441a-ad97-89c857f4473e", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687186519, "uuid": "13b43306-f94a-4e7a-b7a2-02a3acbf6562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687186519, "uuid": "4b0ad2fd-035a-4e94-b856-e5dc4c42f6ff", "value": "RFQ#00987.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc1c225-0e8d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687171216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171216, "uuid": "b730dd45-6bc9-44b4-98af-4dbd715749ba", "comment": "Malware payload (RedLineStealer)", "value": "e88227a7e2d2478753723d404e3d4169", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171216, "uuid": "629a94f9-c729-4b5f-a700-23531b8affa7", "comment": "Malware payload (RedLineStealer)", "value": "ddeb3ad3b0976f33570793a6393c483b482fa0625b3ee8d0f79ab5d2227f44d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171216, "uuid": "39e94c83-3ee1-4179-828f-c768bfe6fc19", "comment": "Malware payload (RedLineStealer)", "value": "a14d9af59aedde93e8b74a98cc6615c476f62c0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171216, "uuid": "764a7290-f41f-4ffc-bf08-6b219448d6a9", "comment": "Malware payload (RedLineStealer)", "value": "b9193435274c462125d20aac6ef705c3affda2ad2a10808a26d041f6bfb9c310a0530db0b3234705a7f922b6d87e288b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171216, "uuid": "e141ccf8-a9af-4fe4-81e4-62148ccf18c3", "value": "T116D41252A6E48573D8F557B018FB13A30B3ABDA06C74032F2686A95B0DF31D4997633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171216, "uuid": "219740f6-5df2-4a5c-afbe-e468fa1d1e1e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171216, "uuid": "e953f800-e888-4901-ab09-2967ccb70e8e", "value": "12288:+MrJy90260lOJVG/sriWqV7xUBlmCzOhLf3Zbll/6N:/y76tJVusrqtxUBlmCzcbl8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687171216, "uuid": "ff3f4b40-e3d7-4bea-b984-ad155869c5cb", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687171216, "uuid": "e9aef576-5fc0-4edd-8c97-aaed6f4854c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171216, "uuid": "315c8325-5ba3-4df6-8d27-7f7a50c7c5b3", "value": "e88227a7e2d2478753723d404e3d4169.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653840dd-0e51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687145324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145324, "uuid": "f942b0a1-dea0-4e77-b23b-29eaec385c35", "comment": "Malware payload (Gafgyt)", "value": "311239d5806811f61fd188d352fd21e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145324, "uuid": "dbb684aa-0a7a-4b96-9ff6-af0413a5d0a4", "comment": "Malware payload (Gafgyt)", "value": "df16fcbaee42da8f3c25be43cf4f6992bbdd8219cec5a1273052029a0ff2fbfe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145324, "uuid": "732eec2f-a5d5-41bc-8c56-92aeaede3b07", "comment": "Malware payload (Gafgyt)", "value": "ad227526b4c910e3cef86a7c5d48a10d7c7bae06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145324, "uuid": "c31e83ce-9d07-40bb-8942-316c3af8909a", "comment": "Malware payload (Gafgyt)", "value": "04cfdcec7a82b6dd3f70fe021261eb0f156058c93680ec29a792a6235c2e96a4f849aeb42006a68cf0b5b5db60dfe6b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145324, "uuid": "cdfb16c0-7649-4f76-969c-440d10a997b9", "value": "T1CAD31905D550471BC2D227BAFB9A425E37232FA893DB33269A347BB41FE179D1E39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145324, "uuid": "83a9e0df-411d-46e5-964b-0c78d7ecea3d", "value": "3072:CZpIjQMuCJUbuDEa/SeW91xBLhHFbfOyW5nF6Mmh3QOEw6vNu:CZ6ZouAa6ZphHFbVMmh3QOEw6vNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687145324, "uuid": "6d7790d5-2383-4eb7-9166-e253fb4c6c7c", "value": 135787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687145324, "uuid": "5298f191-464b-438e-ad7e-255230c85eef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145324, "uuid": "cefa7a61-46a6-42ce-83c0-19e84245ca16", "value": "311239d5806811f61fd188d352fd21e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39392f34-0e7d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687164148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164148, "uuid": "6d8c1db1-0b94-4005-80a2-c917fbc4174d", "comment": "Malware payload (Mirai)", "value": "b5f193c19d188624e8830f9206e13ab0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164148, "uuid": "c21f726c-ae44-4608-a33b-7f630e1d0a98", "comment": "Malware payload (Mirai)", "value": "e0375bd5fbf4961bcdef7262adb2fe5374f72ec042a57a4010512a065af4d525", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164148, "uuid": "57b683af-edc6-4355-be0d-23221e62e873", "comment": "Malware payload (Mirai)", "value": "88dbda932a66500a21f10a2144240185bee77ee2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164148, "uuid": "5c2e0b78-3cfb-4757-8080-f3106cbea7dd", "comment": "Malware payload (Mirai)", "value": "e7e9a71edf201cb63e258188b0b2cc3c82b3de47448e026836729852839459c0688c157fe0e3a1ea0b5205e7c4ff5312", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164148, "uuid": "bd852cb3-1a2e-44d4-9408-f8d6b2a8c963", "value": "T107A37CC5F683E4F5E85605F1217BAB36C733E439502AEB42E3689D36EC61910E61B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164148, "uuid": "a39cb009-67cb-4aa5-b7e5-6cecd670c131", "value": "1536:pK7p5s5v+gWlCS9fDosKzvRSv3U4zPVjE+X2rNcoSpdCa1:kp5sEXUS9fk3NSv3USPeOj1bj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687164148, "uuid": "2871652f-9191-42ee-be98-6ce936606c46", "value": 100364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687164148, "uuid": "9c736df6-f21b-4fa1-b036-ae40f233b449", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164148, "uuid": "2d8c5596-7e98-4fad-ad9b-a3c3539d3cad", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4325fb80-0ec0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (N-W0rm)", "timestamp": 1687192941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192941, "uuid": "4bff63a2-a65a-4e9f-891f-c011c52788a5", "comment": "Malware payload (N-W0rm)", "value": "e3736535bbd23e76596d374e032d943e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192941, "uuid": "e7d2cefa-acea-461c-8d9f-2472de196e28", "comment": "Malware payload (N-W0rm)", "value": "e08322d29f7748579a28904268dc53b66ac3158da4c08671cb0f2a54160b15c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192941, "uuid": "bfbd0f3a-a0a5-4b69-b3da-e8e66b7a4f01", "comment": "Malware payload (N-W0rm)", "value": "ce64040f538a9fab12272102dbd9961ddb91c6d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687192941, "uuid": "3af18a46-4c6a-40df-880a-29df8d785d96", "comment": "Malware payload (N-W0rm)", "value": "efd568ab47a8e7b43456b289a73941ad9826f34aac22415b9fdfdfabaa089c88418518caabfc73bc3973bf1a86e1cdc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192941, "uuid": "c43d8417-42af-44b0-be75-5d5b02a9951a", "value": "T179D4232178863154EE1C46BF945E470920D3AB32F5057BA7E80B4253A3574BA21EAFFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192941, "uuid": "840f89cd-c657-4b80-9b4b-63ab050fdd3a", "value": "12288:Pgw2QkCWe6IHF9Yu8qsrmcAynlDH/Y7pKn2zSbX2TRG67dyMvAM:r2bZd2FGqEuUDHgpK2e768SN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687192941, "uuid": "7b791191-4337-4426-b8f8-274f9cb27bf0", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687192941, "uuid": "17db8222-bee7-4154-8e38-6013fe1018bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687192941, "uuid": "7acf45e9-5027-403d-84e0-1adbc748dcf4", "value": "Uzlrz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617d73a3-0e73-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687159921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159921, "uuid": "dd0305b9-0466-4683-a53a-4edc2d29cc47", "comment": "Malware payload (AgentTesla)", "value": "ff779cf4cc024a3e73b963b2564ba782", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159921, "uuid": "3afd4c65-ddf7-4bb2-8e4f-14f8af858fc6", "comment": "Malware payload (AgentTesla)", "value": "e08362c906779eddf159e006cbe7af9977f55c26f4940ce0d0f5a7eff541416f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159921, "uuid": "8118de53-4705-4b06-b03d-a137def6e28a", "comment": "Malware payload (AgentTesla)", "value": "de9941428d4d020a4352c47e94926861dbb32c95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159921, "uuid": "fb1d1586-d165-4229-935d-7a8a684ab0e2", "comment": "Malware payload (AgentTesla)", "value": "f1f0010baf52c4dc9fb572cc5c6fa531bbea53aa9ec6de9e60c66901cc7a4b10fb482861947fb94c0e840c0912a0e340", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159921, "uuid": "45b31442-57b0-4dd0-a4d9-7ed20114852f", "value": "T1A2047320BA47CC7AFA1146303795F16202426D637D59CE662EC3B20E07F7B506DB9D9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159921, "uuid": "f9d81337-d745-490a-9c94-aa47f952e644", "value": "3072:lXkZ+RwPONXoRjDhIcp0fDlaGGx+cL26nABXN236TttisxSbOGvgqbQGfVE3:l0Z+RwPONXoRjDhIcp0fDlavx+W26nA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687159921, "uuid": "5eb001d6-1bcb-49c0-ba1a-bc76b5b0bde4", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687159921, "uuid": "de27780a-2da1-48df-a071-24290a42eac3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159921, "uuid": "fae3e857-020a-44f4-af6f-e3ed9efbe583", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.Gen.18775.15180", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707f16e0-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1687174120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174120, "uuid": "38969c4c-1e2a-48dc-b08e-726da4cd91d1", "comment": "Malware payload (Smoke Loader)", "value": "9769c181ecef69544bbb2f974b8c0e10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174120, "uuid": "9834da07-98d9-4d5e-bccc-91751c8a8720", "comment": "Malware payload (Smoke Loader)", "value": "e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174120, "uuid": "cb6befa6-1cfd-4c14-b931-3b487c652a9e", "comment": "Malware payload (Smoke Loader)", "value": "5d0f447f4ccc89d7d79c0565372195240cdfa25f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174120, "uuid": "aeb483f7-dd1f-4e5e-9f14-853b47276de7", "comment": "Malware payload (Smoke Loader)", "value": "395ed78560ae5e36dbd4c0540132f1a1b69b8a2b2c1ede819d1ccf9dd0b2b5e8cf4b2ab0cef5b641408e3086f32d7511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174120, "uuid": "8963f9ab-805a-41c2-abd3-653d14cca280", "value": "T16F544A03D2E17C61ED26CB768E2FC6E87B1EF5504F49BBA722089A2F05B11B2D173251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174120, "uuid": "b4a9fae6-ee2a-4b2c-a8ac-fdf05cc7e0c1", "value": "493c0587242c6f974644a1959b9764db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174120, "uuid": "6c6982e4-70bd-457f-ad4a-fb58546d2f92", "value": "3072:Z5SXIMALRKEttgCWAbi1D1fJmxIV0BN3omE9MA5yXsztcJe9:GIMpEtCCWAbiBRmE9o6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174120, "uuid": "49fafec2-d5e1-4c50-88a2-a83605855b52", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174120, "uuid": "d1af51e5-3817-47d3-bca2-c7baef430fe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174120, "uuid": "4f858aed-e5e1-4b54-aeb8-209c4642e4c9", "value": "9769c181ecef69544bbb2f974b8c0e10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9099a9b8-0ef3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687214976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687214976, "uuid": "7665d59a-b51c-4147-a388-c3c5eda9d58f", "comment": "Malware payload", "value": "9c06df703104a82775b2f1b60cd345c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687214976, "uuid": "690ac7fa-e06c-4255-862d-bc4b2a80f9af", "comment": "Malware payload", "value": "e21c17ca8f06ee6bb4043d50be7474a92daf89d6ad5b3126d634ea1a23900533", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687214976, "uuid": "1e205b2a-91fd-4d83-b29d-931b5b7287c9", "comment": "Malware payload", "value": "4f85efb6d969bf140fc35c4e12f271493ecd0158", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687214976, "uuid": "2f81e510-33f5-4f3f-b53a-35ea249a6d49", "comment": "Malware payload", "value": "63eeb51a5edbaff8041af855007b26f56907bb0866fb0d3c6665f0bd9c6634e3c446cb5ecb15e2cb347a22f568531710", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687214976, "uuid": "769f938f-c725-4bd4-b010-fd8c987a7819", "value": "T1A1656D22F2C2847FC4723A7C9C5BB699D8157D102E28A84A7FE45E8C0E397433D699D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687214976, "uuid": "dd0d952a-7cc3-4e6a-aa5e-241a13389693", "value": "78c9e2c31285b4ac9148c2d16bffeed7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687214976, "uuid": "df38d9f4-f3d0-42bf-965a-e77fa5741716", "value": "24576:yPmGZnLfQgqiWuvffICxlBs0Smags9ViRlv/lr/5bshp:mP1qfaBsFmNs9+hbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687214976, "uuid": "9be2305a-3b09-43d5-9300-ff1d0fd4d983", "value": 1431040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687214976, "uuid": "5a5252aa-9dab-41f2-82a4-2d0a463f561b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687214976, "uuid": "50d251db-52fe-4e94-8415-cac2a3548a14", "value": "vp2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685bc1a5-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687168093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168093, "uuid": "1714d69b-f940-472d-b0b6-5483c9e38016", "comment": "Malware payload (RedLineStealer)", "value": "01138de14bcb582cf4130a3642290d03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168093, "uuid": "58d7c425-bc95-473e-8a5c-f248786a9f2c", "comment": "Malware payload (RedLineStealer)", "value": "e3706009e5cb3bfa09a2f066a10ac37241f13316755cecccc111604e192d6543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168093, "uuid": "c717bcad-8b42-4475-a29a-c512caa8b22b", "comment": "Malware payload (RedLineStealer)", "value": "c00b8c959fcffc6efb66b14795c19f1beac97bb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168093, "uuid": "35263554-741b-46e8-b92e-8fb3bc11e874", "comment": "Malware payload (RedLineStealer)", "value": "857ffcd4f2781c8d985645b14ce1b2ebbbe52f8455105602721035c6fa4d2c2dcc927dc0248b479eb67e9201189a5540", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168093, "uuid": "64c38797-3959-43c7-8ad8-519e5eb165d9", "value": "T147C41253F6F89036DCB92B702CF616C306317DA15938836B3799A84D1DB36D5A93132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168093, "uuid": "27f203fd-b93e-45a7-b99c-abe0e54653e5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168093, "uuid": "07be237e-7135-4fed-9c96-9e28be4fb39d", "value": "12288:BMr6y90R3S1XezCOWsSdz8LJ9zAARsFLT0tqjYBQe6XRGDQlkmumD3Qd:ryCC3dYLTAARsFLT0oOQrXgDrA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168093, "uuid": "adbb5d70-c635-4732-ae93-c653da2e6a0c", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168093, "uuid": "eff7dee6-d143-43fb-88dc-956cf765c11f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168093, "uuid": "e14eee6e-f75f-4182-9233-7eac450afda3", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aecffa4-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165440, "uuid": "91211a14-fc71-449a-88d3-8d84060add63", "comment": "Malware payload (Mirai)", "value": "a35142854909e8cb24244ebadf01463a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165440, "uuid": "74f57eac-508d-4f7d-aeb8-f384a2d17cf1", "comment": "Malware payload (Mirai)", "value": "e3d466967760f681b342fef1ee6bb4293cdc4779e1e7f9f399e4713dcded187d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165440, "uuid": "e59aa079-7176-4891-bc7d-316f852cfd17", "comment": "Malware payload (Mirai)", "value": "5f9102d5fb7b23d3c29aeafdf190a9438533bd18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165440, "uuid": "da7fdd67-5b1e-424e-a091-c3ef22a96bb4", "comment": "Malware payload (Mirai)", "value": "e0158e05ad4fb410d3d7085dcaed90522980dcd70ce33c6de51cae31b82525feb3ee3c82abdd9ebe80570345c60d78bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165440, "uuid": "383e4475-6188-4133-9cbc-61086fc08201", "value": "T11C137D7BE46E5E64D0460230B4649E341F13F6C493536EFB1DAA82A15487AECF905FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165440, "uuid": "1a0a5909-6766-49ab-9d18-01b0940dd298", "value": "768:GaRH4ge4hYyFDinQT3yMILr7Cade17C3o9az18C/wwZ:GaRYghh/FmnQyMiSadw7f9W8C/xZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165440, "uuid": "5ab1f063-7f80-4384-b1ab-3e496da75b5f", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165440, "uuid": "9fc3b466-fac7-4cca-9472-583201e0d186", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165440, "uuid": "3d15b628-2034-4fd0-a84a-e593b948bc6b", "value": "a35142854909e8cb24244ebadf01463a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db5cf22-0e8a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687169713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687169713, "uuid": "5efec6af-544a-46cf-a586-289238807904", "comment": "Malware payload (RedLineStealer)", "value": "6b66c265183820fee2d43b61b4eb67ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687169713, "uuid": "eda8ab6a-4246-4b5b-a829-eec2256f66d1", "comment": "Malware payload (RedLineStealer)", "value": "e3f6dfc1fe7f7174216c3e06c60b7443e60cc52d6f50d42451ef7177388b7726", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687169713, "uuid": "78ed3b5f-c000-436e-800d-2135d4575da0", "comment": "Malware payload (RedLineStealer)", "value": "ae2bd8c030d1bab1e6db6920e0af399026c7c087", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687169713, "uuid": "f82d0d5d-479a-4bd0-8efc-94c74e3fe8d4", "comment": "Malware payload (RedLineStealer)", "value": "b120b97d0c37d54843ac2dcffbd219431b283d85b71ad04fa99f0b769623139171d6c42313dbfb5db48436e716ba32a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687169713, "uuid": "b8419b8b-b619-4feb-82d2-b577dcfe0591", "value": "T19E051206A7DC8532D8B437B01CF647C71A327C225EB8536B2786A84F1D726D4B93672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687169713, "uuid": "07f88063-c6e4-4e8e-b36b-d990683ea960", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687169713, "uuid": "b4421669-48ae-4d87-9e9b-f83e70c9f481", "value": "12288:JMrCy90eqkwFcTUC2BWYyH9Ptz/yAjGmlhu/xxbOJdiPO5s7izyJVh0hTCa98ikE:PypIf0YAlysn+xbq+RDjhEX9JkHEshu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687169713, "uuid": "d69b64e9-9056-44f0-8fab-50914d5c9c77", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687169713, "uuid": "cfd306bf-2f09-48f2-9cdf-f85292b58e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687169713, "uuid": "cd944cbc-dd37-4e70-b027-d53628869fae", "value": "6b66c265183820fee2d43b61b4eb67ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44a80f5-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687160570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160570, "uuid": "f5ebd9e9-74f2-44db-9c61-2c0a1dba4ea6", "comment": "Malware payload (GuLoader)", "value": "129b5026038ff04d33a449078f72b592", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160570, "uuid": "ae42aad4-39a2-40ed-bd85-71491bf93554", "comment": "Malware payload (GuLoader)", "value": "e44b953229fc6db4e44c04c280d0f00c67cdd18c3b5e2a7e11863b6fca1a9e04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160570, "uuid": "a265c5de-3bd1-4e2e-b6f9-409c8a8990ef", "comment": "Malware payload (GuLoader)", "value": "7af76c5ce3e71570cb6af96fbc16e025a5d34748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160570, "uuid": "8b3c9183-a72c-4aa2-b798-8721dd4bc527", "comment": "Malware payload (GuLoader)", "value": "3be2d332a483e1aa00c11c442c6150ba4f8003cf759ff62dac9ad463bd2ed87a1c04566c421390c05120da9f4c6c2ea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160570, "uuid": "69c6f24b-95e8-4c1a-9ed5-048ab3306cbe", "value": "T16F74012631119C62D4554A3289FECAB72FA2ACC582B51B4363F57F7F7D1A24C9E09332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160570, "uuid": "199d8dd7-76d3-4081-a7a4-12cee32a8dad", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160570, "uuid": "c37ec655-fd5a-424f-af54-06d79960b06d", "value": "6144:sR+xX//591DMQVHGy1qYq9fSVk2krug+u7oNAm4siLRMGjCvmn1u4tMt:0w/L5GGq5+Fkruvu7AAm4siLTjEmn5tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160570, "uuid": "1c2ca89b-d7a6-4c75-95a9-bfbe2f45d090", "value": 361904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160570, "uuid": "3799d78e-a920-4869-8e6f-4787489f4a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160570, "uuid": "adb5d4c8-1a53-4861-ba92-1d67ca784299", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b64f7f3-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165414, "uuid": "f4868f88-2d8b-44a4-bbb7-97d71732d0dc", "comment": "Malware payload (Mirai)", "value": "f84949dce87e6dbfdc241a146b891d2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165414, "uuid": "8c0784d7-4fee-400e-ab81-a678b6af044f", "comment": "Malware payload (Mirai)", "value": "e4a113457322a74e262a09800d1e6ee8ab79ce5a89e3d784f930ccb856f76198", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165414, "uuid": "3d73b376-2bd0-453b-82b3-703375424e7b", "comment": "Malware payload (Mirai)", "value": "ac7a3d412add0889235d48c78e5b473377d1fc7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165414, "uuid": "0d2b2014-7ef2-4e83-b16f-1e5ba21d18d8", "comment": "Malware payload (Mirai)", "value": "4e4cfb3803455cc3bc398765e2d0a4298eca6108badb851e5b54cf63b7f05b83c7eedd88740548767fa99819d31de84f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165414, "uuid": "2149d23f-dab0-4af6-b6cc-9755072439f9", "value": "T133C2D0F546CE1DA1CA7414B196F4D6C3BFE60B2DF0FEBC42058586E83A5241A29E84CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165414, "uuid": "f7aa1bb9-d2af-4a82-8a49-6de1eea8507f", "value": "384:ESt/koxisa34beDtZwzAXgfQNh7ZCQOufz0XMY2dnxjbE/uKUMqhhymdGUop5hA:ESsoTAZPkQNNR/z0XaxquKUMss3UozC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165414, "uuid": "8578f33b-c0d5-4c73-9251-115f7da952ed", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165414, "uuid": "a5a709bb-436d-43b3-9ddd-9bfd4d3b2bbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165414, "uuid": "9ae09cda-bc89-4c9f-a211-a4ee017b3ec4", "value": "f84949dce87e6dbfdc241a146b891d2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2897fd2b-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165409, "uuid": "9c101886-ef63-4b7d-84e4-081627b5d2ff", "comment": "Malware payload (Mirai)", "value": "cd1e46ef29e80cd8d85640d9f9022902", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165409, "uuid": "ef60c7fc-98df-4a8a-a23e-57f4c7af1e0c", "comment": "Malware payload (Mirai)", "value": "e69b57102b065d0dc9adff9e9d0d3020396228911e9ad683e09aa1b4c322a701", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165409, "uuid": "5632e7e7-1697-4a06-84b9-8060b0056344", "comment": "Malware payload (Mirai)", "value": "d1364270ada481443a85b3201f162fd316d450d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165409, "uuid": "3772196a-1da8-4f9b-9816-96fbe33d7de0", "comment": "Malware payload (Mirai)", "value": "f76443a9930998f5a0c71e73220fb03307a875b48f62ee3f620fe63dfe131703ec977e07eea0e6e9164769d610224755", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165409, "uuid": "cd1200b6-5a19-4ac6-91c4-d7c16f4f91cb", "value": "T159B2D1E0AEA9A8B1C1B0183FD9AE448633151FF9F547F01BAC130938F59E1547AB5DC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165409, "uuid": "ee25149d-e20f-4945-bbc0-81d1ef027c36", "value": "384:fp2axgS17PK9L8gaQUTb1pHfgT7yRexyhrcOLbzoIi6D9Lya6mdGU5EotAoE:oaxpcn9UTDHMx1OLl3D92a63UfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165409, "uuid": "f33f909b-139a-4dc5-895b-1b15f80c5d77", "value": 23824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165409, "uuid": "afc5a790-5e98-46fc-ac7c-8f681a2ab78d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165409, "uuid": "2bd83a5f-5360-4039-acf7-7958863f99b8", "value": "cd1e46ef29e80cd8d85640d9f9022902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c757acd8-0e72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1687159662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159662, "uuid": "bcee4bda-675f-4c45-9258-67634e2c1f88", "comment": "Malware payload (Smoke Loader)", "value": "f184e823c303d399c0dda9de40c7f45b", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159662, "uuid": "fa716130-ff32-483b-a638-7a44c86f5c31", "comment": "Malware payload (Smoke Loader)", "value": "e6d9ca3b117cad95d2877702eb25790266da5c0d0424146f61d80d35efdc9e25", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159662, "uuid": "194a3f06-63f6-417f-a401-82a6ded75e43", "comment": "Malware payload (Smoke Loader)", "value": "69d3911ff6ed2a5e329b5cd88440dc6e33d9b382", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159662, "uuid": "d844a005-01a6-479d-8f82-6579934dbbe1", "comment": "Malware payload (Smoke Loader)", "value": "4df087974f119a1af5092488631324f9948d072c437ff2f63db7285b10229f632ac4503e80c63272fac8af674f5755e9", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159662, "uuid": "a1d0dfd7-05fe-4ded-b4a6-dbe290ca615c", "value": "T1FAB2F6565B8C4C61E36AE8BB835D900E19BCF33534C255C5BDACE6703B6D10E0B6B6B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159662, "uuid": "e45305d4-4b0a-401a-aaef-f20b6e3321a7", "value": "384:X29UektoVddFW8F6aXh7pxO9fivyVf+NufEt39WxCzeesSIaFE06+d5au3RN:mOUdphMDf+cfG1aRSA+zau3RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687159662, "uuid": "68263c6d-e1af-42f2-bac1-99921b9b79d1", "value": 24261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687159662, "uuid": "6029a66c-7c2f-402d-9b05-8c7b26bcc81f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159662, "uuid": "00ccb3e5-8dc6-425e-a608-a68aee16907d", "value": "f184e823c303d399c0dda9de40c7f45b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c128777a-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687168242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168242, "uuid": "644b5f5e-4277-47ca-9685-72abd500fd6b", "comment": "Malware payload (Mirai)", "value": "8815014120ea03b03fc3c83fb19eda3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168242, "uuid": "40b0073d-41f8-450f-b938-8082b93ab32b", "comment": "Malware payload (Mirai)", "value": "e6e5116e04f4c1ef639c11e5d60f67d6bd2f548e504f3d9322dc17ee5bba6034", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168242, "uuid": "af66a5f0-e828-4935-978e-17a5fa1fa84e", "comment": "Malware payload (Mirai)", "value": "bd2c2c28aad4380274df81d04bc8185d1f22824d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168242, "uuid": "0fc5215f-8573-492d-b411-9398ecfabe8f", "comment": "Malware payload (Mirai)", "value": "99c0d6d2a4846286cf35899c68992f2dc3a7a8a597f052b23c96ce2b63e8bd5ba3fd46cae806084fc247b7baf74cdb0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168242, "uuid": "52953fd1-8aa3-4447-9ad7-daf62468477a", "value": "T1D053F856F8818A11C5D412BAFE2E118D331757B8E3DF7212DD206F247B8A86F0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168242, "uuid": "b647b610-2b2e-4ec4-95e2-379a0e3b5ec4", "value": "1536:Y0n3Y16wIYs65Ohj7atp+fz3Ixi0KYz1PmJ:4kwg6Ij7at7KYz1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168242, "uuid": "15232717-18c4-4726-9e08-255391e5257e", "value": 63000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168242, "uuid": "ac10342a-2989-4605-add8-dff05764d655", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168242, "uuid": "3d3bed54-0bb7-46ad-8f64-78f8106659a2", "value": "8815014120ea03b03fc3c83fb19eda3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0de761f-0eaa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687183703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183703, "uuid": "6927711e-cb71-4611-bee8-58e8837f26c5", "comment": "Malware payload (Formbook)", "value": "3d0b3162ae0d69259f3d3c9770bc6165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183703, "uuid": "62d115c6-0c68-4442-95e4-52baf912bfe8", "comment": "Malware payload (Formbook)", "value": "e8cb5925478cdb28bba3e7c553ebc3bd1a3e292d83af4c16a8bfd14a7d20b05f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183703, "uuid": "1cd9a331-0911-4b27-a0b0-ede019e24dba", "comment": "Malware payload (Formbook)", "value": "618de1830863b48e3b7623d9e856635a3660ef24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183703, "uuid": "3a737293-de10-4d1c-9988-90470f7f8e41", "comment": "Malware payload (Formbook)", "value": "370ecbac9ff5a8041c950b0a6ea1cc2ddc04573750ad43b7e2e953627c36a6dfc8e28da17a2e36bcb4fefede1eb7e324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183703, "uuid": "0ca305d8-1761-4c37-98f7-0c2e14b4d384", "value": "T1FF35A23E1CBE523795B4D6AACFD5882BF440E1B731226D39A4D353968316D8239C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183703, "uuid": "19dc5cb4-c860-4f3b-8ff5-ed824af3c26b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183703, "uuid": "e5886455-7bd6-4d67-8179-d93c2856139c", "value": "12288:QqrAyZ2guJ7A8z+RJejenfsEvJbi80ccNobK8/Lf/x7GefOVc1TYKe:Qqcl/zWflMccNobKmf/46uK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687183703, "uuid": "71dfd790-11ae-4e7c-892b-3528a286796f", "value": 1118720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687183703, "uuid": "c1cc2643-7a24-4cc2-9ff8-bd057c74afe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183703, "uuid": "dceb0ea0-6dbc-4130-82f2-a10fcd77629d", "value": "PO -93271.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dcb1e2a-0ec8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687196449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196449, "uuid": "2d7c36f3-d7e9-40ad-b985-9562baf6c08c", "comment": "Malware payload (Mirai)", "value": "a736d5848f16082d657f707823e3075c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196449, "uuid": "8fd04298-b24f-4420-ae65-927f8f07e352", "comment": "Malware payload (Mirai)", "value": "e8d4d9b50b6f5aaf49ac3d26252426c381526535f0cdd4b48b02f54e33d7afe0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196449, "uuid": "4d5578dc-8b93-4c2c-9120-26b8e53994e0", "comment": "Malware payload (Mirai)", "value": "ae359361a3b0d108626bba6429979cee3e95f7a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196449, "uuid": "a779a054-fa0c-4b56-95d3-443bb6359e50", "comment": "Malware payload (Mirai)", "value": "edce199e4572faa71151777321d2222f878414e85cd274d694c7de46e70daf78814a97c905fcc1941b3e3b604e2fb233", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196449, "uuid": "4a83f0bc-421b-4712-8227-c1c0b796ed54", "value": "T1E7D34B46FB818B13C4D5177ABAAF41453322E764D3DB330699286FB43F8676E0E27606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196449, "uuid": "6d4d8c9b-212c-4d9e-bdeb-ccbf8188da96", "value": "3072:9mUh2yQOFRDmUwOUPltMCIY5VxUe+yuBYDnM/9b/CmIw1GoiP:IUh2yRt7kltMCIY/xtuBkM/9b/CmIw1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687196449, "uuid": "9d371210-38bd-4446-80cf-6c7bf7453003", "value": 137345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687196449, "uuid": "623f5ec1-51de-4b1c-8098-acc071f43eb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196449, "uuid": "eae3a5e1-51da-42f3-b688-e84418c268e6", "value": "a736d5848f16082d657f707823e3075c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2898272-0e7d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687164406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164406, "uuid": "24c95c3c-90f6-47fd-aad8-ca7d4e341b5f", "comment": "Malware payload (Mirai)", "value": "6a34d89ba6110122bb283d81a7e92939", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164406, "uuid": "175418c4-fd92-4505-b7ef-9666ba50c9c1", "comment": "Malware payload (Mirai)", "value": "e8db617dda0e1dd58e6d5ae14139bcd2ac7ab9ced185698cadc1a7a957f3f87b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164406, "uuid": "2184aee9-24c9-484b-9e39-8545d01d8d7b", "comment": "Malware payload (Mirai)", "value": "051fa520700fe7b1201ca0c21044e5905b7d1836", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164406, "uuid": "8bbaa392-ca1a-477a-9c9d-3bc8ea6ac501", "comment": "Malware payload (Mirai)", "value": "b35cf1d8c518c839b14d392dce2c181e9ec463747e6fd7fb29df4b5601b1b91193ff17b5dd26db2e2efa1c6ad49b4cf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164406, "uuid": "bbbbc772-8c9b-418a-8752-b84a3d9153f4", "value": "T150234BC49643EAF9EC120A7520B7FB335B37F07A115AF987D3659532AC42711A20B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164406, "uuid": "a628d6de-f8f7-4879-9734-e3c896aee140", "value": "768:c8/MjSNW4GBs82WELH9RfizqNwWxPY+RFEwaK3g+ZdG+:c8/MjSNW4GBz3ELdBNwW/RRaK3hZdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687164406, "uuid": "3ad82a63-13f3-49ce-a435-08276ec41566", "value": 46640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687164406, "uuid": "e6d2b1c7-7221-487c-80bf-248e16e8e6e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164406, "uuid": "b16817f6-0dd3-452a-b634-a6ba0b2b8e70", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2d399f-0e7e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687164635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164635, "uuid": "59d2524f-34e6-45aa-879f-d576e0def58a", "comment": "Malware payload (AgentTesla)", "value": "b6b7b91e3094cc27cc44b071a72609d9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164635, "uuid": "dc6ffc8d-3274-4163-a1ce-decc094ac92a", "comment": "Malware payload (AgentTesla)", "value": "e91036cfb270445a58fe407e355ac25e7264b28bb35a13a699a6c6f90f5deedb", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164635, "uuid": "86b4e387-5707-465f-af09-fe896f701b39", "comment": "Malware payload (AgentTesla)", "value": "0836a8b50655281a1e0e49ac8bacd5ba0ed0ae56", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164635, "uuid": "2a700f05-0efd-4031-b1bd-cc0e19bdc19e", "comment": "Malware payload (AgentTesla)", "value": "807f647d2d8eab34bc336416f9c735091fa32f5573ef67fb3a5d0913605a57d58fd43aa8eca342cb630292398031efbe", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164635, "uuid": "ee12253a-a9b3-4b87-8a2e-4c22b8d2e621", "value": "T1D4C433647A3DA16AD4EDB42FA036EB205EDA5320C9163C1C47D338ADF38784F0557BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164635, "uuid": "57d35cc8-e81d-4618-85d3-0bc67902fe03", "value": "12288:1ZYxc6+jkRfeTKFXufwrU+xSro6liUNH4EvU1ZIzIzPtwYKZnpW0:1aq6+XeFXdrU+xSro6lzH4wiZIzS1KZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687164635, "uuid": "6ad52f9b-f291-4dc4-94a4-407c4702f8e4", "value": 592550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687164635, "uuid": "7f899fda-0ef4-414d-9ceb-e27c3bfa332f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164635, "uuid": "51e71413-8076-4600-9688-230694439861", "value": "Requirements Specification_Details_1.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9795e8aa-0e72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Lu0Bot)", "timestamp": 1687159582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159582, "uuid": "ce203cce-44c3-4b7c-b679-43396f6ef5ea", "comment": "Malware payload (Lu0Bot)", "value": "cf740af753979b293bd1dfae50b2e754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159582, "uuid": "fdd5ae2d-543a-4ec1-8b00-36f84272946a", "comment": "Malware payload (Lu0Bot)", "value": "ea596ff0c0802b85cc304447799c91907ae1016283152ba5ba5dc4cb50ca8712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159582, "uuid": "aa12b298-5658-4bf6-be28-bb2eda886bdd", "comment": "Malware payload (Lu0Bot)", "value": "7c75d04c108020cb3f87a93a0f00002224b27314", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159582, "uuid": "0b7d03b1-92a8-4d92-995a-2cd5b44ddb58", "comment": "Malware payload (Lu0Bot)", "value": "90429c12fc1692ea9b80dfa4451527f5d5261a4fcabfa1ea41da852dbd8bcac7da57253f024181ae8507c4db10af0223", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159582, "uuid": "d29de56b-7654-4220-adca-d0c21294c9a2", "value": "T151C5331AA2F910FBCD61133098FF01A716347D926AB56A17254354CF0C73AE07A79BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159582, "uuid": "9c427f25-24ad-4316-91cd-744e1aac3685", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159582, "uuid": "e9960f53-1a6a-4ee3-9e6a-0f89db3add98", "value": "49152:63zJVxwtN9oNSzWmDjfs4DI0gAF9xvCw/snQfbJAz8naQGPtNT:OJVk3DT5g2UQzOz8JOtNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687159582, "uuid": "6fbbb1bf-410c-4e78-a4a4-87bb012c033b", "value": 2649327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687159582, "uuid": "76dae853-45da-4c3c-8a87-37f58607174d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159582, "uuid": "a4e130ed-14cb-4a32-89d1-eba56aa0f350", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013e68ca-0e81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165772, "uuid": "7ce663ab-7dec-4ede-bb9a-f413a37c957d", "comment": "Malware payload (Mirai)", "value": "b81f1a045849e02d6c923e2643be12bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165772, "uuid": "fdc76adf-0046-4e52-83cc-887e6b992aa8", "comment": "Malware payload (Mirai)", "value": "eb143186410a79e876cb2e4a09eadba530e7b7ffb893dccf6b6e9a5febfabb46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165772, "uuid": "49fa553b-b30e-4319-be66-5ed95a181d85", "comment": "Malware payload (Mirai)", "value": "42e13f5878fb288b29c3ca263ab1841ad9a18b6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165772, "uuid": "856017e4-1f13-484b-867b-e85a96c6d083", "comment": "Malware payload (Mirai)", "value": "33773164afe034a514e3f5221621e6ab30c2b35fd14df407ad7fbdfa0ac86e5aa58a4c1483129dfa720271951b016ff8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165772, "uuid": "4eabe105-7723-4e8b-a543-7f63ce3f38cd", "value": "T14614C70AAB610FBBDCAFDE3702E9071635CCA51722A43B353674D528F54A54B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165772, "uuid": "3a68d227-d77d-49b9-86a6-28d4c49a2117", "value": "1536:Vmcg+75vBsaxKQx1+A5RbSDTLs1gHhILk9hdATF/OQK+4DqXhHVU1jAWc/8Z+jJ2:VmcBd2EKk+QCh9gZ/6+nv5WcdJ+5olS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165772, "uuid": "7dfc29e1-90ef-4e49-9a5f-5f6115e95d8a", "value": 190340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165772, "uuid": "568ca230-923d-4fcc-8031-40289b17b44e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165772, "uuid": "36156f97-2b19-42ee-9e97-2c00cd077f18", "value": "b81f1a045849e02d6c923e2643be12bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ff27ad-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165452, "uuid": "55c377a0-e402-4c6b-bc02-e40361091c9d", "comment": "Malware payload (Mirai)", "value": "c8002e43e3e5801c240bad217545eedf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165452, "uuid": "4361b15a-a6d2-4f05-be79-28d27ad5aa71", "comment": "Malware payload (Mirai)", "value": "eb70ac3c964f12a71ae4b692beeca79ea343e71d6f9a7338d7234f75000a0644", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165452, "uuid": "1c2dca86-dc01-44cb-8cc8-3ac15205c88d", "comment": "Malware payload (Mirai)", "value": "aaf121362710130a29c216e91e90d7cf52fe3aa7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165452, "uuid": "153c4471-6567-497b-b77e-c4f31e14ae94", "comment": "Malware payload (Mirai)", "value": "6f340ec295e9d0d510c3237b5882f1d0606cf9428486aabfbd88151ce0e7dc343f1af03b9229995143128d36b75fe6fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165452, "uuid": "fb31f546-4def-4f06-9faf-32502cce183b", "value": "T173637E36E02ABAC4C0550538F8798EB41F53F2C583631EB71AD946B2944B9F8F909BF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165452, "uuid": "67746942-1e9f-4bc1-8166-319f9c82c90f", "value": "1536:ga/xwtqIN5Lcah74VeEpFxZsrLC1oQGo3o:gOMLca94AIxZsf7QGo3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165452, "uuid": "3966c05c-6953-4869-9400-5cd721095b8a", "value": 67032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165452, "uuid": "f60f446c-849e-45d0-a84c-ee94b910b717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165452, "uuid": "3342b79b-1c0a-435f-a956-e1e810a7a47a", "value": "c8002e43e3e5801c240bad217545eedf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da8df39-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687167994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167994, "uuid": "8dc65f51-2397-464a-9649-efd98acf71bf", "comment": "Malware payload", "value": "8cc9bc5c1649e5bbedafdb61d57e675a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167994, "uuid": "616cc08b-80d4-4d00-a471-1dda2d8281f1", "comment": "Malware payload", "value": "ebef93f0b6843e463bd2affb0b133750147501f5635aaabc4a8e678aeedb8b34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167994, "uuid": "98d2ec8c-2c2b-44fa-9338-1dc7826fdb85", "comment": "Malware payload", "value": "cb3220ae9757ce3e078b623341ab97827d9e0745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687167994, "uuid": "b0341b5e-0627-44ea-98ef-747bb42ba392", "comment": "Malware payload", "value": "64c149707bd4aaa6630a69b1c59fc19eb0b02e2a4b6af8c6cabcfb0cfc2c13efef3e87b87da061ef719a0a7bd58448c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167994, "uuid": "198ea11e-3296-4619-a847-dfb0db7774cb", "value": "T19C763343BA428876C0755B3156640B34BD7E3E042B25CF6EB7F9687EEE742916120BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167994, "uuid": "6473fe57-4926-428d-bc00-0c2901ae2feb", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167994, "uuid": "e076fb97-497a-4dcb-b732-8f546f985cd1", "value": "98304:qOKdXzT0pNr55U0sjiAT8rd2EDDdJUQGE19rcdGCtPXGtGWx3uJTpsqHCc3PRDq0:d8HeU0Ua2EDDdJUGEGS/xRRfRDq56Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687167994, "uuid": "ccf7fed6-35ca-41f9-a089-cc275de4ec66", "value": 7751864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687167994, "uuid": "6cc42ac0-a075-4fe8-8aec-a4fd1d23fdbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687167994, "uuid": "cc6b3b65-71b9-4539-b099-4b915b9a5850", "value": "8cc9bc5c1649e5bbedafdb61d57e675a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6f59d9-0e3d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GurcuStealer)", "timestamp": 1687136689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687136689, "uuid": "0c08d79b-cd99-4ebd-9ef6-3a2b3f8be092", "comment": "Malware payload (GurcuStealer)", "value": "77202c57066c182a76514cae6c1aa0e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687136689, "uuid": "3b2792a7-c1da-4a01-a788-12e5657b41ac", "comment": "Malware payload (GurcuStealer)", "value": "ebfb1c3be89d312d79b273bba951ec9c4abdfcae5e259aa57d925500b24961d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687136689, "uuid": "3453b44e-c269-4fe4-9f2b-f966875b0d33", "comment": "Malware payload (GurcuStealer)", "value": "f0eae0a2cb5e409b4810c31c2b981e2053a48533", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687136689, "uuid": "910a8901-4112-43e0-a57c-09bc2be8c6a0", "comment": "Malware payload (GurcuStealer)", "value": "2044b649f56043e979ee2fc4ddca738229551f2203f1c8b7e2df3bf219d36201a6fb8eaf018975851968cc18df5ef210", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687136689, "uuid": "e9449d7b-f85b-4b04-806c-5ba7e7ba0054", "value": "T17FE4D00271C2E03AC8B211318F868670DBBFA9A10BA14ADFF7E4595D9F256C1973176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687136689, "uuid": "6d7093dd-c6fb-4faa-b4a6-a0987f404258", "value": "367ec698363d9c97d916349e5b0aa543", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687136689, "uuid": "92654638-3f9f-46a3-a559-7c7604a559a3", "value": "12288:LbsaH7DjoFcnpVvRLxVuPb7w2fAXdp+vNwQaaGCwcaG8gwCfo9t9D:LAaH7foFcnphsPbc24Np6NwQaRlcavg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687136689, "uuid": "04bede63-5b72-4596-92ec-4b59de8b1fec", "value": 689080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687136689, "uuid": "8ff5f1f8-2b53-474d-aef2-c00daa591a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687136689, "uuid": "f003a155-f843-40d8-aef9-4a6ffd5959fa", "value": "77202c57066c182a76514cae6c1aa0e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4fd6da-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687160562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160562, "uuid": "b00c6098-e526-4b81-89c7-74fb73641d6a", "comment": "Malware payload (Formbook)", "value": "29125dc2ce3fff94ba09a3b9a820a9ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160562, "uuid": "da231b1b-9640-4a1f-beae-2b27eb6bd40f", "comment": "Malware payload (Formbook)", "value": "ec879f20532ad2763f5b921c58e0231e542ae4f7d488aadf0fdddbaf14fa3569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160562, "uuid": "551b1b53-f18b-475e-9229-221f33f1cf37", "comment": "Malware payload (Formbook)", "value": "01d6231af83ff275892db70fb368bdf220877e81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160562, "uuid": "68c72cc4-79a4-4f63-8571-98f2a3015921", "comment": "Malware payload (Formbook)", "value": "297491475a132420984032a3df0a5b193d87f2be875d8659d54c3f38ce3c6c7a0a26c41b0fee7f9ab2a99dee7801600b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160562, "uuid": "8ddf252c-ec8c-4cda-8633-13b73cd676e0", "value": "T173F4124C3C556553E86C17BC46E037B62B7F5FA93927FA8E1E92B4C8DCA1B0216A0713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160562, "uuid": "b1c88c36-44a5-430b-b470-3a8b0d16f69a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160562, "uuid": "45771bc7-8a60-4139-ab36-1cf70468a768", "value": "12288:ZltYq7J3At5iHOq+ZQcTxkNb9eEps7lLesxcwuoeHaIHDSF:ZDYqtm8OqK/SCe+uomeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160562, "uuid": "707bae7d-ccc4-4cdd-8a01-f96b52bffb98", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160562, "uuid": "e2114541-4ce9-4edb-88c9-1ed16c14a549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160562, "uuid": "c0c5b2db-af32-484b-8f9a-7d29b6052740", "value": "PO-CORPORATION MLS-E-2023060266.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d90903f-0e51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687145285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145285, "uuid": "70299b77-8209-46ff-bbc4-2944257a2f90", "comment": "Malware payload (Gafgyt)", "value": "70de2e4008e1aeb1f555fff76d8b0e1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145285, "uuid": "0c219b97-db16-4e76-9df3-c35f66e6bfd8", "comment": "Malware payload (Gafgyt)", "value": "ed5fe15ba15ebcc5fb8ae525d6d630705730bde3b1462473b41b13ea31035e14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145285, "uuid": "3bc46a36-f098-475e-ab34-e5e452fd5da3", "comment": "Malware payload (Gafgyt)", "value": "ac537ac069eed69400500c5382f14a1aaab14564", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145285, "uuid": "d46b2caf-28a4-4953-b44f-a53cee33ae35", "comment": "Malware payload (Gafgyt)", "value": "2c62abc4fe1388530e31cb5b777a8f5f8b18f333e206ad570755f9f7c4906db59274ad3b8bbd50e158905b27de9a78ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145285, "uuid": "d7a5f126-afb4-4367-a954-6a22c76c8b2c", "value": "T1D1C30905ED44871BC2D227BAF78E028D773A5E6897D733156A347EB42FE17982E39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145285, "uuid": "3229bd3b-0ca3-40a7-9b36-2d32975eb2ad", "value": "3072:oYEbhyxriiQ1zj6OXymbG1P22Xj78zajZLmu4+QQoj59DQLNb:3KeQ1364y/P22Xj78zmmu4+QQoj59DQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687145285, "uuid": "c162ab8d-629b-4898-b285-6e96d46a757c", "value": 125974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687145285, "uuid": "87743b4f-9494-4ffe-858d-95f931a20875", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145285, "uuid": "eca728f7-f4dd-4719-ae34-33d288438c85", "value": "70de2e4008e1aeb1f555fff76d8b0e1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4634b6d5-0e51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687145272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145272, "uuid": "8a9324df-4517-4bc5-ac59-53fa1be9dca3", "comment": "Malware payload (Gafgyt)", "value": "09a93bc012d2a77cc65e7e04aedfeede", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145272, "uuid": "9653cb2c-cb78-44a9-82e4-8fbeedb7c68b", "comment": "Malware payload (Gafgyt)", "value": "ed7efb3de37e309153a8b1db84ace5c1f1fdd316e8a3bc7d2d1fdf2d7df7d162", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145272, "uuid": "fdfc0180-71ce-4402-bcb2-364149dfee14", "comment": "Malware payload (Gafgyt)", "value": "3c9654705a736e7ac98ec3dd44f585db3f9d1139", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145272, "uuid": "174e90d5-baa7-4b12-a752-a64e8c06605e", "comment": "Malware payload (Gafgyt)", "value": "a737118e94663038d5dafcadff6f118432e7ff9d1613a4bd195b467ba37e7e58136ef53c149176b709871bd37414e8d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145272, "uuid": "82a372f3-8fe9-43a6-b3c9-85ff20566403", "value": "T1D2C31944ED44871BC2D227FBE78E428D3B3A5E6897D733256A347DB42FE17982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145272, "uuid": "2f5c9e11-92c6-489a-bab7-5b8e1db66c88", "value": "3072:Nt/gbSZxtXdX15WSHH1IAM2MIZjP+qi93aImm/Z5Q8vMWDapNb:7N9Z153HVIN2MIZjPJe3aImm/Z5Q8vMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687145272, "uuid": "d876ad8b-d471-4507-abf8-b5972fefb378", "value": 118812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687145272, "uuid": "df5388ea-4a4f-4548-8393-837de4ab3319", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145272, "uuid": "14b4739f-1999-49db-b499-7743f716496f", "value": "09a93bc012d2a77cc65e7e04aedfeede", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798a6bda-0e79-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162538, "uuid": "a6b2b723-c501-482b-83ba-a50a9bf09c93", "comment": "Malware payload (Mirai)", "value": "f15996e4f61a205e3c6f89e0d750fa4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162538, "uuid": "598005ac-0807-4ffb-91e7-88d2aebb858c", "comment": "Malware payload (Mirai)", "value": "edc00b934a70a554559f077d97e6ef74f29a85afff415d3b7c691a08569d85f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162538, "uuid": "f03c6d16-0634-4372-89db-8e9a99fcf3ec", "comment": "Malware payload (Mirai)", "value": "eb97469cbf8da812050c3e643b03afa32789c1c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162538, "uuid": "2281e89c-dcda-4a6d-becf-a6b8a878f60a", "comment": "Malware payload (Mirai)", "value": "c6c380ca0a234b5dea00b5d2ffcbe834ca86a82a4cc417fd0de466d2e8a405a1210561a918db2c430f24ec2c2d6916b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162538, "uuid": "f7478ea8-e092-41d2-a578-4b4f284babf8", "value": "T181132A96F8C24B66C5D1127AF66FAA5C3320A3E8C2CB7303CD645B61769741B1EA7E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162538, "uuid": "7f4bed23-2c3f-418d-9f70-d2f2f6003859", "value": "768:eOFiVa2gbBl99FJtPuXTDyQ+CchpRWgrXwzo5JH5dPQt5RRjB9FLUaYNywbZ010I:eO32o3FJtPu3ch/frXwOH51Qt5R/b6b6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162538, "uuid": "c74cb743-caae-444b-8f3b-879a0f2b4b5b", "value": 44572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162538, "uuid": "c08b33be-6a82-4f99-b8ba-c5979e8ff700", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162538, "uuid": "ee7127c1-1ff0-44c9-aa6d-7affb1b822ca", "value": "f15996e4f61a205e3c6f89e0d750fa4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944d420e-0e60-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687151846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151846, "uuid": "b284b23e-419d-44af-8d97-61ebda432be9", "comment": "Malware payload (AgentTesla)", "value": "7b45a6bd569abdf5c703cb21b80b6307", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151846, "uuid": "7c8403fd-b466-4595-a04f-f7d1f414fe3c", "comment": "Malware payload (AgentTesla)", "value": "ee33417ba29028c0946dde44e55434558676b75e5835eee50f462c8e4ebcdce1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151846, "uuid": "aec2d909-2ca1-43fb-adfd-6c496d2b8583", "comment": "Malware payload (AgentTesla)", "value": "c9a7f4304a856c1419412e334ebcc7b45e212a06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151846, "uuid": "f9499185-3d53-411f-bb27-9e054ba2afa9", "comment": "Malware payload (AgentTesla)", "value": "3d2df9804fb3be9ff45486778d3debf8942cf8ebeb3c092e6272b9bccc3c4ff3fd4ae04b18acce7cb13ba3229bd309ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151846, "uuid": "5baa36ef-8bfd-4c39-9052-e1d84cdff4df", "value": "T18AC423E1158904685AE32CFDE0F2689AD54972B5C190746DF7BBB5CFAACE2DC432B40C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151846, "uuid": "2e5dcf14-d267-4bb8-adb1-5689b7936f5a", "value": "12288:byUH9enx2mBqXtD6vOcNeQQO2H39ELpKSHSbaEMa4LHMtwCymvNhchpd:WUH9kh4XtDgOkkO2H6LjjhLst/chpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687151846, "uuid": "2744b70d-6c37-4880-93af-7591888382b3", "value": 590258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687151846, "uuid": "d4a6589e-4f22-457b-bd93-4401d1436751", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151846, "uuid": "67ea89cb-fe54-4b32-b4ec-7de0115739ea", "value": "L SHIPPING DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfac382b-0e96-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687175111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175111, "uuid": "10598ae2-7dee-4298-bdbd-a5aecccc7738", "comment": "Malware payload (AveMariaRAT)", "value": "91f73db3f3549f2b708aa43be1fa59b3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175111, "uuid": "0c92f6df-10c7-4f89-88c1-e471446506d8", "comment": "Malware payload (AveMariaRAT)", "value": "efd42baa4fb3aaea915e9c428e75de10969295a91d360c8dbe80cac138bf5984", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175111, "uuid": "1ef9ea0b-ae14-42a5-9883-d586e0b79ed3", "comment": "Malware payload (AveMariaRAT)", "value": "4d9babb4cdda256a843bab584d269c6c6d10128a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175111, "uuid": "cae9c192-9d99-49f6-b848-90326c59bb0e", "comment": "Malware payload (AveMariaRAT)", "value": "c03ef35d78b9d55973fa5bed3539ea153d82997a4e381a5488a58c8aeae7295d47d511ba0c8eb9bd24c389a1dc24b408", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175111, "uuid": "981a578f-e0bd-4632-93d1-700bcb9eddab", "value": "T1F6656B7224126E8DE92A3470D015B7588D014FFF5E76C68CFC89B25E92B2B931C3D9A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175111, "uuid": "0d209e34-5506-4ddc-b262-afd701f20d55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175111, "uuid": "f5e0cfad-a01f-41e3-b0e7-e1816b048323", "value": "24576:DqxcQHuIp6OyC2wiRJUI98BqMjMXg9ApMH+nJ:bGuG6heI9AUCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175111, "uuid": "349e50c3-ba67-4e77-b0e6-3ed831e66a10", "value": 1467392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175111, "uuid": "6b4fc0ba-6f70-45bf-8c13-10e2a6c8a925", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175111, "uuid": "6c358616-2720-4720-af7b-eea8b1a345d0", "value": "ORDER_PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70528f64-0e72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1687159516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159516, "uuid": "1e32cba3-b714-42bb-ab38-94ca171cdd6a", "comment": "Malware payload (ArkeiStealer)", "value": "2c125c6b43b5555bbcb98cf2b804c958", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159516, "uuid": "e7194cf2-3156-4087-a2f4-dee3f0c0c0d2", "comment": "Malware payload (ArkeiStealer)", "value": "f00c5a8a562a86a53dfc9c4ea0d90b862bedc1d08718966b19affa062856e3e5", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159516, "uuid": "05c174d7-08f1-49bc-af22-b0f6e19fd950", "comment": "Malware payload (ArkeiStealer)", "value": "c96c992bbf9c7db530820651a663b4ec762ce8f5", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159516, "uuid": "9a538e2a-048e-4982-b3bf-274f23d019f4", "comment": "Malware payload (ArkeiStealer)", "value": "df670e1c27da9f779b8733cb53c949e23720efeaa18e01ac23b2575e5971ca261442eb9dca7ea909f64603337a90311f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159516, "uuid": "b1426b02-a0ea-4384-8705-2a93aaa7d629", "value": "T1F7748D0396F07C54ED298B729F1FC6E87B0DF650AF49776A12289A1F44B18B2E173721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159516, "uuid": "25218efe-ac9c-4f4b-bb0e-4de62d729f7f", "value": "0e48d5f6d89199cad77b21fdee68f524", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159516, "uuid": "892155b9-9434-492e-a6cc-fcdeb64fd9f2", "value": "6144:EmNdpblXgF3bqIr+86J/mKPgPBw/BxN0YDBBpnbOzizrvg:EavXwbxB4mzPBw/NjBpnbJvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687159516, "uuid": "8d9d9c0d-9b92-4b7e-9192-ba2908376f85", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687159516, "uuid": "b39a9e05-af13-4916-aed5-c73acf448ad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159516, "uuid": "a8359c8d-a1de-4644-8f53-a37c463b77d5", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13521d9-0e7d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CobaltStrike)", "timestamp": 1687164323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164323, "uuid": "f42e5cc1-1b52-492a-bd44-e3f32a41fc59", "comment": "Malware payload (CobaltStrike)", "value": "b2fde536e23d94f84ed3ecf3ccb1d295", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164323, "uuid": "4b5c589b-c219-4bf3-add2-bb4035644c3e", "comment": "Malware payload (CobaltStrike)", "value": "f0851c538e61353570d558ef39be103b8ddb5427e33f9e8b4ab991ea34a5942c", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164323, "uuid": "8a54fa39-01a2-4d2c-9a8b-b511429b71a9", "comment": "Malware payload (CobaltStrike)", "value": "d649e24fb5925ae52d27fd4c10604a416a1173a9", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687164323, "uuid": "0ccbf327-b5f4-4141-adbc-fbaea5afd325", "comment": "Malware payload (CobaltStrike)", "value": "50e52e00d10c9d24676504ebdec7b562dff1f07a347925b13bc9e901ef09e2ab7c41696de0cb9c29b0ff3f6c96c3739c", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164323, "uuid": "8cae31a3-10ad-4ae3-ade5-e64103c7a572", "value": "T17CE142B32086F6D4C9CD2B88875F9721722572523BE0468C3BE616D6CFA4E54B7F921C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164323, "uuid": "bd810057-564f-4d43-8af5-6aab2551ab34", "value": "192:kplU3+7UXUX/NiLaVyrG+hUbctceqp/iiblI1s6FgDoxhZP0:SE+7UXUX/N78rFUbc5qp/iiblI1s6Gk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687164323, "uuid": "c2370fce-59e9-445d-9749-b10575669e5d", "value": 7440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687164323, "uuid": "9036563d-04d3-4608-9923-7efa5c597158", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687164323, "uuid": "a884e2dd-8d4c-4ebd-b84e-0bf43ea5eaeb", "value": "ProcessPrinterjobs.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ca4421-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Phonk)", "timestamp": 1687175226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175226, "uuid": "bbbe662a-3322-4bda-a171-39de0215982c", "comment": "Malware payload (Phonk)", "value": "14d63d423bde546ed473997353d0d363", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175226, "uuid": "ead3ba7a-e4d5-4136-bc70-2971e2fc2334", "comment": "Malware payload (Phonk)", "value": "f13932164c3348dfefff35921c2f1b7944ba40529ca4fb50eac71fc8da15f6d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175226, "uuid": "6e2109a5-b8fc-4d89-89ce-1aa6f62e72ab", "comment": "Malware payload (Phonk)", "value": "a2360e757fdda1e69e8c6c9320bd418785ef2b87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175226, "uuid": "54c5537d-16ca-4c21-a57e-7a040d54aa42", "comment": "Malware payload (Phonk)", "value": "ee02516af8c588a58756bcb36803b78abad59abbf0dcd91e09e48f1f5c3388bb9b7e824e9c3534e877beb3495e12004d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175226, "uuid": "6ffec5e9-907f-4fab-8efe-b58e6520c086", "value": "T148A54B25B9420CA1DD5D01F1C7EE013A5FA1FB160760E1DB17A2A7CB9FCF6C2A95C24A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175226, "uuid": "42b7086f-1f8d-4862-8542-205c99b1f072", "value": "49152:3i26eMv5uNDwgz9/gd9si4WlYNUfYtjXC5CXzgKkmk+6OnjDmNlqKxOnjDmNlqOW:nXzg5mk7MvS9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175226, "uuid": "ca430e7c-a6ca-4258-96e4-88f25eb60757", "value": 2107144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175226, "uuid": "514bb5f9-aaaf-43b4-af53-8ccf775dcdae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175226, "uuid": "358970b3-0519-4f93-9fbd-71e66a9f32b4", "value": "14d63d423bde546ed473997353d0d363.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b69c3bd-0e72-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687159347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159347, "uuid": "108172d3-d183-47f1-9b08-de4eba6e8365", "comment": "Malware payload", "value": "ecfc255b81568512c173bfe1ff151c96", "object_relation": "md5", "Tag": [ { "name": "72fba06e8f125448dfac107d7ae34042", "colour": "#6D1168", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159347, "uuid": "dec76faf-d866-4a42-bf93-cb959452e723", "comment": "Malware payload", "value": "f1ef7d6069ed548b5e2c2acb3181190af78fec30520a22a51f773ec3db177ae3", "object_relation": "sha256", "Tag": [ { "name": "72fba06e8f125448dfac107d7ae34042", "colour": "#6D1168", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159347, "uuid": "9a181962-1d13-41dc-8475-3b1d784ae096", "comment": "Malware payload", "value": "48bb354f492de78060b5d2859407c7f7bf2180be", "object_relation": "sha1", "Tag": [ { "name": "72fba06e8f125448dfac107d7ae34042", "colour": "#6D1168", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687159347, "uuid": "60de4524-0f40-4c5e-88a4-49b57124e232", "comment": "Malware payload", "value": "c2ab15a3a2dc98c05eae4f0eef1f8332c2d6e15dee861e72ac9b50beb7044f7cce946d06cea06cb8ae10a183156a4d97", "object_relation": "sha3-384", "Tag": [ { "name": "72fba06e8f125448dfac107d7ae34042", "colour": "#6D1168", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159347, "uuid": "a4677c3a-ff8d-43ef-bc3d-40d718f557d9", "value": "T11C35F0146FD9C9A6DC8C93BAD05A095CD2F9D3A99417F34A3C7155A21ECF382C88A34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159347, "uuid": "a57a1ecf-7f26-45a0-ad6a-ee0722e33e12", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159347, "uuid": "198ff745-d4b0-4fe0-8f0c-b3c8aa9d4242", "value": "24576:JyIxTzYVPjt6RXguM8XU+xIofs/oJjmkpIxGI8asN/PbO:JyIxPsPjIRltlxn+olkGz7/PbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687159347, "uuid": "4600473d-4fb1-4b8c-975a-cb56f1f4d1c6", "value": 1102848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687159347, "uuid": "33822eed-cb6c-4a91-a774-b4ee92737cc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687159347, "uuid": "dda64a09-984c-478d-9780-868a8d96c10a", "value": "72fba06e8f125448dfac107d7ae34042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e9cf5e-0e86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687168062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168062, "uuid": "8744f7a4-4c67-43e3-b633-f5a700d98c46", "comment": "Malware payload", "value": "a1dc3e2f998031a7c96685e6571f4f5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168062, "uuid": "4cd13ed2-53d5-4d0f-aee1-3da1662b6b7e", "comment": "Malware payload", "value": "f1f178feb065f7deedf19c4d29428eefb0632acdf4568e48e0067b466f77d15c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168062, "uuid": "e653f95b-74db-4910-a955-74f045741d14", "comment": "Malware payload", "value": "396c0dfc1af6b1084c1a6c882a3933954f7d6204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687168062, "uuid": "7497dfa4-3cf4-4ad9-8559-a0cccc3141a9", "comment": "Malware payload", "value": "20e1c0c6746bb80231fb1c6dcbea8a8275332bc24b864c8d73609aceb554b0b9a027f84b95fb0387f7ee87c42813658e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168062, "uuid": "6cec8d19-8bc6-4521-885d-f196d2608508", "value": "T152D6335663851CB2E6EC93360451596CA721B88A4371EA6F27F0CB7F0FA72D02D37B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168062, "uuid": "05e61f82-1138-49c7-8f46-081bdb9c9ac5", "value": "a6cec5b1a631d592d80900ab7e1de8df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168062, "uuid": "a4d6c49f-ff75-493b-afe8-cb95bcca833b", "value": "196608:SjUOMYe3o5AeNp93S3IdQmRJ8dA6l10sKYu/PaQ8IkaqdVTLDuwY6f5nJbOnzzg:y6YPh8IdQusl7Q8IwdF5nJQXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687168062, "uuid": "41cce500-23e7-4882-9ae3-07fe1c56796c", "value": 13216021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687168062, "uuid": "19e07c0a-1827-4db1-9df5-c33bc3e03d88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687168062, "uuid": "6ccf2668-d074-48a3-84b7-6da643c48ea2", "value": "a1dc3e2f998031a7c96685e6571f4f5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73234601-0ec1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687193451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193451, "uuid": "bef551f6-d1dd-4772-9862-23675e9fb1f8", "comment": "Malware payload (AgentTesla)", "value": "5ff5e7c0799e86196ba56cce0a2cafb7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193451, "uuid": "de5f5009-c7cc-4689-9bc0-55d03db5c531", "comment": "Malware payload (AgentTesla)", "value": "f2927830e4233d9249db711122cafe8f85bf91afa44409b63aacf64b28176356", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193451, "uuid": "c9c0f297-4b72-46a8-8330-c6a678a3820f", "comment": "Malware payload (AgentTesla)", "value": "f9020e84e2390ce94a1756ecc676eb4665a112d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193451, "uuid": "47b1b799-735b-4414-b3fe-b837b5a818af", "comment": "Malware payload (AgentTesla)", "value": "9ad152f98deff1f543ae20b27ecfdb04dd2702fc5586434998b6977aca4cde9e0fb9a5dc5ed1f9256569b28670b964ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193451, "uuid": "d50bc78a-697c-4ab0-be2e-e0dae4d5ef89", "value": "T14615E02036BC4F52E83997F94151B63117BAAA6A783ED7484ED3F0DB2A52F400E91F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193451, "uuid": "ee060cb1-300c-4f0d-a509-84742af01ae6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193451, "uuid": "d8f481fe-b571-4359-8e64-2e903e19e9f8", "value": "24576:WQYqtm8OqKDwyv3/nM3tMG2f7fzUZShl:r+8OxwM/npH7LCol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193451, "uuid": "5ec05a6e-d78a-4dda-99f1-659c1b3719a5", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193451, "uuid": "ded72939-6162-49bb-bf2e-2c46a03255f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193451, "uuid": "24aa6bc6-0178-40eb-81bf-796e5b59259d", "value": "Shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13dd90f8-0e8f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687171817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171817, "uuid": "c08d4859-4df6-4485-ad9e-fff55eed0f40", "comment": "Malware payload (RedLineStealer)", "value": "4d5aa41d8d87eb441e0d80d12a0a5e2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171817, "uuid": "f555bc4d-64c9-4c50-a2db-810397fae065", "comment": "Malware payload (RedLineStealer)", "value": "f30bce701bc05810e7c7873d7a8eee81c6054147593c3c09a9b5f31b403bf7e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171817, "uuid": "c11be37f-ba26-405b-ae01-5fde717d142a", "comment": "Malware payload (RedLineStealer)", "value": "a6318cbc1c41b6d4699b97058cc6a5602e7526ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171817, "uuid": "01ef3842-b9d3-4a61-8e77-41c42e5278d4", "comment": "Malware payload (RedLineStealer)", "value": "5f7d2c6d04b21e42e3793621622876fffb396b9bd34d5e6a16da80b7f687a176a4207e369ad86861a7c7bf2d6c22a8a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171817, "uuid": "6fcf1858-b266-4d25-adee-8e2169710fb3", "value": "T11ED41212B6D454B6D8F017B118F713C31B367CB2993483AB238AA94E4DB22D464B677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171817, "uuid": "b6a414bb-9687-4405-9f72-f63f12860a10", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171817, "uuid": "f300d322-6436-40d3-93dc-1842a5ca9a84", "value": "12288:cMr1y9082Qup7sbuMVbMve1Umb+0DXFM0:ZyfuaxbMveP+0DXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687171817, "uuid": "e29361bd-ccec-43cb-bdfa-399504d43b27", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687171817, "uuid": "3ee0da9a-83c1-4cb0-82c7-d83053712e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171817, "uuid": "153d9a8d-a353-48fe-b2f3-e635b4af77bd", "value": "4d5aa41d8d87eb441e0d80d12a0a5e2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33d07a4-0e9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687176862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176862, "uuid": "e4eb79fa-78ca-43e0-897b-689722c6b8db", "comment": "Malware payload (Formbook)", "value": "4e13394b41e8d0cf8b1721aabdbfd719", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176862, "uuid": "5aac42d0-7512-4a8c-bec5-36f5c0e51cac", "comment": "Malware payload (Formbook)", "value": "f31be72f929b86c056e683db26b8ec78a40f3d1156821fca58901189a8ee965e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176862, "uuid": "4ccc4840-5584-4b75-a032-bc8fd1f52bb4", "comment": "Malware payload (Formbook)", "value": "05a82c9fd3e3fd1282a8585c577c1e93639c42ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176862, "uuid": "a919b087-8b5d-48e7-b780-47bee3c65e2b", "comment": "Malware payload (Formbook)", "value": "00c76deee180b7e5214991aab4926bd9ce8174ead3cd1768cedc8670df1a86d4845846161fcc76f1d3bb6426c3693300", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176862, "uuid": "6bf34839-2902-4609-9820-4425909cae9d", "value": "T10A54016474A2C567D59246312FBAE0BE1FD67D159D6C061B3BC43F4FBA32A80D20E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176862, "uuid": "ae39355a-c275-4632-8012-312d066f8646", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176862, "uuid": "305639de-a46a-49f3-8bed-a10446025b89", "value": "6144:AYa6CpByitT/b/XCuKj9/sB+9EjS6SNFKBar:AYspBPT/e59/sBKEjSnKB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176862, "uuid": "05694df1-2185-4ed7-ab3e-d4c07d8dcfc3", "value": 305635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176862, "uuid": "865aee36-141c-4aaa-9d49-1949ca631364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176862, "uuid": "4e37f1c6-c2d6-47a9-8977-a0dab98f58a6", "value": "4e13394b41e8d0cf8b1721aabdbfd719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de91d5f3-0e74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687160560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160560, "uuid": "76628805-af02-4a01-b55d-12abda769e56", "comment": "Malware payload (AgentTesla)", "value": "9758994bb49d1a3446e80b21cd1d79f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160560, "uuid": "3b07e4b1-9853-4961-946e-fb2b4496fb15", "comment": "Malware payload (AgentTesla)", "value": "f31e33bf7116b2a0b7d78bbeb0f626f564d6febd19296d7628bd76696ce1e617", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160560, "uuid": "24fa0bec-7b6f-47b0-b464-9627f405d88c", "comment": "Malware payload (AgentTesla)", "value": "5c869d57f8b43be376966c40f5582c97f551bc21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687160560, "uuid": "a565b64a-47e3-47e0-ad4f-04e21b59ecf1", "comment": "Malware payload (AgentTesla)", "value": "19026123e08bbe14cd56798ce79fb85199d27516e1b0f70b2e0fed1a0e4f88824dec431821d26e5a7c78f1d86649fcdb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160560, "uuid": "55db8f12-1bce-44bc-b0ce-de23156a440c", "value": "T16A54121AB2E4D06FE8510A700DAA2D07B8FA9D29B8E8D72F0374775D7917681D50F3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160560, "uuid": "6f32c3af-9c86-4e37-afe3-922ef68efe06", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160560, "uuid": "736cd9bd-64d4-4f73-be45-dde7eef53caa", "value": "6144:vYa6FNFGcAL2u45QkviBfM5u1dFpi9hERN6E30q2b6Sr:vYnNFkgQkaBEIZg9hERb2lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687160560, "uuid": "8a65f60e-5177-4754-b211-a045cba67d79", "value": 291395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687160560, "uuid": "f3271809-e4e6-460d-af7a-b5c3f0457ff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687160560, "uuid": "42b39740-397a-490c-a121-df8401bb0eaa", "value": "pedro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0016caa8-0ece-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687198842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198842, "uuid": "240de145-6397-4056-aa74-320ec11325c7", "comment": "Malware payload (Amadey)", "value": "ce0eb519b037816a73bfbdb4a9e5617b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198842, "uuid": "09674998-02a6-4038-b3cb-da80708679ee", "comment": "Malware payload (Amadey)", "value": "f34735e31dcb18528fac64a142b64aa09dbc07a4ac9e28c514168349be57c96b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198842, "uuid": "87027148-0af8-4b15-8e56-a344c3bd3f47", "comment": "Malware payload (Amadey)", "value": "88cfdcf69d5c2dd8c5f9573f05ef9d3019074fb6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198842, "uuid": "9b7aa4b2-3918-44fb-918b-0a8d53312a4f", "comment": "Malware payload (Amadey)", "value": "7e31ec67cc81768f28138edec3c901580f9220301ff8dfb895ed9f02ad73c10d059ca00078d0b6b0a660b976020a85ef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198842, "uuid": "bc6bbebf-b03c-4c3c-a120-16d4277b77ff", "value": "T12415128178C0B130DD714532695EB953ACBCF8A19E70DD9F3B50234E8A756E1BAB022E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198842, "uuid": "04f4c872-fbe4-483b-92d6-fe03a9a51eff", "value": "d91fa928c738702455bfa66ac3685503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198842, "uuid": "907f03c8-e4f8-4394-b66c-c2149b33aaf2", "value": "24576:Y0Rx7fIuM1IEqsfDp584Symem52e3dsRjHx4K:JbLM1LqsrE5226jHCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198842, "uuid": "5d755bfe-3e69-48bc-83d0-9be24ad9448a", "value": 928768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198842, "uuid": "cefb863d-d934-48ef-b9c8-95dc2bb8f763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198842, "uuid": "58e65d15-dfc0-4b08-a1e4-4e1da570d8bf", "value": "ce0eb519b037816a73bfbdb4a9e5617b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c580dd-0ec9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687196763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196763, "uuid": "0fec61ac-ecb9-44b5-ad2b-4bc8d2e69aec", "comment": "Malware payload (Mirai)", "value": "3ab75cfb86d4f739e771b5a1c3422ead", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196763, "uuid": "7e8b979b-ffc2-485d-95d1-085d5ca0b447", "comment": "Malware payload (Mirai)", "value": "f3fb60fc2f45ba3c3a648acb97ecc03a5b88e309ca8c07414c83b7d7f4db45af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196763, "uuid": "99ebf46a-0dcc-4603-b39e-60478255df1e", "comment": "Malware payload (Mirai)", "value": "bd0cb72fe692a66ef876b4ea4793f5ec6d12ea77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196763, "uuid": "e42a19e6-0c4a-49f5-bdb3-2488f441fef2", "comment": "Malware payload (Mirai)", "value": "451066c268a9ad0132060eb100c7caaa6f3b4224bcd7fb0dea64d95b2ce64e09e24331a46175225cb409f286de70e3ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196763, "uuid": "c457fd5f-2b3d-4149-ae11-a23d3bbfd185", "value": "T133632A96B8818F15C5D512BAFE2E018E33132768D3DF72239D106F547BCA92B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196763, "uuid": "f5ea83cd-d9c6-4f9d-8542-a3f2dbc28411", "value": "1536:HTnaQkC5+Uqp9gqo5GQso7Qygu6Q1Hxtz7QPLMoiU7apxSF4dsI107:Ym+fzg3UBoQyg9QVxgR7apxSF45u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687196763, "uuid": "0a3c351e-63c4-40a8-b576-dd936b4bd210", "value": 72224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687196763, "uuid": "730b0e83-2331-451f-9857-445613750617", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196763, "uuid": "203ed768-2f9c-4e74-b160-7dfc60501c5e", "value": "3ab75cfb86d4f739e771b5a1c3422ead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0db63f-0e4a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687142464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687142464, "uuid": "ea97e07d-3c7e-4cb9-a44b-c6d376b80fd3", "comment": "Malware payload (RedLineStealer)", "value": "807e357f04ecc60c6ee77725b584cbda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687142464, "uuid": "b2f96e5f-756a-4e6d-8131-2234de65c70b", "comment": "Malware payload (RedLineStealer)", "value": "f42f905e53103ceafc6c83c23657663e9ea3288732deb8e5bbc38812e79033e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687142464, "uuid": "3206e801-99a9-42b2-a37c-2e88f2f57c62", "comment": "Malware payload (RedLineStealer)", "value": "41bad59db6d117e3df622be51a0b1a78d48ba438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687142464, "uuid": "c566a718-91a3-4cd5-aa53-77b22f70657a", "comment": "Malware payload (RedLineStealer)", "value": "4dc6804dd8d4e3257a9b18538bb567dadcd54f4f9c40c4b748c761efc2ed4ad7eb0a452d4b88194626680db030c3eb36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687142464, "uuid": "ac9e2b9e-1da1-4556-949d-9ca067406024", "value": "T168249E0B3F90E33DC01EE87528294BA9CA55BB341B5552837FD7096AE9342E0A6FC1DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687142464, "uuid": "99d99213-6968-4ffa-9544-8a1a379bc61a", "value": "b88ff38d8a9dd531263365f3574a285e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687142464, "uuid": "950a7d19-ab36-498e-86a5-a56d5490ea31", "value": "6144:3LPMfpIT+wBBEHArokOAz9DoiAlTxGj0u:7eIZz9Do9Tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687142464, "uuid": "c095ca1c-5377-4f19-9d50-95103c7b8fe0", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687142464, "uuid": "804cf104-9d54-4cac-b4a4-f5be3c1558c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687142464, "uuid": "40ebf844-89e3-4158-b4d4-41658d6eb864", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b296de-0ede-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687206070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687206070, "uuid": "fd28f844-f1f8-44d5-8109-e8f545b0cf3d", "comment": "Malware payload", "value": "7b183e16ef9ebc7517756b53b2f34715", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687206070, "uuid": "1cdda853-4051-498c-8b35-ade4f729be66", "comment": "Malware payload", "value": "f4a3184213c5eaadea56d3919d3a885fa1af3b3d76644c4ad024d6aed3fb5c8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687206070, "uuid": "53531ff4-23f2-41c0-8761-a5e65c51fa61", "comment": "Malware payload", "value": "f870143c86541c3ba91fd6593d67a2d7e215dd4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687206070, "uuid": "1d0775ce-b375-4890-ae0b-7d78982fccbf", "comment": "Malware payload", "value": "30d96126e6bee52f5fc8aaec818d9b785c26af0d2243645ab859915715deaf278d87032309f4b8e75cecf58dfc84aaf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687206070, "uuid": "b317d416-d7d9-410c-b909-691d4a79f5bf", "value": "T1043633DCBAA0B1DEC957D5B1AD242DA5D6A4747AC34B0153A07708AEDE0C887DF980F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687206070, "uuid": "98c8f524-cf12-4849-963e-63511012a8d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687206070, "uuid": "fdd929a1-7ebc-4b1c-914f-aeea7d19a401", "value": "98304:besQRCTXJi/06cywDnKRD6I4Sjv+KxaWqdTqv/p+GZL305Bg+8oj:Ga5i/hhRD6IhWpWqdTqv/kFBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687206070, "uuid": "08a040ae-bd71-4619-adbb-9a9169e70a43", "value": 5227352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687206070, "uuid": "9bd277cc-cc05-4c62-aa8b-b2054309c3b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687206070, "uuid": "5535bee4-66ed-469f-a01a-82a9fe966989", "value": "Keoxe365.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e028f7c-0e51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687145312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145312, "uuid": "a3a39b62-cdd7-4544-b688-1037718033f0", "comment": "Malware payload (Gafgyt)", "value": "0fe3de75f1d8b25e25b1e07d31e3e139", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145312, "uuid": "0191eff0-d17e-4fb0-bd37-60655acca0f6", "comment": "Malware payload (Gafgyt)", "value": "f4d94781dbef2e0b36b0189fbcd7ee9d54eae10d0debde29dae21646044aba1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145312, "uuid": "2f9394e2-7071-4704-929a-441fbb74268f", "comment": "Malware payload (Gafgyt)", "value": "7e9fc40804990905b94f8ae4f0e5ad357d7702da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687145312, "uuid": "ef620f41-9934-4c00-9655-fb3a4be0f28d", "comment": "Malware payload (Gafgyt)", "value": "a1ed7998b903a88bffae2a770173ad6e68f9576853175ade0b54325d6e000e0f64d5f4ff22612734d6945052cab120ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145312, "uuid": "43c39b42-86dd-4212-a3e1-b4fae1ea8aed", "value": "T114B329076B1D0B47C49BAAF13DB737F0876AFD6102A602C1A10AFED41772AF46126F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145312, "uuid": "72fe7db2-2c93-4197-a13d-6d21b66e5008", "value": "1536:AbsUXLMi8dfs3rTMqOaU368Q/gmkjVGte3onCaGmpi4kuCLNY7XY0Nb:AYM/XXUaAQ/gPjyCaGmp/kuCL27XY0Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687145312, "uuid": "ab1d88fb-5ed3-491d-8c8d-29a5b12e6f12", "value": 111290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687145312, "uuid": "89a19a86-df34-4a52-af22-fce3d3289cfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687145312, "uuid": "1a4e311a-b72d-4401-85e7-bad2cb2f4300", "value": "0fe3de75f1d8b25e25b1e07d31e3e139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41eb7d7-0ea4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687181078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181078, "uuid": "5680b792-1966-4550-91af-1d4ea3dc1432", "comment": "Malware payload", "value": "2bc114fefa85c50cbf155b6bfca863c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181078, "uuid": "73359258-5c9e-4315-a16c-9f2e3158b600", "comment": "Malware payload", "value": "f53121ea255b65cce147a0dedecb10ae0ae6d062c1a7a8e95b6a999036d4c5be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181078, "uuid": "096cdf8d-4e85-439f-864f-c6e4c2578eb4", "comment": "Malware payload", "value": "33dea7a3d8f64347d9b70ca12ff5c8e7cafe141f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181078, "uuid": "6834967c-3586-4e1d-b6e5-e88b6a0d7e6f", "comment": "Malware payload", "value": "7254596e6b7403e2a4e6fdf73c4ded5e20b0fe74e2a623e99698644c57863581531fe4522af161ca3cdb8497bdf5c116", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181078, "uuid": "352e0aa5-2241-4640-805a-ad64c499697a", "value": "T143A58E2277D18C76CD632DB0451AA3F9A5B99E24CB3941B752903F382F7C5E185382EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181078, "uuid": "4db38645-a46d-4840-8754-9f5bb07b5a5f", "value": "80fea8df94be37a11f3662b90cee73ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181078, "uuid": "6628e9e2-0980-4049-a7d6-339f6ad54ef6", "value": "49152:6ZTcdPr3Dj/gXpGWqVsdBngjGL3N5m5zMEECJwbjbYpMAmOOc:McdPr3DEX0DsdBngjGL3N58zZEnY2Amy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687181078, "uuid": "74910e76-4081-4af8-91c0-8a613773d26a", "value": 2162176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687181078, "uuid": "862c64c0-9b2a-47ba-be6a-f80c314e4e72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181078, "uuid": "5133e94f-311d-4662-80b5-f35c77cf38fc", "value": "cell.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34755f7d-0e8d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687171012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171012, "uuid": "4c4d0ca0-c4e9-401c-80a4-2669c209882a", "comment": "Malware payload (Mirai)", "value": "aed644b30ec50e34ba9e4c8d220b90f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171012, "uuid": "d112cdda-4ee6-41e5-8f58-16e979c8f3f0", "comment": "Malware payload (Mirai)", "value": "f5623728e69bf04782c7f785d67c43ccada604c7001e4c20f591b7990e2c481e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171012, "uuid": "5bcb225b-ff42-4784-941b-4ceb965397b0", "comment": "Malware payload (Mirai)", "value": "744711a0d23c1b93153ef00fb43ed6b6d9d73d6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687171012, "uuid": "1a894354-d481-4b62-acd2-64aeeec3a07d", "comment": "Malware payload (Mirai)", "value": "a5d302d4da77a2d174cb41882c72be0455f8b7b645c33dd6fd32b490a8a8573ea8719a0f8cbaf90bea15e9196825d7e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171012, "uuid": "e1d43e60-1b48-4298-873e-2b0199b34d1e", "value": "T135533B99F4028E3DF88FE9B984160E05B93123D212931B276BAEFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171012, "uuid": "543aa8b8-60e4-4f9e-b2ba-a6bbd20a2a9d", "value": "768:me4gpsM204GEkRbjveXQonQiuQtt7v3gFHy1eu48B8vB6J7EzNfXQuJpozNE7Pw:mo3EkRbDfDiDHIFy1X48B2SEzNfAuJ7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687171012, "uuid": "17585a17-783a-4d54-b05a-ef1a1656698c", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687171012, "uuid": "e7ebfba2-ee0c-49e1-bf67-25d65dc8317d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687171012, "uuid": "58426b76-eb28-4df0-9b79-14d3549ee0ae", "value": "aed644b30ec50e34ba9e4c8d220b90f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ffc661-0e70-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687158593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158593, "uuid": "9208eed0-6cd2-4d74-8327-7df5ac0a73cf", "comment": "Malware payload (RemcosRAT)", "value": "a95530ebec578129a6660689d22748ac", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158593, "uuid": "dcd674ec-c7ac-4637-b64b-2043239889ac", "comment": "Malware payload (RemcosRAT)", "value": "f5d1fc94cef9d62e567ed313b3168c13ef86cd12b8ba786caec5572494eccf57", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158593, "uuid": "24c6b1c8-b7f4-4c56-947d-8e2abfa12c93", "comment": "Malware payload (RemcosRAT)", "value": "69fdd4d5a82019b0cc2944724b6898a3a03ff227", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687158593, "uuid": "d21fbda2-5524-48fd-accc-bf332e9eb11a", "comment": "Malware payload (RemcosRAT)", "value": "2a3f676cd0f6e5d53d25b34d6fb19c11adf033893b4acc055c1484075e5257282e3026be4206ec99cfe1c7a1ef0c9050", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158593, "uuid": "6a0c8a13-b6a4-469d-8c85-4a4c275e1089", "value": "T1B9742394B6D8EE4F3B603602B4895A554D51C7877A506E38320FABEB069C1C4EF760EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158593, "uuid": "7e2c8ee9-d67a-4a2c-84eb-1a843bc3b508", "value": "6144:EJJlmqTt2DvfINpWkrOsmJpkUSKonMAQDHZQfCo73WHCOUsQvE0GFJ1wtua8Vwex:gTtQvmpWkmSUVo92QfCm30BCF8W5Az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687158593, "uuid": "5fc6a356-6892-4845-89b5-ca95eefd4753", "value": 337352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687158593, "uuid": "43907594-06a0-4fe1-b01d-9aff15c109b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687158593, "uuid": "94b3be9d-ec9d-4029-855d-d1188b39d5c5", "value": "INVOICE DT.$25,000.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b63fec-0e9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687176838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176838, "uuid": "5b29b561-d5d9-4510-bc1e-09eb6c800aff", "comment": "Malware payload (AgentTesla)", "value": "b17445243117804a2a0b91906c6e0094", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176838, "uuid": "6eac7fca-2291-4e6d-bcad-0dc171152422", "comment": "Malware payload (AgentTesla)", "value": "f68067f9115e9ede57c73b7392912980129fd16b51f3f6550f8e086702b65eac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176838, "uuid": "59fcb60d-8bc2-4ea0-86a9-d1a1dd30e27e", "comment": "Malware payload (AgentTesla)", "value": "260aa9c571789b7ddb78e5bb1cd3775bf3038b44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687176838, "uuid": "2fd620be-bc90-4312-be7c-d3d208602d23", "comment": "Malware payload (AgentTesla)", "value": "a5784524fc5ea426c240a054eaee38efff1c39fb2a1f71d8483a845ef4f456cf03b74bef1f94ea2b55bdb2251e97de66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176838, "uuid": "e63ef558-3197-4e43-a46e-7ca6db47c9fd", "value": "T12BF41258782C8647D86A0BFC4AE43730133E5BA97E22EBC46CD3F0E8ADA5F921511757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176838, "uuid": "dae53d15-3f93-4f0f-bd2a-f1363995f00d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176838, "uuid": "73329ec1-1f3a-4d51-a269-3dc02f017e2d", "value": "12288:YqtYq7J3At5iHOq+ZQSOqZnH6LOsg+pPso4dBetvNfTc1LJP/a3Bk:YCYqtm8OqK9LqaIPs3dBsrc19Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687176838, "uuid": "0209c00c-782c-469e-b078-c4c25cbb45ca", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687176838, "uuid": "0894f6e5-b2fe-49de-bc58-6e9d4e9d3f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687176838, "uuid": "2d4de366-fd02-44e8-8c83-0d5d9ee5f288", "value": "b17445243117804a2a0b91906c6e0094", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63425989-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687175386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175386, "uuid": "4e6f2c04-a2b3-41de-bfb9-299e4a0ccda8", "comment": "Malware payload (Loki)", "value": "0ff616164ab8ecde43c74215fe0f9741", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175386, "uuid": "8be808d9-622e-480d-b391-d56ce71570e4", "comment": "Malware payload (Loki)", "value": "f71c90e78037d7c76457c4fa4816cc1544f2b93bca4a9222a9da582f7172c300", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175386, "uuid": "0892d5e0-9fbb-440e-b34a-ba545afab970", "comment": "Malware payload (Loki)", "value": "fda3dc376083956719423b612eebb33f6fc242d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175386, "uuid": "5aab7192-1bd3-4528-93c0-c9576f291ac9", "comment": "Malware payload (Loki)", "value": "118d4609f4deec64f22311291fb2a9f6baf8b5b8098ac4133b6863901fa5a4fe5c372c4bf0018f600d7a48689ccebe1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175386, "uuid": "6340006c-acbb-45fd-8ba0-f37cacfc6184", "value": "T1B4458D123A51C912C15D36F6E1A7603053778D82272AE30A6DF633A61E337EFDC5968E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175386, "uuid": "865cd181-4cf4-40b5-b1c2-4c06a9ae8255", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175386, "uuid": "723dd805-78ca-4465-8d62-55f10b16f687", "value": "24576:tGISNOVPhvIf6lcv9VAoueA8Wo+T8ceulPTpaSUo:tGyVJvIf6avYoueAg+TxeuDaVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175386, "uuid": "054742be-78f5-4483-b8be-d2023fca23ea", "value": 1188352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175386, "uuid": "ccc8654f-b0c7-48eb-9ebb-d261af692c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175386, "uuid": "9d938ddd-02e9-439c-927f-8ac9397da9ce", "value": "0ff616164ab8ecde43c74215fe0f9741.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a83234-0e7a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162901, "uuid": "f3c71b19-3b50-4c1b-ac22-c1529efd7e4c", "comment": "Malware payload (Mirai)", "value": "24642062177cdd69184faac31b66d0f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162901, "uuid": "e12c11b3-1649-4083-aa71-db561d1278a7", "comment": "Malware payload (Mirai)", "value": "f732915f841a213fe27841888f710a391e5f3586c92d4a484dd71615c4e862b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162901, "uuid": "57181e88-4587-46b3-b318-07bda3011cb6", "comment": "Malware payload (Mirai)", "value": "2764bc7e703ad09ee79a71e83e4230c788c31964", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162901, "uuid": "fb51e4b8-0f86-48fb-804a-9994c4764e24", "comment": "Malware payload (Mirai)", "value": "b574aa5a9c0d06099735a14fe434d5b0551e181d52bfab520ed5a731ed616a5dac41ddbd7125ef77baf4d9fb5c889ab1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162901, "uuid": "33b72e61-53f2-48c0-b3f2-8271a7053f86", "value": "T13E432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162901, "uuid": "f61b0ce6-cc63-423d-9446-a385ac10522a", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIEQKqgESnmC/xO+KpAwI:RqtmZPuutfbltZFBSJsBcfDSTFIIBEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162901, "uuid": "6fb26df1-c298-4a57-a573-c07ab49e8939", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162901, "uuid": "83ec66ab-ea1a-40c8-a40c-aacc6883cb19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162901, "uuid": "4bbfda40-bc0f-4281-87ad-921f2e8e3a73", "value": "24642062177cdd69184faac31b66d0f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0bc89c5-0e37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687134338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134338, "uuid": "c896550a-ce44-4904-b9f3-2873352487dd", "comment": "Malware payload (Amadey)", "value": "87d71a2eece7587e2ca2b30396f5c754", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134338, "uuid": "5da3200c-44aa-4125-b828-2a7ef53a65f6", "comment": "Malware payload (Amadey)", "value": "f7bdbe27d6bd111c3e80381213d58dd2d4e8ece25eac43eabd21d283395a2472", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134338, "uuid": "fbcafed0-f3d1-4b63-abef-3cfe264f13e3", "comment": "Malware payload (Amadey)", "value": "9a76fb8504166bc5bf4215c700c3a7c0a7b73196", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134338, "uuid": "0143ee93-9846-4f35-bc6d-9c4a69efe077", "comment": "Malware payload (Amadey)", "value": "76572b0beb4e4f2bd87a73242fd97ac46c75ce734e2c1e6981cdcc4bdad8e003f0173759ba20ffc3f570c27dc8f20c7b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134338, "uuid": "6762e4ca-6ca3-4b64-9d03-dd1d8f859421", "value": "T12A546E125CAEF7E0F406D83E654AC107E97699717E7486C22F820EF2057AF845FBC9A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134338, "uuid": "657a1977-af33-4e38-afc0-35ae5ec26e4c", "value": "b88ff38d8a9dd531263365f3574a285e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134338, "uuid": "bbef8909-8c30-4859-813e-008e401dcab3", "value": "6144:IGYZatOVBV44zWAdPPzLqsGLWA/DwtDq:I0tOfV446AdPPnGCA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687134338, "uuid": "08898178-3cb4-463d-b5e1-4fd2560325e2", "value": 291843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687134338, "uuid": "90ec3667-1d2d-43eb-887e-2032a22830a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134338, "uuid": "f3bc7cc4-a627-4116-af5d-261cd81b6b4e", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09aefcd1-0e39-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687134863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134863, "uuid": "baf8013c-93f2-470f-b896-aeb02f8cac7f", "comment": "Malware payload", "value": "4745404cd64106b9c935d69198e8a8ef", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134863, "uuid": "3639fe47-c4a5-4eea-ba98-6bab0d48c397", "comment": "Malware payload", "value": "f7c36c8c6509d400075e5556903700e7e6d271c0d61fd587612141fc23af6587", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134863, "uuid": "ec57dfd7-b22a-4e5e-8cb7-2bf041b162f2", "comment": "Malware payload", "value": "42021d6c31b0ee3b7f394398efc562d554103fda", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687134863, "uuid": "151bce62-fe9c-4e96-a62d-dcb58ef5f38b", "comment": "Malware payload", "value": "ccddf66a7de948e4c32227e912ca08902837e3afb11a865b0ed1007b3aa18b02d6ab2c9a3d002fe1ebcc693a817e4b32", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134863, "uuid": "48c70efa-a9f5-4b75-bc67-27da5387a809", "value": "T131F005D19FF2512445405A14C857D35B855CF4E5E479024130EC20DEDC3EA0B8A36FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134863, "uuid": "b43bd06f-39d4-4826-8831-cc23ffae5dbe", "value": "12:jfsdLdMOV8uTCvy2NHKmjat2s840c4oRn6wUS:sZMO7OXqe4EoR6wT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687134863, "uuid": "b6109281-1872-40c4-b862-4962b20b2650", "value": 509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687134863, "uuid": "0d89eb2d-867a-4ba3-9a99-e66904fb3acc", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687134863, "uuid": "294aa045-44ec-473a-920c-02348b601d4c", "value": "LUXXY.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d2bcb3-0e80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687165401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165401, "uuid": "479e2253-27c5-4934-94f4-cc4c0efa31a4", "comment": "Malware payload (Mirai)", "value": "60811b97349b0185b396b53d14d063dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165401, "uuid": "dc809f8b-e682-40b5-ac34-e2b990f1ce46", "comment": "Malware payload (Mirai)", "value": "f83daff62ff460c480f28e8895d9ae32f33523b9080f55f65b4f18682465f1d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165401, "uuid": "fbd0c2c2-cda3-4db4-8177-43c28b456201", "comment": "Malware payload (Mirai)", "value": "8da93bc293644f993014e201d5a32e9517d6fd33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687165401, "uuid": "c615a4ee-809d-48d8-8ff8-1cb1ab0d2065", "comment": "Malware payload (Mirai)", "value": "23a5bbf0b98e9e2694fe1c5826d91de9b8d0df9f6c9b5825dfb40aeb196da65391cfc3eea6bab1f36afb8e5c254427eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165401, "uuid": "15ed1167-cbf7-44ab-8619-5c970ff5ba45", "value": "T13A142B45AA408B13C0D627B9FADF42453323AB58D7EB73059528AFB43F8679E4F23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165401, "uuid": "2ad901cf-e4dc-4b7f-a100-70f738913023", "value": "3072:2+0Vk8WDccjWQ8JgLaRWC2ZhKO/nY/YaZHsJe2zFq2oNM/R2qB:2+0UjWViLaRWC2ZhXqYwMJzzY/NM/RV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687165401, "uuid": "2ea2e712-2f37-40d3-864a-e61f291c0460", "value": 195080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687165401, "uuid": "e8a4aba5-864c-42a9-bbb8-372248270233", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687165401, "uuid": "cd689f08-8b69-4a07-8f26-da6194deb0ff", "value": "60811b97349b0185b396b53d14d063dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea3ab33-0e79-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162547, "uuid": "a97bffb9-2e23-4f8c-b0de-57b989bac46e", "comment": "Malware payload (Mirai)", "value": "dfb9b8c2a2b1639b35acb4171f5e1373", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162547, "uuid": "1b237d53-1a5d-4db0-80d1-ed4ac0cf9ea8", "comment": "Malware payload (Mirai)", "value": "f88ef2f6386f4c02218cb6421d50b4645e5f47d938e6b90bf73b324b0e69ea05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162547, "uuid": "5b4cb4d7-2ce5-45a0-b069-08634efec14d", "comment": "Malware payload (Mirai)", "value": "b983e4e4d6fa0247ba7b9165824f9ca9fbafaf3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162547, "uuid": "73ff4ea3-2268-4438-a550-d4fa5c691e48", "comment": "Malware payload (Mirai)", "value": "904009e8309cc664ac46529909b34d1912a667b8265ffb38fd3e2754d13be32cdc8f22627b899c6767740d2ee90bba83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162547, "uuid": "7ecc83f1-1b27-462f-a077-585d91ee3950", "value": "T11D63961D7E218FEDFAAD823447B78E21AA5823D627D1D5C4E15CEA011E7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162547, "uuid": "67a29842-da15-48a4-b856-e682dc00f5bf", "value": "1536:i0y4avHfPTn/m9cf2j8qth7+0jRb+10W6C5:ihHrBqX7+oReZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162547, "uuid": "00f3d1dd-252e-4c60-91fc-50179dc884bc", "value": 73304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162547, "uuid": "f226c73a-8d96-4d52-b346-abdc7ee3a899", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162547, "uuid": "9500f804-ef31-48e8-ad89-84d3f802fc7e", "value": "dfb9b8c2a2b1639b35acb4171f5e1373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6da872-0e67-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687154624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154624, "uuid": "6c703d41-bab9-4e7a-b02f-04d3c7d50329", "comment": "Malware payload (RemcosRAT)", "value": "6ab2204fcce7db922b5c5333764a70e9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154624, "uuid": "3eb4773c-e599-4b57-86d1-e169d08ac38f", "comment": "Malware payload (RemcosRAT)", "value": "f8bedd18ad84b9df1bd9e19e37df72d304c4a00afbd5a0a3286fae15c32d18ff", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154624, "uuid": "1bca0c2a-2e79-47ad-a7ad-aa6806d512d8", "comment": "Malware payload (RemcosRAT)", "value": "8826b7d7c2c6ca8c0d41bff61ec1df4b57ff4751", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687154624, "uuid": "2a72497d-74d4-46f2-bf4e-4fcf7f192bc9", "comment": "Malware payload (RemcosRAT)", "value": "b70102df8fb813bc0dd6fe2c4b9ffa2bb8e647433b485c085e12eb60fa97fb5546792c4fefa910a6f1883c39ca14e933", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154624, "uuid": "911e6678-cd15-4cb3-8e6a-5baa5188796e", "value": "T12FD2C756E79A03784F810276671E4AC9AB3DB13E736055B1386C933433E9C2D4676AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154624, "uuid": "04b6f860-cca1-4083-9201-7970e0b54259", "value": "768:bFx0XaIsnPRIa4fwJMSuJGMflbeQBe5E3:bf0Xvx3EMSuVS5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687154624, "uuid": "e2496ac9-4a6e-425b-90fa-240d9553b16c", "value": 29669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687154624, "uuid": "1fc37ad5-345d-44cc-a233-f298d4cd3100", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687154624, "uuid": "eceb3862-f04e-4461-83f4-de3e4b029245", "value": "New order F08923.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72507f64-0e79-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687162526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162526, "uuid": "14c2816c-4ebd-40ad-9e06-ab48e615f8c1", "comment": "Malware payload (Mirai)", "value": "6fe66151ef850f29508f8b276ed1c575", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162526, "uuid": "2cdc7870-af52-449d-ad62-65456c1891e4", "comment": "Malware payload (Mirai)", "value": "f8f6e04065cea62aff82455a0f4fc431e8ccca93a499836a93c1251ab5f497c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162526, "uuid": "827894b0-b0a7-4cdd-adfc-131f48ae0960", "comment": "Malware payload (Mirai)", "value": "8b82a3dd15983c6ef3fd851ae637f8d42f473bd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687162526, "uuid": "7e38168e-eb8f-4586-ae22-94c8f555c7b6", "comment": "Malware payload (Mirai)", "value": "991ebc9fc0b24d0e1656bd7b8f888ae8b5edf3493c05a23e7624d381acbbb9174271bdf436b7e0ac53a4ad6f2d47842f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162526, "uuid": "b425c784-1724-4463-a75e-0f1b37e5363a", "value": "T12FA2D0293B925E5AF3782874865F8203A7AF1B7C51FA31F274402B70E7CE14A5E64F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162526, "uuid": "f90cda53-018d-48bc-adfa-4ba4af1e1e01", "value": "384:vvtIoZxrSniaXs+qx+bwqPXme91CRI2cjdYQPrDH6SAhymdGUop5h2:vvQn4j+QenKidzDH6ps3UozY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687162526, "uuid": "877c6b02-1239-4d24-9ab9-6a45765037d9", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687162526, "uuid": "67747273-c17a-4079-90c1-7200b0d1c2a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687162526, "uuid": "29520178-7072-443e-bdb5-21991a81a01c", "value": "6fe66151ef850f29508f8b276ed1c575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d36a07c9-0e5f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Neshta)", "timestamp": 1687151522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151522, "uuid": "4261c79c-a698-45c8-be2d-9880fc70c305", "comment": "Malware payload (Neshta)", "value": "61be99bea7d298a903f49087876d8a91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151522, "uuid": "e7eed6bf-e358-4dac-86f5-eb72a809b2ff", "comment": "Malware payload (Neshta)", "value": "f94903b0a50cc5c472b19dbceefb98e9f433f1e8fa9cb0a6f98ffca8dc609d5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151522, "uuid": "f0c2e308-9d5e-4063-867f-e4e90ba6a7c4", "comment": "Malware payload (Neshta)", "value": "36d37b773555effcd72f0fb17ed208e8c62662ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687151522, "uuid": "2f7573d5-5dfb-430c-938e-75f9e02231e7", "comment": "Malware payload (Neshta)", "value": "73667dec1b0ff81bcd6c8dab0d407e12702cc9ddd4705d624f33c8daddc52800e73b3a0fe0c4f175240442a87e40fe9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151522, "uuid": "8b612366-6d94-479d-aa1e-31dec3564af7", "value": "T16C15CE5061A89F12E03FB7F55561203083F52E13B56EE68A9DF235EA1972F93CE8118F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151522, "uuid": "782ea983-88f8-4c20-8fe3-d7a99945ee77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151522, "uuid": "2ca0e2b4-02c8-435a-9565-6d3db7319324", "value": "24576:WXYkZNnPXjZ+1S5LA9FMNWTdDlOg9/J217OVy9:WPXjZ+s5LATMgTdDMg9/J217+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687151522, "uuid": "8e8b2350-40a9-4712-a562-0fa947431588", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687151522, "uuid": "7e39cb98-6e47-498d-8c66-209f6910c9f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687151522, "uuid": "b2b83b64-6f57-49ee-a636-58f0b45c0d3e", "value": "PARCEL ADDRESS INFO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d622ceb0-0ea4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1687181162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181162, "uuid": "6169253d-e723-403b-ba91-6e708df81fc8", "comment": "Malware payload (RustyStealer)", "value": "0ab447fdfcc85159252fe638ae1bad75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181162, "uuid": "3c6a9081-9f4e-4ee5-85de-34f2006b897f", "comment": "Malware payload (RustyStealer)", "value": "f95c5db3c31025b8e713199ba0a653a335f7da6a1b898e9023afaf206da0bd9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181162, "uuid": "5fa34adc-5a2f-4251-b2ac-83dcd02d6a88", "comment": "Malware payload (RustyStealer)", "value": "45eadead2fe4bb7527a8bd3ed05155c7b42c6705", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181162, "uuid": "f0e89eca-12bc-4d32-ab5d-828081437397", "comment": "Malware payload (RustyStealer)", "value": "d336d0fafc85704b4c2df1dc43583769c05a4577d2a7214d82ba77c1b1eb2ec5253fae8c8b969a6e738ffcec47869ace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181162, "uuid": "bfc5863a-0e9f-4657-a791-cc206868afa6", "value": "T18FA56B12F69199EAC169C17492076232FA317C490735BBFB1BD4A7313E66BD02E3D398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181162, "uuid": "d2b2d877-1b08-4912-98cd-9edec8a56724", "value": "22cbc0e881202ce6323c4dbd87ecdfc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181162, "uuid": "b5f82b8a-f72a-452d-be2a-d18ca7f36d25", "value": "24576:gHMLqiIAu5Y53oW4IuJF4duPZADbHR+sZnIb6bzfTZQn652GOA2u4dy:3LQASY5z4I0FsuPc7R+onIb6bL48YVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687181162, "uuid": "96ebf247-4718-4a1c-8a52-81b54064d286", "value": 2082816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687181162, "uuid": "5a1103fb-148a-4123-b878-1426f14ecd4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181162, "uuid": "50feca27-fbfd-4bb5-bafd-2b349d01ef6b", "value": "@6145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93134f2a-0e92-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687173319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173319, "uuid": "f25fdbd0-93cb-4aed-b586-58bea3b81231", "comment": "Malware payload (Amadey)", "value": "c0226926d9f315b253aaea6dc39f729a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173319, "uuid": "518c6e38-0894-4f40-805e-3e9778a94e4d", "comment": "Malware payload (Amadey)", "value": "f99105d3e75dd3ff6a90047b7ba912f4fcec7234695b9355a5d9cfb6db0fb05c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173319, "uuid": "e9e416fb-0c1d-4667-8a22-89e761628b12", "comment": "Malware payload (Amadey)", "value": "19dd35994c42d5046d18274d6c90dfde63b1302f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687173319, "uuid": "1bbf9775-82af-408d-953b-6e0358c2191c", "comment": "Malware payload (Amadey)", "value": "43fa6a75282c73abecb716413e9a950155c517832f9555c54f1219beec2d046af7c3c30d7427e0d1ee361fb9b0e482ba", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173319, "uuid": "d614f9ba-5989-45ed-aeac-3ad1288151e8", "value": "T1204612A93584B368C026C43C9523FD18F5B2790F8EA649A936CF7B823FB5710D947B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173319, "uuid": "26595255-a284-4a34-b2ad-316a8a7eb098", "value": "8bcd8b76fba5e5fd12dd6e198b4c17e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173319, "uuid": "6eeecbf7-e0fb-4c8e-9895-d8656b223569", "value": "98304:iAsVbn59o6F4qJeNFOsQZKvGmjqsajZvJZ+qtndn8UDf7HjSKkCqe:vWb5RAAZKzMZ7tndnRDj5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687173319, "uuid": "c310b652-b1cb-4432-8953-3e284f21e86b", "value": 5526016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687173319, "uuid": "7565814f-2eea-45b6-9123-2bdffb957fdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687173319, "uuid": "66199d90-1fc3-4a7b-8ae5-7f34f484639b", "value": "File.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012f6b52-0ece-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687198844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198844, "uuid": "444b21c5-f986-49f3-9858-f33e503d1804", "comment": "Malware payload (RedLineStealer)", "value": "5c3bcc836958df2d2e495372f481fc4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198844, "uuid": "32e1c5db-f47c-48c5-8626-84f225b29da7", "comment": "Malware payload (RedLineStealer)", "value": "faadfbb4f2b75ce0b608f44582390c2eeac4c3a91e5d6aba2d1d917809e1bddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198844, "uuid": "98cea20e-6181-4a93-a2c4-e28908ea9c80", "comment": "Malware payload (RedLineStealer)", "value": "91028005c6f0f2877e19fc8999cdb399d30d15ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198844, "uuid": "92ed9ed7-79eb-4e15-a267-0243e54a2800", "comment": "Malware payload (RedLineStealer)", "value": "55d6a97ec14cf24b5c9004a7c25358f290434d16883df50f78f29198e7fa09f4ab7e29990a40f5c486791081165ba450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198844, "uuid": "68bbb7a6-f80e-47e4-ae9e-1cc8675d81bc", "value": "T18ED41206BAC88033D9B9277058FA13931F357C61CDB5866B22429E4E0DB3BD5B67136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198844, "uuid": "712513be-cc4e-4c61-96f6-6cad7bac9801", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198844, "uuid": "a878ec37-d57a-47f2-8efd-9c01f5fcb5e2", "value": "12288:sMruy90gl9TwwtQyhKrLsTAkaeXJ3vv98VH21hxYBVpTNnNpwEL7b:6yN91t+LsTA7eFvCVQTaVNpLXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198844, "uuid": "b19326a2-54ab-413e-9a14-464930caee7d", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198844, "uuid": "2c193317-6f88-4e8b-b0d0-c71fb9d8f4c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198844, "uuid": "369d19af-1f0d-4595-be98-d343ac523742", "value": "5c3bcc836958df2d2e495372f481fc4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c8acba-0eaa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687183571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183571, "uuid": "cd79fa8f-fe53-49cf-8e3b-71b606ead777", "comment": "Malware payload (AgentTesla)", "value": "53339f936e84b46f0c71adaceddb25d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183571, "uuid": "7c5c4164-9c82-4f87-9915-822e6e0d8011", "comment": "Malware payload (AgentTesla)", "value": "fb0ab2548198f387789c903cb8408675b02b6a85c7d1866faa6a40212e93ca2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183571, "uuid": "13320dd6-7103-4373-97c5-7c538b83f797", "comment": "Malware payload (AgentTesla)", "value": "e0968facd6456ae0ba9aa31d446cc4b0b435aced", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687183571, "uuid": "5b762adf-2c22-40c9-9e6d-6168defe332e", "comment": "Malware payload (AgentTesla)", "value": "c9c77bc58ac9042942c2ea8636df478b49799bcdd10ba5675536a10bb9f8ff4d2d0a37a8ea5751d7812be1a0b8be80a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183571, "uuid": "bd2aedaa-1767-40fc-afb5-b2b0bb132b4f", "value": "T16335F101324881D7C02A37BA5F8A96B4B2FE4D573C35F98F2D163D97A7F0B8805A1D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183571, "uuid": "4e7f44c9-0b08-4c84-b54a-b4b8b95ca692", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183571, "uuid": "9024a857-6ecf-4c2a-b176-9906d42de426", "value": "12288:HjcvG73htU7/2eQ1x9nmH+5/2GDVGD0VL5oFr7696bYzeReEQyNE6lWzPIOwsSgV:HjgG1tCueicrDKcK9rEXAcOwn9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687183571, "uuid": "e0ccbe70-020a-4d7c-865e-92130c977319", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687183571, "uuid": "609538d6-1422-48f1-84ab-348780a9d678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687183571, "uuid": "695683c3-4795-4a3b-8da5-120cf67766d2", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9b0b64-0ec2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687193761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193761, "uuid": "a464955a-3758-4cf4-a72f-a520df2b21ba", "comment": "Malware payload (AgentTesla)", "value": "27070e69754c12f67e5541c7f0203f0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193761, "uuid": "00e18dca-207c-4da3-936c-5599c3ca1641", "comment": "Malware payload (AgentTesla)", "value": "fb40e17851858fbbec34c25bdcbe95780011fe11cbda99334b17852768cfcad2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193761, "uuid": "2c45fc0a-930c-4d14-9517-880ad6c6059d", "comment": "Malware payload (AgentTesla)", "value": "a8d9a6d9d791bd1636d51611a7d44f54cbccf28f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687193761, "uuid": "4f66a6f5-659b-4ace-ad2c-fbf7f4f459ad", "comment": "Malware payload (AgentTesla)", "value": "c051b22e9dad192939bf724e2976256c709bb6ad68a1e9443d38fbd01b60a1405a31f353a7cf673646c8c4542de4389b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193761, "uuid": "2e676cda-1da0-4bf2-bacd-b44991fdf0bb", "value": "T1EB640220B664D17BE0620A792F39D1BE77A4BD21AE58525333D0BF4F3A7DA44950E323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193761, "uuid": "15119ef6-65aa-4565-9763-087017fd6862", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193761, "uuid": "a9cf3db8-416e-4207-ab4f-99c39549a62e", "value": "6144:gYa6hDH7aETZ8mIoqCf7z8ZFmCvE7gPH9QRiAgoLKzFTRn4ETu/4:gYvS0df7z8HmqWyH9Q8HoLC5F4ETu/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687193761, "uuid": "b56eef95-8442-47f6-8e8c-992fd5425209", "value": 336564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687193761, "uuid": "73c7a919-978d-4b78-8fce-bdf75da6e998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687193761, "uuid": "39e99daa-58bc-47e2-b2af-e86eef967b41", "value": "27070e69754c12f67e5541c7f0203f0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c572532a-0ecd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687198743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198743, "uuid": "96bb0fe5-ef60-4ebd-a271-f5ee5fe3e7e4", "comment": "Malware payload", "value": "0ef8bbc4d5b4f5a8ed4e97c251160a02", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198743, "uuid": "3720628a-fab2-4658-a477-58ec90ca5c96", "comment": "Malware payload", "value": "fb7e02337610786ae877993240a0a0f9dd5dd8f0c4916c97d45149687d5422d0", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198743, "uuid": "a945cc23-ec3e-432c-8738-a4ced43f3191", "comment": "Malware payload", "value": "fe70144f3054a35824a2e3456491053bbc299f6d", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198743, "uuid": "3e9fe17c-cd23-4f13-8279-480ed9e59784", "comment": "Malware payload", "value": "955034d123bf55b07f55f44730a8c26a76e2ea7278a8e67c32e5e1f1c20bcc39b395a64c4293a1e619b3d027d9edd5a0", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198743, "uuid": "32e01882-9b28-415b-8477-2cc9ebc1eb29", "value": "T1E9151215B715664EDC1EC83550FB0C605BB2B7D2167386833A2F939DCF47B83AE242A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198743, "uuid": "826f1367-41b3-488d-a4ea-1a2b323a582e", "value": "12288:g86vg1zxFTI+bQPhAfkf7/GcAWz8dzH7iOc88gBS4hKEd5skZvsuf7x1I88zmA:gCzf8EAfjGcAWUzbiO2GhKEdNeuTzGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198743, "uuid": "5c182b87-135f-4c91-8dc0-d087b3e51246", "value": 933888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198743, "uuid": "7fc3256c-4da7-4967-ae18-25f45030ab02", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198743, "uuid": "36026a6a-ca8b-47ab-8911-6510977d5810", "value": "nPO 6789936.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a9b418-0e94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687174152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174152, "uuid": "69bc322b-36d7-4078-bcaf-78c0445060a9", "comment": "Malware payload (AgentTesla)", "value": "66053adf88b54cfcada3c2c7637dafb7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174152, "uuid": "6e7d44b2-715b-4ca0-90ed-a7a54c27c7db", "comment": "Malware payload (AgentTesla)", "value": "fbae148a8cb4ad7722dc7feec2ad6f5a8fc71a85406e80075b55b38a81f9d80f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174152, "uuid": "3b621b0d-d2d5-4bf4-b5e3-3204875970b0", "comment": "Malware payload (AgentTesla)", "value": "f5594ba39a1aa9714b9c809f54ecf3422a3178da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687174152, "uuid": "50f8db5a-73d1-4609-ab5d-1b288be5bc0e", "comment": "Malware payload (AgentTesla)", "value": "1773af44ac55a9410bdb7c69d75ad741c565a21fba8fbb9eeb8bfd95995a0c65126203eead77c9c9aadf6340928b3ae5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174152, "uuid": "df855e6f-74ce-44b7-baca-cc499cf12c7f", "value": "T15192C035D90DAA35F376D3334368838EFA1D50C7AB5AE07D29E991DA2132D874B37448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174152, "uuid": "4e35928d-72cc-428a-bc25-5bffc939bf8c", "value": "384:Y6R7Ka8MB5WF9bSEvY5Px/SFAd9pSZ1D1d3emTzmJDcALQHyxjPC6c72:JJZZjShhzadjSHDfuQmdxjP7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687174152, "uuid": "fe0ef105-e97f-44f3-b665-555d26d36f33", "value": 19883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687174152, "uuid": "24c3505b-6100-4188-bd0c-fb255374697e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687174152, "uuid": "5210bfbe-6916-45a6-8ee0-574accde7616", "value": "New PO 700218943-20119.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9cbe44-0ec6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687195772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195772, "uuid": "1fd20517-b58a-4d15-8f92-f6c9bae1b549", "comment": "Malware payload", "value": "613431925fc9e5c5887da278f34be05b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195772, "uuid": "7157a11a-1909-41c7-bfd6-0e687eb9e7f8", "comment": "Malware payload", "value": "fc3674b81350c17f15e597ae48783f545890592461d33643a952dd5bf71d9ad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195772, "uuid": "945ed169-79b3-450e-81f6-df3f45a51bad", "comment": "Malware payload", "value": "e674b5e106997c6a4ce47d19f309db9000619d7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687195772, "uuid": "2df36a12-014a-4853-8ab5-901360e11ac9", "comment": "Malware payload", "value": "0cef00ead36b6b93a5aeb0ee0bfc84120b10451d64800e2954e62fc438028948a0f0543e87e62a7810d9df20435e9210", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195772, "uuid": "fa15c068-7667-446a-8339-1cdc4e4fe330", "value": "T17F86331A2B0BD5E4CE55E97DDC415803CB22F9B9B918D42D070CF7F12E0E3E5AC69A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195772, "uuid": "c1872d33-ff9d-4434-8535-92d2d8244581", "value": "196608:F4HumqUTr7CpjbLnbD3r3OCJL8bJuk50f5n5B7/Il:6OTAEHLbz6CV8cnDBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687195772, "uuid": "537d92f8-f272-4e9c-9d84-1db0fa7d503d", "value": 8563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687195772, "uuid": "e8b4281b-6c60-4b42-ba80-d1a69def3a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687195772, "uuid": "c2694794-8b56-4cac-a5a5-1823ff048532", "value": "SecuriteInfo.com.Trojan.MSIL.Inject.30484.2469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7054bf22-0ec8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687196453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196453, "uuid": "2bbc0565-f02b-4084-a25e-0a9c4fb22b2e", "comment": "Malware payload (Mirai)", "value": "b8a0f2fc7c58915331bf933d939ebbf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196453, "uuid": "62c274ae-6a98-4860-a0e7-8ed66a4ee832", "comment": "Malware payload (Mirai)", "value": "fc7ce1b4942eb928424d14dba2cccb1cf128d1658b8e2dfea47958c44dce266a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196453, "uuid": "ddef3722-760f-40d3-8783-b35ebbfc1b58", "comment": "Malware payload (Mirai)", "value": "3bd8b5914b94de3b79a306ea8d003d8d3a6311a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687196453, "uuid": "f24584fd-7e1e-4e94-8f2e-3c705ae862cd", "comment": "Malware payload (Mirai)", "value": "a4fc82ca2069062ba5144d4aa32814b54ec91195ae2587aa46c364bcf631af337111975ac3cbf10cbec0ed9a8c61ec74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196453, "uuid": "1c2d88c5-c88d-496f-8f40-f60a78fc19ed", "value": "T134536B31AEBA3D27C0D0A47A12F34325B2E5175E35A8C72E7D620E8EFF146506613AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196453, "uuid": "0146e526-1977-4f37-87d2-590aacd90d4a", "value": "1536:QwCR/NmrSAkqTe4HuXSR7vFvQXPFlfwV0kD:VCFfMnOCBRkY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687196453, "uuid": "bac6389e-fcb5-4df9-b8f5-e3e28c59e659", "value": 64888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687196453, "uuid": "4fd9ff56-8063-4ba2-b493-eaed93410b39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687196453, "uuid": "ad8e89ce-3d7a-406d-93d6-fced9a7a4a03", "value": "b8a0f2fc7c58915331bf933d939ebbf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045154ce-0eb3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687187252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187252, "uuid": "bb730668-27f1-40d3-b3f4-9ea9eefe79a4", "comment": "Malware payload (Formbook)", "value": "29a008cff78f0506d3dea78d44caf59a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187252, "uuid": "4031a27a-c574-4458-a18e-4088c4bcef69", "comment": "Malware payload (Formbook)", "value": "fcc8e7e9ee856cd2e32825a3a7de98d558f51f0c8f79f82a415108b40ee43255", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187252, "uuid": "3c339509-b945-46a4-a84b-a4b738ff7359", "comment": "Malware payload (Formbook)", "value": "98456597daa00dd7916a501130db6d27a7759b43", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687187252, "uuid": "13fa1a67-dcea-48f2-9a7f-77fb11105e7d", "comment": "Malware payload (Formbook)", "value": "109765c7213193d95727d219f4c760e297490ed4b2c8b565c987785634cd5a951a2c9026914a616a767bfd5a11be2ec7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187252, "uuid": "fc9e8856-be6e-40be-9f43-1b1923f2782c", "value": "T1D2742373FF7498AB580692542CF729FC2643CFEBF1439B56E84CB7C322995A2C622505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187252, "uuid": "e272feca-d0d7-478b-8c18-823f49a1d61c", "value": "6144:hU3YOEKQymAVJJjaGwuTnqk/OoW/GIgOSadJf5ZLhWrFj6yB6nPw3VaW:h4mAVfWiqz/vgOSavf5lYrFVBXaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687187252, "uuid": "247f24a0-5c5a-4d3c-b65c-29a224bee1ba", "value": 348104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687187252, "uuid": "7e1e10e3-69a9-454f-b0eb-36e80b50b516", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687187252, "uuid": "107a19d3-b422-4f09-8ae3-e048fbe08f8c", "value": "NIEUWE BESTELLING.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21536d12-0e7b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687163249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163249, "uuid": "4bc5fdc7-ac2d-4f65-97de-d1d569a0ab6e", "comment": "Malware payload", "value": "3fdb14ac299d25721c21859f3f7f23d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163249, "uuid": "f54335ca-55d5-4e36-abec-adfd70cb8e37", "comment": "Malware payload", "value": "fd3650c9e744136e098385a16b36c273ce073836ca011c1b1168f9af3061797a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163249, "uuid": "eece8ad3-2747-4699-8d38-416c1bcc66fd", "comment": "Malware payload", "value": "5bb16d456ccc5d39b31c88dad1e459d29a247892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687163249, "uuid": "c7e59874-51b4-420a-bc50-e64c12f9b438", "comment": "Malware payload", "value": "f7be8c2c013bb9d66d2f7da012040e45fc4b01e2e9dcb079e91d73439d6bed79c0c241a0b7edcb097ed1478d271d07f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163249, "uuid": "d832f2c8-05c0-4315-8efa-3780a93642d8", "value": "T15D744A00EA01953AE93799B75DFE946DB628AF540B04168793CC7E2D4F3B4E07E2B11E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163249, "uuid": "fa3ac2b2-154d-40a7-92bd-cca6fc9941cc", "value": "1e36deb42b4a97dda659ddbe9b7dfbfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163249, "uuid": "ea5677d5-2cc1-4bcc-ac6a-c31598902e84", "value": "6144:JmrQa97GXy354rNDszYD9Gd15mOSIIQRtVj9ss:Jm8C7Z5TzldOOTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687163249, "uuid": "9e4cc1e1-1e25-4b1e-8e3a-899e2be58e99", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687163249, "uuid": "827ae414-cf5c-42f8-b949-d1d2bfacd2d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687163249, "uuid": "8d7481d6-4aa7-4391-a88b-4078c1390769", "value": "\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb523b3-0ea0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687179326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687179326, "uuid": "353f2242-90c0-4782-9692-2d675bd8f0d6", "comment": "Malware payload (RedLineStealer)", "value": "784a0dd84e1a911aa5a6b52a19acf069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687179326, "uuid": "4837e17b-4010-4f32-9868-728d9a9bb35b", "comment": "Malware payload (RedLineStealer)", "value": "fde7d0b48ad316598693b9cc8a47f9a927d87da67027384ef6719375a8cc664c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687179326, "uuid": "a0855db6-2a6d-4139-bfb1-e43957c11a9a", "comment": "Malware payload (RedLineStealer)", "value": "a1d1828c0791609dd761f895d6f644dae8f56a32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687179326, "uuid": "68a509aa-115f-4df6-a21e-b8a1def454ae", "comment": "Malware payload (RedLineStealer)", "value": "0ec1f7a1e8ed5523dbddfe9e317682179dc4459ab1e4d80e300c362ac3edef001903d4d304dbe3b51945cbaa8d712a5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687179326, "uuid": "1071aa68-e148-4d0b-9993-ab365c75242a", "value": "T172544B0FB5C50336E471103D2BB02956EDEDBC910D34ADB73A6CD329116BBE2A9690DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687179326, "uuid": "f1915c28-0692-49ed-8df1-28505e32ecd8", "value": "d91fa928c738702455bfa66ac3685503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687179326, "uuid": "a98ee76a-eb21-4e55-87a5-795a13c21581", "value": "6144:0jbab2L7FAUjnFM9P3Z73jLxYKJk+JyvVLMl:ua43FOLxtRyvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687179326, "uuid": "ca964168-17a3-42d5-8611-1a949620286f", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687179326, "uuid": "f36146d7-0375-4a14-b067-5394d754719a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687179326, "uuid": "36674b68-ae81-4bc3-b0e0-831a1d98b9d0", "value": "784a0dd84e1a911aa5a6b52a19acf069.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51670c24-0e97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687175356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175356, "uuid": "98286082-4e1c-43a8-b73f-dca362286c7f", "comment": "Malware payload (GCleaner)", "value": "abf743ea31c02a5020fa0d52fd479f9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175356, "uuid": "30814834-65bc-427b-be22-93a4b81a98c2", "comment": "Malware payload (GCleaner)", "value": "fe6729e76130be23d0128bb43888c83febc0e3ff2301cb435e13c90cd45dea48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175356, "uuid": "8d8e6d01-5627-450c-8fa4-d1ba4914fdba", "comment": "Malware payload (GCleaner)", "value": "6ca9f24732fbeaeedbc9baee552614c6f81b16d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687175356, "uuid": "9f30ebae-2eac-43e6-82db-0e30febfec06", "comment": "Malware payload (GCleaner)", "value": "b971bec0e4228f60c6d3220b4274bf4ee90ae24cf87eeb6ff9931b3665b6b8629044ff28c75c8ca3ff43b4633c381148", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175356, "uuid": "7e43e5cf-b4e2-4b8c-baa0-4b930a524158", "value": "T1F6646C53A6E03D54F935DE728E2FC6E8360FB6504E49BB6DA128EB1B04B11B2D273711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175356, "uuid": "bcbaadcf-80a6-4c12-92a0-46fd8cfb686c", "value": "fbfdab5bab62efe9f7a82229783d35ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175356, "uuid": "fba3345e-6074-41dc-86ca-1fb575218b51", "value": "3072:85Pel8rqw1snTJL5gczOd635/6eaY7K0TeMriqIv8XpFGWdEP/WGR85UrxEsp:0elHnfP3F6ea6KM+8XpFGWdEPeee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687175356, "uuid": "60ba0674-123f-4f9e-af1a-012a21d9a069", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687175356, "uuid": "09942bad-ee0c-48e9-b9b1-60a14a25d1f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687175356, "uuid": "f9250c91-b698-4e83-962e-65d7de9d9917", "value": "abf743ea31c02a5020fa0d52fd479f9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff9eed1-0ecd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687198681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198681, "uuid": "a40eecae-cefa-4cd6-8cd7-144af6f28567", "comment": "Malware payload", "value": "f08796344aab6d080197de73a089e441", "object_relation": "md5", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198681, "uuid": "08689c4c-ad73-46b1-9ab0-60582ffbd753", "comment": "Malware payload", "value": "ff484f716796a61f6448c1f060de1129c063777c5370053aef71eb0f0c84b396", "object_relation": "sha256", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198681, "uuid": "ac3b1c1b-7a59-48a3-ade0-429c6e7dd152", "comment": "Malware payload", "value": "8249b39e3b3a68ed43a26453390e62ea89a3b15c", "object_relation": "sha1", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687198681, "uuid": "c2224333-de25-457c-985a-968b91df28ff", "comment": "Malware payload", "value": "ef8396416b9b1c16fd1fed98c7c584ad5775e6802150ba95eb1d561f74c532e813108cd7be1dc8377647c74b703426f8", "object_relation": "sha3-384", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198681, "uuid": "ff13863b-f023-476f-af2e-a89126fe4a67", "value": "T13E54235C73D0B33436A60D5210F59CB09AAC96A64F887F3F02DE6713B0A5D7C5B06AD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198681, "uuid": "b3e07535-8ee3-4991-b917-cf2eb3dcc9c2", "value": "6144:Oy6s42F812J1aGQY6EdQyS/dWxCnvRhQZ8w3YK0QugYYpWHGmpqG1e:EsBG1yV0dWxCnvRmIK0QNYLgGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687198681, "uuid": "773a550b-585c-46e0-b330-83a828067455", "value": 301896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687198681, "uuid": "2fe4182c-1f33-444d-82db-f88c29cfff5d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687198681, "uuid": "61fce131-4fcb-4f31-adad-78b99ef5db89", "value": "ncopia_della_richiesta_PDF_exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2087d59-0ea4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687181209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181209, "uuid": "b8eb09fd-e920-41c2-8ca5-f4076c4684fd", "comment": "Malware payload", "value": "b751cae832d7a8e18c0dd56cc868e86d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181209, "uuid": "d7d75de9-6054-4c04-b658-26903953c5ba", "comment": "Malware payload", "value": "ff710d7bd226814a024262134d21e76da89294a7f7f576756aa1029d4438ac07", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181209, "uuid": "10ef4470-5aa5-4b96-b388-dcabfc2e55ba", "comment": "Malware payload", "value": "aeea3d4540e1ac9ff98deefd13b635a9fc21a61a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687181209, "uuid": "bfcc0570-4b95-436a-8123-8355e7f8a15c", "comment": "Malware payload", "value": "61499cc44453f365a202b8d965a27b8c372118cf2e123412354aeff4ae99c307c57ff6c6ac262ccbcb3f21264ae02418", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181209, "uuid": "737eba2d-05f6-4ac4-8d46-293ab617f76c", "value": "T1B695CF25F3C7C522C55C017BF958FE1E1938BEA3473041E7B7E9396E88B08C166B9A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181209, "uuid": "032c2a13-8867-441d-943e-7035ec4ed3ab", "value": "24576:q7wxFN7puyi4QX851wfM/3Flb1gqCMWOmjUU2jSdKQmt0O5KFjS1CeCGqctN3:q7ana851wfM/3F11FWOubdKQw0O4Agk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687181209, "uuid": "27724070-5ffc-4f98-bbf5-3b5611b1a824", "value": 1960960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687181209, "uuid": "4dd272bd-295a-4103-9746-ae321cb72ce0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687181209, "uuid": "18ea1acc-6bc6-4c1c-9d0d-ac4be7734edf", "value": "WPS_Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff446b6d-0eb4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687188103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188103, "uuid": "84da6b01-4241-440c-baf3-c9ab10b1dc5f", "comment": "Malware payload (Mirai)", "value": "a3a2f70b8220e56af1474c6d03a4b5d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188103, "uuid": "e71a7cab-ffa9-4131-877f-2780196997dd", "comment": "Malware payload (Mirai)", "value": "ffdeea8fcd5660a237bc45d29a30d0e4732aaf0bcf6def190f48ba30443f50d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188103, "uuid": "ee0f3bdb-a1fd-42f5-b8d7-35d14f20d4ee", "comment": "Malware payload (Mirai)", "value": "f80bfa225baf7b9686dea2a7b12c1185bb4d0ae7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687188103, "uuid": "565f19d8-e470-4329-8620-ed213d9141ea", "comment": "Malware payload (Mirai)", "value": "13a2b343305fbea907670258ecb71261d1a1e1ca601b476995a1750be1dd4a97304c27c46c695c6401925bc529773c26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188103, "uuid": "efd6951d-90f4-45b0-a589-96e28879a72e", "value": "T122245D46AA808F13C5D2277AB69F415933329764D3DBB3068D286F743BC766E4E37205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188103, "uuid": "58dab7e3-dee2-4e00-b861-630050c46689", "value": "6144:J8O5NGLSpWk7EawV4sFLUlgZomDOTHIM/9JoT9l/:J8O5NGeHEak4sFLUlfmD4x/PML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687188103, "uuid": "e71465b2-6c30-499d-b995-8ad30c43f7b2", "value": 214701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687188103, "uuid": "fd2d6863-f6d3-4494-8459-e6e096315bbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687188103, "uuid": "083f0422-6398-45b5-a057-b8793157a3a3", "value": "a3a2f70b8220e56af1474c6d03a4b5d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }