{ "Event": { "published": true, "date": "2023-11-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-11-25", "timestamp": 1700956981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4a9f5b75-27fa-4a98-bcd4-724b6650adec", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cf46fd-8b82-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700910420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700910420, "uuid": "2311573e-458f-4ff9-ad28-32a5c83a9c98", "comment": "Malware payload", "value": "fffe4cae0f0338ee4d3cf42a35c1315f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RacoonClipper", "colour": "#C56B00", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700910420, "uuid": "0d3d1d23-acc6-4bcc-972c-e23602f86b05", "comment": "Malware payload", "value": "04e3926ce6762b1dc0ce2ea8107a36e9bdda11673ae5b333bccb81a72690a3a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RacoonClipper", "colour": "#C56B00", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700910420, "uuid": "be7c0cdd-8077-4469-92ee-88ec2a0de936", "comment": "Malware payload", "value": "3785113edd826b04469b5cec5e4b60dbb7f51bfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RacoonClipper", "colour": "#C56B00", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700910420, "uuid": "1a6484ea-b295-4ac0-bb28-76f939c7121a", "comment": "Malware payload", "value": "5f45f2ce68e0686a50ff488aa64e84d58072b74e5f18d14cb970c9be9fe4ef0677d6b5f6852a23355f5915017fddda0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RacoonClipper", "colour": "#C56B00", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700910420, "uuid": "b5bbc2cf-9dbc-4508-b265-dce3eba93db6", "value": "T1DDC6F123BE97C5E3D2991737C5AA11104770E882B713FB0B7A8E23295863B779D4361B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700910420, "uuid": "9fe6f446-e573-4a04-b574-e26731c507e2", "value": "196608:ORs7fuoXLXtXd+MLcgcB2uy+nZge4lhSDNFFvssPVnaw5WCy8etE5md8BSceofTN:8KmUL9XgMIeCKhGQstZW/3E5m2FeoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700910420, "uuid": "f4ac2bb0-e7b8-4517-897c-a711b4f3989c", "value": 11601560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700910420, "uuid": "4735c21b-bd6f-47e0-a3d8-545ee1707fb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700910420, "uuid": "b4dc396b-1189-4852-94c4-670121fa9a66", "value": "C4PROloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe807531-8b82-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700910522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700910522, "uuid": "78475836-3850-4e5d-9e50-449f382c1a51", "comment": "Malware payload", "value": "0886591e54c2439ece1541c573f11d35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700910522, "uuid": "a2542e0c-fba7-4934-8241-1aaecab4fdb8", "comment": "Malware payload", "value": "05f8f506a4418735bcbcda961c275ee048d8e5b1110cfc7ae75f11c12486704d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700910522, "uuid": "1b3b2fca-ee73-4634-aedd-7d435268e093", "comment": "Malware payload", "value": "223e96cbbf39e38eb526741bf714c0959356cf93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700910522, "uuid": "7ad20a5c-1539-4dc2-aef3-38062e9d9bec", "comment": "Malware payload", "value": "0b2b02fb32b08c25ac9fcd14fb57cd5463116ad74df63dc891696bcf7ce90a3aa3a02c0d195690da54d684841fdfa679", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700910522, "uuid": "d7ce79af-3775-45e3-a275-c2cc40bb2921", "value": "T1D8757B22B56309C4D9374CBE93F1A190A6F32D4B9602C36C7A6476618F016CFBEDC66D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700910522, "uuid": "74731e79-cc45-4bb1-ad13-8fe47c29668e", "value": "1ae2f82dd7856f68aa07d49752621f38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700910522, "uuid": "1202ef1d-2c00-4ffe-a994-b29fe31974f5", "value": "24576:3PD+hc2VyZ2C4grbH1D6/rp7uTFNuU12SOba8OZtkIwxMqFbv:/yhrVO2iP1D6/rJuBNDxvZtXzqF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700910522, "uuid": "31f2ad67-b736-4d78-8a19-0dc63898ef47", "value": 1637940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700910522, "uuid": "3428a034-aa75-4fdc-a189-b964327e895f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700910522, "uuid": "3be71409-1e48-4648-97ec-9991982ffb17", "value": "S\u0435tup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9f90f8-8bd1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700944072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700944072, "uuid": "777a7532-7751-46c5-96c7-b9ebaf56b775", "comment": "Malware payload", "value": "f63a40899e72aa3ce48bc9bd6030f500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700944072, "uuid": "e6139efe-3286-48dd-ae7a-3160c5ca20ef", "comment": "Malware payload", "value": "07cfe98212136c2530608c2ef759f9a6ca5573027896f9a53c5b9c70c7d475a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700944072, "uuid": "2b63085b-d8b3-4392-8f46-c37e530df920", "comment": "Malware payload", "value": "ff3c92addfadbb1e80ad302e9e37f81fe1637929", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700944072, "uuid": "bc55a993-9520-4890-970d-faafdf608649", "comment": "Malware payload", "value": "1be8c24cc6816ee87959f979d19fa7531a4a5de3e4dce914768c63dc2719624ba6e3ad1965d9b2dcb25d09f74f91f117", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700944072, "uuid": "0e52670a-0c79-4dc0-9508-9118e9e37b63", "value": "T12F54C71392E13E46E9268B728F1FC6EC778DF6508F5DBBA962189E1F04B1072D263750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700944072, "uuid": "5e11b4b3-c14d-43d2-bd7e-ad737a7d7b78", "value": "c0846180de212a99e5224d9162840371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700944072, "uuid": "eaf35c27-f619-4f60-b3fc-3375f802e153", "value": "3072:hLcOOtdAgW7/CZTH37PVW2gY23hNnk8FQ5mgB1ix5kVyBk3eFx/RiPB:qdt+3uZTH74tYcnf4Ad+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700944072, "uuid": "ee868a9b-3fab-4b51-af66-af2a1c5f2ed5", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700944072, "uuid": "234b894e-83fb-4c85-afb6-71a2fcd0d81f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700944072, "uuid": "8ffb0a0c-c980-4f82-8679-ee70e4abff29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75461d8-8b45-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700884203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700884203, "uuid": "3fc02a92-6baf-464e-b359-72729cb17fc0", "comment": "Malware payload (Mirai)", "value": "67e277a283e813aa51aa76476a0521fb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700884203, "uuid": "d5937cea-8746-4a33-a45e-b9595677081b", "comment": "Malware payload (Mirai)", "value": "0c6622a3a947315c7b50da2a3bf9f39277236c08e2054ed2cd44f3faf63d928f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700884203, "uuid": "80990232-0437-439a-ba93-09dfaf64daa4", "comment": "Malware payload (Mirai)", "value": "7cfdf561249485f2ad8fc30ae72974d752b2f002", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700884203, "uuid": "47844a7a-f5b1-499e-bc9e-c07ff3103d3a", "comment": "Malware payload (Mirai)", "value": "1e01de3d1cca2a83815fd181b41af622895a4f0d183c008246698448fd583338fa825efc340686279adcd042ca827aa7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700884203, "uuid": "89dad8bd-a35f-4e0e-9160-fc824a0193a0", "value": "T1203302A217ED6AE152F04773FC33F819A29C16E88C6730DA3CF06556B3C58164EF2686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700884203, "uuid": "40c33571-a345-469c-8115-62fec9d88153", "value": "1536:u9O/ZMAXIxNUk0HwGfPqF1aBexo4opKZbt:u9O/ZNKyMG3qFUF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700884203, "uuid": "8699e666-c8b4-46c8-a613-c942927ea1f9", "value": 52656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700884203, "uuid": "977d09e9-3878-409c-a06e-f9dbbea40a47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700884203, "uuid": "d0bf0bea-f3c9-48f1-989f-6b2be98c97ac", "value": "syms.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d7e80e-8b5f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700895334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700895334, "uuid": "b669827a-dfe3-4f68-be60-a416e5a6b997", "comment": "Malware payload", "value": "7057d64851b78479bd432b7606006eed", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700895334, "uuid": "e7b5de0c-0da9-4eae-b125-eadc8b0a0e2a", "comment": "Malware payload", "value": "0c9fc20ded9d618e0ebddefb1fa4aa10169b7c22320a7589fcd8690ca602152a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700895334, "uuid": "068ddc7f-d833-4dd3-a409-9e3faeb8f1a3", "comment": "Malware payload", "value": "b9f08abf305ad8cbda08c9d9bde94f569107683f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700895334, "uuid": "ec0fcc7a-d33d-4ce8-ae5e-2a7f1f90c2a9", "comment": "Malware payload", "value": "07a68eeb64e02f90401e6f87e0d0ecc4400736355e101efbdf06c085e4a400475682993f9e760c5f34eb77123176d2cb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700895334, "uuid": "b61aa229-d808-4d19-8c8f-c87c4178ec15", "value": "T169F33A46FA814F13C0D71776FA9F424A332297A4D3DB73068918AFB43F8669E0E63915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700895334, "uuid": "5ec409f2-5433-4d23-ab6a-27dabac40420", "value": "3072:+kMqrOPPKhylAYapv+VwzlQkvF0u/fYwbZn5R6XD7nmM/9SAVolsYb:+3T3k0AYapv+Vwzqkv1AwR5R6XDLmM/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700895334, "uuid": "e6e9ba90-8386-4c04-bb34-2c9ba4651f71", "value": 168709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700895334, "uuid": "150b6965-63a8-481a-bfe7-d909b847d76f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700895334, "uuid": "c34e77de-56d1-48a4-a5f4-10246180057c", "value": "imaginebeingarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397eecd1-8bc0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700936820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936820, "uuid": "d9117d7c-5210-4109-949d-098fa57f0a86", "comment": "Malware payload", "value": "a1b4f0ea99c7311fe3a855ce3b625d3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936820, "uuid": "bd0ac84b-7cba-4d7d-9743-b7f363bd62b1", "comment": "Malware payload", "value": "0edbf15340660b057a878c9885d6387022e0aef1b2cb1cdcaf82058c25ec6ace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936820, "uuid": "7407994d-c709-457d-ac2d-5578ea49dfbc", "comment": "Malware payload", "value": "0cec3a886a131e8823daeaa44721f9597a330f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936820, "uuid": "026f90a8-7128-4086-b241-4d8fe7894021", "comment": "Malware payload", "value": "eae75cf2708c361b5d8c87df39bfd7703e60c296d32b2bcb0d5615d19bf69d239ab8e3cbe3e536d506ed80abaf32efb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936820, "uuid": "0dd73f5b-11a4-476d-a486-03cad2cc5b85", "value": "T15344290392E13D54E9268B729F2FC6EC7B1DF650AF597B7922189E1F14B02B2C263750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936820, "uuid": "75e8d145-278b-4e14-8255-14d0de40da71", "value": "c0846180de212a99e5224d9162840371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936820, "uuid": "13aa80bd-474e-4e13-9339-7bed7b58c720", "value": "3072:zWMzUFyjEAe4ZYoDQWP7wZlXfdXQ5mgDq5UyBk3eFx/RCgB:a+UDP4ZPQE7OXfR6Alr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700936820, "uuid": "52967ade-d7e0-4074-9bd1-9419f7bafdd9", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700936820, "uuid": "21615324-d5d6-4029-83a9-29b8dca62478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936820, "uuid": "363bc063-b857-43db-9117-e0dd6dacd1ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9b57aa-8b7b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700907326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700907326, "uuid": "8569fd01-cdce-4bd0-8c44-9a857d5bdb90", "comment": "Malware payload (AgentTesla)", "value": "90b792cf86d9afd7bbd1f48e5dc43cb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700907326, "uuid": "6148edb1-a48b-49e2-90ba-4fc48e8b16f0", "comment": "Malware payload (AgentTesla)", "value": "0f3ff1ded6ea1d1f1f99e20142508697e403253eeb8323a18476ff46847b22ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700907326, "uuid": "57074d6d-b53b-4a98-8830-47eefffb8536", "comment": "Malware payload (AgentTesla)", "value": "10205a12730a7a0e8c6cfbeda590513e6162acf0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700907326, "uuid": "0673db73-de34-408c-8f77-206d15cf57a6", "comment": "Malware payload (AgentTesla)", "value": "e52260afaa2d5b5a919e811a062b1df610e79f81acfeac9601b5254e005b9122188f0ef7c1872621c895be725738fa78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700907326, "uuid": "cb9f93b1-3d4d-4b8e-ae8e-63510b3fa343", "value": "T143E412F6713D26AFD95612FC0860D10153F1FD3640A2D2DA6DE276CA81FDBE19EA10A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700907326, "uuid": "a9d42593-09c8-462d-9577-980f1a463090", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700907326, "uuid": "f0f0f656-0b77-4e8b-b5aa-5f22aea24c87", "value": "12288:7WE6jD/BFpk1ZzjJ4MrZ+UTuyRPFebWEbh2CKhdYpuUeAENz4:qtD/TOzJ4MrZ+5+eWEbhpK36uUXEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700907326, "uuid": "fe23e07b-7e48-457c-ba2a-f3ed33c5f4cd", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700907326, "uuid": "14adeef0-2267-4966-9df4-77dc4bbed6a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700907326, "uuid": "1f312040-d091-4a16-9a97-122a263073c1", "value": "SecuriteInfo.com.Win32.PWSX-gen.13139.11757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef6aa04-8bc2-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1700937608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700937608, "uuid": "7c9dbfee-7206-468a-8f86-f34bfeeb4838", "comment": "Malware payload (Stealc)", "value": "eb7690c80160fa324934dc49313db30e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700937608, "uuid": "7d018301-884e-4987-b5f1-c707bed8224d", "comment": "Malware payload (Stealc)", "value": "1004e1aa6d023b53325d5d8f9aeec8d7e13476b8e3810ea1584641a134da5619", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700937608, "uuid": "1277922c-ceaa-4042-aa21-30f29654e44e", "comment": "Malware payload (Stealc)", "value": "c77c21384269c2cfc2c0bd9166449b699e661204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700937608, "uuid": "4d1762ef-cb42-4243-94e6-31a35c4af4ba", "comment": "Malware payload (Stealc)", "value": "f5e409358c5b62cb32c45173e3daa733d43978b4d92b12d119a2303bea66b11b6bb21856ee1a306db0193752661cd161", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700937608, "uuid": "86089de7-22a5-494c-889b-fcc2daafd9b7", "value": "T1E664A24382E13E44EA268B729F1FE7EC774DF6508E49BBB922189E1B14B1176C663710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700937608, "uuid": "880bc09b-4e98-4b4a-a683-026f539e6bc7", "value": "5436687cad9eeb8d4746b898301812f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700937608, "uuid": "0566b523-a8f1-49e5-adf4-4d18c9420762", "value": "3072:nXaHrjgb8Vc4mo/eD1RJhLwk/+/A5naGHRki2WxBJbI52af5XyBk3eFx/RIAB:Xangb8mthke+/KfHLJfac5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700937608, "uuid": "9666c21b-8088-45f0-a8b6-191825ab4bc4", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700937608, "uuid": "ad805468-f925-4897-858f-609cbc85cb54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700937608, "uuid": "dc7b863c-1756-4d36-b92f-d888e0dc9e7a", "value": "eb7690c80160fa324934dc49313db30e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730beb4f-8b30-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700875069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700875069, "uuid": "ff4b36d1-de73-48f4-9630-b8e368d0acb5", "comment": "Malware payload (Smoke Loader)", "value": "5fc13ae876abfaf17064f002a33de0d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700875069, "uuid": "ca5ab20e-ec7b-4eec-ad85-0f551cd55012", "comment": "Malware payload (Smoke Loader)", "value": "10ee1aca215a5ecbf4bf1088639b0903ff0fe4801c75c1c047bb2db5c30b9bd6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700875069, "uuid": "9b8236e2-7f28-4559-b619-51c5ab51a2e0", "comment": "Malware payload (Smoke Loader)", "value": "e137a1ec7a87dffadd01f96a480ee47c6c39498c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700875069, "uuid": "ef3925ef-9dcf-45d6-b548-aab6dfcb1f04", "comment": "Malware payload (Smoke Loader)", "value": "6c80b5b5f158635cf7c9adfa6179d0c0739caaed0b633421d2d87f5dc094510438b38427199bfe4fe0025cc3c66db4f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700875069, "uuid": "0f312913-0c83-45d4-8d84-c7a8d8c0d193", "value": "T16474A45382E13D44EE268B729F2EC6EC7B1DF6548F4A7B7612189E2F44B2272D163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700875069, "uuid": "c83812f5-def6-4a34-ab18-da35991798bf", "value": "ac2a65b4a5041877693100400bbe0f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700875069, "uuid": "09428534-343d-45dd-be08-180b0170342e", "value": "6144:Xo48e53vZcB1lAJkBCmFgzqEKqMT6TGx:Xo48sUokBz1E1T6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700875069, "uuid": "d8a27c04-4f1f-4e7b-b937-d92cd6b665db", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700875069, "uuid": "cddb235a-6989-40ef-a1dc-f7b3a5f82693", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700875069, "uuid": "eb58d88d-1132-4763-8977-7d517b7278a4", "value": "5fc13ae876abfaf17064f002a33de0d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec885d4-8b4b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700886739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886739, "uuid": "4263c774-4c69-4655-aa2f-f701cc461c66", "comment": "Malware payload (Mirai)", "value": "55ddda91a45a847db276cec7ee865e5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886739, "uuid": "152ffde7-7e8a-41b2-8168-6fa8134e1fc1", "comment": "Malware payload (Mirai)", "value": "136963f270c695aedd9d6b4051df4cb08d5a7bbbdf4fbbd69404fdcd7d0ef09c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886739, "uuid": "4934db81-b355-4f4a-9ff0-3ac774741101", "comment": "Malware payload (Mirai)", "value": "e502cbf407a069e18c6a075f6b2c656772236e54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886739, "uuid": "55a1c2f0-6222-4ef3-82f8-ea72a4ad4f68", "comment": "Malware payload (Mirai)", "value": "6b5909f1d552bf09c75cbbf83f9e361e95a1f98f05bee94021f3b327da31f6cc83be91b04cf471dc200997f8658cd33b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886739, "uuid": "a2c97a51-baa6-41fc-818c-68ee9f739f23", "value": "T161535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886739, "uuid": "69ff5ab7-1b46-4479-b69b-61c6a6c40f0b", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8s:N1GjR8EVGOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700886739, "uuid": "498937a0-e6d3-4349-a95d-146c10c2ad08", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700886739, "uuid": "955414a6-2f12-4674-9ffc-a9bb6f371137", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886739, "uuid": "c3a31a37-50e0-4b87-84a3-b640852bbb2d", "value": "55ddda91a45a847db276cec7ee865e5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0d25a0-8b69-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700899593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899593, "uuid": "ae85a1d9-1e0e-4ab2-974e-2010cbfa958c", "comment": "Malware payload", "value": "fe6f6a8a8dfaa8beba8093a086838375", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899593, "uuid": "0c830756-95fe-4b93-8a5d-f4a9feb2ff8c", "comment": "Malware payload", "value": "17b3d2bd9619297a22df5a49c22e937a6508e039322fcabc875da6cf77aa680e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899593, "uuid": "3a61e151-2c98-497a-a950-f70014e21fe5", "comment": "Malware payload", "value": "a065e4542a1022c2f0f0392ac6f28e529119635f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899593, "uuid": "30352398-e0fd-4b26-8dc3-5aafd5f5fcea", "comment": "Malware payload", "value": "ecd5648b6924f35bdab8d5a0ca2b02a11d0d889134850ade31bd3e607285f30806452e222c34db89bf1c6f0441d89701", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899593, "uuid": "75238a04-a830-444c-a7a9-12c177061a2f", "value": "T1470533289D840A77DABE43161771EC091A8CBC529E843262DFEB9CF4ED6790E7D532D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899593, "uuid": "cdb71299-bb3e-4957-b1f0-388a72e151a0", "value": "24576:nIPG9IArDrwJI7tSFEZzxaRkMgql/jVHR+3y:nlvwqBQRkMgq3Uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700899593, "uuid": "fc643f34-c67b-4a40-9fb1-fb1f5686dc56", "value": 804472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700899593, "uuid": "c68de89d-0859-4f05-97dd-e641b0d169dc", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899593, "uuid": "93951f17-e04d-41b8-8333-00d4b4e17c0e", "value": "Purchase order.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148b193b-8baf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700929457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929457, "uuid": "f0a98c28-8865-44a4-8f31-222912b3dfe6", "comment": "Malware payload", "value": "ba523d756b02debdbcd004fd1ce21caa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929457, "uuid": "0f08fda2-e9fd-4404-87ea-0d58d0b52721", "comment": "Malware payload", "value": "1c9bbc7877083e9526d0a19ee88f5910e81754b7c22a03d7234f7b7ca720fa65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929457, "uuid": "07f03c22-aefc-40b5-9022-46fe94f8b6bf", "comment": "Malware payload", "value": "848d0b1db9a2c7195407633d50d27cb365bfd1eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929457, "uuid": "c936572e-cfe4-4600-aed2-54437409c51a", "comment": "Malware payload", "value": "4130f30682238af79618f63f2ed9803817872050517c62f5c05375e43018b72ac53884697ca995cecc3ae22711f566d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929457, "uuid": "bfa1c9fd-3412-46d4-ba5d-1698fcc43756", "value": "T116734A4C5FCDABD2C2AD46BF8CE276420375C9A29797EF0B6C89221148323D65473A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929457, "uuid": "827932c4-0aba-499d-b592-19569c8bff9e", "value": "1536:lITqPKkDBRzFbO09fPrz4xVBr3DWzS3irxpdch6Ry:cG79hfeVpdgxp6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700929457, "uuid": "0cb89b5b-ff26-49bb-8c40-015d1193f392", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700929457, "uuid": "7f4712d7-edb9-4586-b48f-61549b04793f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929457, "uuid": "1f8137f1-e8cc-491d-ae94-aeb1b430a82a", "value": "PEL - V2 - 22112023 - TEMIKA LTD.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde0ad40-8ba7-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1700926359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700926359, "uuid": "f30c7b47-8e73-49c6-963c-eceb891ceff6", "comment": "Malware payload (Vidar)", "value": "471a0a9546307c950bde3c7c4aa66cfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700926359, "uuid": "c0841e15-20ed-4876-a95a-ffe8973fda4c", "comment": "Malware payload (Vidar)", "value": "1d7456676f0ab486a249f583847442337cca3bfc46c4148b14fe52bb25663c85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700926359, "uuid": "3d6b7678-0769-48f9-a719-f96f4ca72b99", "comment": "Malware payload (Vidar)", "value": "89f0a92b57c354336856b542f74759c72e0d3f64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700926359, "uuid": "dee84dc4-0274-4304-ae91-9f5ccd57a702", "comment": "Malware payload (Vidar)", "value": "4bff442de72021969cdf15c4e6ba52413b7a336846212e050e7ecaaf8ff2bfccdb9c55a03cdce8fb95691b7c752c45ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700926359, "uuid": "651cda49-a709-4afd-9072-07cfe270a4fc", "value": "T145445913A5D0EC63C4520F358E2C96EC7B2EB8619E6497872778EF3A69312F1D627311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700926359, "uuid": "7abe8fda-896e-41ce-ba08-9a127a5581b3", "value": "26174cd618191e0f458fd2f9d0ece6c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700926359, "uuid": "8b6500a2-cc26-443c-b068-7304ea8f4ebf", "value": "3072:5OhqIawV294/k+6IoUKPEqig1om4BW9Vca1CG9UC5Re0PAo:IUby29gkIn1g74U9VFUse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700926359, "uuid": "358412ca-c167-4658-b7c7-fb0358310209", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700926359, "uuid": "35ba6bae-cdec-49aa-9c85-0e7b30c626cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700926359, "uuid": "7c9f949d-ac26-4b22-9ac0-603fb5290035", "value": "471a0a9546307c950bde3c7c4aa66cfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5eee90d-8b36-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700877732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700877732, "uuid": "2721005e-0d12-468e-8454-59872c924a97", "comment": "Malware payload", "value": "552fc1ab56ac48bebff7d6ddb8555045", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700877732, "uuid": "a3e5c81f-b235-4f3b-8a55-baadb067232a", "comment": "Malware payload", "value": "1e1a63dc013e9571d1430993d08eb080e5f97339e107efcfdb39bae9aef8ce54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700877732, "uuid": "685e4905-4a0c-4e4c-857f-7fdb72381029", "comment": "Malware payload", "value": "a3d47484a165a3c2d0684ac495e3d8e80e81d26f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700877732, "uuid": "26efc357-2e66-4c5a-b426-253e18ee9a6a", "comment": "Malware payload", "value": "1f517e2afc0cb97b49a21ff4f11087d4153fe4195f23872af97dfc236d6f4606c1dd5472feb7a38ede64e7d0d72d1560", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700877732, "uuid": "36c887fe-ce9b-427f-947e-3117c5adf2a8", "value": "T14D859D017E84CE11F0191633C2EF450887B4AC512AA6E72B7EB9376D69123937D1DAEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700877732, "uuid": "9083a8fb-6e79-4630-af41-88e29207b476", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700877732, "uuid": "d2c2f663-1c62-450c-8aca-34abc099c28e", "value": "24576:u2G/nvxW3WieChpnoW7Y2eypAqUVZNNPnMVbhYsPfczm6BBpWgxKIC45SPX/UA:ubA3jhpTIIGnMV9f94foIC+Sft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700877732, "uuid": "57a0adec-0569-498a-851e-ea9694351d69", "value": 1737315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700877732, "uuid": "d67f2750-3680-44ae-a76e-57862ef32756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700877732, "uuid": "6cdb2d00-71a6-4532-a92a-41c310168a27", "value": "552fc1ab56ac48bebff7d6ddb8555045", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a9d0c5-8b31-11ee-8907-42010a9c0042", "comment": "Malware payload (BlankGrabber)", "timestamp": 1700875369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700875369, "uuid": "35a20270-3e8a-4099-873b-266b2b3cd404", "comment": "Malware payload (BlankGrabber)", "value": "bf552178396e2c988549aed62e1e3221", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700875369, "uuid": "a3694413-c77b-43a2-b76f-f3ddd6af58fb", "comment": "Malware payload (BlankGrabber)", "value": "1f987030ee59d137f1a419e8bd0823571cd659e2449d0a939d4f711bb06fe0d2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700875369, "uuid": "d9fc6c6b-e513-4b6e-b893-86082707a9a1", "comment": "Malware payload (BlankGrabber)", "value": "1ccc6d74268bd7131aa99fc0d523365ba83fbce2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700875369, "uuid": "54b630e6-9d99-4d20-a4db-b97396cd1cc5", "comment": "Malware payload (BlankGrabber)", "value": "a91e43551a3f75969de2540816e2f5d4f62ddd1e13009f9e696d3138da69457316f998c8099cb0ba2cb6fd6200c41edf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700875369, "uuid": "86a1240a-5d05-422d-835d-bf2387f3c635", "value": "T156763311A3A86CE9F981963EC5CAC622DB33395123B0D58B07A847B25F171AD4C3BF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700875369, "uuid": "5b62d755-fa1b-4a4d-9755-282bd64ac1ae", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700875369, "uuid": "daeab47b-645c-4802-81ef-5790b18df110", "value": "196608:uMYS648OshoKMuIkhVastRL5Di3u41D7dJi:1YSZ8OshouIkPftRL54VRDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700875369, "uuid": "abec5eec-7fa0-42bc-a5e5-cf090599e031", "value": 7677919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700875369, "uuid": "acf2c4d1-5dcd-45d0-9a1b-d68c1b0b7124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700875369, "uuid": "d768de72-56b0-4f32-b010-f638793e5473", "value": "bf552178396e2c988549aed62e1e3221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccab5c3e-8bc5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700939215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939215, "uuid": "c39d7dbe-d3eb-4530-b42e-b8c4a676cd0d", "comment": "Malware payload", "value": "c40de6eaaf26e3c4cc147364cd616f3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939215, "uuid": "fdb6169a-fb56-4f01-966e-271d0c92a3f6", "comment": "Malware payload", "value": "2320972aa2c56d4b824c2a9fa925f9f476a9860b46beddddc323c50b1ec376e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939215, "uuid": "cc62d272-92bd-47fd-8969-38e662323f71", "comment": "Malware payload", "value": "096cacb02d26bdfcbfdbaded89ace96d7d9921dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939215, "uuid": "8712522c-11a4-4e0a-a523-0387778d2652", "comment": "Malware payload", "value": "80009a5a777c8c8fc9571ce9962e3b1df6fde875e6d135e80d4661609b4c2eafe58ba696f27c25a1d16e61d78361e867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939215, "uuid": "f17a77b2-02cb-4c8e-a7f6-c6d78036e38e", "value": "T124658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939215, "uuid": "18f1c5d9-3cee-46a8-8a4c-3de8ffc301b5", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939215, "uuid": "3f4efeb4-18d2-4e29-8c7f-03c718b4147d", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700939215, "uuid": "e89d9497-3e10-4cf8-bcda-6c292c003d44", "value": 1539663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700939215, "uuid": "791142bd-45d5-4920-8538-772ed0cf24f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939215, "uuid": "9bbf8a33-b16c-45ed-9c92-7597c730c961", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370f81fc-8bc4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700938534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700938534, "uuid": "9c18b87f-2225-480b-9282-35447491918e", "comment": "Malware payload", "value": "193bf9df72716b53f91091865ad95a3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700938534, "uuid": "83a89579-3628-4aa9-bdcf-94806d6f6b40", "comment": "Malware payload", "value": "29750d9486434d4c2fea75ede7e18672c9e9fd36bf1f611674e0ae0cb46616fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700938534, "uuid": "17718b62-8e43-4a97-9107-7dab9755adcd", "comment": "Malware payload", "value": "fbe2127ccf12d1fa2d5d2fd38920c767b9595648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700938534, "uuid": "830cbf59-4739-4748-8c54-8de159900239", "comment": "Malware payload", "value": "7d63664041a1bf50b257505ff3353a50a099c55a6bfeed73dd5a184c27ad5eb190af839ed6c77ee2ee1a3596ebbfef3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700938534, "uuid": "3915196d-dcc4-4bff-9ce8-710022fdef2c", "value": "T1396623EFFEA5C0FCE1E3E23259ADC397641834455404B0ABADF40589643CCA52E97EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700938534, "uuid": "8b75f92f-fea3-49fb-9daf-1cf9dcd6d177", "value": "35af46e721c3612e443f2d1e1e4798be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700938534, "uuid": "1c813569-75ab-49c7-b2f4-04fcd3460a80", "value": "196608:Zn3JrwbTDBDkmWt7i8heVQzSjVpAK/IpjIAUPC:Z3xw3NDkmieVQzyYjWPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700938534, "uuid": "98499f4d-e10a-4b4c-a0b5-073378a145cf", "value": 7109520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700938534, "uuid": "630b0741-2804-4412-98df-1b8d89c1ce23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700938534, "uuid": "ed934714-821b-4e00-a511-ab99998e2eba", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6d6d60-8be0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700950700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700950700, "uuid": "b02b5116-2378-41ba-8ae8-ebc84710b388", "comment": "Malware payload", "value": "4781f141128ddff5788f85d1b8fd485c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700950700, "uuid": "d1f24ea4-8880-48fe-a177-4efa5d2654f0", "comment": "Malware payload", "value": "2a4b320b83021724bf132400af5180a88abce93d668d560d1640fd6180b52f15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700950700, "uuid": "452b0840-9a2b-4777-afb8-8472e243475d", "comment": "Malware payload", "value": "14c99362bb0181630b6b6f9f2a6f9e10d0759029", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700950700, "uuid": "c45c8f5c-5ac2-464c-a58e-8afd4833bf43", "comment": "Malware payload", "value": "ffb5db47a31ab46a5222d57cbde341941bc86c86d14cb9887d4f14cb1c3cb45d3d2511d721f4e607965e0ada84609b0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700950700, "uuid": "bb3750d3-a8ed-4c6a-bb55-e982f4ebaf64", "value": "T110658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700950700, "uuid": "16b2147f-8d42-489d-aec1-6359b9b5315a", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700950700, "uuid": "37e18ede-813e-44ce-9b80-126e82dab238", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700950700, "uuid": "f56135d2-9248-4393-950c-0b2685dfe1d5", "value": 1539683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700950700, "uuid": "a05ed4bc-13f9-42bb-83c2-1634677f75c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700950700, "uuid": "288052ce-f868-4cea-a750-a76226cdbc4e", "value": "SecuriteInfo.com.Trojan.MulDrop24.22194.11577.14574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772ba943-8bbf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700936494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936494, "uuid": "336fc86a-4bfc-427b-8a27-73da660b1323", "comment": "Malware payload", "value": "93720dd2305c81a9edb4bdae1f6d43ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936494, "uuid": "2014d7ca-5571-4001-84fe-477fee16bc85", "comment": "Malware payload", "value": "2a6445fa7dd0763c979a6c01111eddb0fbf1126ce05a3d2acad57c70aae48c39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936494, "uuid": "d9760a4a-2cab-45b5-b18e-662ef387735e", "comment": "Malware payload", "value": "34d78323261a44187c026a3a148b85cc8c95df58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936494, "uuid": "de9ff724-fc04-4518-9870-35c8eefaa2e0", "comment": "Malware payload", "value": "b07a4ce09e8a4f3a2ceb5bbe02e0baa7acb37c85725e16bc9066f435240f1567557ba3a1fb3d17723949cde6b4a2c2ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936494, "uuid": "f30db150-8642-4f4b-997e-5efca5a62e9a", "value": "T10F65F52F72C174CB905EA29A764E8FF3E471113469BE544363489E76EE3029B91DCB0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936494, "uuid": "87cb11b7-75ec-4f6c-b2f3-4323740c372f", "value": "7e92add36c82f5474f8384991f7bcc1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936494, "uuid": "d4e5b305-ee2c-431a-b0d0-d213309f50d3", "value": "24576:L8mB+Um5pCFkwHLYEIRfunH+As4eROiOey7KdmPT:L8mB+UqkawHXIRfujv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700936494, "uuid": "075d9e0b-7b65-4414-8c11-94468b80f192", "value": 1447424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700936494, "uuid": "4a40d108-50ff-4e0d-95c3-f8aaf0ff3c35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936494, "uuid": "28b75055-7e69-43eb-9c51-5b9ddb7b76e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce20ccff-8b33-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700876511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700876511, "uuid": "1d14a91a-6792-4f1e-8e65-ba1e67f92a74", "comment": "Malware payload", "value": "c80e8f94bfe6637b15e06aadf61e18b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700876511, "uuid": "7bc3531d-0e78-4daa-be4d-c036c707297b", "comment": "Malware payload", "value": "2bd90ebb9e56d79b4f68f92a47c8d78c97a0d4290966325c0c49744bc21b491f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700876511, "uuid": "fe1e40f0-cfc7-4c3a-a7d2-398cc6f7988b", "comment": "Malware payload", "value": "e2f2436d519f10dd0adc04522a2d94f4aa5c1890", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700876511, "uuid": "b9a5fd7a-9b5f-4d07-8e8a-33fa368fd701", "comment": "Malware payload", "value": "fdc2bcda6970634ecf7090492e4ae659c03ee09e0b79afa12777caefc58582662b09e8275037288ca82fa503028b3ec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700876511, "uuid": "022bf52b-76d2-48a8-916e-e732b8cbfcc5", "value": "T16174B74386E13D44EE269B729F2FC6EC7B1DF6508F4A7B6621189E1F44B02BAD163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700876511, "uuid": "d2f4751c-4afd-4bda-a7c1-df7a42732703", "value": "ac2a65b4a5041877693100400bbe0f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700876511, "uuid": "50bc5d05-e8ac-4656-a3bb-fec8c00c9a25", "value": "6144:IDg4ME33jX1YULFdsgDNRWNElTQrXWfTGx:IDg4d1nd9ZRLmCT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700876511, "uuid": "ae2e2e07-0094-47d9-a060-f41118832c9a", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700876511, "uuid": "663cd30c-e11e-4f42-a2c6-57e0bac9a778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700876511, "uuid": "4b527bd8-e2e1-47cb-a0a6-f8eb66fd32f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9ef44e-8bcf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700943381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700943381, "uuid": "0f0cacec-e359-4ed5-9347-57fe5fb6b650", "comment": "Malware payload", "value": "8bc31b1cdfda16c303217e42d5fd0fb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700943381, "uuid": "bc47baec-517b-4c26-ac35-efe0bfcfb6e9", "comment": "Malware payload", "value": "2c5ce077c54b36e5158871792e1e03983e71dcbabf252790b4a59abc423e2951", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700943381, "uuid": "644b4902-1fa7-4849-93a6-f9ebc466c603", "comment": "Malware payload", "value": "487185e8fa140dc50fb6b733ef1177d847ab43aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700943381, "uuid": "5817f7d3-e772-49ec-9c37-da9da497943d", "comment": "Malware payload", "value": "d7369a40696f4008408ccfa64c305c8926e61531596c46bcf801f05eab79d6eb55d10d2f31f64a256dd153afbc161115", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700943381, "uuid": "84986686-6980-42da-b807-aec126206d33", "value": "T1D6658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700943381, "uuid": "28997361-3ac1-400c-a495-8e951b05fe84", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700943381, "uuid": "69190b78-9b79-46fc-9d7b-e5528eeef237", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700943381, "uuid": "c28232a3-f238-4bf0-88f9-1147987a0bfb", "value": 1539647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700943381, "uuid": "ceb0519e-9834-4cc2-b3e7-aaa45ceaed62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700943381, "uuid": "c5209ea9-5616-451f-880a-4ee150bcdc14", "value": "SecuriteInfo.com.Trojan.MulDrop24.22194.14401.18479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc446671-8bc1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700937469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700937469, "uuid": "10d1d688-3914-4950-b4ba-7bdb269f4a10", "comment": "Malware payload", "value": "13c54df3790dbde46fbe989793e21ce7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700937469, "uuid": "2eafc213-9c84-4601-a02e-ef953f2a1b31", "comment": "Malware payload", "value": "2cc26a714371577628a15d4b25ea23af43995d7d20b2a3fd891db403915e5e69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700937469, "uuid": "912569b1-4f45-432a-bc58-5748b505e34c", "comment": "Malware payload", "value": "ed331ca706aa52e6ddee7af22da490cc001749bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700937469, "uuid": "9e007caa-3579-4f69-9175-a5368f3db2d7", "comment": "Malware payload", "value": "e26c661f5fee78fef76cfc20b9516257ac5b2d2c8527798c7500250bb7cac6caa843668143bafe81a4f9890f3e495d8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700937469, "uuid": "41fc34cd-b435-409c-8bcc-aed9e2dfd838", "value": "T1D07633A035F954B9C70A5932CF587F89A2BDE1498CE0047727684D2DAEBB091313B79F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700937469, "uuid": "1184ee9d-05ed-422c-89de-7a6d3e2f149e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700937469, "uuid": "73581da7-bb34-4529-ab47-ebc4b58860da", "value": "196608:91OMVkbPbPFUEBQXzM14+H22JZu9c7eSL2r5bbk:3OMV0jPOECDMK+W2TXLO5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700937469, "uuid": "4281748b-701d-4d7e-8fd7-817fb32099cc", "value": 7500244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700937469, "uuid": "f406621f-e101-4a2e-bf93-bf1c88ea79bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700937469, "uuid": "384c1220-3843-4cab-a478-9c0c0cd49f33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d55f9ae3-8be2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700951685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700951685, "uuid": "cc614982-09b9-4965-bac9-2a6f9c8e7ec8", "comment": "Malware payload", "value": "5ede04cedd23463820622cf3ba4acd75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700951685, "uuid": "491b2eda-fe74-4f5f-8fc9-f4da2a2edbe9", "comment": "Malware payload", "value": "2d4d0d71a305d067656e93ab37ffb9793d025beebc1c8f21d37777e7b0471180", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700951685, "uuid": "93dd7a46-d6d4-4dac-84d0-e7e0485d7a15", "comment": "Malware payload", "value": "646cea0603470a1e5c116ae18b44c79b2c35f7b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700951685, "uuid": "cb7019be-8b03-4245-af9b-2c530eb70103", "comment": "Malware payload", "value": "6918506d914960bda323dc82fc4251d17852a60130a82368a86b6a1ab1b17adc19573e7fd236662f09130d5f11eb9a18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700951685, "uuid": "f3a0f772-26e3-48e1-a2e3-d97fc43b49d6", "value": "T11C54D75392E13E44EA268B729F1FC6EC778DF6508F5A7BA9221C9E1F04B1076D263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700951685, "uuid": "cc974e80-000c-47f4-b3e4-0165e47258ee", "value": "c0846180de212a99e5224d9162840371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700951685, "uuid": "9fbdc970-b6c7-4118-b0cf-c7ea44243ada", "value": "3072:q2oT0GPqCKQVaVrOAhMu+lBaHRYQ5mg2CFds5kVyBk3eFx/RiPB:tC00raVrzhJSLCFi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700951685, "uuid": "13b5a331-6f12-4509-980e-c0416e9c1c8e", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700951685, "uuid": "b86118dd-8d1a-4ffc-8a49-11eacc27725a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700951685, "uuid": "ae2d33a6-8923-4ac9-a440-cc9bd49df05d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110aba66-8b41-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700882207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700882207, "uuid": "1eb996d9-e5e5-4b37-b421-0cd37eba5d8d", "comment": "Malware payload", "value": "cc4d3fd3e73d8eee4b4761d8f804cdd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700882207, "uuid": "d6ee8bb4-b0ba-47d7-b567-898ce0726ec7", "comment": "Malware payload", "value": "31a12e385f44e67ef446912ffa957292fb8a824295dc949ba6997986e22a3487", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700882207, "uuid": "e1f4af07-ad76-4b09-abdd-b05e44ce7efc", "comment": "Malware payload", "value": "5c2964f588f9767c19a58c666781d2eeb7fa686d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700882207, "uuid": "9993cd30-840a-4263-b0da-88d963f9f3b6", "comment": "Malware payload", "value": "7365bf4e30e70f5d5a73693a046ca5a73704a3f12fca154e7d6bc1d1ca8978107bed5445b2d2993f7f2b104ca30610e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700882207, "uuid": "afeb8505-82c8-43c1-8893-da014e8a8824", "value": "T1CD43A507AF41DFA7C81FDDB306F6871130CDB8972564272A3174EEAC7A2A58749938A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700882207, "uuid": "4abbab1e-5883-4d93-a052-67d91ae9dd7c", "value": "768:ZAPhqgbRht7Hmd+kdUk/wf14xWmZTVIXi3QCepAVGeeJelHgy8C1IrrdKZa:Z8Nvbmd+kwfoLZTVHPGeAmHgyNWrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700882207, "uuid": "19a8e8c6-5582-4439-b75d-63dd3ced0166", "value": 60196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700882207, "uuid": "d2dea853-86e0-4f63-a99d-5e7a6818e510", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700882207, "uuid": "564f3891-0ab7-45de-bb8b-3720cea586b9", "value": "SecuriteInfo.com.Trojan.Linux.Gafgyt.8622.18306", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6017f3-8bb0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700930198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700930198, "uuid": "d4d8f140-c6cc-48df-8347-0916ee321575", "comment": "Malware payload", "value": "711204c7ad7aa94657f48fbbde87e37a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700930198, "uuid": "f83cca4e-0997-44b0-8b60-13c3df3622d6", "comment": "Malware payload", "value": "33da86a999f82f99598ab1a10ba98010501249231229051d78d35b826526e99a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700930198, "uuid": "e8dcdd5b-a8ce-46fd-ae91-c3add84ad941", "comment": "Malware payload", "value": "a8ff15875a09fed650e1afbf372f361d23a3ea03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700930198, "uuid": "98777d32-17f0-46c7-af8a-ff6f51681b3e", "comment": "Malware payload", "value": "3b0409c85c83ba49e427d2ca441e98e5841619731f69e032616da70ef532690479a7948448bb5df5ce3438babd580a6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700930198, "uuid": "727fcaa4-2065-4a47-87b4-b57c016b27bf", "value": "T1A164924392F13E44EA268B729F1FC6EC77CDF6508E497BA922199E1F14B1276C263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700930198, "uuid": "2c40c489-dda4-4682-9283-14e0baaf21e8", "value": "5436687cad9eeb8d4746b898301812f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700930198, "uuid": "0e7092ed-2fe5-471d-8a09-76e3142d3773", "value": "3072:4k05xp3CUPWUEYd+PrbO0t9EX5JP0wnPiosfDr7ltI52AWf5XyBk3eFx/RIAB:N0F3jP3EYMPqX5F0mMX5c5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700930198, "uuid": "45666fcc-6dd4-42fd-b23c-f0a7ceab7d03", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700930198, "uuid": "63dbf7cc-d2c8-4351-b046-786af59203a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700930198, "uuid": "f758d51a-f81f-45f9-adcf-e32b76982b35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31073a5b-8bc4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700938524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700938524, "uuid": "b88248d8-a5de-44c0-aa3a-17e96329c7d9", "comment": "Malware payload", "value": "5c38ef0322b18059377bef0fc76f2b2f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700938524, "uuid": "e7571078-b9ea-4e7a-9c68-092ae5576d82", "comment": "Malware payload", "value": "356b0d87f6bed04f155feeaab0c7d2b7d867214c5c124584625f07cd8f3ec865", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700938524, "uuid": "fedfd405-6610-42ca-a3a6-958a87143e81", "comment": "Malware payload", "value": "6b9b7b5b10b38e05b665fbaa9fb2e4762fc5a37d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700938524, "uuid": "46b52349-960e-4570-8edb-e244ef588760", "comment": "Malware payload", "value": "1fe4aac243dcebb8cdce9aca348b05468631ceccc1641774e7e48c0eaaeb37715906b1ad3620209a5c7aeb0c7d22145e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700938524, "uuid": "1d36f62c-72f5-4a94-a176-3874452691a7", "value": "T1206623EFEF75C0ACE1D3F2735A6DC39B640830569405B06B99F40549642CCA91F8BEE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700938524, "uuid": "7e2aaee5-7cab-486a-b35a-9b9f1423216c", "value": "196608:qn3JrwbTDBDkmWt7i8heVQzSjVpAK/IpjIAUPC:q3xw3NDkmieVQzyYjWPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700938524, "uuid": "ed16d61e-25b2-4398-8221-d2bd7fa249f4", "value": 6948752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700938524, "uuid": "1b4c96af-af91-45d6-97f0-46493ed110a2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700938524, "uuid": "d171d457-f93b-419b-b080-d131b33df7c7", "value": "1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587cdedd-8b37-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700878031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700878031, "uuid": "d65c0d71-7420-4c27-840c-2c4979d89de9", "comment": "Malware payload (Smoke Loader)", "value": "41d1773285e28b1ecea4ab1ee2e6f3d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700878031, "uuid": "9f2fcf36-1ac5-491d-8b6a-597017bc1591", "comment": "Malware payload (Smoke Loader)", "value": "374759c6b7befc3ca7b914ee861abbb6ac3f7949e4c8ce08fbf55a14c57b6e8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700878031, "uuid": "3874b3bc-edd4-41c1-b9d6-4787f9184759", "comment": "Malware payload (Smoke Loader)", "value": "16737c55a02d7795566d4b76dd48cde0650b8ddc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700878031, "uuid": "ab51afe8-b9ee-4fdd-b00b-f3beab42bfd4", "comment": "Malware payload (Smoke Loader)", "value": "33639fcb2a641cc6e685c7e3900a593add0d94c75e2f288b116bfc0c3c5d8d37b068214041064348c4215eae19057459", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700878031, "uuid": "2cebcda5-65a8-4dbd-bdf6-ca8d65c7daaa", "value": "T11574B64386E53D44EE268B728F2EC6EC7B1DF6518F497B66121ABE2F44B0272D163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700878031, "uuid": "9cc08de6-4e97-4f4a-9d79-d906aa1f4d5f", "value": "ac2a65b4a5041877693100400bbe0f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700878031, "uuid": "f0e75bf1-4148-4df2-aa0a-360c8b3c169f", "value": "3072:fSb/4keCV0cl5ILWml/qoNYT8kslAhxwovhJhgyl135wHkTrYdke0:az4kekormI/lALwo5PgUMETGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700878031, "uuid": "7ffd2059-225f-4592-b793-25939d14dde4", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700878031, "uuid": "7768743d-b30f-4589-aca3-8c6422bfe55d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700878031, "uuid": "5e82069b-cc1d-4ed1-a353-11c353039e66", "value": "41d1773285e28b1ecea4ab1ee2e6f3d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed201c16-8bd7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700947000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700947000, "uuid": "bd362fc2-f3af-4014-9a5c-f5923a103712", "comment": "Malware payload", "value": "82ef8126f48267bbc13abff1214211ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700947000, "uuid": "f884b7ed-fbc8-4eae-bdf4-af3f7dbb0611", "comment": "Malware payload", "value": "386d2c06801c4272236c90d2e04db15bacffea10af82b46a13f9f14ea282289e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700947000, "uuid": "cc6dbe4f-b2ef-40c3-b0cc-b8221c53ce38", "comment": "Malware payload", "value": "0028abe17b52e5877f8f2cb2c2b9f526639d132d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700947000, "uuid": "de0fff13-4baa-44e8-84ee-9831a4ede6dd", "comment": "Malware payload", "value": "0a8edcf80365bf7aba09cbf480fe89e1b4d8d98b563bf49077536f112a5c9eab91df2e272f850690fa23cf5f99cbfaa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700947000, "uuid": "725e7c9b-63c4-4a7f-aa35-fa65ca71a8b5", "value": "T187339506BF41DFA7C81FDDB306F6871134CDF8AB2565232A3170EE6CB62658745A38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700947000, "uuid": "87aebdb4-8977-41ad-93c0-ee49b6643e60", "value": "768:hSQgNOCTduAYFV6rwvuR3vQcUzZYhoN+Xi36DeyhFXNeceErfnyvAIi:hSBNRdh2g3vQ7zZYiq7XNlzrfn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700947000, "uuid": "f083253b-795a-4b6a-b6b2-cd6b2c7f166f", "value": 51184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700947000, "uuid": "611b093a-2a78-4d42-b01f-1023cf8edd80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700947000, "uuid": "330a97c3-d620-47e6-840e-a5bd6a7ec9d3", "value": "SecuriteInfo.com.ELF.Mirai-CLZ.13548.1196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12769a71-8baf-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1700929454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929454, "uuid": "ee2cdce1-a899-4dd0-8533-3aa12e26cfdd", "comment": "Malware payload (PureCrypter)", "value": "87855d601e472d9d37e772e53029dacf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929454, "uuid": "e178f82e-38cb-43e8-b0dc-eb441709cac7", "comment": "Malware payload (PureCrypter)", "value": "39b10e16dcda487ccf77695191c4c5e45d7e3b1ca85099f4bd934f260dc7ef62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929454, "uuid": "1d6e1aae-76e8-4c19-a891-ab155e36b5c9", "comment": "Malware payload (PureCrypter)", "value": "dd320d1aab72cf9c3f3f7fb08a71aeab98309fd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929454, "uuid": "03aa6bd0-4f1d-44cd-baf1-c1e9befdb917", "comment": "Malware payload (PureCrypter)", "value": "65f1eec83e62e8e1022433c7f49d5a0bfb82f8fae64ef3833fc9d0491a38e850fd7a28f1cf92ada3b17d1f509f8670b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929454, "uuid": "05001f87-857e-4af7-935c-a782302a8494", "value": "T1A752A4D8AEDC45F2C43B47B58CB673031A23FE5A4C667E992C0AB14458734A11A73E9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929454, "uuid": "927ac65d-9f0b-4639-81fe-f1fb197e01f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929454, "uuid": "bcc249a6-1cee-442e-9c7e-966aaa5eac42", "value": "192:Cebp4jyqq7b2GG0/j4XlOgTQe4tt9nSidoo79ED607Ib:CebayqO2GGxXlDTQe49SCMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700929454, "uuid": "8b7df518-9eb3-4335-a97f-02e13b3f148b", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700929454, "uuid": "9d6e7c89-30b6-4612-b6c4-1077f9e8f30f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929454, "uuid": "53f2bfb2-10d6-4810-bc02-5588575fe397", "value": "RH23148 PO-1483.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0411d82-8b94-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700918122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700918122, "uuid": "3fdacf42-e6e7-40c4-aae7-89a49088a646", "comment": "Malware payload", "value": "3a1cb901f3873ce82a21ff01f1fa1251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700918122, "uuid": "c62a37b0-4707-4bba-bfaa-4feb481d55f3", "comment": "Malware payload", "value": "3b13f1afc77c4d537fb4b1488846b042cbdf604345954541af429fd21418e9b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700918122, "uuid": "dfd70e34-970a-418e-a506-209d7192fdae", "comment": "Malware payload", "value": "a1068b07dc55523310e1abc315616b28ddeaa7e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700918122, "uuid": "b49bc6e2-1294-4ee9-b32e-eb5d5c34facf", "comment": "Malware payload", "value": "d04b916adf2f9080d4dbfe3199ad1a414ba57db8d8c8213b8803ac86d678dae748c1096dddeb2952485f45dc91b7ece0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700918122, "uuid": "b0aed2de-8c63-4738-b60b-7c01a41a8ed9", "value": "T15764A76382E13E44E9258BB29F1FC6EC774DF6508E597BA911189E1F20B117EC2E3718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700918122, "uuid": "ebba47dc-5cdb-4cd5-a0f4-b8e327184154", "value": "5436687cad9eeb8d4746b898301812f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700918122, "uuid": "2d52b01e-2950-4c65-bcd3-9e6c050e714a", "value": "3072:/H0NHzj/zOsr/rUZHADTL6ioCrdTtS7I528d8f5XyBk3eFx/RIAB:MNf/isr/siTL6ArdRi8d8c5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700918122, "uuid": "a857f800-019c-433f-a05c-f32028f6b4da", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700918122, "uuid": "e091fb6a-aab4-487a-94b3-8682c7a89a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700918122, "uuid": "9c285b6e-223b-4fe7-a253-cbff84cff969", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e98ec65-8b73-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700903892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700903892, "uuid": "22e946c6-241a-42e5-8f6f-8b0dc1465574", "comment": "Malware payload (RedLineStealer)", "value": "55e5a4e20f63c3ee2955dda315a8c49b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700903892, "uuid": "c101efe3-ce8e-4c4f-8f98-0cecad0a2dcd", "comment": "Malware payload (RedLineStealer)", "value": "3b1ab3f60e6ff92836c45cbd4081ce88322eb185e69d1c1d160c7f4f24f67df4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700903892, "uuid": "dbaf7959-2b9b-4a5f-8451-433019e20144", "comment": "Malware payload (RedLineStealer)", "value": "3b540d1b45d71a89c5fe2420bb7fa847d893b389", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700903892, "uuid": "5d050bf8-1c02-4f64-b7f3-8c33a4764abf", "comment": "Malware payload (RedLineStealer)", "value": "9f97ad2c6048f2c0f791837347d1935e8369536e90ab634f625d7393508a59f399cb5a61f85aa3109f18e7b9dc348f2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700903892, "uuid": "765cf5da-15ac-452b-9244-40aba1b5de39", "value": "T1D924D62AE314551DE83E433DB41C38709F707C52E16EE32F95BA7AED693BB098A105D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700903892, "uuid": "2cf09817-c4f6-4769-b0ef-7f38a322652b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700903892, "uuid": "6446f28b-1514-4250-930a-fe83e6fb6e6e", "value": "3072:JoAj57yNgcrX2JrXK3hytMPRSdp6bS3wegbcONpKSq:qA57yNgcrOrX8UG036bSANbcONk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700903892, "uuid": "c1a186ca-23f5-46e0-9e7e-382bd63b7056", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700903892, "uuid": "31e69a70-018c-41c8-8abc-a0753d5d0d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700903892, "uuid": "f73b2427-4d9b-4361-be76-b30ec07552bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6eea4b8-8be5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700952895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700952895, "uuid": "def417b4-e077-4ef1-b806-b0a527f8fe2f", "comment": "Malware payload", "value": "5f0cd9ac657a0eb96e77805bb60bbf65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700952895, "uuid": "8dad6c36-12a1-4ac8-9e45-707b4c5690e6", "comment": "Malware payload", "value": "3b9714ec3103dee5d9c1f945da55a27adcba30d8cdebd6809b9769d8b9a30cd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700952895, "uuid": "b14273ac-3be7-4709-8fc6-dd61f37e3121", "comment": "Malware payload", "value": "f060b6b2537b6f8d555eb48862f30f67d000968a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700952895, "uuid": "15bc5606-9a04-417b-8a33-e057a4b30a3b", "comment": "Malware payload", "value": "f4dca3a1c13b27ffccf4205688c2ae2261a1ad14dcc546557bc128dad9962a44aaaf90c9a0d6ee17bb97f359bc1c2cb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700952895, "uuid": "aaeeb1a7-67c5-46dc-ba38-6f09d326eaf8", "value": "T1625406C923B294F2CA2BD0FE5B6A8643237BA8755561D5AA274235F1090D05C3FF7B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700952895, "uuid": "ae93a039-5f00-46e9-bb60-13926f53db00", "value": "523157735e566b276bee878a6353a15f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700952895, "uuid": "30b18f3d-c36d-48e1-8507-cfdb342a78a3", "value": "6144:3ts2X6GO3SSjYlMRSPhjw6Gl/ncS3nSjPF9GW8nQ:3Z6pAwHnTnS6WZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700952895, "uuid": "c3788807-6a81-4269-a9d5-9ce09607e1ac", "value": 293960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700952895, "uuid": "185aa1cf-cd24-458f-ab43-6954390727d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700952895, "uuid": "b74a92a5-7b09-4a8c-bcbb-731ced6743ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d29665-8bd9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700947800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700947800, "uuid": "8e90423a-d84f-4154-b157-b0f5681688d3", "comment": "Malware payload", "value": "4a657cf9c1289e3df987268e32961a66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700947800, "uuid": "f34da7f8-1e94-4577-894a-b16e3971465e", "comment": "Malware payload", "value": "4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700947800, "uuid": "14b61463-2e6c-4e9f-b549-482b8540b000", "comment": "Malware payload", "value": "77167ba7c7adb768ba4a1a0d561a8828e73f5035", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700947800, "uuid": "61cc6eac-241c-42f8-aaf5-3d606b7c77df", "comment": "Malware payload", "value": "9b378cc0011e533e6a80daa93996ca039fcff5c7ce2aae62ee134e3b04193e4b0fdfca5123151c4b71096b41974c7a95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700947800, "uuid": "7448e2b0-3a18-47b4-ad17-f6205fd73986", "value": "T1B956AE31724AC43BDA6201B1192C9E9E512C7E750BB264CBB7DC2E7E1BB54C21736E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700947800, "uuid": "ada3b971-753b-4944-8ec7-f213c3e47f2b", "value": "d79dd35f147f0bd91cc18a6615fcfa5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700947800, "uuid": "80594a7a-74e9-46c4-b735-07b85205696c", "value": "98304:QAs++BUHecpbpx+sborjZGS/maM8jwsWjMZd3CuwQ3dm0vZ0QgKuEf:QAKBx4px+sNgHW4H3CkZqEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700947800, "uuid": "98cec5d6-2d02-4d7f-bd74-7f810ee91d84", "value": 6359496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700947800, "uuid": "0dcbbbb8-dacb-4395-a930-9c33d66e29aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700947800, "uuid": "f8a45ab4-a7f6-4f76-a112-f22fc5de5e9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7524ce32-8b9e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700922318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700922318, "uuid": "17e8b7a4-6e91-4cd3-82bb-56f516bdf735", "comment": "Malware payload", "value": "7bc400c287e863d093e099a2a3d86d0a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700922318, "uuid": "eaf31d8c-f8f6-4923-b3ea-5ba983f11a00", "comment": "Malware payload", "value": "420fb1238dd57cc2166770c49d1577eedc64ace3c130e5b10871b2e9b71f4c04", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700922318, "uuid": "d144663a-eacd-4f23-8c7e-eed9bc67690b", "comment": "Malware payload", "value": "0c53d559fa4f3e58241f67986fe7c0d342671e20", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700922318, "uuid": "92ef3114-0c2c-4cda-b5ba-207e6d20e590", "comment": "Malware payload", "value": "47f821852d71203386523750fe091310b2f92e59875147c84c2d706eb52daa5788f64c20c5cf02e16685eaaf407bc645", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700922318, "uuid": "3e497967-0f8b-4105-813a-98d1bd6d08e4", "value": "T185D6CFDBFC9FDB2119BC656DCDA39FD3E398F83898A0ECD9411D09089911196CC26AD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700922318, "uuid": "1d065491-6ab7-4ee4-b675-fb125433a511", "value": "49152:uTP+Ip2MMykXMHOh7Ufks1muCwKWPM7J6QlHiVH7BRDS83Tm+fn907TA1HimUEQf:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700922318, "uuid": "131ec70b-1770-482c-b655-4a431e25c7fc", "value": 13066637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700922318, "uuid": "bcb9fc0c-bf4a-4a0f-8f59-594bc051a2fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700922318, "uuid": "855d0c7e-eb36-4c0d-9039-4caae0a18579", "value": "Rune Launcher.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548cade3-8b29-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700872012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700872012, "uuid": "17d21837-b569-4ebd-b0c9-e73ccdb05cce", "comment": "Malware payload", "value": "faa78f58b4f091f8c56ea622d8576703", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700872012, "uuid": "9352f303-b0b6-4708-98c8-8104590bcc64", "comment": "Malware payload", "value": "464c7ab944886103d617e334c94320344761a543de5395c6b541ae386b448ea0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700872012, "uuid": "5bc894b3-2762-43f9-a7dd-aff08d4a356f", "comment": "Malware payload", "value": "2bd05e7cf298f79bc7408f400e2f2fd37fc8bdf1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700872012, "uuid": "e0747bb1-db67-4b2a-8575-01e71f421c0d", "comment": "Malware payload", "value": "845e0436d86218f976bc59cca0ff277e8ccdd66a90d98362f716fb1c69ae4599f09efbea00462958ffcc064a1083da7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700872012, "uuid": "be4557b0-98c0-4e54-8e06-0d8833fb83f4", "value": "T15D6612763344246AEBB310246A306AC9D46F2D23AD5CCEDE211F27CD2D7A386C97715E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700872012, "uuid": "56f31981-1c2c-49f6-a556-bdd6be62da33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700872012, "uuid": "2055aaa1-179b-49b2-860c-2bb997d7377a", "value": "196608:AR4ERFw+DIaY5cI1CmjxOSdKk7lpv3/4AkRKM:ARxR9Y5cI1CmVtVpvgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700872012, "uuid": "4fd82bc8-1497-465d-b075-4825b0c493be", "value": 6736896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700872012, "uuid": "e6c524c1-e1b2-4ba5-8613-c45925dedbda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700872012, "uuid": "24af9b29-6b7b-4e8d-a5c3-6755450431b6", "value": "faa78f58b4f091f8c56ea622d8576703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341cce3d-8bcc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700941965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700941965, "uuid": "bb3bd4cf-39a5-4c3d-9a6a-74cb5d4e01dd", "comment": "Malware payload", "value": "6968db3a94af77b2d950281406ff4ed7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700941965, "uuid": "4a025ab5-7c1b-4b2a-a60e-1c997fd41ff8", "comment": "Malware payload", "value": "46a8b050715b4438cda624ee10a35038c638bdd19f106406bde7ee42aa8b3626", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700941965, "uuid": "bc958db5-6cc2-430a-8e89-c9f299d4b99d", "comment": "Malware payload", "value": "d15313f20ef415434953739a22d35a4628d9cfb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700941965, "uuid": "8691a70a-64af-4ac0-97bd-de13deec5580", "comment": "Malware payload", "value": "ae99d47f721b9c0fcbe2f461026e0516fa8af5a74685d447850fd8e0750a32523143c29bf26ffd79228ef23e1870c6aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700941965, "uuid": "5b18b239-8666-4810-80ee-1bd8b639beb4", "value": "T1B193D74977E52524E4BF56F79472F2004E34B44B1602E39E49F259EA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700941965, "uuid": "2e9ae40e-7ed4-47f4-8237-b64570c683fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700941965, "uuid": "95a7f3d8-6d25-4f08-88c6-0b1c1e91b319", "value": "1536:EUwC+xhUa9urgOBPRNvM4jEwzGi1dDoDbgS:EUmUa9urgObdGi1d+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700941965, "uuid": "dc071b4f-057f-437d-9b21-3acb46026e06", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700941965, "uuid": "9b54d821-144b-4dac-bf21-d9055cc5f30f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700941965, "uuid": "ce355229-7d7b-4bca-82be-51611bfb918b", "value": "12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477c5d59-8bdd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700949299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700949299, "uuid": "47c6a557-0d7a-4c69-a124-b1d84a97bc19", "comment": "Malware payload", "value": "17f7fbc386f49cdfd379b12bdc0ee101", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700949299, "uuid": "24054d78-ec0b-42a6-8eff-2ed4ab9db08c", "comment": "Malware payload", "value": "48908e873860ee8847691ab971c13a9411551866b32a5c6598355dd70184ac6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700949299, "uuid": "8eb230ae-bcdd-4b61-9473-a045d492585f", "comment": "Malware payload", "value": "f9300cc4c8748f999eaf80b78981be7650ccbffb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700949299, "uuid": "b4acd417-d49d-444c-a228-7dc5a6842c27", "comment": "Malware payload", "value": "e0d66885adc99fcb0b15a57195c5cadf163677803c1efcf31955676df233bb57d29f2b867d788eaa86a8570d5ecf9611", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700949299, "uuid": "e37bdc9f-81e5-4804-acca-fb7d582855fe", "value": "T1D923399AF8028D7DF94BE77E54164A0AB93063D152831B2B13B7FEA3BC731592D12E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700949299, "uuid": "a105f927-3e3c-437b-90a9-25bfb67e9bbd", "value": "768:G4SeUp1dxT8dM2NXMgZjySxuqVsxLfkMYazQwq8DbqSdG4:ZS1T8d31jySgquLfkMVzQr8DbY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700949299, "uuid": "63b0a4de-ea28-4f1d-a534-5b58731247b5", "value": 46672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700949299, "uuid": "348012cd-9597-4b20-8c6e-bc90cbb73752", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700949299, "uuid": "ce2bed54-9d08-4c3f-a181-7274e0cdf064", "value": "17f7fbc386f49cdfd379b12bdc0ee101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8be4f7-8be9-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1700954408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700954408, "uuid": "f8350782-3ae3-406e-92c0-68387754ec13", "comment": "Malware payload (Stealc)", "value": "43212c1da3e8b4f48cafb16834be720c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700954408, "uuid": "594df096-06a0-4f2e-b0d1-772409c6f16d", "comment": "Malware payload (Stealc)", "value": "49b9bed8c75d31a496808f435537937b8d7a08e86456ceae55a59c88a660a3bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700954408, "uuid": "4d3c0681-9509-4a89-8f52-cfaa4e835a6f", "comment": "Malware payload (Stealc)", "value": "8d8665f4838f1b93d59f50f0285578163fdb6338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700954408, "uuid": "e2b4517d-2dac-40c8-905f-97885c8e3007", "comment": "Malware payload (Stealc)", "value": "3435d1aeda71e7996cc7073ae530f342a1880f82baccf39fd3d9ddbacd7126f4ac708b3fe37909cc98037dfdb93aa61e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700954408, "uuid": "b3fcefda-498a-48cc-aeea-0ca2e19c7732", "value": "T14674C50393F17E46EA268B729F1FC6EC774DF6508E497BA962189E1F14B0172C263718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700954408, "uuid": "0d1635b4-878a-4bf3-9565-42e6e35b6e45", "value": "ac2a65b4a5041877693100400bbe0f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700954408, "uuid": "2b5e19c6-e9df-46a4-8e3e-8947ac0b55a6", "value": "3072:1TnZR4ieNV0cA1fYf1BsLWKKpI5sReTWUhfUNJ+jFuw8ZU5B435wU+f5XyBk3eFH:Nb4ieEuX5H+ceqUhsNJ+FUUL5cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700954408, "uuid": "4788daf6-4b23-4f29-83c9-37abc3c07814", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700954408, "uuid": "e21b6a0b-18a7-48dc-8713-ec6aea76d509", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700954408, "uuid": "1e62b4ea-43cd-4901-b615-8b7709584e47", "value": "43212c1da3e8b4f48cafb16834be720c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f979b8f5-8bd1-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700944444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700944444, "uuid": "b44486c3-03d2-4729-b507-a95e3962a436", "comment": "Malware payload (RedLineStealer)", "value": "c04ee29cc098afc72469c1bd01b06dd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700944444, "uuid": "8014e974-f1bd-4698-8ac0-5e0d82fa3124", "comment": "Malware payload (RedLineStealer)", "value": "49f65e66b00f5178744bb3e3c1f7572aad43485fbbf6b4a3f729e58bf86c8d74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700944444, "uuid": "14cae26a-af45-42bb-8236-a58ae5e8f4d3", "comment": "Malware payload (RedLineStealer)", "value": "31dfc31f70793781e024251f5692b0f31cf96910", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700944444, "uuid": "1d74c90d-d9e6-41e7-89b8-5c14644dc5fd", "comment": "Malware payload (RedLineStealer)", "value": "789af969fe9f15ca35b1bf6afa667517ef27eab68a4da4ecf4a63e681753191d0b7c7e7e223c9b4dba5deb4a7844ecc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700944444, "uuid": "ae2105ac-e035-457e-bb89-1bee4a6e7112", "value": "T10C54E71392E13E44E9268B729F1FD7EC778EF6508F49BBA922189E1F05B1172D263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700944444, "uuid": "66198181-a0dd-456e-ba4f-d7be0deead54", "value": "c0846180de212a99e5224d9162840371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700944444, "uuid": "a271387a-9747-404f-bc06-468bb76c4315", "value": "3072:FIy+dIrLEj2qPpwqRY29MX6Xn/xQ5mg1/4r/E5kVyBk3eFx/RiPB:a5dALEjV1MXYBk/YQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700944444, "uuid": "1beff9d3-2c6c-4fe1-9da7-1f9137e7b62a", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700944444, "uuid": "32aafde3-d2f0-4441-a9b1-9d33ded81d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700944444, "uuid": "04a81d7e-4333-4dfe-81a7-5a1b90b74a4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c3ba26-8bb0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700929889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929889, "uuid": "5968c0f7-7ed0-4a0e-a117-db505ed86d07", "comment": "Malware payload", "value": "cb0a76a4da27509d81851b7b32c5ae19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929889, "uuid": "b4b55123-0406-4d44-a064-004d119766aa", "comment": "Malware payload", "value": "4c526fb72f18b76d7ffc7683b7bc822c8234b7aed6376733efc1cf9f6b0dd0c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929889, "uuid": "40daef08-3988-461b-aa7d-bc79bce96d5c", "comment": "Malware payload", "value": "f152f540312b64c0192ef3f0a7ad1c1d48882ec7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929889, "uuid": "46a22152-c9d7-4336-9057-a975e187c6ea", "comment": "Malware payload", "value": "10ac9349977a1315f19ff4b1284b0923376b523663451642e6b08ada25c61eafb1b630240e86fa3418acb452f1c03ecb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929889, "uuid": "aacaf1d8-ed43-432a-8318-c800f64ab26f", "value": "T1B5944BD4B9F7D5B0DB2382F99FB8AAC2CFAF454000429EA9775822F5245D48813B637C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929889, "uuid": "af1d2f11-acb8-41c1-8b6c-040621db574d", "value": "498b869806d0a462d1f0f1e07c032fb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929889, "uuid": "c7a8fd01-305e-4845-95bb-8178bb64cc34", "value": "6144:l3t1G91dNzfptuxo4lJ0lFVnSWvJpJ4pXM9aULf+Hc3:l3bQtuTYvVnH4p+LB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700929889, "uuid": "1d624ee9-8de3-427e-864f-9933dc4416b2", "value": 419316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700929889, "uuid": "2cf6bc1c-c2be-4497-894d-49c515c705f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929889, "uuid": "d298dee6-5227-486e-9666-3620d394dfeb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2d4494-8b37-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700878039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700878039, "uuid": "d301bdb2-91fc-49ee-a9af-a77981209f28", "comment": "Malware payload", "value": "8a7ee9dbd620232871c7ce897fcb14e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700878039, "uuid": "4f0512e6-aa5f-4cd5-b5ee-6addbd306707", "comment": "Malware payload", "value": "4cac61484c84732dbe188caa0a13f8a688299c46a9d689b4b90fc76f299fe8d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700878039, "uuid": "e0379d71-347e-4640-ae1a-f3992af7c78f", "comment": "Malware payload", "value": "c00368c6344a13bdbcef92abd262dcd5d81518e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700878039, "uuid": "0db20725-cfca-4007-9e56-532fe9205717", "comment": "Malware payload", "value": "3e31d7d7125c73f472ca3b92f096e9b6ea441f4c4588bfc969f27cdfc520095eff053513b083a6ad85a5234ea134adaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700878039, "uuid": "ca63fa31-1d30-4bc8-9635-9a1d007811fd", "value": "T190D423F8F2E89217CF8D53F678D0985683F2DF225200CE8B6F2678489D52B0B9D11967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700878039, "uuid": "81a864f8-e89f-47e9-8117-297f13bb183c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700878039, "uuid": "35452283-a2d9-42b6-a2ec-c27c5d01660e", "value": "12288:OqHoHYIuvBgrbZowiHcVT697qYnf+d+bozmnZB8KNWS6sSM2wfGyPKeCLS+OUij:OqIHYIuvBgfqt8V12WCZB8KcPs7RyLSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700878039, "uuid": "212521b0-aa81-4e1c-8565-11f0b32516e7", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700878039, "uuid": "70987852-97df-4612-b5b9-ce6fb0f95e2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700878039, "uuid": "9209d078-1d2f-4a4f-8f1f-1f5bb1d66518", "value": "8a7ee9dbd620232871c7ce897fcb14e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a0000d-8bb4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700931769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700931769, "uuid": "f1a3c267-b481-412f-8435-be8c27045325", "comment": "Malware payload", "value": "9bc6f31bfa435bb9341f17fe92124494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700931769, "uuid": "27cdcb3f-17ad-46c4-87f4-97359c1c4d1d", "comment": "Malware payload", "value": "4d80f93923e0ff63d3dab7126446f4b33924d1306ae7524dacf36470689fdc28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700931769, "uuid": "51f203e2-1516-47b4-9c7c-4d74092bf44f", "comment": "Malware payload", "value": "2faf41c2376076c67d2aea5b0ecf536f818e802a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700931769, "uuid": "12733f93-4d96-4402-9560-00db316929e2", "comment": "Malware payload", "value": "cb32410291760f1a7b7daca0fb2c052b7418e9ef99f5d4e17632dfafdf19a9c118cb5e0a5ae49f71989209d0ee349081", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700931769, "uuid": "2f6708f8-9fcc-4f5c-91bd-1320acd20df4", "value": "T1DB64A34B92E13E44EA268B729F1FC6EC774DF6508E497BB922189F1F10B1176E263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700931769, "uuid": "caf6e0c7-2a8d-4ef6-b009-f41d760e4af4", "value": "5436687cad9eeb8d4746b898301812f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700931769, "uuid": "3c2ed83b-4dd9-45bb-bbe4-4ca2ac22d893", "value": "3072:FScc5DlAi2rr34I3tHb6PXNsHssn4VI52p7EGf5XyBk3eFx/RIAB:RcrASS76lsHssEJc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700931769, "uuid": "5ebee8ef-df27-41e8-85d7-74ccd15bd550", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700931769, "uuid": "8d95e99d-7601-4cbe-9a07-4cac53f61d48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700931769, "uuid": "7dab0ae5-186b-4f70-8cbd-6b6cca1063b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c700521e-8b70-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700902698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700902698, "uuid": "12d6149a-05f4-4589-bb14-43374c8bb847", "comment": "Malware payload", "value": "f8d9bf95a0f0bcd2dd37c0afe5e68283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700902698, "uuid": "798dfabf-898e-4a8c-a091-3eef7c8c672a", "comment": "Malware payload", "value": "509da045b3985f51bd0e3646d66f3d5a5efc2964d53afe1b737427a2aba6e914", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700902698, "uuid": "b30ae0a3-8b7f-496c-888a-5eee1e02bcf2", "comment": "Malware payload", "value": "a2cb4de35566b516dd4177a02c59d6e3dc7e652d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700902698, "uuid": "edda1453-0daf-469c-b0d7-bef11cb8baf5", "comment": "Malware payload", "value": "aae868fe9fea38532497d15dfe6a29c4f00761c583330b73c1c4d1df8ab37828c326adb137848ceaef80932abbdd8af7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700902698, "uuid": "f3928ee6-7e6c-4580-acb9-06de4f46c3ab", "value": "T10474A60392E13FC4D9268B72BF1FC6EC774DF6648E497BA922189E1B14B8172D263750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700902698, "uuid": "afe2f9e6-0c1d-4ef7-9385-df9a39a6dd4d", "value": "ac2a65b4a5041877693100400bbe0f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700902698, "uuid": "ac4e63da-36a9-4024-a985-81e01428daa1", "value": "3072:YWLG42e7V0c6XMyWS/i51Iwi0hC31Sc0M35w/Xcf5XyBk3eFx/Rb5B:fa42eWud8/0h5ca/Xccr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700902698, "uuid": "8f1cc50b-0d81-45b9-a662-1c9fa6676617", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700902698, "uuid": "ec0473f2-59e3-4799-a50d-7b158179e4e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700902698, "uuid": "02b3147b-f8b2-4554-9dae-a3482ece7138", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f124b3a8-8bc0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700937129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700937129, "uuid": "c2a87a60-0d08-4cc4-a198-609205608080", "comment": "Malware payload", "value": "2b39a08529883ffd66a8ff2bfada777b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700937129, "uuid": "de7a96ec-ab72-470c-bcea-a8094e8af3f1", "comment": "Malware payload", "value": "5111aad50f3671b57955b5b42494bee6d2546e5fde2bac37f28036b14ef2746c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700937129, "uuid": "50733e77-ac25-447b-a865-1c8c0d9c8f01", "comment": "Malware payload", "value": "b2b44034b22f4b6e3a3d78cc67e806b1d21db269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700937129, "uuid": "eb9cf51b-2287-4ea2-98ee-325c651c7821", "comment": "Malware payload", "value": "c17d93ab910f9645ae5771c175299b280138bd32681fca4cd0bf700765f29d6cad8f7ab08bb5462e3d4819a3d9ee3ad4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700937129, "uuid": "845f634d-953c-43ea-8236-5606b5de5370", "value": "T145658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700937129, "uuid": "8d213b6c-0276-45d2-a7ad-eccdbfa443ba", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700937129, "uuid": "04476413-b70a-49b8-a67b-bea66845e24d", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700937129, "uuid": "e9f820db-3671-4d62-92cd-97bebf3395cd", "value": 1539654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700937129, "uuid": "6773e284-4a0d-4416-be1c-81fba5a80f05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700937129, "uuid": "1cd2ce5f-fd21-40de-a685-81d91d24f75a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7ee4b0-8b49-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700885794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700885794, "uuid": "0882c699-32a9-4330-aa60-e027b041047f", "comment": "Malware payload", "value": "92d29a1bf1818719fa8181be3f899cc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700885794, "uuid": "b036e4b7-ba22-4779-8660-9b5747f60745", "comment": "Malware payload", "value": "5286f3014333ec6653027d78583e452abbe0514e119782f1c341255b02cee9e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700885794, "uuid": "cbb74496-a9f8-4177-9f03-55d85a88f9c9", "comment": "Malware payload", "value": "dd1b1d538667556efdec0b56a0f51d31a529a7fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700885794, "uuid": "46287d2e-9e13-4e0f-9489-bd7da0d7cf22", "comment": "Malware payload", "value": "d9a27e6810f2abef3dad8fdfad624b92758cb9c8d4f6799a22e33ef1fbec768e46f0e46a41bb36dbafeac18e21dad603", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700885794, "uuid": "5686d64b-1e9b-4845-81a0-a32f5e7b0f82", "value": "T11836335348E8E075D0C301727FF1AA417DF2B95AFC78CA4C39991D1A8F731B6A07AA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700885794, "uuid": "415ea694-b70f-4ab3-8a07-30cb7da19e4a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700885794, "uuid": "583d0c1c-ea45-4401-ac00-32562c4ac0b0", "value": "98304:coMd9WqCSk4EGkBijqVx8g2E33MyyLF1qbVA4ZVJc1GlE:L6KSkukgj4BBaLFCrVJc1Gu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700885794, "uuid": "81ff5fb7-c65f-4345-809a-c87dc7a176f7", "value": 5004696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700885794, "uuid": "e98d2d0b-bc9a-4de7-ba60-dcc23315cf5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700885794, "uuid": "b907b537-f9ab-41dd-a6f9-6de8e39b175e", "value": "SecuriteInfo.com.Trojan.Siggen22.15436.31317.7712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d235f7f3-8bca-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700941372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700941372, "uuid": "ca71292e-412a-489c-9833-801361211263", "comment": "Malware payload", "value": "aeeb2199f2731322a9aa7b34ef844b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700941372, "uuid": "48c35a01-ced2-4f0e-bd63-779c2a915930", "comment": "Malware payload", "value": "56f78326b4f5a623539a1d12719e35a45eb4e761b2fa104688ed39b176fd51d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700941372, "uuid": "b52a1880-3aae-40ce-9774-efed2ddc27c2", "comment": "Malware payload", "value": "adf41cd27cf722931f56e4241df4fe4db7e9bbe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700941372, "uuid": "69d96d31-cddf-479a-8f37-b69ec669aca7", "comment": "Malware payload", "value": "6f31b29c39046563546c4c787c12cb1a3868e7b271eb411e8a2951630502dc523e7c36711aa817cf80e30e169b37c5ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700941372, "uuid": "808e0bcf-8500-41d1-bb77-c9bf68d03ad5", "value": "T10693E84977E56524E1BF56F79871F2404E34B44B1602E39E48F219AA0B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700941372, "uuid": "0df3b87b-2361-4193-848d-3e22c621bcfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700941372, "uuid": "b28c3a12-7cef-4e6b-a100-0e813c010ee3", "value": "1536:7Uk1GkeUqZJO5iNSimjEwzGi1dDxDNgS:7UPUqZJOQAOi1dNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700941372, "uuid": "ce4d0faa-5e0a-4885-a390-fbe292332ba0", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700941372, "uuid": "d9933fd7-ef29-4519-b2f9-17bd35cc9aa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700941372, "uuid": "6b360076-9533-462a-9998-eed50c826cc6", "value": "12345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d94df03-8b72-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700903407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700903407, "uuid": "197a8951-89ff-420b-9ebb-59730d10ac25", "comment": "Malware payload (RiseProStealer)", "value": "2106cdd471ef4638ed845bda27a2b9fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700903407, "uuid": "09ad16f2-e493-4b1a-9723-99363fe218a1", "comment": "Malware payload (RiseProStealer)", "value": "5b555ac4f9adb52cf12e6b590d0f7f2d41e26a0b2d635e19c384f0423934cf53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700903407, "uuid": "c3d99a4d-57b0-4a97-a2fd-7f873d745bbf", "comment": "Malware payload (RiseProStealer)", "value": "44378a4addd93a6d6e772c17bed99a2a236290e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700903407, "uuid": "d8488398-8f36-4da2-ab8f-386b3333363b", "comment": "Malware payload (RiseProStealer)", "value": "bcc8a176eb44f16404a5f7684d09ca84b222671e4dfb9e4358e119b7e5b51cb96015ed79a0c17e01f184cc18691cca61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700903407, "uuid": "4d86dbc0-8771-41ad-a0f4-472a7d5c00d2", "value": "T12A659D21FA08C0B7D09211B0916D6A7B95997A322BAF4CD3F7C05E6D01B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700903407, "uuid": "6da5698b-5c12-4afc-9e67-a8e5622a686a", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700903407, "uuid": "69514b68-b969-4e73-82c8-fd9c6824ceb0", "value": "24576:8N+bPGUvbX8AdjI9Bahe/wz78RaiyhrbnC3OlKekN4srzEhbaLUCKWmRlsSmYTzC:8wyYjI9EheW7WaiUy3V6baLUCmRlnmYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700903407, "uuid": "5a444a27-89aa-4a8f-875f-e8053327960f", "value": 1542402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700903407, "uuid": "b186414e-55c2-4250-a8af-f7612ae0a22b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700903407, "uuid": "7d3f8cb3-68d5-4162-9754-ae725e3c2b72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d8a768-8b96-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700918799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700918799, "uuid": "d9bf7555-4254-4386-86ae-ec5472f247c1", "comment": "Malware payload", "value": "444d41194cdf6b85e43e2932fd66140c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700918799, "uuid": "9a66edbe-8967-4622-b5be-8db2fd42e2ea", "comment": "Malware payload", "value": "5cae32229070c310e8bf979827c6e2ebe37fabfda2f29f83c2d05d81f4e569a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700918799, "uuid": "867119cf-8346-42c4-92d2-7a5a0de7baa0", "comment": "Malware payload", "value": "f8595b506f811a654c8da718df291f4969342515", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700918799, "uuid": "d256b5a0-2dd9-49c4-94fa-02c11a722309", "comment": "Malware payload", "value": "73466d0167ec0599a6e2f0c22f2171aad264c4d9ad41988ba1fba3889a61d3c87e952ad3494950f6e1535ed25c28497a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700918799, "uuid": "aee913b2-a921-4a49-831d-1f65b4ba211a", "value": "T13364A30392E13E44EA268B739F1FC6EC778DF6508F497BA922189E9F10B1176D263750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700918799, "uuid": "51820308-17a4-4239-bfd2-2d1e3f746ba1", "value": "5436687cad9eeb8d4746b898301812f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700918799, "uuid": "80ba5eea-cf10-49c9-8339-62a813b0e7fa", "value": "3072:gF6/EjfKidbf5BEEoxAXl5GLADsa7I52bdf5XyBk3eFx/RIAB:s6qLdj5BErxAXlsLAD7/pc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700918799, "uuid": "f24af1ea-8975-4b7f-8081-80095a743476", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700918799, "uuid": "ed10815f-b4b2-41ce-b44b-b45a2cd1f08a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700918799, "uuid": "e1e14c81-b712-4c79-ab8f-665288cb9ac3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8257ca2c-8bc2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700937802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700937802, "uuid": "fdaec917-a95f-4656-b84b-b4634d5de2a5", "comment": "Malware payload", "value": "3c22e9f884a858ecd2343d181660ef27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700937802, "uuid": "92dd96b1-acf4-4681-a45a-ee2de1c27e71", "comment": "Malware payload", "value": "5f38f9fc4ef01d4b048a0ce6199622afd8f0a82168ff70b13bb1576bec721ef0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700937802, "uuid": "a9a2d536-010b-463b-b6af-2e41a46b08bd", "comment": "Malware payload", "value": "0e12f789d1baad2511f2c5f8877cc61f452cc3c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700937802, "uuid": "eae03ecd-1c78-451f-9d85-aadcd1012efd", "comment": "Malware payload", "value": "432ffb89f13483d36de6979602f62a9d69e779220c0a68a64b8778796ee08a928303fd5cccabed7f7d7a5cf04003616b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700937802, "uuid": "408b2d61-6892-46fe-95b8-3ec336288591", "value": "T1AB75F223B2E04537D1735A7D9D1B57AC582ABE113D24E8872AE57D4C9F3A780342F2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700937802, "uuid": "0ec30990-37f3-4ab8-a509-37f6a13264a0", "value": "a955949b4816efc39bdc74feec2ef8ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700937802, "uuid": "c1f15fa9-0439-4305-b8e0-80cacebdd57d", "value": "24576:l7ziH9/8zn+ezqIZeJbzHiNxQ6rK1LFP9lRGjwQGZuxCujhgypxQ1nc:l/A/Die9HUG6rKhPlRZQGZqVVlQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700937802, "uuid": "f29303ce-cb21-438a-b157-6ee88c19d3ab", "value": 1668608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700937802, "uuid": "9a0eb992-522d-4935-adcd-ec50e57d85a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700937802, "uuid": "9486e4bc-0c68-4586-9a3f-16a94e8881c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e7bf0c-8b41-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700882210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700882210, "uuid": "a0f0b429-7012-4b5d-901d-464752a658f3", "comment": "Malware payload (AgentTesla)", "value": "8fb77e0a72fd58877460ae734179d388", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700882210, "uuid": "a79817df-e394-4d0b-ab52-692b06126bea", "comment": "Malware payload (AgentTesla)", "value": "61af5cbcf8452d49cd6a2f9e562bebcd55a560a68aba7bf1d591f01bbb9c0290", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700882210, "uuid": "abddebd2-8dd9-43ac-9619-fbddb343286e", "comment": "Malware payload (AgentTesla)", "value": "2dba24ec72dcd704d98d96de2b93d4c9c3f82f26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700882210, "uuid": "ce51f661-e593-4f78-b8a4-60cdea160fbb", "comment": "Malware payload (AgentTesla)", "value": "2e033889684cdffce7fdbea4adf49529c3895c56b1d0cd2495b4585fe4ead9d3811da76eb36246e1407ea44ef0e14869", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700882210, "uuid": "5f8f8e04-b714-4059-b5e4-d412b1416425", "value": "T113A5C633BE97C6E3D1895736C5B715108370E881E723DB9A398A23B94843F775E4262B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700882210, "uuid": "37b392a0-9ad4-4ba1-bbb1-eb4d578b2cd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700882210, "uuid": "9aecda88-434a-445b-a1d6-9b20a07aa1c7", "value": "49152:XVSZZ9WBVVjJNOUrrbsyc2TP0DHEwb3zxG6R:hrrDwbzxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700882210, "uuid": "d6c35f2a-48f9-4d02-bad2-6298dbfc021f", "value": 2222080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700882210, "uuid": "302b992e-f803-46f6-abb2-15207b7009c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700882210, "uuid": "5b37cf45-97c9-41b4-8b65-005a6cd169da", "value": "SecuriteInfo.com.MSIL.Agent.BBC.tr.20382.30346", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9413358a-8bc7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700939979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939979, "uuid": "498b52d3-f312-4b06-8daf-2736d267c455", "comment": "Malware payload", "value": "b258c6c900d8254cdd3b9c2c5a87bea4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939979, "uuid": "b05ef12c-1e85-4ddf-a58d-e09a13d0bcbb", "comment": "Malware payload", "value": "622c29afbfa539ff6211fe3a30e285f7717de587c9c53af43e4aebc4d6c57e24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939979, "uuid": "72772eeb-f47e-4213-a515-7dccdc305b8b", "comment": "Malware payload", "value": "7c89b78c2aa226a7a10530fd8c710989f26e525a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939979, "uuid": "1ba17ca7-4a0f-42db-9508-44edf171baf4", "comment": "Malware payload", "value": "bb229fddaee9875639d57b09099e250f7060118bd3dd1691f4c36d89a136251a3208568538a11b78b28f5ef5d43bdf89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939979, "uuid": "569e7cc9-9f6f-4719-8636-d83c47ce207b", "value": "T1C133A503BF41DF67C82FDDB306FA471134CDB85725A5272A3170EEAC762A58749A38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939979, "uuid": "3a9bdf9a-8aee-4128-9c61-a522fa983cd9", "value": "768:Tg/DaBsP06hj9GrKw5uNmZTnEXi38aeZl4epeRefXtrplvtJIG:MBM6RONZTnPdepYMXtrFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700939979, "uuid": "22ff413b-633e-40ef-87af-0085852793d5", "value": 52116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700939979, "uuid": "aa450511-536e-4aba-b41b-e2419bd4a7dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939979, "uuid": "f577ad8f-aaff-40d0-94f1-891abde34e46", "value": "SecuriteInfo.com.ELF.Mirai-CLZ.11900.31985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22b6a0b-8bd6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700946526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946526, "uuid": "eeb31dae-edc0-4eba-a7cb-3fa8a8ec7a58", "comment": "Malware payload", "value": "8205873805b16c6f72cf7ddfc8284c98", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946526, "uuid": "05dd0f31-f328-4b0a-8985-92386a94fa5e", "comment": "Malware payload", "value": "63860aaecfa1632b2bcb7dfea4bebf4f8de2872f2d02424415fc467eb0118538", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946526, "uuid": "a22a862b-4e3e-4454-b380-d2424b3892fb", "comment": "Malware payload", "value": "5c7eaf56a31546f29313564f7743885fabc817dd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946526, "uuid": "78dcad20-7c67-4774-bdd2-99ba9a874e3b", "comment": "Malware payload", "value": "25db64dc16e37b5f322141c416906826f1d6eb6be9189fdb89c5788daee312d8d1dccc09e592dd5f02d2a1d8b68b1567", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946526, "uuid": "5c532c3e-d6a8-482b-8d83-96f137d1eaef", "value": "T1F153B519BF610FB7EC6BCD3709A81B0538CC644A22A87B367934D468F60B25B59F3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946526, "uuid": "8e3ed814-32ca-4084-a9ba-e6e087d4b6d7", "value": "768:iAVWeSUxEYGMmXsew5BheiTebiQ2ZFVyXiSA7mWzkCwE:iAVWxs4twxjTIitZFVbmaoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700946526, "uuid": "370a54be-eb6f-440e-bc87-d588d4632b5a", "value": 61080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700946526, "uuid": "5c77eefd-df86-4fcf-afbc-da75a8c5984a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946526, "uuid": "48c01018-ba46-4fd3-81aa-432ad8ab16ff", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1440832d-8b65-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700897674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700897674, "uuid": "62ff2997-83ce-4048-b8ce-e7342f60b441", "comment": "Malware payload", "value": "44c5779e39094864563cf9d2386b5a43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700897674, "uuid": "1c61d418-c988-4c08-9f1a-06f43d4f0412", "comment": "Malware payload", "value": "6396c6ec85f9181ea7943b484ee8d9d0e313f7d408d8c1523f16102c9ede62b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700897674, "uuid": "dfbbc512-8534-4581-b762-2354654fbbd3", "comment": "Malware payload", "value": "c303d9dfac74dcf1f447e4d5a9ec46bf83ef25a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700897674, "uuid": "7afaddf7-ac1b-447b-9844-063f7411b9b0", "comment": "Malware payload", "value": "87f2de0b408e5d0458915304d2eb0426dbd36f06c84395d8a53eaa277695751d406ed059a387a48758ff14dff602d16d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700897674, "uuid": "dced5bc8-bd3d-4ad4-b61f-df872a646848", "value": "T12974B64382E13D44EE668B728F2FE6FC7B1DF6508E4A7B6612199E2F44B0276D163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700897674, "uuid": "53b29df4-61ed-4b77-9ade-cd08d725165d", "value": "ac2a65b4a5041877693100400bbe0f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700897674, "uuid": "0d9b1599-dd23-450e-b152-1816d1eb6102", "value": "3072:8//E04WezV0cH+HNnATFMC1uz7r8L6ddky8CLKlm35wnAJTrYdke0:83D4WekH32uIHyFKZAJTGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700897674, "uuid": "bc6ba443-a30a-4318-808b-e6ac3b60622b", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700897674, "uuid": "bd44ab13-ae04-4f9b-a7b5-7c00974ee760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700897674, "uuid": "8648a771-7799-4e79-a7d2-e14a3b701af3", "value": "44c5779e39094864563cf9d2386b5a43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b307dd37-8bbe-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700936165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936165, "uuid": "84049945-dd40-4b8f-bfd9-467b9d4d4c1c", "comment": "Malware payload", "value": "8db57e0e839354349491075e1ec50669", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936165, "uuid": "cbe15159-c2bf-4d25-80ad-7131eb1fd140", "comment": "Malware payload", "value": "63b88e067c9f3dbb0fed09c5275e22db77cfc47fe7b5065e922239356eafaa4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936165, "uuid": "b7958bef-9e33-40d6-b76e-6c8aad66ce43", "comment": "Malware payload", "value": "74d7e111650aa6b53c32c7b4ba9fa836a7301a42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936165, "uuid": "f7af494f-5df2-499a-a05f-52c28ddb9c30", "comment": "Malware payload", "value": "6f0a16cdba67a3e4641a0ab6e734d24aac14a79cb1c04b4b73b40994a01f3f4a96bd4be941a971ce2989a3455eb364f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936165, "uuid": "e66157b0-2040-4cf1-827d-9af0300ad23b", "value": "T1A233B603BF41DFA7C81FDDB306F64B1134CDB8972565232A3174EEACB62A58745A38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936165, "uuid": "88b0d638-4881-478d-a350-a1220c7f1189", "value": "768:NEMROkI9fgB6ZuCwlusvQ8QkZ4vbIefXi36jejhl3oe8eCrr8uEI1GId+:NEM0945FvQ/kZ4vz9y3oFnrr8NZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700936165, "uuid": "aac66f3a-181c-42e0-91a7-257e8a6d3353", "value": 50760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700936165, "uuid": "a79d66d3-9666-4727-8f2d-f0da59b81b49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936165, "uuid": "9dc27b6b-34f5-43e4-9641-9cb4777f1f9d", "value": "SecuriteInfo.com.ELF.Mirai-CLZ.9952.8166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59af9473-8bb6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700932580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700932580, "uuid": "1b275bb9-959a-4abc-a94a-e8bd20fad6bd", "comment": "Malware payload", "value": "9c425e8f573e1242000314dab1712d19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700932580, "uuid": "02f082d3-b839-4f0e-b27c-00b56d4c8ea5", "comment": "Malware payload", "value": "6845cc46a9a56ceaab71cc2f989c67abc828c7cb87a4da8924ce0b68e84762b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700932580, "uuid": "29a7f6a4-d87b-4338-8968-b434c0e061ff", "comment": "Malware payload", "value": "cde0887ecd92af25d31fdbaea218bf79687c89ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700932580, "uuid": "5bc99c9d-2ed8-4776-9e46-41e680e87dbb", "comment": "Malware payload", "value": "735646708885f749f35494ca3c7c69ae69c5a6645dd19583d885713b556ed29395d76c1cb49eda9162eec8f6420752e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700932580, "uuid": "141adacd-697c-4cd3-a284-3feb4048fbd6", "value": "T17233A607BF41DF67C81FDDB306F6461134CDF89B2565232A3270EEACB62A58745A38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700932580, "uuid": "32ebe693-59ff-487c-86d0-5adaf2e8ff35", "value": "768:IlGQzGyDsFMywdu61xZT41Xi38aeYpoe2eweTTPwIJNI3JJ:en6u/pxZT4Eoe2ZUTPwqAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700932580, "uuid": "d6d36550-7f0e-4649-8450-0b9d2e8a258b", "value": 50620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700932580, "uuid": "12de5932-2e31-4009-a1e5-08095b53c11c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700932580, "uuid": "3881f09c-4a8f-477f-92d8-f4e8f73536bd", "value": "SecuriteInfo.com.ELF.Mirai-CLZ.23937.20485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa14e69e-8b4a-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1700886463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886463, "uuid": "28038059-aa38-4641-8024-bb6076c3aeb7", "comment": "Malware payload (Stealc)", "value": "dff504b0b52beb1847292c7ca09c38ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886463, "uuid": "927aa1bd-8875-4ac5-8500-f8cc9213dd72", "comment": "Malware payload (Stealc)", "value": "6b35b46a864d2ee03b85ba71e118fd1f3bf9e820fcc5d6aa5a7b745d75472009", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886463, "uuid": "543c26c0-7580-4b8a-91a3-19f1b2d28d41", "comment": "Malware payload (Stealc)", "value": "1100f916f8b5dffe4987167a493c2d0a4d92a05f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886463, "uuid": "d728d3a1-eba0-4c11-915a-732990b52871", "comment": "Malware payload (Stealc)", "value": "afc9b61b96eaec9b3f94eda1a1d92118d6a7419c7264dc73dd3f0af9f19737a4bf44ca11c62456566daaa4481d66242a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886463, "uuid": "c2494218-cd6e-4660-8782-d054767be69d", "value": "T1A274835386E33D44EA268B72DF2E86EC7B1DF7508E4B7B6612189E2F44B0276D163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886463, "uuid": "8916ea90-21f4-41c4-b0e7-53347e10d4f0", "value": "ac2a65b4a5041877693100400bbe0f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886463, "uuid": "5cd76969-4546-4235-bd5d-75ac0f31948f", "value": "6144:OZ49eKSgaIt1u2yIMk2sSVsWJ8xkWTGx:OZ49/IulMk2rVdJ+T6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700886463, "uuid": "5c487b6a-f532-4034-a0f4-3ba84fe3e7ca", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700886463, "uuid": "10365003-054f-42b0-bfc2-1cbf84501409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886463, "uuid": "c6a58b52-a132-4902-b8e5-76cd69ed049e", "value": "dff504b0b52beb1847292c7ca09c38ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b269d2e0-8b4b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700886772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886772, "uuid": "33a38f61-be99-4518-8af5-b54403ac778e", "comment": "Malware payload (Mirai)", "value": "55e1f62d96f71dac9a65525924d6a83a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886772, "uuid": "560d8ced-e6b1-4154-80ca-ae4975503942", "comment": "Malware payload (Mirai)", "value": "7504de0d7eca58a8a3f6203b176aa86ce3ae5a0e6563e838eda56af4fa818995", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886772, "uuid": "6cc28723-6a64-47f2-b0f7-774b196c8f58", "comment": "Malware payload (Mirai)", "value": "9f32770042c6770491ff9b21b299517b0e8308b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886772, "uuid": "7a0126e3-9343-4387-a4b5-cbdff18e99f6", "comment": "Malware payload (Mirai)", "value": "e23c52f0baca012d49d535e0081b24fc149c68638e1b7b2f428bf7abec15929520e11d97fd10e537d9da0a50d59b69eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886772, "uuid": "0b3e1d19-10f5-438d-98e0-ca22fe1ef961", "value": "T195C2D045E046DE00E6DB35F62D54D6EBFBD03B6B6966CE50265063D2AF0C3678306EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886772, "uuid": "c589adcf-e5fa-434d-8c76-cb40706f8d06", "value": "768:GVdafO76jpmNJJKehmA7trpfIX9KeA7PvC4uVcqgw0t10tLyD:6am+AnKehPRa9aXC4u+qgw0tYuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700886772, "uuid": "99fb3ace-6964-446d-ad40-9b8ee90d56b5", "value": 27544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700886772, "uuid": "137f6a52-ad38-4f02-ac44-41799288ba3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886772, "uuid": "c5605c85-4973-4c1d-8552-47f2988928f6", "value": "55e1f62d96f71dac9a65525924d6a83a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89752ed8-8b95-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700918486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700918486, "uuid": "82232bec-de02-45c8-ae58-516cea5380ce", "comment": "Malware payload", "value": "16c26361b397d709690c9a7978ee6c6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700918486, "uuid": "3b71d153-87f4-4fac-b2fd-7a6d19fb6a17", "comment": "Malware payload", "value": "760cca934f2fb907c9a7b99dbf5affea9c01e8257b41d67a5ebc4968eebb982f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700918486, "uuid": "880e7140-4538-4f14-a89b-0e00500c09e7", "comment": "Malware payload", "value": "c218d62a22a3609bef21c064eff40839e53e0329", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700918486, "uuid": "904a96de-46f2-497b-b7e0-702ba8489391", "comment": "Malware payload", "value": "6263b005ffa58f8afc81ef5e1fbcc2d9a6c77a99d4683a601edac627a4fa6feff230a064fc7b1e0be5ca62d4b78fc57f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700918486, "uuid": "1a057ed8-1ebd-43a0-8b5c-fe76eded88a9", "value": "T14E74B51392E13E44EA268B729F1FC6EC775DF6508E497BB912189E2F14F02B2D263750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700918486, "uuid": "6f9d6177-c5b5-454c-b0af-3391f3f838bf", "value": "4c459b08e177ae567cc13290dc63378b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700918486, "uuid": "05ada47b-3882-4739-a880-009bb1bbebae", "value": "3072:xls2M49elJ0cixigWYiIste1k6a6ghG49YFP5wAnGA5f5XyBk3eFx/RKgB:xeF49euigWPIe6a6u9Y4A95cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700918486, "uuid": "548c8bdf-7b9f-43d3-bbf1-5ee6a39bfe11", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700918486, "uuid": "049ef5e6-cf37-46f6-b5fc-8838d84135b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700918486, "uuid": "b363f17d-3f02-4be6-858e-e4e18e4c4c52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54a1a26-8b5c-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1700894105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700894105, "uuid": "66e1ba3a-7a13-4617-b7f9-f7354a4e3b4a", "comment": "Malware payload (Stealc)", "value": "1ef254b5e144dce8fdb20b9be81bb30a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700894105, "uuid": "9e4cb1c0-696c-4288-8a66-be135fd8144a", "comment": "Malware payload (Stealc)", "value": "772ec57ae0bf39c7e670ffcd35667deebf39e5cad531bf6f114393ec92b901f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700894105, "uuid": "33419033-e325-41aa-a70e-c5dea0210b1a", "comment": "Malware payload (Stealc)", "value": "25f1af6bc70429114a030b08fbd2a9301f489730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700894105, "uuid": "9dc500ac-0706-4791-a65e-94ce11b9abf1", "comment": "Malware payload (Stealc)", "value": "c2b4f26f517bf2b58253355d76a7ab00bc097100013e03049fbcad5289c5526aede577edd4687bcd7b2cdadf3294f926", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700894105, "uuid": "7ef76c29-6de2-4ffb-8ff8-f1b0137a005d", "value": "T14A74C74386E13D44EE268B729F2FD6EC7B1DF2508F4ABB6612989E1F44B0272D163750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700894105, "uuid": "6696c16b-ac17-4b8a-9097-99e6d6d39df2", "value": "ac2a65b4a5041877693100400bbe0f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700894105, "uuid": "c177e7f0-02d5-424d-b94e-531b087f4d9c", "value": "3072:qZ5U4ledV0cIS2y8tlilUoFLeWBS76mPTZhhx1l35wksKTrYdke0:KC4lebz8WlU0pS7HPTZArKTGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700894105, "uuid": "9026e2f0-535d-4309-ab34-0958fd8085ed", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700894105, "uuid": "340cb0e4-a8ed-4605-858f-b053d59ee768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700894105, "uuid": "19e843ae-557c-48c6-83fb-2dfbd6436006", "value": "1ef254b5e144dce8fdb20b9be81bb30a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495ede52-8b79-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700906353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700906353, "uuid": "e46341af-d249-4520-a580-77bc909ce64d", "comment": "Malware payload (Formbook)", "value": "84682f07f2f1698e49b6a29573c5679d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700906353, "uuid": "57d8bcff-f090-4282-a15c-532013ae06c1", "comment": "Malware payload (Formbook)", "value": "77339a584f9271a01eb8b5cc7fb4b67d7c4098dd2965edd2e1f3adac59ea519e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700906353, "uuid": "44412284-26a4-4f44-a2cd-ba4a6d0f7273", "comment": "Malware payload (Formbook)", "value": "dd7d69174748011e1543e2a7c0ab6c9a28286b1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700906353, "uuid": "3c8e4e83-485c-4c37-a296-00b314b109cc", "comment": "Malware payload (Formbook)", "value": "79925e3ec7bd6a66277446c5d696163c92d978e065dcaf834468bda356e60880c9de1f358af2b76b2fa796e1b32b36ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700906353, "uuid": "2f6ab505-fb14-459f-82ee-ac9648e132b0", "value": "T195A4226175E2D87BC40916315C6CE2FCD6B9FE18CD22A25B33E03F9F75318D2AA49246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700906353, "uuid": "0a98525e-7c0a-483c-ba33-b1d5472378cd", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700906353, "uuid": "b8682e17-ac39-4fca-bc87-60eb099b41a5", "value": "6144:BBlL/24RQJ0LozxdrCufm7vTY5FXc+B0f2KTSuskyRwUWWzGVPfrvx7cMAg6PofC:HMlPTDfOvsPXc+BY2KTSP4vx7c+Ru5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700906353, "uuid": "db104949-39ab-4414-bbab-2f4f8aad4840", "value": 468105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700906353, "uuid": "e8ebd037-3e55-4396-89fd-1d7f5dd41a06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700906353, "uuid": "89f9a97a-b9c8-43a6-9621-7bee6151f6db", "value": "84682f07f2f1698e49b6a29573c5679d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c26128a-8b82-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700910330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700910330, "uuid": "539cc344-ed52-4701-89d3-e932672766ac", "comment": "Malware payload", "value": "1458915a0f26a7e5282361f78d27304e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700910330, "uuid": "3f5ffd24-a0a4-459b-a0ed-486d51161db8", "comment": "Malware payload", "value": "777976f9417271b846118cd2a82dec029d212bf6096ef833d9ba8690f9c1060b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700910330, "uuid": "2d5d5fe5-b969-4d39-ac82-a25295a7a179", "comment": "Malware payload", "value": "4f2c7270985eadf25dcabe5450809e3e6409c4b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700910330, "uuid": "af02e726-b089-428c-af0a-5de7b52aabd8", "comment": "Malware payload", "value": "0258b7659f4cf1df2753c33d2f4fd91921356ec5aee9744d82d78572330c2219dd412e47da943c804f584c0d475fe5f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700910330, "uuid": "d3f99118-4759-4c2d-b223-fd9e20edad4f", "value": "T171073A87F95100E8C1ADD37486369262AA713C891B3027D77B54FEB42F32BD4AEB9354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700910330, "uuid": "9958e725-25ed-4ca6-8d73-63824f99167e", "value": "85cddd6092e65c1a58dd1e6e9ab9fc63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700910330, "uuid": "4955c8f8-8cfb-4c5a-8d8d-13ad9a5d4f57", "value": "98304:H/tRzZOTKqOoHbH805K32g3iWAPaOnEvuUG0NRU65vMiazCm:HVLoHTK3Yah2+RzvMi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700910330, "uuid": "f9249895-d14d-48bd-9a84-504600b20461", "value": 17978880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700910330, "uuid": "aef30afb-2481-458a-a5b7-cdd4c317c1ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700910330, "uuid": "9a976313-7c17-4101-b875-fb4c56ca1a6f", "value": "Pulsar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc095caf-8bd6-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700946542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946542, "uuid": "4c6e9972-8c17-4e88-a2d5-3ff15bc336b4", "comment": "Malware payload (Mirai)", "value": "14cd8a2c759ae38a04ce07c0f6227565", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946542, "uuid": "ac683320-9267-4877-b31f-bc7a586ca0cf", "comment": "Malware payload (Mirai)", "value": "77b56a46e5d02bff3af9d22923dec480c013905fb0a6201af167c7772d790431", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946542, "uuid": "51f13e33-7460-44d7-b83c-a03c03dceb01", "comment": "Malware payload (Mirai)", "value": "0793e09d6d33e3306a485cfc55689ad3705910de", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946542, "uuid": "c411c47e-d7bb-4966-bc8e-7be00a4e8673", "comment": "Malware payload (Mirai)", "value": "2c2d6b6c939841bf1e01d0bd7a0e430e91d9e70fa65da9d6ba90f3c50fe6e18c15d18c6f02172003be6aad2bea18c830", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946542, "uuid": "4e57299d-816d-4df3-ad9a-d81be4db36ef", "value": "T1BAC33B46E6818B13C4D61775B6EF42453323A79593DB73069928AFF43F827AF0E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946542, "uuid": "637e1408-15f3-41fe-a821-e451ffe6bac3", "value": "3072:AQO3WqA6OKMoMuPGYlqqiaoH+EuNM/9cE:AQO3hXMoMuPzQqYH+E4M/9cE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700946542, "uuid": "bd8ab5ac-3dc9-4507-a103-5b4abfa6e774", "value": 120446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700946542, "uuid": "f0771e11-abe0-4e8e-aa98-e4b9e21e31bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946542, "uuid": "f68d4626-c34b-47b5-b6e1-0e843a3f2ee0", "value": "arm7-20231125-2109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eddfa08d-8bd7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700947002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700947002, "uuid": "ef384187-4353-4505-bee1-526e8ddc5da3", "comment": "Malware payload", "value": "20ac7ca97a09343ee246c5139c833c4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700947002, "uuid": "4b7fafaa-10fa-4b8e-8a41-effae9ccbb70", "comment": "Malware payload", "value": "7ae506f17215e1e2a05b21e5d4bdf6836dd7566f2bb65de6a512124416d920ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700947002, "uuid": "c99a00a7-2da8-4c3f-95fa-5dbd08d391b8", "comment": "Malware payload", "value": "991a043128b10fb0774ebadad41eb2301a4e24d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700947002, "uuid": "883e4f63-ee3c-467e-953c-51e21c943954", "comment": "Malware payload", "value": "9bcd8aecd4e9b5682e4df3cb8aa4848df2652ae952e307567e4093588787e328c0b0fc6989b9d99a08a14f17fc9edfa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700947002, "uuid": "45fffcd3-d625-404b-8af0-d2c7960a38d2", "value": "T154658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700947002, "uuid": "f6f9cdde-9091-4604-9b35-a9255b370693", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700947002, "uuid": "958f385e-74be-4a00-8c63-cc9ad6ded460", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700947002, "uuid": "de75f2e0-22b9-437e-9400-06a335d87832", "value": 1539668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700947002, "uuid": "2b4b749d-0973-4b9b-9cc5-5ac12e67bc48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700947002, "uuid": "fa4845df-4b3c-4f49-9993-ea32432b162f", "value": "SecuriteInfo.com.Trojan.MulDrop24.22194.4049.20010", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba17119-8bb2-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700930838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700930838, "uuid": "f12025ef-5afa-4324-b5b0-57efd90a49be", "comment": "Malware payload (RiseProStealer)", "value": "951e52a740d63777381a9092c3f790ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700930838, "uuid": "d1df308d-d14a-49f8-82ba-481b4b54aefc", "comment": "Malware payload (RiseProStealer)", "value": "8087756e0253efe24b3914678849b043582dbe4086665defe9d43e1152fa46ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700930838, "uuid": "183738b1-e923-476f-93fd-516c919f57b1", "comment": "Malware payload (RiseProStealer)", "value": "140e48a48f1248624ccc8bf26f1d0e4b23881a36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700930838, "uuid": "ccf9b167-d554-498d-b14e-6ffdaa47ed6d", "comment": "Malware payload (RiseProStealer)", "value": "41b04442167066589ac55883db3a6de42a028ce5057202291fcdc5672b1768c9750f27b6cc5310832c0fdeeb782bd325", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700930838, "uuid": "1d64630e-2732-453d-abe5-1a6e8af3b5c3", "value": "T103658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700930838, "uuid": "ffd0444c-78d2-47e6-a053-14577f8660ea", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700930838, "uuid": "de55eb1f-1056-40f0-95c5-d47db525ca35", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700930838, "uuid": "6cd4efd9-05cf-455c-af52-b18fd74a227b", "value": 1539621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700930838, "uuid": "9ad10c96-d392-435a-a9f6-e6c57103b070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700930838, "uuid": "be876aed-995a-4f1b-82db-3b7ba8df4b28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d72f226-8ba5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700925311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700925311, "uuid": "ace08917-a0fa-4e78-bbb2-e2009ac83904", "comment": "Malware payload", "value": "0e33184bab78740f0a5b9cec1ca0704a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700925311, "uuid": "bd2f5384-6039-4a4c-815a-4d40c50e4f45", "comment": "Malware payload", "value": "813c0c02e8f498fdd3583567ceff03842b89a3cddafd100f46c84f926e768322", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700925311, "uuid": "5c8e6ae7-2599-4952-b066-76ae98bca378", "comment": "Malware payload", "value": "307e62eeb35a879ac5f76a1eb257580512e8c8ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700925311, "uuid": "07871d5e-4781-4b63-a8e8-a24d97969ee5", "comment": "Malware payload", "value": "f0639de558fbc37aad18982ea701fa8af625b5325891eaa1bd023430ae7a7c01f6ad4e3ab56d377a89cb935108e7fafe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700925311, "uuid": "bdd00c22-da5c-4be0-a4d7-9c863d3c03d8", "value": "T1AC8402E26AE0C3F6DA01A932F8799AF695B5EC9CC755405313A0FD3A34BC6C245AF053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700925311, "uuid": "3a56bfb2-028e-4878-8e66-ce58252db5a2", "value": "ab6770b0a8635b9d92a5838920cfe770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700925311, "uuid": "c90b4f9a-b47b-4df8-8ac8-763fd749fed1", "value": "6144:dan12f3a1nD8yY/m2YwEo72HJ8tOf99WP0Z/CCOa1fcAGbRw2lOQ11aElmcQ1hII:O2fSnD8yMzYwSuInZKCXFcAcRwgKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700925311, "uuid": "11f32f02-5906-4d9a-99c7-9d7bfe202429", "value": 392576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700925311, "uuid": "007f2d78-d77e-4311-a1ca-ebece8d4a8da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700925311, "uuid": "cb886afb-b1d6-4063-ab53-cdeb478de48b", "value": "0e33184bab78740f0a5b9cec1ca0704a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f512ea0-8b99-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700920241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700920241, "uuid": "d022ca5c-45ac-4c0b-82e1-27cffb65b318", "comment": "Malware payload", "value": "23f0bacc4cbe235859d9e900b5b70891", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700920241, "uuid": "3d4a0cb5-c6dd-41a4-bd92-54f3b5440612", "comment": "Malware payload", "value": "817756a6176e6970a10920e72e4011655d9e21270c911960b7c14a93e9d6bc2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700920241, "uuid": "2106a1be-f937-49d8-8baf-b581fcd5a2f3", "comment": "Malware payload", "value": "739b8349162bded9ef7ea872285a984b037d5f08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700920241, "uuid": "f924302c-baff-4cfc-af9d-162b8e31e3dc", "comment": "Malware payload", "value": "2ae9f7bb1c8d257550e55e4e5a8c928a8557f5417cf1f8a40f6eeaeceb009dd14cdf5691012d86f2e560b1eb456d9dd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700920241, "uuid": "2cdb5571-bc9d-4ad2-b3c5-d2ac67049389", "value": "T136F78D44F6867825CF86A2FA4001E1B1D057799E2F6591FBEFC952C4E309EB62731E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700920241, "uuid": "d59632cf-03fc-41ae-b534-7ce434406c80", "value": "7a4597e7495001824ab87be69165b080", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700920241, "uuid": "53910690-b9e4-4f6e-acf5-79c96df8fe10", "value": "3072:XMDETaLzCwpR0ydAcUyL0P03V2r7/Z0wkLPhC4C5sLH4:x4mwpAz83V2rCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700920241, "uuid": "032cf46b-bb70-481d-8f7c-b20877280e13", "value": 75497472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700920241, "uuid": "8946614b-15c9-493c-9ccf-af1154e73c76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700920241, "uuid": "1e2ab76b-f509-4755-ae56-bcf5d2a842be", "value": "UnverseCodeLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b0ae7a-8bcb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700941599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700941599, "uuid": "20dcb2d7-d85e-4b92-85f5-3dfa3bb23821", "comment": "Malware payload", "value": "ef7d2ee9cddc1d88ad831f7b41e66bb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700941599, "uuid": "69703606-31ec-40bc-af0d-d4fb6a5c4e0f", "comment": "Malware payload", "value": "869d6f735bffa9f2d91ac477c629b95b3ea96ff6592bba07eb9bf77b723c5dde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700941599, "uuid": "5166c1e1-bcb4-4050-9a27-2adc76a023dd", "comment": "Malware payload", "value": "392914bf5dfcfbb929c311d54e65931456211f0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700941599, "uuid": "863075db-ce87-4916-a210-6e3fafe530e9", "comment": "Malware payload", "value": "457d89b924448016aa09af460ebe971d3cb3eec0a58a71b3fab9575f4dc1cecf8c8d4dd24e3982166770db9aecd82a08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700941599, "uuid": "5fbdd981-584a-421d-8913-fa7663c9c31a", "value": "T17B658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700941599, "uuid": "61a7821b-e0b9-44bc-ae46-e414c35b4b08", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700941599, "uuid": "9a153e41-9fc0-416a-9a90-68c25b96b5ce", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700941599, "uuid": "26fe1a63-d3b9-4af4-ac5a-b38ce8b950a7", "value": 1539675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700941599, "uuid": "c02a83ae-376b-470d-9450-886225c4de20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700941599, "uuid": "6b6837cc-a9f4-49a0-9629-06004ef26d0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae13a730-8b6b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700900509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700900509, "uuid": "ee85a7ff-5347-4c72-b4cb-59290549cba9", "comment": "Malware payload", "value": "6ccbc4b8dcd8545a6b21910cea73e1c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700900509, "uuid": "371ea9da-59be-4020-bec3-546dc2997c33", "comment": "Malware payload", "value": "86a45c0d829cb99ee7b76081fc47c17a9072fd4bccdc791d67b1be528a0351d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700900509, "uuid": "4400d187-6b0e-4785-8372-52e347577669", "comment": "Malware payload", "value": "9b77ecc92a69570f450cdf5dc929f162e0f08983", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700900509, "uuid": "6805362c-5050-4d3d-8019-f94252333207", "comment": "Malware payload", "value": "7521d85f23b216b83a7320fb978386d96a44ac11cc1b1a98eb7d0a840ce0f7d8e48e3814076b1a13923d54e2ca0dfb68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700900509, "uuid": "d6848001-a6da-442c-9d8f-d3bd1f389109", "value": "T17974D81392E13E44E9268B73BF1FC6EC774DF6508E4A7BA952189E1F14B1172C2A3712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700900509, "uuid": "9b103217-71ae-4c06-bd47-ecf180b24a6b", "value": "ac2a65b4a5041877693100400bbe0f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700900509, "uuid": "4b6dbf84-e029-4081-83be-507047da7f66", "value": "3072:wAD44KeiwV0cc5l1qzThgV6IkxPdWzUfHOaZK1rYcIa35w6f5XyBk3eFx/Rb5B:JM4Keip/qzTpIQffHOaZKVw/6cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700900509, "uuid": "41dac0e2-5581-4b79-81c9-bdbd906468dc", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700900509, "uuid": "e4c98cbf-5aa3-41d6-a375-b182997c8777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700900509, "uuid": "219e5953-6a52-4c5e-b073-a26fc25115a8", "value": "6ccbc4b8dcd8545a6b21910cea73e1c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcde05d-8b4b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700886768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886768, "uuid": "c64ccf35-658e-49b8-be77-d500c4da0db5", "comment": "Malware payload (Mirai)", "value": "e0809cadf1c6ac82f0b8ce9ee041580a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886768, "uuid": "b92e48cb-078e-4e4e-94fe-b0223f0b1e27", "comment": "Malware payload (Mirai)", "value": "86a5ba2ab546e68ace5b67abbb9fb628b2c3864b739e7dd365bf38027f1ed9f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886768, "uuid": "c419e0cf-cbe2-4ebe-b6ec-0f654451ab94", "comment": "Malware payload (Mirai)", "value": "ecb67389e0a1e2e547b4c2c32f5b5a82e4791b51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886768, "uuid": "8d0b0a56-3a78-4850-a8e5-dcf61102e4da", "comment": "Malware payload (Mirai)", "value": "e539abc849b0e262f81112a4fb06e92b71da4e226125c78fff30d8ad28af77053b9369c558f87cdfc0afde6927644777", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886768, "uuid": "e853311e-656a-4d81-8b92-97c3b5f2ad3f", "value": "T12BD2E18875D653FACCCED9BD760F002A30B9B5A166A2A373F306C8134B72280F694D4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886768, "uuid": "9398c2da-856e-48ee-8bfe-0311c40c69b1", "value": "768:+lxKd29WcxEns+V6IHE4RlY990T11bnzk9+:zd29tn+9HEw0aT3zk9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700886768, "uuid": "f110608d-240d-4323-a106-a41ddda5fdf7", "value": 29688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700886768, "uuid": "14f3d3a3-ba1a-4b48-8d43-0d0a786e8b46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886768, "uuid": "5bc78e7c-895b-4c79-8571-b76cdbf61156", "value": "e0809cadf1c6ac82f0b8ce9ee041580a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9769bf0-8bd6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700946538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946538, "uuid": "4c6fac83-5bbb-40c3-8c35-69bb618291e6", "comment": "Malware payload", "value": "d507a50c8cd134d514b6f9f3d9c1815f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946538, "uuid": "f5e5a386-4a97-42e2-8b35-25aa9dd0719b", "comment": "Malware payload", "value": "8940965d7c6bed02deab20e5393aae3b044f82d2af3b0dcc772d5b7827cb40e0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946538, "uuid": "da311bbd-0aa4-41a9-b937-dc48de24be1f", "comment": "Malware payload", "value": "78a44120691b9c2211e24b6ed216fe72b78d68f7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946538, "uuid": "52d6380b-5b81-4362-82f4-8b6c0a141048", "comment": "Malware payload", "value": "f61b8f583b1fc264e72d83c007a71072d9b35f02b604d18944a07d757a69545fbfb7fc3dcb5fc3775ab61cb35b94868d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946538, "uuid": "f1ab2c16-9941-4c8e-8f91-380474e6ceb0", "value": "T10603D651F8825A27C2E1137AB6BE4A8E332073E982CFB617D9214B107BD551F0D63F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946538, "uuid": "ae0d455b-fbff-4202-9d45-7d2375e7e937", "value": "768:ZqILBdhxPh91eftcG5dm80LyFBWEu/tOr4MkKvlw9QSo8qMurE1Jomxu/NkwokkH:c0zmf2G5dmSBWjV8kZbJqa1RuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700946538, "uuid": "583f3693-fe58-430d-9968-b9b0f54d1e65", "value": 38116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700946538, "uuid": "a2926faa-8306-47e8-b505-3d722e0d57fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946538, "uuid": "7919f1e2-85ea-408b-8e54-7725714b81f6", "value": "arm5-20231125-2108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6c7f86-8bcc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700941978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700941978, "uuid": "1838d615-bb48-4c4b-911e-55d8f456ae70", "comment": "Malware payload", "value": "64bd60a7982ec2dcd5c92ff797202653", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700941978, "uuid": "a506e4d0-2c1e-45c6-a907-650496102ced", "comment": "Malware payload", "value": "8af864323e89e92851ff10a51583d87b46bcea41317902c9a45c3a5f2b2b71e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700941978, "uuid": "de719c13-e014-4e7c-b575-a4cb9c06eb27", "comment": "Malware payload", "value": "2b28b85cd8d1ec3c48332d21d6ba1d7a9acf05af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700941978, "uuid": "ac753c62-f7c8-425f-927a-220c0f226207", "comment": "Malware payload", "value": "f15d61eb206c11cceb84527ac0ae6946fd5abccaf3ca9fa169fc18f1aace6bff895e64c992fc643674b5d163b998794f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700941978, "uuid": "bc35adca-1093-46b3-a1a1-9e236c8fd176", "value": "T1EB54D81392E23E44E9268B728F1FC6EC778DF7509F5A7BA912189E1F04B11B2D263750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700941978, "uuid": "a6310617-dd32-4a9b-a4f0-799b86f0adcf", "value": "c0846180de212a99e5224d9162840371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700941978, "uuid": "9929e14d-9530-419d-a03b-a82b84fd5222", "value": "3072:VpZOtDXcNvQPwUKLrpgtKRZpaDZ69CuRVAQ5mgnYEp3b5kVyBk3eFx/RiPB:7AtDfYLrStKRGDZq6yYIn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700941978, "uuid": "7b3b7f0b-a3bc-4151-bc4a-1ca05fcf3246", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700941978, "uuid": "4f92ae45-6c8d-4e58-bd31-e4cc2e4ca91a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700941978, "uuid": "63857bd0-fcb4-40ea-8d1d-a4143239cc93", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a68b55-8bc6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700939522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939522, "uuid": "f15ca8e0-b9be-49dd-a477-ec8893b6c024", "comment": "Malware payload", "value": "1df523a8ef33157ad55ae5cec8a3aa96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939522, "uuid": "0a9adda2-2f74-4337-bd47-3362bee87adb", "comment": "Malware payload", "value": "8ba93462601376dbc05b9f0ce1ecc7fc5474a130fafb6eee8c89dc22ba94f587", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939522, "uuid": "8736b112-e13a-4f7d-88dd-9a5996ae9170", "comment": "Malware payload", "value": "a9ae7eac43a25a96f36ad7915a242956dadd805b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939522, "uuid": "934d8d75-6c04-4807-b14d-71990b96967d", "comment": "Malware payload", "value": "8da4fd4dcec52615d9344c4818028c259c3e316ae72b250343cf9f540f2d22b4b6a6f5f3aecd0034b703605680e3844d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939522, "uuid": "fa2f9773-4bc1-4c66-ad81-15b806312482", "value": "T10E944BD4A9F797B0CB3382F987B8B2D3EBEF654009419DA9376422F7144D48C1B66368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939522, "uuid": "b6dee650-2799-4f46-889b-a5f61e23d969", "value": "ef6c83f45c064b5b72490592b2d96804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939522, "uuid": "e8773f7e-3466-476d-b4f2-61d6c223f27d", "value": "6144:6MwMgbDFFfBKcAizQ+VvOF3tswKQFpX19aULf+Hcg:6MwX/NjOhFp9Lxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700939522, "uuid": "18e6fd2f-49a6-476b-825f-3117521db929", "value": 418452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700939522, "uuid": "0e7407bb-1a8d-4915-936f-882298229e70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939522, "uuid": "1655ee3a-2660-467b-a5fc-4a2c52730115", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad202f3c-8b4b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700886763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886763, "uuid": "30416d76-d911-4c24-86e9-7ca81229e969", "comment": "Malware payload (Mirai)", "value": "0747f2e4db871eb4580f04dfd1a12891", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886763, "uuid": "fdf946a3-5c0b-4118-bc31-b10145c0a691", "comment": "Malware payload (Mirai)", "value": "8c160a4a1ebe8d2c427e732b078c9d95f7ca12086e8cbf2ed16150734aac2200", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886763, "uuid": "cec6b977-8c7e-4b73-8333-4f8d775a3471", "comment": "Malware payload (Mirai)", "value": "4e7ccee96911bf27805b682bcdc56e9a329a8d4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886763, "uuid": "5e382b3b-7a72-45e7-9db6-83990d750eb8", "comment": "Malware payload (Mirai)", "value": "f929020cf8b26896ee8581a94e602af9e85e9676a750758652454d537e64903518c3dd7af54f15830f278d92fe8bc262", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886763, "uuid": "81284bae-9ef6-454f-aad7-5187f0c7e280", "value": "T1FBD2E11CC95E7844CA9D3EBD90DF65B6398C64C0931AEACE1766C408E657F8BFC1B0A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886763, "uuid": "369b6ee1-bccb-4337-9984-6e447daf2c0f", "value": "768:K1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNCdJbpWGPOX:KbDs06t4BEub4sU/MbUCdzPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700886763, "uuid": "17dc800b-3ff4-490f-b511-04cfbfc5856a", "value": 30548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700886763, "uuid": "84507427-49ce-4490-8d2f-14314e38a613", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886763, "uuid": "4bbc9080-e451-492d-bdbb-b52f2dc546fa", "value": "0747f2e4db871eb4580f04dfd1a12891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9093a21d-8b69-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700899600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899600, "uuid": "99231f34-6722-466c-82e7-5f505714f763", "comment": "Malware payload", "value": "39b3475c7f4e41ba07dbd81c3d26fb22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899600, "uuid": "d9926ecd-b7c4-4a39-8ba0-da9dd2e5aa78", "comment": "Malware payload", "value": "8f085b0c0abca741f2f1254d6d089a686f3864d407acb9ba843f74afa827cbec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899600, "uuid": "5c7157ed-6248-4671-8f0c-6248e848b26e", "comment": "Malware payload", "value": "521b8df75e2f494822a15ea8781d81a05f20139e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899600, "uuid": "0e06303e-a8ad-475c-a65f-5490ae0b30bc", "comment": "Malware payload", "value": "92f17bd5bc73757ff46be349dd12b4720573210039214e8bf13ed70299160e154cc75c2972372160b296d3322b81411b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899600, "uuid": "ac6f7ad9-be8c-46fe-b8e3-595c8f7961c4", "value": "T1F0A5B623BE97C5EBD9482736CB9634188370EC8A6713DB0A794A13691843F7F9D4361B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899600, "uuid": "240baf73-bd7b-494c-ac1a-46ce4e2c6029", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899600, "uuid": "caa86236-3626-4f34-8019-5190293fdae1", "value": "24576:bxV6Zy9sBvVbJmO0Ko3/lhO2GBKskoBXkgNJF1lIuwgh/Y+HR+m:bxV6Zy9sBvVbJmOQnO2GEmXkgHHSmtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700899600, "uuid": "cd24724c-98e4-40d4-92af-21fa37c13335", "value": 2229760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700899600, "uuid": "02be2a61-48f4-46a5-904a-6145010a6290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899600, "uuid": "a0023462-e8c0-4399-869f-e824f4b588a3", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a718be63-8b86-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700912094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700912094, "uuid": "e5f74dfb-cf09-4bbf-bdc2-794a68d737e8", "comment": "Malware payload", "value": "30739136dd085b6d0cad77fd366a134e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700912094, "uuid": "389d3d11-7416-4cb7-9e8f-011933d56a42", "comment": "Malware payload", "value": "8f25d5b17b0f59b6f2c2472fa0b18962ae4e47eb481f029ef57f7e1d050222d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700912094, "uuid": "74788fe9-a28d-436c-bdb7-1265c4dd2959", "comment": "Malware payload", "value": "ac50797286bec3974cd8ed68335c9fa1ccefd486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700912094, "uuid": "0c25931c-5c11-4ed4-b1be-f08f08ff22ac", "comment": "Malware payload", "value": "8b86753d37e45e3b1b5a3e20415fb5e842cc0b9af5f2728138496c7768352eea65b8157ee8cc83d0be159e7c8a63846b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700912094, "uuid": "66f751f6-169b-44b8-9d20-2f0c27d4e11f", "value": "T1C365C03370499036DDE911B666EC7E748D1FA0A40B6D49CB01E86AFEC715BD03B329D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700912094, "uuid": "9f6e07f4-269b-40f3-8628-fa6aeff93108", "value": "87161a064f5daa4a79ca02075d04f281", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700912094, "uuid": "027b2623-2dc1-4495-b6ec-2e8f9789df3c", "value": "24576:KDyEoRU5L8QyF1eNfB5VUfbyAMJzPKdRwPmvrRqJRezDTDIibeHZtO9EwGLZwZjE:KWEZ8QyF1QfcbrMJPKdCPKrRqJRezfDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700912094, "uuid": "2692a297-d2a7-4f6f-95ef-2b1dc1bb423d", "value": 1547264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700912094, "uuid": "0d948623-bd1c-468a-9ae5-7087db8e90ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700912094, "uuid": "03c28f9a-6a1f-411c-b090-89d7f4c29cb9", "value": "valorant.hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aff033c-8bae-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700929253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929253, "uuid": "26127d85-bcbf-4267-985a-ec0bed4b75ad", "comment": "Malware payload", "value": "98998f32b87d9ecdbd18597981fcb3cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929253, "uuid": "7a00c42d-9536-44f4-a7eb-4b7134d1aca8", "comment": "Malware payload", "value": "8fb7d47d8e4c4f85ac48a1cf960c7aff4dd08da86d5676d55b4349c5a9928606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929253, "uuid": "4007ac0f-d75a-45a8-9dbc-2fff0e27e7d3", "comment": "Malware payload", "value": "3a5eacfb1d60abfc99a766e04726ad25c98ce7f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929253, "uuid": "2c1e8f76-5e9a-4eb3-aa73-773fa9f846da", "comment": "Malware payload", "value": "aa81c0c74f5699afcad14e64415dc527e0c1686876303f54925f5a1450e2c9dd5dc9178c7b5893f74e753ca5b9ba5822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929253, "uuid": "d78b6f54-d367-4152-801e-ce513df708bb", "value": "T190E533435A89481DC3AD28B382FBC85D0A70069765E28E869DBD04CDF777F52CF12A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929253, "uuid": "e35ad28d-5a41-4cc2-9e64-633fc34e84bc", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929253, "uuid": "59de6f27-885c-47b5-b09f-aab26785d5f5", "value": "49152:Vc+NUurJ4xAfx2eHqGUWM574QHDoVyg908bOSycd2MU7R6DZFs7pf2rCl:VRhpfwvGUF1Ya8bODcdWa2p+rG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700929253, "uuid": "a7c6cc16-0a29-4be2-a8ef-affffa08dec6", "value": 3041800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700929253, "uuid": "cdcae6c8-abf4-4eee-81a5-bdf55dc48bf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929253, "uuid": "0f11e58b-ea16-448e-b7a1-9c6d7e6a9c7c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a59aa54-8b75-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700904556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700904556, "uuid": "97942d67-a35e-4495-a64e-f25b748ad06c", "comment": "Malware payload", "value": "28ab924f4ef8a47d3e45db3675b1adab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700904556, "uuid": "18fd3f64-6556-460f-bbff-66efa33dc2ec", "comment": "Malware payload", "value": "9498399e00f48252d440863a0192975037222a1e30cbcf24b49f16480aa1ece7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700904556, "uuid": "7cad8304-eb34-4b86-88b5-1c28fa1911ea", "comment": "Malware payload", "value": "bc999c667d10139a13b4ee039df6d5f75141cb74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700904556, "uuid": "bad1a8e2-a0ca-4675-9fdc-6f91019ceda4", "comment": "Malware payload", "value": "2f71baa731372bcbfba364e6395ee264644cfedb707442d39edcd730d29504f48f1551ce9fced2ac9a0a9dd5cd15eeb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700904556, "uuid": "9513cff7-4892-4495-82aa-e7bd906ffec7", "value": "T18A74B51392E17EC4E9268B729F1F86ECB7CDF6508E497BB912189E1F14B0172C26B750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700904556, "uuid": "4199a55a-3066-4e6b-8e98-14a2aa8624ed", "value": "4c459b08e177ae567cc13290dc63378b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700904556, "uuid": "ecd229be-1b29-4de2-a831-96a0f0be2e2f", "value": "3072:kXE/4UeYJ0cKHTNm+TMAXgkwMA95OnUmnm8Ce0624gcdROP5wW7f5XyBk3eFx/Rj:aE4UehTgoMA3694nho16bd1W7cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700904556, "uuid": "29dfc49b-b434-48d1-8f0e-247062b04d37", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700904556, "uuid": "88b371aa-dce0-4de8-a08e-4a6a763c17d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700904556, "uuid": "7e51731d-c215-4853-ba68-e1802728a4fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50d1fc6-8bbe-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700936169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936169, "uuid": "90bcc944-d4a4-4175-8e8c-c2520c8a54c8", "comment": "Malware payload (RiseProStealer)", "value": "9adfac99ffc6520d221a465f558ebe18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936169, "uuid": "49151552-618c-4250-9855-513893557f11", "comment": "Malware payload (RiseProStealer)", "value": "94ccf32b195a32b371a498c899d21d5494cb3c1ab151435b5f292ca45e2f5907", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936169, "uuid": "20d7c30c-3696-47b1-9078-ca41c6ac6c72", "comment": "Malware payload (RiseProStealer)", "value": "85095dc2b16c3af2af94a1900cadc56c0d8ec9be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936169, "uuid": "ea7e8efd-e705-4096-ba23-38eae7409a89", "comment": "Malware payload (RiseProStealer)", "value": "2ce79d402945e005d336fb9e59aec8e875d1960329c3fcb5fa0c1e321baaf416cb948c29b0a69d634300e5d68c3f9263", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936169, "uuid": "653b623d-370b-40c2-82af-4c571a84439b", "value": "T11C658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936169, "uuid": "c1199393-1c1b-46a6-a397-cbaec08ad540", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936169, "uuid": "05802e72-659e-40f8-88f1-626efab721db", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700936169, "uuid": "fb89f44a-e06b-4210-8296-d6091f962c16", "value": 1539611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700936169, "uuid": "63ab635d-290d-4ddb-9b66-877af22d5cb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936169, "uuid": "9e7098fc-1bec-4ee9-b16e-c5b3c985aa2f", "value": "SecuriteInfo.com.Win32.TrojanX-gen.22815.11297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1daac0a-8b36-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700877725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700877725, "uuid": "24bc62ea-ed8a-465d-b903-c20ab29e4c0b", "comment": "Malware payload (RedLineStealer)", "value": "715d9e1786839981fc5aa6ec4c9df1a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700877725, "uuid": "bd92c07f-56ef-4f01-8335-c85484813af5", "comment": "Malware payload (RedLineStealer)", "value": "9d4991393962992db54a17e7aad1152a8965c3d51ac309d35768953f7e20dac5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700877725, "uuid": "7481e27b-9471-441d-be66-c8f6ccd46b46", "comment": "Malware payload (RedLineStealer)", "value": "e4f3d03f3e92faa404669b55c7c28aba157a44ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700877725, "uuid": "0e045a3a-b38c-44b7-b243-1f18c044164e", "comment": "Malware payload (RedLineStealer)", "value": "3246ef489d6fb97bd70f475ce5e71289d39aadafa6e607bf281eebb4a15e09ffd0bafd11279e8f6a32536e635cd5df5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700877725, "uuid": "f3058e59-e510-46d7-92d3-9b1d6ff6fea1", "value": "T1C034BF6C2FA58D15E1EE4E7408B3A368D63C9D732E09C503E5993E951B37E885E123B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700877725, "uuid": "e44debbf-919b-4eb0-8ed9-2b8add5e23ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700877725, "uuid": "3e13b68c-06d2-46df-8cac-1d6f5b396a9f", "value": "3072:FjToRFRb8MPOin68SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9NzLnQ:2RFRbVX6UhcX7elbKTua9bfF/H9d9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700877725, "uuid": "2947b72f-6a5d-4b1d-8119-d68abe56fa98", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700877725, "uuid": "d60a7dd4-1ea0-4d29-919c-a30242fbf869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700877725, "uuid": "b277f57a-67e5-46a5-9ec7-f1aad06a1f60", "value": "715d9e1786839981fc5aa6ec4c9df1a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b4ba9d-8bd6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700946535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946535, "uuid": "632f0f0a-185a-4ca5-83bb-6df33ab6c3d1", "comment": "Malware payload", "value": "5d0a1c93f0f920bbfe02e6e5070c3c69", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946535, "uuid": "8d8d07a6-edea-49ac-b08f-cfa839a3af64", "comment": "Malware payload", "value": "a081a5d0043fc43aa425498cb4471f866c281edd42ea6f2da092e8212c1e1f94", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946535, "uuid": "abb0a0be-e377-4149-a31f-c223a07ceaee", "comment": "Malware payload", "value": "ef6948a44b00fb2cd46af6ed592aa9efc6106c65", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946535, "uuid": "3b75ccd0-02a5-4637-af66-7a660a32c501", "comment": "Malware payload", "value": "72204bfa47bc3ed3a2eca5bf63ff98c7dd1a62d53e6760696b91ed766348130b949f6bf54bd25827ff947ac67922b759", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946535, "uuid": "5f8b5724-3cd5-495f-a6e6-7974fd8e30d5", "value": "T10E231841B8818623C6E4137AB66E46CE372563E8E2DFB3179D221F503B9682F0D67F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946535, "uuid": "25c145d5-90b4-4d22-9453-0ef41e412182", "value": "768:p9T3kFvFsOvIZg3VevqKxpn9m+/8KlUfPoVs//N+WX7JTzLgwo:L3kFvqOv0Q8lgxfF/z91o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700946535, "uuid": "9628377c-5ddc-405a-965f-f0f168818a37", "value": 46864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700946535, "uuid": "63a42d20-f6b8-41a9-931e-e83e83365797", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946535, "uuid": "a93e665a-cb80-46c1-bb8c-281542826a94", "value": "arm-20231125-2108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb70d530-8bba-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700934569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700934569, "uuid": "0cd09173-ecc6-4fdc-b6ec-94c51cc224c3", "comment": "Malware payload", "value": "203515e9c0d346cca1ba293c335eb6fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700934569, "uuid": "1a1dc616-3e52-4e0f-88d0-c8b3246ce984", "comment": "Malware payload", "value": "a0a73f9f2d0aa56ffceef8da32e097f7d87e1199ba8282d065d5c0c78d0f49ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700934569, "uuid": "d13cc4ee-1743-449b-9815-46214bb3719d", "comment": "Malware payload", "value": "4cdc24e1d3b00f994f03770f62d4bf9729978650", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700934569, "uuid": "5b71f381-6de8-478d-b012-9f88ff80ebd9", "comment": "Malware payload", "value": "4ff729b5b758371ad18c0f89bb07612f129c28b5f23319cd83d607a4e55c48c5b77d7ae60c7ac33e00ccc1c22193bd23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700934569, "uuid": "682a9434-3c1f-470f-8d9e-79d9a491f1f3", "value": "T118D512368A0188AED0A38AFF83773B2D4EEC3F51B319626B61D41EC58731855D5E660F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700934569, "uuid": "cf00d9ea-30c1-44dd-b342-705b4fbf1d25", "value": "5b36115ff362711943f368adb695e60e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700934569, "uuid": "dad7b01f-8478-44c0-bdba-4b9c9af24359", "value": "49152:8jVgiG1hT8cm8U2zkpdt0n/s0YRZHPm4poP2UkCsPt/BI:8ji7F84UJoE0YRZvm4pk2U/AhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700934569, "uuid": "86d4dd7d-88e8-4061-bdc3-3dabb062a353", "value": 2781184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700934569, "uuid": "e60ec2fe-5c32-4c6d-accf-71c7b2ceb76e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700934569, "uuid": "26e1d7c2-5680-41d1-8027-fab4afc732c3", "value": "878fb90fc48f5313c8a08db582628f9fe7ee1fb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046ff4be-8bb3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700931148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700931148, "uuid": "62484ad4-2675-4147-b4b5-20c482d0e3ae", "comment": "Malware payload", "value": "38b5f76317e1b003755aa011745aa6cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700931148, "uuid": "f0187c4a-061b-4863-8f7b-37673ef4492c", "comment": "Malware payload", "value": "a0f6588980293c6a7433beef8226b491b3bd6246dc4930d08b45c0eb7b31d84e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700931148, "uuid": "b251956f-f278-41f5-8e7d-ee1c91ce372a", "comment": "Malware payload", "value": "aec818e3dfe2de19aee80c763f809fbcbb0c8668", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700931148, "uuid": "a06b28be-11ee-4f89-b747-4e182759ad04", "comment": "Malware payload", "value": "faaf3e3dbb467da6f48ca7fe8eb6a65558a4ccb6fb70c1674ec5d6fc70bbcd8143af3e4aa92a5982c80e57063577d8e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700931148, "uuid": "474de770-909c-4867-9dcb-8a0999ace325", "value": "T18B5416D923F394F1CA2BD0FA6B6A8647137BA8351572D5AA274275F1080D09C3BE7B1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700931148, "uuid": "5c925beb-3761-4174-a6e0-2017d6601288", "value": "cf21347b4fa195306df8f1936b9500ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700931148, "uuid": "50705472-c18d-4f48-b35b-a7a79299b535", "value": "6144:bks23cPbeMbi8CkifVrQRcuZSDo9PqFnh:b8cPvikRc+Bqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700931148, "uuid": "896d7a2e-8436-4a17-ace6-75a781e3d47f", "value": 294204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700931148, "uuid": "1bca8d00-8649-4930-a859-fc1d2437594b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700931148, "uuid": "a1c88d24-2e83-43fc-8d10-619cfc95d461", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa63e09-8b4b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700886759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886759, "uuid": "b8d12466-1fc6-4f83-8141-7f3c7d2ef651", "comment": "Malware payload (Mirai)", "value": "bb19493ccd6967b86fbad7e023ddea70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886759, "uuid": "40943153-1a10-4551-a184-a4d345cfb632", "comment": "Malware payload (Mirai)", "value": "a3cc9074b2823e59c7bd9b2aafdf2e691954deaaed551efe174a1ecd39c052b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886759, "uuid": "28ff331c-45d8-4a70-859d-9f45d886ce52", "comment": "Malware payload (Mirai)", "value": "33abda5c17b03c93e080868ca6d09452526904b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886759, "uuid": "8355c169-d399-49e5-b653-b2c5e57db837", "comment": "Malware payload (Mirai)", "value": "d3095b3f1fa367e5fe588fdace8f02f97309aca05908a33c91d5fad847c1f16bebba44caad7bed20e290b4679c078798", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886759, "uuid": "a75246fd-df71-4ffc-84f8-172354088f1f", "value": "T1CFE2F19393B1B052DEBC1BF2F52DC1CA62BE4A5CD2B230935E1595683A870536F3D493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886759, "uuid": "86fa910a-dbb5-4326-84d8-67af3099ee8a", "value": "768:voiWiO031vpAPbrVWZK3XVGxm9XVY3UQwpI7:vorm1vpALgUJM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700886759, "uuid": "f4736fa6-8d5f-417a-95c8-2dc9345475e6", "value": 33164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700886759, "uuid": "1ee0654e-495f-4176-8f97-aa81bcfb2eff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886759, "uuid": "5c382a63-ee09-4920-a2b2-7c62676345f5", "value": "bb19493ccd6967b86fbad7e023ddea70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293451dc-8bb7-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700932928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700932928, "uuid": "cb6aada7-ba19-4b8e-b0b8-e725a8ce886a", "comment": "Malware payload (Formbook)", "value": "1530c857fe5d228b4836a177a7fbb92f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700932928, "uuid": "039f88c6-640c-4047-85dc-4971d4c1629e", "comment": "Malware payload (Formbook)", "value": "a48bdc85f4da302d6c3bd23a5edb8b56a64ffe9e0f79b6e150c11982295b277e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700932928, "uuid": "0027efe2-7c04-4169-aa9d-60389834fe50", "comment": "Malware payload (Formbook)", "value": "05d8268b3f56c60b3d318902c37920f9ad030872", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700932928, "uuid": "6c3e5a9a-bf20-4be0-9ad3-7395d1d5ee51", "comment": "Malware payload (Formbook)", "value": "ea644347ed46c7a56e83a255531c17b091245a5c40425580086c7d3e83908b418bce61f4b492d027afedc84e78951255", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700932928, "uuid": "b8f58af4-54ec-4a62-9874-d1c7eb1ece85", "value": "T10B15F12C22B40F99E8B797F58968420517F6BEAD502BF35D5DC0B0DB4E72B811A07B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700932928, "uuid": "7f2191eb-53f0-4ab9-bb6f-a196c03adf13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700932928, "uuid": "508dcd3f-6e24-4ed9-9a38-66b848ca6959", "value": "24576:8mtD/61xQUqRbqfLZAY4cFAs+VXI4YU5nLsjvEN:Z6gVRbqfWsQMUVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700932928, "uuid": "c0dd73db-daa7-444c-bc06-b610b3973d21", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700932928, "uuid": "f113d636-17ad-4a7b-ae61-9d4e8667192a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700932928, "uuid": "fe989501-b7e1-41c3-a1cd-f57c16bf0969", "value": "AUS 9141124-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d04e0c-8b60-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700895589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700895589, "uuid": "f785faec-0fc0-4ca7-9ed8-3827f62fab65", "comment": "Malware payload", "value": "00e10489d0d0eee2ca1c89f8a225c88c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700895589, "uuid": "6d287ce1-bb30-4d55-b54a-3fb99f1ad6c6", "comment": "Malware payload", "value": "a882a94fe647991ec876779042d5238562541749de4b3f888dd5135862fbab20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700895589, "uuid": "978a7f77-13ec-4f30-a90c-7caea21f0ab4", "comment": "Malware payload", "value": "c272dbdd42dacd1109aa3e8e550c00ed730ca0ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700895589, "uuid": "cab4409e-5d8d-429f-a11a-3834aac0fcf3", "comment": "Malware payload", "value": "6858e5e9a01a90d3ffb23cfd1146c23d3c2b1e6fc72bcbea196babfcdea2c65b858bd79f643abc80b49c222fc5808a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700895589, "uuid": "64009ea1-a8ad-4641-8291-dd964c726ad4", "value": "T11D24D62AE344551DE83A473DB41C38709F70BC52E16EE32F55BA7EED683BB098A105D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700895589, "uuid": "33440ea9-0cc0-4196-9a4b-2d199b093e36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700895589, "uuid": "5a28ef72-a1fb-4708-b4e0-480df7d30364", "value": "3072:uVf977CNgctVghrb9YsGtGgRSd521SvwemZ4liKSN:GV77CNgctirb9YnJ0D21SovZ4l9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700895589, "uuid": "bec37dc6-1052-48c8-8922-e5d70c66f7fc", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700895589, "uuid": "3ffc8045-370b-4880-9c5b-f7fff4cbc158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700895589, "uuid": "6e54a4f8-011b-4b02-a960-86aa31ff1de0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c80886-8b6a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700899795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899795, "uuid": "9705dd49-52d6-411f-aeeb-525eba512f04", "comment": "Malware payload (AgentTesla)", "value": "be582774c7364c2c3cf4e0403b1a44d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899795, "uuid": "62ffa593-4cc8-49fd-9015-bd0b1a7953df", "comment": "Malware payload (AgentTesla)", "value": "ad942fc486c91d8bd5c3d1ab5266d94582b10ea8ac3f284c6914d8c0e1542af8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899795, "uuid": "a39cedbc-db57-47c1-afa9-ff9201a31a48", "comment": "Malware payload (AgentTesla)", "value": "e4d458a61edc7338f84b36c0e35960bc934afcae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899795, "uuid": "8869ff26-63b4-4d85-8b8f-94ad6f6df7fb", "comment": "Malware payload (AgentTesla)", "value": "f856e382303be2f63651de29ab11d65438a4e581b59e176f6b80db855bfdecbc75cd2e551ec123670e4978596244ff00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899795, "uuid": "c72effad-b7a5-4811-93d2-a7f92db1f198", "value": "T1EDD4236A271EAFDBC85D03F60D60910413F1EE2D54A4E968BDC671F38E7DB608B65A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899795, "uuid": "f26d51a1-8654-495a-a0b5-646d40dec96d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899795, "uuid": "ba49a683-301c-40a5-aee6-9fdecccf20e7", "value": "12288:4E6jD/fFix+ngEZfsLYg2IaXelATbtWicw1Pnq73qVPN+5WHCdENz:4tD/fF4EddulATb7cwpq76SwH6EN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700899795, "uuid": "012c2018-a3a8-4407-a896-6d3ad4fd922c", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700899795, "uuid": "7ea2b14a-fee6-4292-bba6-7dfd33925c18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899795, "uuid": "5bb11a83-3020-47d4-b5e1-640dd4b43414", "value": "open-order#456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0405349-8bd5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700946039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946039, "uuid": "801aba2b-2b3c-4979-b8dd-97db7dac8e18", "comment": "Malware payload", "value": "f29945550d021c67e59a988226304db7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946039, "uuid": "de3148ca-1838-49b9-a8b5-7d17cf93b2e1", "comment": "Malware payload", "value": "aedd4345043e20d11951c5f302d60586c6b43c1d474789418c487f1c3310fc68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946039, "uuid": "d7638eb9-be21-4d3a-a413-73d5fe47c80d", "comment": "Malware payload", "value": "559832c818649606f3af617ad07c6af94cd24847", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946039, "uuid": "79ee1c13-18b3-4127-9c9e-1c80875cbf3a", "comment": "Malware payload", "value": "80006354a7b4673ba76a3f3d2f86ff13a06527c6ae3c019b6df78c172185dedc6a97a0d0ceae13924a2c03c07454cde9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946039, "uuid": "36f9167c-1b43-47bf-8725-7bb8174f1657", "value": "T117658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946039, "uuid": "35d86910-7e8f-43a9-ad5c-db58bc0d427f", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946039, "uuid": "aa141c1c-bc28-4526-9844-7e7f3534f410", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700946039, "uuid": "8cd52fa0-c861-4c7c-a990-24dd74037f8f", "value": 1539700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700946039, "uuid": "7911e729-3470-4c68-a486-a0d53dd72237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946039, "uuid": "5b4a08d8-fc77-44e1-8c74-1b6c9df1c306", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d36b36-8baf-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1700929434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929434, "uuid": "e77d38d4-5c26-4c43-a991-dd4c04b64f36", "comment": "Malware payload (PureCrypter)", "value": "db0bec9092b3322fb8a3a563f4447ab2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929434, "uuid": "b6c6da9e-1603-4937-a2ed-c2b22b41297c", "comment": "Malware payload (PureCrypter)", "value": "b1c809fdb081893fd2fc35b8e757bc684c5f222cea0eeca0e2c62cb73f89ead7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929434, "uuid": "3cf81266-dfe1-4a42-8182-af13a95936f8", "comment": "Malware payload (PureCrypter)", "value": "007ac05e94be02cf79bed668d8ab345f1333d630", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929434, "uuid": "8aadcd89-c552-4ae7-ab0e-6ad828b2870e", "comment": "Malware payload (PureCrypter)", "value": "1822a5192bb3660437af8d1b564033600b16b50f16af573c616fbff1a87b9741a01c961b434c51e45df6341672fcd717", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929434, "uuid": "9bffa0bd-d9af-4193-b499-128314120e99", "value": "T1F454188523E616AAF1EF1F73E8F4362547B8F841AE7ED70E184019DA1C73B528854B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929434, "uuid": "6d9a3216-a4c9-4ec1-bcc9-4e9f316eae74", "value": "6144:udsXmjgsJn8XRskwwCZxJfsb44/j2tgrK2FMzHmsUkh:tXQgiKREu44/j2tgrK2FMzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700929434, "uuid": "8ca37e0a-7070-4159-a42e-c5ed65a48f2f", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700929434, "uuid": "c6733b50-8215-4060-a1ce-c6c1cea2485d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929434, "uuid": "6b9f1405-81f3-4204-aa8f-44bdb4f5985a", "value": "Aluminum plate & bar requirement.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a463f0ca-8b4b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700886749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886749, "uuid": "adf256c1-fe1a-4023-8fd8-07f573cf76c3", "comment": "Malware payload (Mirai)", "value": "38da4d6c7f5b39265e24ef3c46bcf6f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886749, "uuid": "8723ef1f-9cd0-4ba1-ae6a-8f75eb6dc724", "comment": "Malware payload (Mirai)", "value": "b9ae8fad14e765c5781a922b9ba34629f568970a9046515fe256b46681327ba7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886749, "uuid": "1ca15ead-8e8c-4e93-b909-3d1f4ccdf7e1", "comment": "Malware payload (Mirai)", "value": "dba7f22e065a05f48b7f9ac0683a3f30d6b04df1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886749, "uuid": "0f11a6e6-a1db-4e75-8963-020193b34977", "comment": "Malware payload (Mirai)", "value": "e4461830628c784444a0ea9edabc6c7a458cc0a1c2064e74841f9db63a62e921684e0b2e582a8a668c449eb3bccc98aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886749, "uuid": "4e69aa85-4516-46e9-a1e0-08354a79e9f1", "value": "T1AF539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886749, "uuid": "7d7318c9-ce16-411e-93ed-0c7fe1e71f7c", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700886749, "uuid": "30588da5-9a0b-4157-83a5-448653a120f1", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700886749, "uuid": "4a014c7d-bfe5-4653-a170-7abf77e782dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886749, "uuid": "e11d397a-252b-4446-a6a6-c34a2848f291", "value": "38da4d6c7f5b39265e24ef3c46bcf6f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c603eb-8be4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700952390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700952390, "uuid": "e35c165a-e553-4a56-bd44-ad6cad7dde7e", "comment": "Malware payload", "value": "7e839d41a7d1178d96158ee3ae28779f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700952390, "uuid": "28db4fa8-18d5-4f6f-a20f-0756cfea21e5", "comment": "Malware payload", "value": "bbd1de6202cbf7b144035b2f82d48567c36cc77909a6f8a52604bacdfd80449f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700952390, "uuid": "0756cf59-acdb-4857-8a58-cd39c0cd2270", "comment": "Malware payload", "value": "daac863ce741c99e477e90e94b607a2f0147ecec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700952390, "uuid": "e611740e-d894-4e09-a9c5-398b5405bf77", "comment": "Malware payload", "value": "997e93f147d07b7d7c1dbcc0be381e6b824c30f191e683d0351fb2e07e9294d3060b903a38241b5eb6af24bcd6f9da4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700952390, "uuid": "509eb02a-1b69-4759-a2b2-26acf95d3f87", "value": "T165658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700952390, "uuid": "3e8ae221-030d-4672-bb6c-6224ee1c669c", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700952390, "uuid": "ef3b578d-58ef-4af9-8c32-281b128ebace", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700952390, "uuid": "53c9dc90-18d8-4f2d-a248-0b5d311e9671", "value": 1539729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700952390, "uuid": "afa065cd-4486-44d7-8268-d949784b3cf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700952390, "uuid": "b08bb6df-082f-43ae-aad8-b9f1c5ccd9c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bd585e-8bd6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700946530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946530, "uuid": "7b62b560-70fe-46af-93ef-71a397f63a07", "comment": "Malware payload", "value": "dc00641763e8165a0a1306b457eaf9da", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946530, "uuid": "7c338f44-f7be-467b-b237-b4b18b7c4a58", "comment": "Malware payload", "value": "bbfa89a13a95585f9b1d2430defd72711548d1dd1499eef2bfff9d8ef539f5b6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946530, "uuid": "22bd032e-c4ec-45e4-8547-8d9131845f29", "comment": "Malware payload", "value": "b8cca8de1ddfd76833e9eaf9e4f48a8497b109bd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946530, "uuid": "3feda385-0d6c-40c9-b16b-f998f66b94e7", "comment": "Malware payload", "value": "20f02fcdbb267c2384e5cf7b4b4c2945e8b1f7b5279daf6ac8241193399241ac0743286d1790ce29754f2910d714d65b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946530, "uuid": "2c2874eb-c16c-4987-8899-d03bb2d004bc", "value": "T1921318C4F553D9F0EC5A06703076EB365E36F1FA222CE553D3A5DA32BC82602E60699C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946530, "uuid": "f6ff2e68-67f7-4ab8-ab7c-52b60fec0425", "value": "768:xMlB2zs8ssGfrRI6aQ2nEenz0q8uDOycN95VlVs:YYzs8ssGfrRI6aVnEeIWOrNrVla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700946530, "uuid": "0b48eb9d-46f6-47a1-a90c-0b5816c86690", "value": 41776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700946530, "uuid": "c06d6876-83d4-4d48-8709-5bcb26c380d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946530, "uuid": "4f6c5255-6065-44a3-993a-02bb1470a1b7", "value": "x86-20231125-2108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc8d6b4-8bd6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700946548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946548, "uuid": "56fe6b72-6493-46df-8a78-efcecc8a3a9c", "comment": "Malware payload", "value": "26c75af2d3a3d33e62d53a509eea8059", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946548, "uuid": "fc7e6c30-5946-4156-a7be-216782874ba3", "comment": "Malware payload", "value": "bc095e45e980f35a599b11880b52dbeb5a6942efb5655f93be6162a069e456bf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946548, "uuid": "aff4cff6-2382-4c4e-b397-f619fd110c61", "comment": "Malware payload", "value": "249351e7224310cf2959cc9b7611e0472869dfdc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946548, "uuid": "2d67d0d5-5e8d-446a-bba5-9fbac83e181e", "comment": "Malware payload", "value": "7351ee24c4f097ffeb94e54c82fec068314bc647e0a7365115def4a7f6454832e6715fc336091e4fd2b9103f42563d04", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946548, "uuid": "362e8a5d-4442-4ba7-b3ca-250e8735585a", "value": "T19A23F807F54381FDC09AC274066BB93EAC2675FE0238F2B67BD4A722ACD5E215D19C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946548, "uuid": "64c0bf1f-8ea3-4c8a-a8a5-01e76d022b34", "value": "768:vZCLNaOGW6bQHT9XmB3OIB/c1cV9KFf8D+wdYFmuqpjik0BLvI04Wx2fEj1smKhN:oLYOGW6bq5XmB3OIB/c1cvK++JMBF4IT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700946548, "uuid": "1a924f43-a172-40c2-ad7b-d024e7ea1089", "value": 46336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700946548, "uuid": "b95ffbd0-7d4d-4904-bbaa-0b36ccab3580", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946548, "uuid": "b51e18ad-4ec6-429e-8587-3096959463e8", "value": "x86_64-20231125-2109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac2046d-8bb1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700930514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700930514, "uuid": "591f615d-1dd3-483f-9764-11fede06ddec", "comment": "Malware payload", "value": "3ce4873ffc38e53b38eab144fb82f829", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700930514, "uuid": "019e181c-1728-41ff-9523-e01feda460e2", "comment": "Malware payload", "value": "bcdf1c2e9b7f489d189a8245706c64c9b82b2eb1f61fbd0d35f29f1f5f32d45a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700930514, "uuid": "75c2f2a0-6756-4add-a276-dd2f0b458bb6", "comment": "Malware payload", "value": "13e236434af891d6975e375e328a91cdab408e31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700930514, "uuid": "e8a23bf4-f464-4df5-89e7-5b5fe808de1b", "comment": "Malware payload", "value": "43ad90d827f84004bc4e9c8e70a13860b904fe3cd8473fc19d60e9693a8e912bd40768e1c1b7707284a35449d474f15c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700930514, "uuid": "fc576757-475f-48c7-9864-ab200f68d16f", "value": "T11464821392E13E44EB268B729F1FC6EC774DF6588F497BB912189E1B20B1176C263B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700930514, "uuid": "8c955137-fd77-431f-a3d9-465766b837c1", "value": "5436687cad9eeb8d4746b898301812f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700930514, "uuid": "658aa0ae-1d39-4235-8370-dd5c3bc35b90", "value": "3072:rZzDFjdNFLEsley1/9otdh6mgXSI52hZf5XyBk3eFx/RIAB:FzJ6sl/qdh6MhZc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700930514, "uuid": "017304c8-46c0-4a4f-8ca6-4ddb9d660860", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700930514, "uuid": "bf358315-18c6-4fc8-8c92-0a6ffabaae8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700930514, "uuid": "e5b5a5e3-0a6f-4e42-87ec-00b5d22ef939", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce955ca-8b30-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700874979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700874979, "uuid": "aa2de017-f5f8-4c1e-aa13-7aa391c22411", "comment": "Malware payload", "value": "c8122543bfe19bcb17812ef033036202", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700874979, "uuid": "4e4fef55-476a-4c34-955b-49c12c380604", "comment": "Malware payload", "value": "c06808a236d20c93225fc9a13521dad2fb6a52709672eca5439192108ce9fe05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700874979, "uuid": "c931ad56-4338-44e7-89ff-6124bf8b8f5b", "comment": "Malware payload", "value": "db05bbaf5a1c0ae8353b96709f488e84501d91a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700874979, "uuid": "edfe6f58-bb5e-4098-915e-39b3e095becd", "comment": "Malware payload", "value": "49b30f57ffb431ecee00f5517c106b786298dce873d040fc6727f9c79ce2b6ec0b103409c06f737615917a282b1ec0e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700874979, "uuid": "e7728818-ad61-4618-8f92-7c97a6a62441", "value": "T1A8439606BF41DFA7C81FDDB306FA861134CDB8571565232A3170EDACB61A5C749A3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700874979, "uuid": "291c608f-abe3-43ac-a962-67621cbb74c4", "value": "768:dfToTNUT56C9hnzPwc4OkGi6ZjqLvXi8Seyp8/BeZeVPTLdAmkWISVMH:dMTSV6YOckt6Zjq+u/BQmTLD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700874979, "uuid": "93e64b65-b071-42b5-b83d-eed02486990d", "value": 56632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700874979, "uuid": "c5c0da66-7608-45f7-b54c-8a015ecde745", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700874979, "uuid": "ef93871c-281e-4b9a-bf14-c425e002461e", "value": "SecuriteInfo.com.Trojan.Linux.Gafgyt.25265.26771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c16ea7-8be3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700952068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700952068, "uuid": "94ad5b0b-5a02-4323-94be-f4fa38c86478", "comment": "Malware payload", "value": "0e609e4681b1b5244aed42409f22d19c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700952068, "uuid": "571b923c-68f2-4766-94a0-4f9223b6690c", "comment": "Malware payload", "value": "c08eee0129f5e63f5226ff413a14a442cd931290cfcac55e2192a704eff63562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700952068, "uuid": "9840e86f-24e6-4bd4-94fc-a03153d321ca", "comment": "Malware payload", "value": "9b0627a36900165af87270a52c6eb07d30e9fa43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700952068, "uuid": "332c88f5-2643-4b02-b45d-b88a5d038b00", "comment": "Malware payload", "value": "9ba6f163589722765860930609ef8fc6cae2cc6ee942f6f9e1b8989b299ee0ab321f00edf8379822d10d84c3d4e21ac8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700952068, "uuid": "e762259d-a710-44f3-bd5f-79d394a2a33e", "value": "T10C54C653D2E23E54E9268B729F1FC6EC774DF6508E497BAD22189E1F04B10B6D263720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700952068, "uuid": "1a6f7f22-493b-4eb8-82b5-ab39a648ea07", "value": "c0846180de212a99e5224d9162840371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700952068, "uuid": "1dad966e-33ad-4502-804d-3a2f86b2bac5", "value": "3072:vi7VODdV86tS0hqvA7DxTesY6qgN/1IrfZ0eGV0FrQ5mg/zqX5kVyBk3eFx/RiPB:KpOBVHtS0hqvA7Dxa9pgN/2rO4n6Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700952068, "uuid": "24dfba7a-ebff-47e5-834c-33c744057b1a", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700952068, "uuid": "415b2a10-7fb0-4233-96ef-f578f2a3d378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700952068, "uuid": "dc34cd5c-0414-42fe-884b-5e6d336cff20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81ff5d7-8b4b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700886755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886755, "uuid": "e2892b12-73fa-4b09-b49e-c62452fa6a82", "comment": "Malware payload (Mirai)", "value": "faa2b28b60ca260b3ce1095e65f4c31e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886755, "uuid": "de6ba672-bef9-4883-b781-1a736ce91237", "comment": "Malware payload (Mirai)", "value": "c21edb06f246ed383c068ee3b2d369ed18a168dbee4146c97adcd4e649e0b305", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886755, "uuid": "db8f915a-ea23-47ed-bd86-3fe758d96da1", "comment": "Malware payload (Mirai)", "value": "cf7ea577ac47973f1278e4f77d935bb4a031fc54", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886755, "uuid": "cad19def-af46-4896-b2c0-a54b86e644b4", "comment": "Malware payload (Mirai)", "value": "9c4ebd6c622e0b9d36f631bc1d54cb5fbcaa15c22f6be5018b099f9b7c6398e9e95b6c4052fc454604c3f1666bf82f56", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886755, "uuid": "49f14bd3-58fe-45de-be04-936f8980007b", "value": "T131D2D0AA81D7E5B8C0BAA9B6113D07D9F979B116C2245AB708E83071DF531C94D31EE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886755, "uuid": "d04ec17b-99c1-4156-94f3-d0ddd6b58450", "value": "768:gYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBgddYcShuZM:gYJdJZiy1aBnQfTqBguTuZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700886755, "uuid": "5bc3d7a5-1185-4765-a8ac-9b27f00fbb64", "value": 30104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700886755, "uuid": "0735a031-7ce5-437c-8835-fcbd0be55cca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886755, "uuid": "9ec9dce8-7f40-48e7-8323-d9a080798d1c", "value": "faa2b28b60ca260b3ce1095e65f4c31e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c99484-8bc7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700939980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939980, "uuid": "84830955-cb92-48cc-8520-609039b04133", "comment": "Malware payload", "value": "09faa9617549b665144b272d4a31b8c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939980, "uuid": "b0c1981a-b7dc-4d81-afb6-7fe9a50911e1", "comment": "Malware payload", "value": "c233aed58e67dc39ea4793fe6e451e0748c959395abbc39741457b6df59c07aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939980, "uuid": "1ff45cd8-9ee0-44c2-8709-d464b93c0998", "comment": "Malware payload", "value": "e27779e8961a77495bc8b17b4ed34120263d7206", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939980, "uuid": "60dbb9ea-27f5-4add-add8-6bcebbb9b61c", "comment": "Malware payload", "value": "7bfcb3279294670773d0e8acee3f9c4df785a447a4d8c8ae0c353cad98d7177084d753585978644e35ff1f44b67e9646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939980, "uuid": "d334fa9e-4a95-44e3-bb6b-e601319f8cdf", "value": "T1BE658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939980, "uuid": "854820a5-9558-4473-8919-8cc0917ea044", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939980, "uuid": "8dfd0012-11a6-4c15-82a7-b60a0481fbf9", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700939980, "uuid": "369b3620-d0ad-48e7-a304-d1e30944b34a", "value": 1539630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700939980, "uuid": "56875afa-6841-4a18-99db-a3d8aad04f49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939980, "uuid": "60c9f693-2444-441f-8d4d-fc86c6707272", "value": "SecuriteInfo.com.Win32.TrojanX-gen.21462.10764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1bff7b-8be6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700953204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700953204, "uuid": "94ede31a-c43d-4b64-9e55-40a2181277e8", "comment": "Malware payload", "value": "088d08b059fafd20dba0d096d9e8a366", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700953204, "uuid": "371a7c07-8bf3-4615-8d93-2494a52190f3", "comment": "Malware payload", "value": "c64d61a083c392a5c2a6f8fc502b92815a365a1817bf7eabf0e776f220d9e009", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700953204, "uuid": "844d54db-984f-434d-b81c-8758dd79174f", "comment": "Malware payload", "value": "cee15932fca54e3bbeff6c6b4f620255173a4bd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700953204, "uuid": "afb44ca2-673e-4757-820a-50f1fb7ff2e9", "comment": "Malware payload", "value": "b3843fd15a44b02817376e916ff1ade21e4d2215b35efcf6f8a8108456f8dfd72ddbf04fe6cd49fb8122e5b3cd17e4d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700953204, "uuid": "9100db8d-9cfb-4f10-a3bb-3b7524c6b8df", "value": "T19524D62BE344591DE83E473DB41C38709F707C52E16ED32E54BA3AED693BB498A205D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700953204, "uuid": "8daf060e-c0ae-4d7f-908a-a66d6926ca83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700953204, "uuid": "93232e16-2639-41ec-b129-5166f9281c74", "value": "3072:qhN3l8G7aNgc6qjhrWKoCpw6mBIbtGzyBA4RSdg6GSuweGiKSZ:qhN+G7aNgc6ErWKaIA+N0C6GSjR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700953204, "uuid": "1de646f9-3149-4c0b-a339-ffde5d3ad4e1", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700953204, "uuid": "7557cf5d-7e51-4d44-bd70-274a3781d049", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700953204, "uuid": "b886da0f-5b86-4296-a416-1f05b646ab8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba273af-8bc4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700938569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700938569, "uuid": "6d2236c5-4099-4eb6-b80d-f6aa24207484", "comment": "Malware payload", "value": "f21c70b9e531f2905f2e97db40221de6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700938569, "uuid": "e5d5f165-a867-4147-9153-12ae033bf81a", "comment": "Malware payload", "value": "cbfbf22cc99b326363e3dd1fb0f56c76b9e2f7e708124da99d6dcb17e04b656c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700938569, "uuid": "40c40517-1dc1-47b6-a1e5-d3a5646b2d33", "comment": "Malware payload", "value": "f179b6c5762be0f5449173c79ee46c0bc9483d26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700938569, "uuid": "996110c3-054f-4d25-91ba-63f205f92e9f", "comment": "Malware payload", "value": "aa25c44bec2fabf0afcaab6a9f73f0bcc1cb488e35e5eb56793970849a7a0902682674aaa3b8848026a520578b2e9e04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700938569, "uuid": "4e4dc11e-e5d1-47f4-813e-3661cbce6399", "value": "T195658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700938569, "uuid": "1fa73532-67be-4bf7-9c70-64e55781f648", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700938569, "uuid": "ac8c0689-8603-42ec-a806-de319deb3382", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700938569, "uuid": "f1ccbf4d-f564-418e-9c65-82da125bc3d4", "value": 1539661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700938569, "uuid": "ac038e51-68d0-4bdc-8430-70549c975e28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700938569, "uuid": "c972790b-098f-472e-b918-e82b7f47765e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c806a8dc-8bbd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700935771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700935771, "uuid": "9da79234-4c8e-4a3f-8137-84535575cced", "comment": "Malware payload", "value": "ed89b0c891fc4c160708ef0de6a7c49b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700935771, "uuid": "05c75904-4eb0-4d63-904e-c60b0d2247f0", "comment": "Malware payload", "value": "ccd69debd81c0c3fb8955765cf651b334b7ae7ae3d8435b28dcd8e15858ccfb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700935771, "uuid": "6c11a6e7-ed7e-438a-b2d0-8592d132bbc9", "comment": "Malware payload", "value": "a4f9826830bda56113c77af13509358c2aac0b1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700935771, "uuid": "a14de857-dd06-4643-acbf-6976ff28c8fa", "comment": "Malware payload", "value": "e4aa461b83c8fad4f174f89d18c7c4ab6e9f55830fcdbb2ba07fcc1688bc216da569749752c0c26557a527c44a7089a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700935771, "uuid": "7468618e-c190-48b5-be3b-252a566ef1da", "value": "T14A44070392E13D94F6268B728F1F8AEC779DB5709F197B6932588E1F14B12B2C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700935771, "uuid": "b52bea9f-3f05-4fa3-bbfa-92cfdf038e84", "value": "c0846180de212a99e5224d9162840371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700935771, "uuid": "4878d77a-d96a-46b5-9c30-f09f64e68083", "value": "6144:iMmeU+GYJ1gl9Ya7NSHUe6AgKNKNmtclr:iMmeUUsSa7NW6AgwOuclr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700935771, "uuid": "433d774a-9510-40b6-a1b5-4cc8c8c3739e", "value": 263680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700935771, "uuid": "8b070d79-c67f-45d8-98af-f34d77555c71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700935771, "uuid": "eb755ae5-75d9-4bd3-aaf5-e134dab2258e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a189d369-8b4b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700886744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886744, "uuid": "0fa0de5d-13a2-482b-bbaf-d5539454b984", "comment": "Malware payload (Mirai)", "value": "e96ffd10f46d79e41ebfee1f35ee75cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886744, "uuid": "e51fd6a8-8bc0-49ed-8812-cbbdfe2c64b1", "comment": "Malware payload (Mirai)", "value": "d5ad9eb2d59418ace8eb8500afe9061afb22b1d9993a10b27bf88f351b985dad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886744, "uuid": "38038261-b02f-4385-92d2-6286d7a06ec6", "comment": "Malware payload (Mirai)", "value": "cf7d617fdaf2d6c03dc11c6f40c12c78655ae9ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700886744, "uuid": "c72aade3-d1c8-4626-8c64-5df093e20dae", "comment": "Malware payload (Mirai)", "value": "2f2f91d375a0e9c30554516a1ce759f057ef274cccebd6f53f1d59f534aea5119c01114ef6df9e549d9412a44426c774", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886744, "uuid": "8101ef8f-870f-4f3d-89b6-b5e5d7d2fc78", "value": "T1D4B2D1D48A909307C5B078B6E1388F916A3B19B0D6F724271210D7ADDB8289573FD9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886744, "uuid": "14f2d006-31f3-4fa6-beb3-65caba2324d0", "value": "768:WHKQFH0rs3zWoDDRsjt7LB9U+B1j3b3UQen7c:uK7rs3Kktsjt7IujJe7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700886744, "uuid": "af35afb0-82c6-41ba-9b16-ce4a1bd01d47", "value": 24672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700886744, "uuid": "cb9e37d9-5f49-4cc1-8fd1-c14f3dd27e39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700886744, "uuid": "8d07321f-24a4-44d7-8681-fce037fbfc2b", "value": "e96ffd10f46d79e41ebfee1f35ee75cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6745a17-8ba4-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1700925112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700925112, "uuid": "6ead874d-e4c5-4109-b483-0db366ea8bcf", "comment": "Malware payload (GuLoader)", "value": "55d1fa02fe0fba43dfe1dca00a444f4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700925112, "uuid": "3db408af-ef62-4e41-9574-61cab95f85d4", "comment": "Malware payload (GuLoader)", "value": "d61a40be88930788c91fe81e5bcb58d175d332ff64c5076e2896eab2f74ab4d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700925112, "uuid": "35b93f9b-36ee-43eb-8051-a049dc207c70", "comment": "Malware payload (GuLoader)", "value": "8cb09bf123af75b2611f0dff84432d0422b37943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700925112, "uuid": "c3ee8902-a55d-4ff8-9a1f-ac014d0177f4", "comment": "Malware payload (GuLoader)", "value": "e9b8841cb31d806945a02919410a2ffe60d15748c25a5f361786fb0e2d3f55574c4a5f480eb56a33b768e86acbea61cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700925112, "uuid": "2a7b7ef0-7f51-44e9-a785-8ee2c8a7a284", "value": "T118B4120139A5CC3BCC564776C93486FA0DE9DE21CA6A858B33043F9F79737510A2EB69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700925112, "uuid": "0c9a58d2-d50a-4c54-88ff-e360b4bc27b3", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700925112, "uuid": "1018868c-1900-4fdc-a949-4ba8874e915c", "value": "12288:gDzHGJ9vnPcQ+1Nnbs8jr9eTqvgfbfQcxDLiV:+6fvP0NhjlgfbfQcxD+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700925112, "uuid": "33839e25-821d-4700-aecc-627bcb3b3bf2", "value": 541496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700925112, "uuid": "1b6fdba2-8793-4fb8-8ca3-87abec24311f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700925112, "uuid": "1c8b3a18-be22-46fd-8f1c-d606788f8489", "value": "Contract - 8001569.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ed7771-8b69-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700899447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899447, "uuid": "82bf96db-66f9-4f07-bf9a-4b3f0b4cf1b4", "comment": "Malware payload (AgentTesla)", "value": "52bc41fb9342f1a555300537f35beb80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899447, "uuid": "c083dcdd-4ea3-4dc6-8591-5c5e3b9a039f", "comment": "Malware payload (AgentTesla)", "value": "d6686d4b31bf3af0b8e6521ef0817358c5ed1969199115f9001bbb3e814e77f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899447, "uuid": "dd80f299-30c4-42eb-ac65-3247c6812572", "comment": "Malware payload (AgentTesla)", "value": "9caac1cd3bc6b2c0cec419063be05a517884ccd3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899447, "uuid": "7e7db4e5-1223-4927-b33f-13a0e8621313", "comment": "Malware payload (AgentTesla)", "value": "5e01a6a1a690377a102c9c5842cc19d4bd4e3eedac065b98cfc7f60bc9fd6ec46fa9348df6323697fb40a8ff12543c7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899447, "uuid": "878892bf-a5db-4f81-9d48-0d4f3cf3bc85", "value": "T197F423A41E9E04F10D0E3678ED91C6640DFB0CFD98D50BFE2D96DDA824D8A49F85C9AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899447, "uuid": "73c9633b-4bd1-478c-b358-6ba0babd3ee2", "value": "12288:VGQ25Tk7qHyCKyqraw4nxUpusTnNqtA7yTsK9iqQLnqAaHAgVFzohl1uUagLl:YTa/kqew4xU/TnNUA7yTsOmCggjal1u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700899447, "uuid": "ce3f13ad-785e-4dfa-90ce-ad1823cddd40", "value": 743210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700899447, "uuid": "a0d525ed-22aa-44d5-9730-39463cf44f73", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899447, "uuid": "5ddbc3ec-bd46-4851-b81a-5d560b2fccbd", "value": "NEW QUOTATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93a52bd-8be8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700954215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700954215, "uuid": "21efef0e-9f74-4ad8-b81a-d052a984b920", "comment": "Malware payload", "value": "3a12380bbeb662c8b996664997593374", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700954215, "uuid": "0f32aa69-41a2-4d89-964e-2cce9c15aa13", "comment": "Malware payload", "value": "d6eedf1b1b56e33d3343b037b9f3de967c32c7411a28a0bc33046301db38a6b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700954215, "uuid": "86a2a3a2-2e45-4c7b-8c61-672d7c6d2529", "comment": "Malware payload", "value": "34123a5ea618e25ab3777ede4d11b67ea01e5e0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700954215, "uuid": "9f6cc0da-9092-41f7-96c3-11b949488708", "comment": "Malware payload", "value": "6df3e2efae65c5c2a832e427cc1dfe3e3cc194ade4076833e4aa6c7fee5011e55718de2bc645e57d0cabffe964f5b91a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700954215, "uuid": "be6f8cbf-a1ef-4128-945e-62218d456c57", "value": "T120658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700954215, "uuid": "9a6e4874-f3ce-4db3-ba02-b48480b83758", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700954215, "uuid": "082c79ef-241c-408f-b97a-d937cdfb4dfc", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700954215, "uuid": "9ea98284-185a-423e-97c4-fd9aaf384b63", "value": 1539701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700954215, "uuid": "b2c4e335-5429-4fbf-9533-8e29153f873b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700954215, "uuid": "15f0e3f0-c461-4ec8-b303-31c509a8dc59", "value": "SecuriteInfo.com.Trojan.MulDrop24.22194.24846.6542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053c3b69-8b6d-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1700901085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700901085, "uuid": "330d31f9-81f5-48ac-ad0a-a2e09fa3c6b3", "comment": "Malware payload (Amadey)", "value": "7c49606bce11be51d220ca774b337c77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700901085, "uuid": "3bc5e121-03c1-48f7-a933-e68f64601218", "comment": "Malware payload (Amadey)", "value": "d8886a5bed580b5568d0868e50018692adb7a6b9ba8fa650347aca3473187cc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700901085, "uuid": "9302ead4-b827-4a27-9ff6-384fc8c8eb3e", "comment": "Malware payload (Amadey)", "value": "15d93aa30a50f0f0c0c8fba9c23797faa7ca1efa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700901085, "uuid": "440ce20d-b63e-4373-bb8f-036406ea93a2", "comment": "Malware payload (Amadey)", "value": "6fe5aba56d6fa700c98a09a42479be171034423269a307d1eacce634d5eada96b22725d57b40284a27e343f73c0aebe1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700901085, "uuid": "452c157c-0383-4d21-b354-624047267b74", "value": "T1EFA35B057695C071E66D1A3A1874AFB1877EAC14DFB04DEB27400E7AAE243D2BD35C3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700901085, "uuid": "dd7aadb1-f212-4620-a968-9b46ae8e3233", "value": "91452bf3259a3ff5928a3bb7f6be301a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700901085, "uuid": "1d5ecbc6-6d57-40a8-85a0-608c635bb6f5", "value": "3072:HwTxt8T+Mz7G2MosmfNuQR/SrT7BUFYW0Z:HQ7R0PseNuQREvW0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700901085, "uuid": "3331a3ce-a2ec-4d76-99ec-9d89aa2e918d", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700901085, "uuid": "f70246b8-4d62-435a-bfc8-eb6d7dae3bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700901085, "uuid": "e6e454fc-7795-4360-8887-efd2d9eb48c7", "value": "7c49606bce11be51d220ca774b337c77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fd3580-8b26-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700870811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700870811, "uuid": "bd3d5614-0e01-467d-8e19-0cc0d5d138cd", "comment": "Malware payload", "value": "c0495cb1e372a65254ddaf43736cadff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700870811, "uuid": "6daa8d6d-4310-405c-ba60-76d688b95d90", "comment": "Malware payload", "value": "d8b6bf6b66f9db15567b43e5b725a2cd5fa74854f4b2e715f58ee6ae44488f02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700870811, "uuid": "05407ad7-f1af-40be-8f56-9c74e290d9a0", "comment": "Malware payload", "value": "a51ac30d1719516dfe5c93a35600de04ca467b1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700870811, "uuid": "173c7faf-188c-4748-b0a0-7f356f1332d1", "comment": "Malware payload", "value": "8b54a161b5965146f928bd8781822aaefb7c59851939b09ca485fa7f9a4592b71c985693f90d63f48b7fac0e9ffe2b69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700870811, "uuid": "e9ce2395-4451-4b76-ab3d-d2b4ebe0f7cf", "value": "T1DC659E1278954136FF9210F282CEBA3A065DB6B01B641ACF16AF57FFB6503D11A31B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700870811, "uuid": "7e242d22-8e90-47a0-8e34-3f73eb11bc95", "value": "87161a064f5daa4a79ca02075d04f281", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700870811, "uuid": "2124542a-f363-4f23-9d82-a6574b76b606", "value": "24576:/spUqF2JAwTDWLGf7ROqn2qepppWuedVrB/TI8beGQKM1:/awPWLGf7MqnEpuTVrdk8bHRM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700870811, "uuid": "0f74c550-c53a-4ee4-9a6b-8ae927213c2b", "value": 1545216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700870811, "uuid": "12c6422a-e0de-4fe6-aa90-3a60f427ff3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700870811, "uuid": "bfe5a65e-3ac6-48bd-be90-e70d569a1eeb", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e3a445-8b6a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700899789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899789, "uuid": "57002108-75e5-487e-802b-747254c39303", "comment": "Malware payload (AgentTesla)", "value": "f1fa4a41d9eb39ea6f3570cf8764dcf5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899789, "uuid": "064dc0a3-82aa-46be-b98c-c5452814f25b", "comment": "Malware payload (AgentTesla)", "value": "d9ba4927174717c804a7cdf4cc3260b5f3c2611fea7a4f6a6d8a68706034ea95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899789, "uuid": "6dcc2241-f0d4-4fa5-ae3d-b1790f40990f", "comment": "Malware payload (AgentTesla)", "value": "02fb1ab81695910a23ca19584da8161b94415ff2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899789, "uuid": "2293ac9b-1bb4-430b-befd-c1b77e1e9ced", "comment": "Malware payload (AgentTesla)", "value": "1442ab7fe788bdc7d27c4ee38469f8198e7698dd9a07b3de62e257a27eb90e0ef7de9c532451d7992689b3e127c07cf8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899789, "uuid": "1c967626-8248-4189-bb1f-10f8b0c23b32", "value": "T127C423BBC3CB4C024E6C146CB6D17236D147421BB3FAB964904F6A715A6ACCCD29F399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899789, "uuid": "a57e73e4-ad72-412e-822e-9e058a10b2ac", "value": "12288:pCwPwWOy8fWfQkOYgYyanYlo9jbc8cwXf+y/rcI49y2c:pjPQOfDvYlo9jfcwXfFrX4M2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700899789, "uuid": "7f99581f-d5e2-498b-b816-6d99570283a8", "value": 565587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700899789, "uuid": "832c8208-6a30-4b0e-98c3-e53e553deade", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899789, "uuid": "c6ec7717-d879-48a8-8f2d-4c2fe857d344", "value": "open-order#456789.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d6e9cd-8bbe-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1700936110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936110, "uuid": "1a0e15e2-f6d5-4dd6-80d0-a94f732fe95c", "comment": "Malware payload (DCRat)", "value": "bd5ced687a465577324c3e8256f1595e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936110, "uuid": "45e32f2d-754d-431c-ace7-419e3733e406", "comment": "Malware payload (DCRat)", "value": "da310c26f5adcdd47601937ff147ba5a7826ca0c0bc41aeb3aff6f43c3d655f1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936110, "uuid": "37924988-3c6e-4172-ba77-53626e042d9c", "comment": "Malware payload (DCRat)", "value": "0bc18d3b12f2a6550a0bbcff13c3c6b3809a2ce3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936110, "uuid": "54b61406-3df2-4910-ba7e-0e1b87fad9b3", "comment": "Malware payload (DCRat)", "value": "a4c7a1e52bc9122d299e2fbb1d7ee09e739e8a170b661ce290be938eeb6e3aac9da936dd14e67d508d5204986c849dc6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936110, "uuid": "4da6903e-9fe0-4f6e-8c4b-92ee37dbbb3b", "value": "T10BF5F10AB5528E77C3A63F3180DB452D43A0D6623627EF0B3A5F54E5780A6F58B172F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936110, "uuid": "935e4a3b-82b3-407e-8729-ea21d968eed5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936110, "uuid": "d19c0fd6-6e06-45d5-a5c5-bc77c84a6ae0", "value": "49152:l4qEq7/CzceCL6uRalXiq8RGrAztDyZxcKULGo6Zv0WWZevXTyb410EzztbIunDc:l4zcvpLeiz2AztDegKT3zXmE1nhna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700936110, "uuid": "a77e122a-3720-4804-89cb-36cfaacda4c0", "value": 3642368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700936110, "uuid": "9b40cb11-3b77-40ea-8859-80533e15991b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936110, "uuid": "1348efa4-afa5-4e1e-bd28-485132c44d29", "value": "bd5ced687a465577324c3e8256f1595e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb8cd66-8b87-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700912616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700912616, "uuid": "efbaaecb-03c5-4a0c-a7a4-dafb43e42c5a", "comment": "Malware payload", "value": "749377ba5974bc335559f2cb01bcc152", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700912616, "uuid": "b6b78026-f42e-4164-b849-23c59d714c4d", "comment": "Malware payload", "value": "daed3dc9b621dc7d62cd2ab8443e18e1cdf93f5db7131c64135ec76769502b7f", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700912616, "uuid": "d9dc862d-1f25-4480-b0a4-813ee6fa941b", "comment": "Malware payload", "value": "0e67317000023f519bed10d5c935dd9382940518", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700912616, "uuid": "81a43d03-7c2c-4375-80c4-fd31db293bcc", "comment": "Malware payload", "value": "87f330bbbcae1371cbc34e089180c9131e5cb577c2557480ccf3fba6cc3ec6e10f86c7e74ff50a6685722ff2bd62833e", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700912616, "uuid": "492e6f98-349b-483e-a377-5a238be58ca6", "value": "T138155AA843E8871BD74D0335B019334DCBF8D4266287F796BE456079FCBB3628B9A512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700912616, "uuid": "6af3ef15-9e4c-476a-9000-fdd388684fd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700912616, "uuid": "2ac9dc82-bab4-4b05-8e8a-f30e142273d8", "value": "24576:fjqBxYAeBKzKJKrytKr6EtLekihhB3f4ocfQu:0SRBKzKJKrytKr6EtewocfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700912616, "uuid": "ec19b7f4-fbc6-421f-a93b-34daeccf0fad", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700912616, "uuid": "adb79821-3c14-4aa6-98fd-d04880c514d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700912616, "uuid": "a71387cc-cf12-4c58-b545-8bd8d8270392", "value": "Gntlypxzym.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac6fba0-8bd2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700944768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700944768, "uuid": "017403fe-d849-4c2d-beb1-cd3edb6faa1a", "comment": "Malware payload", "value": "fae3f7a56a772e035934a74ff39d3861", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700944768, "uuid": "69f42a53-ee5e-425f-a00d-85aef454080a", "comment": "Malware payload", "value": "dbc2b542f2112e4ae0f34aab35b68107597d63dbd7aeaaf0ce996793e17ae747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700944768, "uuid": "ec5edf44-7795-4df1-9eec-f61dedd2a33e", "comment": "Malware payload", "value": "814418644b04b5d0774d9012c6b93f8b11547c73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700944768, "uuid": "2fa61d48-3abb-4383-9a9c-9f4d208bb18d", "comment": "Malware payload", "value": "3470c1915c45edec73f4fe75bbac0a3a520322c7ec554d7facdc4f8a2c14b9a2490bb258bb1cf18ff89e1f9533b9af14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700944768, "uuid": "5c00e726-cc55-4758-bb75-e2583c594fad", "value": "T14C658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700944768, "uuid": "4e49cf96-329a-4401-9ddd-60a081e55477", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700944768, "uuid": "d75036a7-f53a-4bf5-9016-6c3c16d49b76", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700944768, "uuid": "359d2158-028d-4653-8a32-8db901ecd59b", "value": 1539691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700944768, "uuid": "5af99056-cca6-410f-b39c-8c39d6379d05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700944768, "uuid": "17b66289-54ad-4464-90b6-6454e29f7fa2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a145185-8ba4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700924930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700924930, "uuid": "4144503f-7cfb-4c01-ac7b-21186517c3fc", "comment": "Malware payload", "value": "baf3e85ae915f0b70d3647bff2e0ba9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700924930, "uuid": "8dcbc6eb-3c11-41e5-86e2-09e7ca59e9f8", "comment": "Malware payload", "value": "dd01880be0c5a5e8659691cf5edee36edcefc7459cffbd80043548aa93681d8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700924930, "uuid": "fbd2dd74-1e2e-4509-a9c3-35cbfa9a4801", "comment": "Malware payload", "value": "d59adb8dcb5659e94a7e9b4104f753c2f83341be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700924930, "uuid": "0dd5bcd1-869c-4664-9584-2c448eb07442", "comment": "Malware payload", "value": "a2cd7170e305bc283c6e6568a160e4975bd92af01da091c2b4fed77a2df324fe52264ea4a8ce7193ae5dab7336b0d532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700924930, "uuid": "882fe784-783b-43ab-846e-d3a1fd646dcb", "value": "T17F658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700924930, "uuid": "7a16e3c5-3566-4d0b-9e15-e97c3baf84cd", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700924930, "uuid": "25dadc87-553e-4aea-b13e-1d00edd9e386", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700924930, "uuid": "1993abc0-b834-4b54-b019-8e2390040043", "value": 1539601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700924930, "uuid": "d0e7396b-9aee-4de1-8797-c1d8a0a4ab10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700924930, "uuid": "37b3fac6-159d-43e7-b436-63ce050e6382", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86ddfc7-8bbe-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1700936148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936148, "uuid": "aff1ce66-b6df-4adf-94a8-58b5be83a0be", "comment": "Malware payload (MarsStealer)", "value": "f59b1340aea1862712cf22ec50bbd3a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936148, "uuid": "a748b0dc-cccf-44d3-a491-9d81bae58911", "comment": "Malware payload (MarsStealer)", "value": "dd447ea1ac60721efa84d80d3101e7f79eb2d86785df2358cddbe04809a283c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936148, "uuid": "d66eb06a-db6a-4e66-9ab3-9c1fb0ddad3f", "comment": "Malware payload (MarsStealer)", "value": "0dfbea987e4ffb1a91a77ce8efb916cc41c081b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700936148, "uuid": "76a9a406-9e42-49c6-9b21-b29a92ac7e5f", "comment": "Malware payload (MarsStealer)", "value": "24443f7273fba4bde7e75c347b7e5325bfd8b69698c21aa70dfa516a15a05184cf621793f1b41232433a7137ea672a74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936148, "uuid": "cf308c1b-afc8-42e4-9d73-7d669a652f56", "value": "T10D44290392E13D54E9268B729F1FC6EC7B1EF5509F797B6A22189E1F14B02B2C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936148, "uuid": "e0082509-0931-461c-ab4b-5ef0fc016484", "value": "c0846180de212a99e5224d9162840371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936148, "uuid": "8f802f2d-5a51-4a89-9951-a87e4d29cccb", "value": "3072:VKu+dscXXBSset0JSMCufTcpTPZKPLMrUbFmXp+cQCU0pQ5mgykUyBk3eFx/RCgB:Utd/RSNt25IFB7rwmYci0ZPklr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700936148, "uuid": "56f8e163-52cf-4bd2-9e39-2c8a128efb93", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700936148, "uuid": "2008c81e-3c24-4c97-b66f-49ac76a47a91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700936148, "uuid": "22077c3f-0fe0-4ccb-aff2-ec5919ed5dae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c87be7-8b6a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700899826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899826, "uuid": "847a6d1f-2b57-40c0-a188-34b1b82ec518", "comment": "Malware payload (AgentTesla)", "value": "7c64789f34d005f5387105babbe5dd24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899826, "uuid": "ba41626a-3771-41e7-8be1-2db7463e199b", "comment": "Malware payload (AgentTesla)", "value": "de1859ea088bba589cca707d6c30cafc4a544d7c2d3e37907e61e8d76eb6d6c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899826, "uuid": "e022bb96-5aa9-41c2-929c-4202390984bc", "comment": "Malware payload (AgentTesla)", "value": "71d71d8ad05f2f7f599e4d1b8335ecd8c759826d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899826, "uuid": "d2c2d87e-804a-4b03-8065-6a4decdc9875", "comment": "Malware payload (AgentTesla)", "value": "f2a849df63574e09f2c72465c7191193fda01acaf23824c933ca2d9b3b320e2700e19c1a6348fa79277b96d76edb92df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899826, "uuid": "13ec0e93-9abc-4faf-b5e2-db0b7381ca00", "value": "T14FF423A41E9E04F10D0E3678ED91C6640DFB0CFD98D50BFE2D96DDA824D8A49F85C9AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899826, "uuid": "8da16510-5af1-483e-b3d2-66b84eac4cab", "value": "12288:tGQ25Tk7qHyCKyqraw4nxUpusTnNqtA7yTsK9iqQLnqAaHAgVFzohl1uUagL1:wTa/kqew4xU/TnNUA7yTsOmCggjal1uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700899826, "uuid": "8c1997ce-7470-4efe-94fb-3f741b51e246", "value": 743216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700899826, "uuid": "b617c228-58d2-4e22-8092-24043fb8e6dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899826, "uuid": "dbd57b58-e491-48b8-b4ad-89ac15991c3f", "value": "PRE ALERT NOTICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d387b59-8b69-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700899622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899622, "uuid": "e5edffaa-4832-44ef-9386-375928086c08", "comment": "Malware payload (AgentTesla)", "value": "6f726d571c05354dad7906926fec4b5a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899622, "uuid": "929858be-4186-4133-83da-a702191d58f8", "comment": "Malware payload (AgentTesla)", "value": "de4e820acefc7e02387b335cc0db0b10d9bb724880836ba237b7fac41912f15f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899622, "uuid": "cfd7eac6-c46d-479b-b47a-0366adc67998", "comment": "Malware payload (AgentTesla)", "value": "e462a10f870741e14d415f29d241625aabbb8c3a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700899622, "uuid": "40cb15aa-3f5a-4fdb-872c-575c6c6058bd", "comment": "Malware payload (AgentTesla)", "value": "3d8f0e1f42d3e2d4ed7b47e074ee0faa1c22d450e3a69cbe16ab17b3f2577eec8da5884763fd1a27772aa8057b239179", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899622, "uuid": "9b4246a3-a216-479f-ac2d-f6c06c6bc581", "value": "T17105236EDA95A8C584890643848B3354FFB4729BC0D2ED9187283671FF39E2D379EC58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899622, "uuid": "6b461be3-2f7f-451c-8a23-9b33eb4e8bad", "value": "24576:0Sb3jtlZTb80nOhRDrhPyRRIvUqwE5z0Gh500:0+jtT80KhPyqwE6Ghx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700899622, "uuid": "f49d4db6-0f28-4e85-bfd6-c28d39b64118", "value": 802772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700899622, "uuid": "38a5d0b7-ae71-47be-8ec1-1b00c0469bb9", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700899622, "uuid": "9dc21792-ba33-492e-b2f4-39d89b2e1c76", "value": "Purchase order (2).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb57ae65-8b9a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700920825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700920825, "uuid": "3fa235ab-24e0-4407-bb6f-776b536622b7", "comment": "Malware payload", "value": "f53852366508939495a696b0af3f1459", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700920825, "uuid": "5850088d-0552-4e23-a1c9-83a78caf6739", "comment": "Malware payload", "value": "de60c5633d4704caac39da20ffe91dc4065777b91cab6bef8994c994a164b2c9", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700920825, "uuid": "90cccc29-21dc-43e5-aa86-0f0dc0da9ac0", "comment": "Malware payload", "value": "f35d44f28270df5c9b060d91433bf64c83b7deb5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700920825, "uuid": "613a1d93-a88b-45a8-b684-2e6030576261", "comment": "Malware payload", "value": "35a8aeebd07cf2b1150377e9007566a0dee19e1dc77cf0d81073a1cd5248d4a3abdc6063b0a6efd97f0c541aac94f88f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700920825, "uuid": "284b59f4-280f-48aa-baf5-4031a6161549", "value": "T19531D04608BFC82D14F6C25D0551A424D3A1B789B0B4DCB5EB47DB4061F179C573250E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700920825, "uuid": "0ec1f801-277a-4ea5-8a7e-1c469ff561f4", "value": "48:SDUsdsW2v9wjHw9lEtFQwh8YlKn8Pon90wVOk7U:qsfa8Hauwh8YlYIq07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700920825, "uuid": "74769290-9752-428f-aba5-6a29e3390d3c", "value": 1596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700920825, "uuid": "f31b2514-31bd-4b67-be52-9e9071df4e61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700920825, "uuid": "630b215d-78dd-4fb5-8ccc-969e091701d1", "value": "Comprovante_Pix.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbbc7c3-8b2e-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1700874441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700874441, "uuid": "19bee048-c7e0-4742-b01a-eef04a67c9ab", "comment": "Malware payload (njrat)", "value": "d732678890d2daad454b44744cae44b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700874441, "uuid": "489a85f3-def8-4c31-ac80-433c8cb2806d", "comment": "Malware payload (njrat)", "value": "defec415793e9bcf719f0858df5b8415a8919bf4c10d67deef03776e089bda20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700874441, "uuid": "17f5d38f-5fa0-4d3a-8ea5-2f571b63e50b", "comment": "Malware payload (njrat)", "value": "c9f9a49de61b7c5ef1b647040f670c47443cd586", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700874441, "uuid": "2fc6fb0f-e153-42c3-b40f-7988b4954e31", "comment": "Malware payload (njrat)", "value": "e8d4d8d75584986108c5df1db4a4734ae5b04412d18463467bc92a63aeb11e9a148896001f9e849c2e327a679a2ed098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700874441, "uuid": "9ab448af-d1fe-4390-a0f1-a8ad975e916e", "value": "T1A5C2295D3BA08162C2EF6B700AB2D72502F2E10B5A17DB6F4CD844FA6B773D14D81AE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700874441, "uuid": "dc55b9d7-de36-4db3-acc4-9fcc2a0564cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700874441, "uuid": "b2c8714e-9ba6-4892-b13a-199e0a94b480", "value": "384:5Ld6Q72JyPo3Cj3P9teToser2HzCYe/8Y2OzRLTm3yilqr6vJbctVvG6f:Jj2yPoSjf9teTw2T5e/8s0eVvGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700874441, "uuid": "8890fe0a-b8ec-4b88-bc20-75bb2f50edc5", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700874441, "uuid": "1deaeb61-0749-445a-b2a3-9cab580b4bf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700874441, "uuid": "88133f5a-8fd9-405d-a66d-b223f8ea184e", "value": "bRQD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ee0ce3-8b5f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700895333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700895333, "uuid": "46763766-3202-4a87-9fc4-9f837549e869", "comment": "Malware payload", "value": "cdc94d44673680a5ef3dc4b3914e3db9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700895333, "uuid": "116b0307-f815-41c3-afda-b68680e42765", "comment": "Malware payload", "value": "df7a02a64db048e94094993eecf408b8a9b8799e053a8b10ae3c53bc23f554ec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700895333, "uuid": "64f4aa45-3af6-4ff5-bdfa-d3ac4420e775", "comment": "Malware payload", "value": "059d3be5ca9518cd2e264c9d16b154883a84190f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700895333, "uuid": "f439b4a9-44f3-41bf-aee4-2d724b2b6c20", "comment": "Malware payload", "value": "f452da969e6a9e6211a3d31e2e0f70162dac54b7941d3c2faf22bd176c2dfd30bbbe28d1532e54658fe1084e06015788", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700895333, "uuid": "1eebe1f2-252f-44d2-bac9-e6ae645c222f", "value": "T115731807F5C199FCC44AD0744B6F693AF862B1ED0235B1A727D4FF226C0ED219E29896", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700895333, "uuid": "fb634cbd-6f5d-45a2-818a-2911a7ae4342", "value": "1536:+44KhG+OvMDOgVVr4SyXvcpd3P3inA54lc8AkIhxNILP1wFbcl+wbZnN:T4Ks+O0DFn0PX+d3/Ei4q8AvxNC1wFbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700895333, "uuid": "8f8338c8-41d5-4a0f-8b37-676d6bc488e6", "value": 79680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700895333, "uuid": "7794ca67-b6eb-4a40-a322-c8f0da91ef8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700895333, "uuid": "cb0dbcce-62d0-453d-b4bb-7cd246446846", "value": "imaginebeingx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac076565-8b8d-11ee-8907-42010a9c0042", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1700915108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700915108, "uuid": "976497f2-1293-4019-9cee-96c3eb37e22e", "comment": "Malware payload (Gh0stRAT)", "value": "806da4585efe71a44da2775e3bb6331f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700915108, "uuid": "0e20f1e6-2ffe-485c-b5ea-c6e43802e078", "comment": "Malware payload (Gh0stRAT)", "value": "df890eaf4da04ef4283f61bc09e2a0d48e29e6da11f0a880059cbf2a4cbc2dc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700915108, "uuid": "65bc7588-d131-4153-8097-fb1b3ff0c423", "comment": "Malware payload (Gh0stRAT)", "value": "8c9f91d31268c124114c97255aa29f7024c5b4c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700915108, "uuid": "1f3236f7-a5ba-4b7d-9f98-e69b4747136a", "comment": "Malware payload (Gh0stRAT)", "value": "c39228d1a37f0cf89a254e4c4798f005157a5da13fd31657913dedeeb4d5b74b3d96b7519f9e6d353ee65a2d0e1441f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700915108, "uuid": "092a0c05-009b-4f24-a85e-9d473e7862cb", "value": "T156A5D0B2A74A40B9C2D5A8301F76BE3797271E0D0E11DACB93DCEE166C793625D33126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700915108, "uuid": "a786b93a-17ca-4f7c-8f2f-fc6d20085cff", "value": "bb9d495821e6e730a7a07045d899c977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700915108, "uuid": "148a440b-9170-411d-8d0d-f3e6bb3c8103", "value": "49152:8X4uXjo0ZxiADiEMTGpxDn4q7msZg6pCQjcaP3E9:k4uTo0ZxZiEHnD4ts1CscoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700915108, "uuid": "4167deaa-66dc-418a-9973-04522038d4bd", "value": 2139675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700915108, "uuid": "eb6bc1ef-e685-4b6a-bda8-06ff071d8d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700915108, "uuid": "dca277fc-8449-4610-aad8-b688c5d75061", "value": "806DA4585EFE71A44DA2775E3BB6331F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4af4083-8bad-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700928920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700928920, "uuid": "6bcc88c7-b3f5-4d3e-bebc-a4286473217a", "comment": "Malware payload", "value": "22033d55e472e7f41e203d2f67cd76cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700928920, "uuid": "72310935-ef7c-4e56-86a0-b9bcf8a3db6d", "comment": "Malware payload", "value": "dfd763607915c16c88b819170639b828a72f02196be6e123318cc70633ce17fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700928920, "uuid": "f7649781-e784-4058-9a57-bc20c0eb1825", "comment": "Malware payload", "value": "2447a8b13d33e24656410d35c63f85b6ea7af200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700928920, "uuid": "b9ca2ccc-fe58-4761-99e5-c3bfaac7a653", "comment": "Malware payload", "value": "9dc198f54fbc7a05d3c1304e8dfa4a301ce4d72e1b12d0acb65ad68a9786997ba6e7c681374694c100927ba2ba90011c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700928920, "uuid": "3076e169-c645-42de-b230-76e69ee5a589", "value": "T12164A34392E13E44EA268B729F1FC6EC774DF6508E497BB92218DE2F14B11B6C263750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700928920, "uuid": "52f63489-da04-453e-9b02-c67a2ea55fb7", "value": "5436687cad9eeb8d4746b898301812f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700928920, "uuid": "1d1e6442-d50e-482b-ae5c-b886af304076", "value": "3072:wlc5kpSgWGlDN/Uz5fe0ZdKOo6FiI52Uzkf5XyBk3eFx/RIAB:YcqSZeaZaVUzkc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700928920, "uuid": "c41aecb1-2404-4a00-9c5b-269b977a7c8f", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700928920, "uuid": "8cb8718a-c587-437d-93ff-ad743dfb364a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700928920, "uuid": "7bf375af-2860-4256-a961-a29b3c040e9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6a3cd2-8bd6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700946544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946544, "uuid": "8d21c700-5cc4-41e1-8eab-ef5b64bc0ec7", "comment": "Malware payload", "value": "1c92e8e964514df1ba3773e5445c005d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946544, "uuid": "16381785-7df7-4776-a8a2-41fb22e45e4f", "comment": "Malware payload", "value": "e0d9648bcafeb1ec191ab51d1f3e63f2469207a707297b6958da2a364d6da83b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946544, "uuid": "0d409fcb-75d0-45d6-b6c5-eadf600e984c", "comment": "Malware payload", "value": "bcfe0470ce184fc88ab805a4b4fb1241a6b78097", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946544, "uuid": "8f705d55-a8fb-4415-adfb-d255b0ee5dde", "comment": "Malware payload", "value": "73a314eb9085a7c2c509d4510eae519038e8426f584e016a1d91cf6d36da5a70d3f53bbf357570d44679ecf7159ce670", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946544, "uuid": "fe503250-d4a1-4d21-88cf-86e77d15bff1", "value": "T1E643F855F8818B22C5D4027AF92D118E332367E8E3DFB2139E116F247B8696B0D37E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946544, "uuid": "980c14d2-21e0-46e5-8fc8-d895abdc136c", "value": "1536:5Jng2Ke3tTQZoSgLyUN/aBD3ezzIci13FihNJ:A1edT+dCO33FihNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700946544, "uuid": "09ec107b-ae2c-4c3f-b5e6-67594546ce31", "value": 58676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700946544, "uuid": "be5d2418-a374-4771-bf43-0e80750d59dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946544, "uuid": "bf95625d-216e-450b-97fd-dd57af426d0c", "value": "arm6-20231125-2109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8efee45-8b45-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700884206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700884206, "uuid": "852bdba9-7bf5-452c-a568-24f26e45760a", "comment": "Malware payload (Mirai)", "value": "00647653f805433d148e059d6a29c680", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700884206, "uuid": "a1b1a972-e63f-47d2-bc37-f1ffb7015fe9", "comment": "Malware payload (Mirai)", "value": "e0ec895f3f65821c2d77d0337cd8f19cf733c25c3c764e9706b9e66ce54b380b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700884206, "uuid": "3345240b-d1db-4171-980b-062b0ca12422", "comment": "Malware payload (Mirai)", "value": "ba5456ba4cb0bf426d118e469ed72c877347fa99", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700884206, "uuid": "64ced38d-9dad-488f-8cdb-6f49c0fd856c", "comment": "Malware payload (Mirai)", "value": "253b6ae669850b54d232074da107ecf65f09d325e89de049e3a6bf5fcd0bfb25c9ea3f1cfdf646aca9d64bcc0e7b7e9c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700884206, "uuid": "b5530ef7-cc6f-4771-b51e-1959656e64c3", "value": "T1FFC2E16FB2A95A2AFA5D723CE432810B03B4F6285B5D37AB63010936E95E41D3631CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700884206, "uuid": "9dbfac66-8a31-40dd-881d-77b77b2b948c", "value": "384:Mu1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZH2Qzg6M:HMwxdyoEUnDz+Y8tqHWXmWx6nzk9FND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700884206, "uuid": "76a6c8f3-3f36-4cef-8881-d2d7cad9dca1", "value": 28272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700884206, "uuid": "e9e51c5b-e570-4f23-8676-79a015462153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700884206, "uuid": "c4d1bfe5-561d-447f-9d63-6af046d8d071", "value": "syms.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0663aff7-8b5f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700895074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700895074, "uuid": "09e98522-4e08-471a-bc0c-4aa7743f0761", "comment": "Malware payload", "value": "a75ae4f8c5d58166ceab4e3f77bd9971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700895074, "uuid": "a93dc101-6225-4453-b56c-8eef3733c890", "comment": "Malware payload", "value": "e4593c2762d76c2532db610793c5480f2c40a4fd5097f4d7d5e1ccf4c8b6ada7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700895074, "uuid": "48bb49d3-19dd-4042-9192-a2cd8b57f265", "comment": "Malware payload", "value": "92e7b5fff0c6ba07f51dfc4272ca2a8ea89c47d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700895074, "uuid": "a0d016f9-cc24-48be-897d-3f7286633a9b", "comment": "Malware payload", "value": "6ad2f062fd416325df063f5c2914c7a1816154de6ab98482424ba387463a3efd5d3f417796a0f765243c6ed6ea633a55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700895074, "uuid": "4e3d1059-b5f6-4279-b3a6-7f2681a66bb4", "value": "T12B749693C2E13D44EE268B729F2E86EC7B1DF6504E4A7B66121DBE1F44B02B6D163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700895074, "uuid": "03db2c21-7223-4ba7-975d-3138bda6bce7", "value": "ac2a65b4a5041877693100400bbe0f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700895074, "uuid": "c48f3bf4-b123-4738-8509-0f9c04b242e1", "value": "3072:SNNz4oeLV0cQs37OAYy8oNddcuelsGKZROfpX9B935w3STrYdke0:214oeLLOpyFdcuelsFerUCTGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700895074, "uuid": "06c94af1-efd7-47f8-a2a8-cc7587c5377c", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700895074, "uuid": "821d4f6b-5141-4600-8549-77820c84a5aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700895074, "uuid": "2f03cc28-3a3d-477c-9ded-fd721802113f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc7dff5-8bdd-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700949310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700949310, "uuid": "1ecadba8-6113-45c9-9d71-32fae6d47d3d", "comment": "Malware payload (Mirai)", "value": "9744736c0eaa1e6a18cf38b2aa336b0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700949310, "uuid": "4225be04-bcec-45ff-9690-827fcef86d7f", "comment": "Malware payload (Mirai)", "value": "e6a70ca36b951cda242497cdcf0a53fde1050d85794bc0317683fc8d52e1b566", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700949310, "uuid": "72969224-a458-4836-9bf5-e6cb705ea657", "comment": "Malware payload (Mirai)", "value": "b998631fbf342268168d2744e0ef06d59b5e297a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700949310, "uuid": "14a17a3c-b1bf-46d9-8c8a-bd5fda6c8745", "comment": "Malware payload (Mirai)", "value": "53ac157b6f7e46d76bddf9a648fef4165a45e10d677d77efc451eedbcd0bdd5a79b0ca5d1e5bd3d42f76247357e69bb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700949310, "uuid": "0261cf86-8fb0-4002-9171-85b88912c696", "value": "T102232B25B9761F17C0D1A8B521FB4B68B6F106CE26E8CA4E3DB20E5EFF619405503AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700949310, "uuid": "13fad77a-d803-430f-a4c1-3d0b0d0872f0", "value": "768:nxoZ6yf3xx1DEmtrBy1ZBJcI7s8yAIQjCO+AW31WwWW:nxEjf3xPjrBy1/JcIA8BIQjgjBWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700949310, "uuid": "9a0eda2b-6ec1-4eca-a614-fe23543726cb", "value": 48856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700949310, "uuid": "11940a22-5cac-4154-8beb-b5219769cf89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700949310, "uuid": "860a4a0b-6103-43e1-875f-b3bafaebb805", "value": "9744736c0eaa1e6a18cf38b2aa336b0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3ab496-8b34-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700876915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700876915, "uuid": "51df7049-d7cc-46d1-bd5d-ce7d2bc8bd20", "comment": "Malware payload", "value": "08b810da9124157c51ff7101345dcfef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700876915, "uuid": "ecbccd61-9fdb-41fa-a2ec-9e34a5481266", "comment": "Malware payload", "value": "e6fa2f50df9523e2f5e6da0e4afef99b83d54b74e729e5cdffea119288527b0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700876915, "uuid": "24415e3f-1b36-49fb-8849-321c68ea4598", "comment": "Malware payload", "value": "36b8642f93cebeddc10601653f26b1e5dbf82107", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700876915, "uuid": "77c1a5f3-cdf2-42f1-9003-d4d704d0f5cb", "comment": "Malware payload", "value": "90ccc3304109b039f00d439e4772c2764c7ef4e9ca39c5c0ae396eae30b4a028ff6aa484da4e9cf5241032fcddc47652", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700876915, "uuid": "d360762b-668c-4f28-ac65-51a740bb55ac", "value": "T1A474964386E13D44EF268B729F2EC6EC7B9DF6504E4A7B6712189E2F44B12B2D163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700876915, "uuid": "90b6d413-ade5-46d2-925c-e176f3412dd1", "value": "ac2a65b4a5041877693100400bbe0f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700876915, "uuid": "bd6155c7-f2e6-4ae3-98f6-86f5b1e365b3", "value": "3072:VkD/4kelV0ca5qZjIJ7kattDfG3Gk6SEq6X77VrSnG35wOYTrYdke0:+L4keiq5ATG3wq6X7sOYTGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700876915, "uuid": "b60cb85d-4f83-49a3-ad3e-9d254e6e6cc6", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700876915, "uuid": "a222c24b-94d0-43ca-913d-016c19190a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700876915, "uuid": "f28b4e36-be42-47d8-aed6-910d1e1a7029", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0884509e-8ba5-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1700925142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700925142, "uuid": "9aead74e-e9c0-4ed6-bad5-b41f97855b2d", "comment": "Malware payload (GuLoader)", "value": "db61418aa6c2317b81f3238a4cc8dc10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700925142, "uuid": "13474725-2914-43b8-872a-d4ed423b4e2e", "comment": "Malware payload (GuLoader)", "value": "e766575d6010e9d2ccd3f68e0a88b83d0df233be3cc2907e1db5c875aa07b855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700925142, "uuid": "6e1b0325-4b30-43fd-905b-d81fcb26f07b", "comment": "Malware payload (GuLoader)", "value": "fae4192a47a846ddfabc1965210cd17c092d1448", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700925142, "uuid": "90c3bf7d-a98c-4500-b82c-5330778848be", "comment": "Malware payload (GuLoader)", "value": "e658a2789ecf0c017959462371ccbacd26baed57cdea8da3a4fe7910bb11eed9f7df602a01ca60c47762b9edf362c93d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700925142, "uuid": "b2e912e7-eaf7-4f05-b1df-057e5ada1528", "value": "T12984230283E1A837DB831B326F72C1AFD275FB5C9E5CAC8B07247F8674668A55D42063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700925142, "uuid": "c8483274-48e5-44f5-84bf-d4561b474552", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700925142, "uuid": "0d6b5162-8483-4c55-b7d6-45669a645896", "value": "12288:QoyP+aJ/F2HkWyGD5TLUVoAeCeHOGjhSmOGw66HGsiWyg/OV:QoyP+aJ/6e05vo+HbShxDP/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700925142, "uuid": "76fd3318-5279-4e60-b010-fda52818e7fb", "value": 401553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700925142, "uuid": "4a7ee282-7556-4818-887e-5d3b809e8908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700925142, "uuid": "1b6778cc-691c-4127-b7bd-60c233030bd1", "value": "RFQ#84839PRODUCT_MATERIAL_TEXHONG_TAN_CANGcsst.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff08c92-8b3d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700880675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700880675, "uuid": "48964b2a-f6af-4f99-a212-431f6df45248", "comment": "Malware payload", "value": "7078cf4a836372feef78985170ab7aa1", "object_relation": "md5", "Tag": [ { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700880675, "uuid": "492faa57-32e0-42ec-823c-70c3b1ee3d0e", "comment": "Malware payload", "value": "e77aa9c4d21bc77e0f581ed5fd0617d81081da81541468e44a5e1235c182b36e", "object_relation": "sha256", "Tag": [ { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700880675, "uuid": "4bf28a24-eebc-4945-ade4-bce779476d20", "comment": "Malware payload", "value": "a6dcdb2598c8816a56ab2eab1c5bb1c127694925", "object_relation": "sha1", "Tag": [ { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700880675, "uuid": "67ae80e9-be24-4a18-89c3-e78300c8a212", "comment": "Malware payload", "value": "d768430bb9d9817992213793c4cbe031418026eff251cf1bddc7bcd085a7f550ec72e673c95db38aff70a7e76096b29a", "object_relation": "sha3-384", "Tag": [ { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700880675, "uuid": "7fd3225e-542d-4e18-acd4-3c0f0e23fc99", "value": "T1352533823353E1D2D21DB8BF5DA182623771E27B4FBBD20D3A21F7617076E109D19A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700880675, "uuid": "41cfc6cf-509b-4a9c-9c4e-783fa9d1c22f", "value": "24576:tM3A+CB4q4BAY0/0z3agZZi/y9Sk3tXlx7:OQJyBBIzii/y7db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700880675, "uuid": "cf957349-4e00-4be4-99c2-bcfa96a8a7af", "value": 1035694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700880675, "uuid": "bac7eecc-8044-4ad2-b43a-1259e69882c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700880675, "uuid": "c71a6108-7760-4a2f-89c2-a7f95435a0e0", "value": "cheat.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634722e7-8bc5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700939038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939038, "uuid": "989f6765-8092-4704-ab92-aeb0ff9ea3e3", "comment": "Malware payload", "value": "d6d92703ad1bd824cbc022a6402d7337", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lambda", "colour": "#3DFE08", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939038, "uuid": "1dd1a3c7-a610-4b19-8c51-23e88cb4fc83", "comment": "Malware payload", "value": "ea761022497e50f68f276b659e340d95afa27c6b72776aaa497ec3e38118e48a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lambda", "colour": "#3DFE08", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939038, "uuid": "703e933e-d65f-470e-98a4-bd0da5290b1b", "comment": "Malware payload", "value": "25a46b05630c4927f8ec0d95c4d7bbb2ca93ccfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lambda", "colour": "#3DFE08", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700939038, "uuid": "3a5d31f1-50e5-4383-a5b5-dd72218070b2", "comment": "Malware payload", "value": "bf29f41c3c1d48edebf3b32b49cba2e7fb86e1756043eadd2b828913a7a0f81cf8af88d5a5019089c47b36c75c0e52a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lambda", "colour": "#3DFE08", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939038, "uuid": "5c436159-920b-40a6-a669-02009636ce63", "value": "T1F1347D51B6C0D036E8A2053406F4D2FA253EBD302B6095DBABD17E3B7A716C35634B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939038, "uuid": "aef23b93-3712-48e2-9744-a96dc53d5981", "value": "2b886e02f7b1558b7145fe5930f722ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939038, "uuid": "fd04ffeb-10ec-4c8d-98d2-de12a2eb5512", "value": "6144:cy6gDdV3TGDpoLDcol+LGRCjD/ex0J5QFwQgzD:dnGDpoLDcol+LGULgmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700939038, "uuid": "55c59eab-dbc1-4430-999b-3dff795a599f", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700939038, "uuid": "8bd9e422-55fa-4b40-8b04-43acb9de6792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700939038, "uuid": "13a38b73-a4e6-4614-9d8a-d39bb1222093", "value": "Lambda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095fb969-8b44-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700883482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700883482, "uuid": "846ee03e-a6eb-49d5-af3a-0b4fc6c6cf0e", "comment": "Malware payload (Formbook)", "value": "e59325a169b1a80fd0525ea86e130ff8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700883482, "uuid": "0709de05-d7d9-4697-94ec-8f23994a744c", "comment": "Malware payload (Formbook)", "value": "ece7b97dcb7fcba52f0b348578e52178bbb7bcc22540ed9123997b90c14323e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700883482, "uuid": "f51c9447-ee62-4766-9c31-603eb7ed5952", "comment": "Malware payload (Formbook)", "value": "7c95903106de756f1f55df7f3b4542ac91692f39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700883482, "uuid": "04c6c187-c545-4b54-84c3-42efde1a1125", "comment": "Malware payload (Formbook)", "value": "ca0544ea107d44584eeb14429a7eb11a1913a9796709f5aa00a009ca09c559b7210bfc3a334008d569e6e4c9f853dc64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700883482, "uuid": "713a276e-bb2c-4a41-96b8-e4ddf14f8c5e", "value": "T124D423406BBD88FDD0BA2FF601A016B55FF1C13966E7F06A34DBA57DA6127100B0972B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700883482, "uuid": "a38d53fb-81fe-4e89-aa44-a0454d524f3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700883482, "uuid": "9d209f05-39ad-415d-97d4-dab4f3df27dc", "value": "12288:fy8oXi8ViC92Z8y/2mpBT32oQMwUaQs5+A6JYJL:fFUzN82mpJ2zMwUaQkoJcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700883482, "uuid": "d8946e36-b855-4e79-b90e-67e47895db52", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700883482, "uuid": "2b1c812b-7587-473f-b84c-d25775a3171b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700883482, "uuid": "f579a177-b9db-4bb9-a3f5-a7ecaf07023a", "value": "e59325a169b1a80fd0525ea86e130ff8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995a68e1-8b71-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700903051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700903051, "uuid": "7e4a1862-06cd-4525-9372-1066b1eb3aed", "comment": "Malware payload (RedLineStealer)", "value": "0d1e2b8dbed6027391b46e09b4cc179b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700903051, "uuid": "b4305d45-4195-4a7b-bc74-a02f06acf6ac", "comment": "Malware payload (RedLineStealer)", "value": "ee6c94f8571d57dd6c987d04d0d767941127f6c1604dbe3668cd01053e98e214", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700903051, "uuid": "44cd02d5-9c5b-4751-add6-01e84f191123", "comment": "Malware payload (RedLineStealer)", "value": "41260d6019426941fb10dea2b771a672243cfb91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700903051, "uuid": "90a82a53-51fc-4161-a9ca-9e3ae55b41cc", "comment": "Malware payload (RedLineStealer)", "value": "ab626d2c64ca3c43363443c7ff8bd16c7dec57b445cdad19e72736a51b818f5fe02aad4b356ef4049407d9323976b1ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700903051, "uuid": "44ad0043-14a6-440b-8aee-c8de2eb59d00", "value": "T107945CD5A9B791B0CB23C2FA97B9B6C3CB7F01800152ADE9776821F2144D49813B7B78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700903051, "uuid": "4195ee33-2299-40ee-a828-727620af61c5", "value": "3660d83a680d788923f60a50202d4752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700903051, "uuid": "bc6fb7b0-e7cf-4626-9a79-d6c294623f5c", "value": "6144:AJUbUFX+T7B057BOXuvXIvWBN9ULpX99aUrf+H8jJ:AJUb6tyLpFrhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700903051, "uuid": "1686020e-569a-4165-9c78-3a32ab89b084", "value": 418716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700903051, "uuid": "a9b7c6d7-786d-48ae-99d3-83084eb05d0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700903051, "uuid": "ebd3945b-1caf-4f84-bc6b-c0f4ec5edec6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab0baea-8bdd-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700949305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700949305, "uuid": "1f461e28-93f8-4ca7-8c86-1e0552ea8c81", "comment": "Malware payload (Mirai)", "value": "be3a9bb5227eff366cfed7e7187b4a8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700949305, "uuid": "5fa106e2-ea97-4319-9e25-01dc51667e30", "comment": "Malware payload (Mirai)", "value": "f0087b5b56588e07a59ffc9ef344b5bad658b36f3f628242ebb7c4385c3ac8d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700949305, "uuid": "c86cbe49-d2c6-4f79-8487-072aad4788b7", "comment": "Malware payload (Mirai)", "value": "fc09ef0b5e4dedad6cc1444e19143b7581ea8265", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700949305, "uuid": "c72b428d-91b8-44d0-ac18-07cf64971024", "comment": "Malware payload (Mirai)", "value": "35fb166049f21a64848fd088b2dc84f1f1a29b9bb64c693bedefe8bb5950a2d4725879398cbc46099d297d753da9df00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700949305, "uuid": "9f28ceec-e39e-4862-bbdc-bfe29b540e90", "value": "T103133C42721C0F17C4A35A70253F5BD087BEAAD032E4F285665F9BA68A75E371482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700949305, "uuid": "715b05bf-1a8c-4e1d-be3c-fce6230bfd08", "value": "768:g40J4bzio9RfQRW0qRGQ8Jt8hTVsBWltn2susHzFuMtdW4dLFrwV:70JOC+QqhTxxjEMtdFLKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700949305, "uuid": "c152e176-ae0e-483f-a9ab-a95b51692ae1", "value": 43780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700949305, "uuid": "0c4c6670-32bc-4827-a1b3-602ecb22ff2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700949305, "uuid": "7d39d759-05e2-436e-8c7c-7cceb8b78198", "value": "be3a9bb5227eff366cfed7e7187b4a8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a2f298-8bd7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700946857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946857, "uuid": "58f08187-2ac7-407f-835b-40b5f1099c80", "comment": "Malware payload", "value": "ccb64aa6ad20064bac4e4c04df2faaa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946857, "uuid": "5c23a2b3-9d21-47b7-94a1-d8c3bde1efb0", "comment": "Malware payload", "value": "f0cd119e092bc32973c8db3a2d9ac72f675a2537d6dccc430a1863002a6213d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946857, "uuid": "224419f3-0103-471b-ab35-954a4e5a2d97", "comment": "Malware payload", "value": "cdedee7585e4db43316cfc7a532856671cf8bd17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946857, "uuid": "ab5e1c80-3843-4369-9e1f-e0dc51ff89a8", "comment": "Malware payload", "value": "26a5b09925fead5c062c89e97f2e61d761d7b28e1660e1f220faff0ae02abc9156458992ff3b6de46882ddc9368c9506", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946857, "uuid": "c142bfea-962e-4aa0-b8e4-79542129ad3b", "value": "T1A0658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946857, "uuid": "b61d0d4f-a3a6-4918-afa1-00cc39e4366a", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946857, "uuid": "d14f8554-2cc2-49af-b3f1-e3c4958b507b", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700946857, "uuid": "001b67c6-9b13-405d-adc5-db60676c296e", "value": 1539703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700946857, "uuid": "47288b4d-5f35-4432-ab12-dfdda6831574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946857, "uuid": "ef7862fd-9e37-4877-b2b5-11f13022f482", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec07e023-8b7f-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700909203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700909203, "uuid": "314c4d24-6e46-4786-b0e1-feaf1274b669", "comment": "Malware payload (Smoke Loader)", "value": "2988fcdac118cb22eea42671064f4ee9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700909203, "uuid": "4ded53d1-e2b8-4386-9604-f2b2aef078e1", "comment": "Malware payload (Smoke Loader)", "value": "f203266977b3d854f5b06d8012bf2e5cc84df25a74a4de4dda92b964e4cde385", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700909203, "uuid": "5c622bda-e917-4c54-8b29-fed0dcf45db3", "comment": "Malware payload (Smoke Loader)", "value": "0fc30ef69a485ac64fa3826139a897c97e007ade", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700909203, "uuid": "dd1a6a77-1c31-41bc-b473-8266953f9ca4", "comment": "Malware payload (Smoke Loader)", "value": "739262eca7118278a821e9e1257be8d0f71f74ea39ce0455e0f2e41a8bed4949e835a70b35d2c6d21ecde4f4d2545fa6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700909203, "uuid": "168930e0-008b-4ba1-a938-74ef5e38d099", "value": "T1BD74B41392E13E44E926CB729F1FC6EC7B8DF6508E597BA912189E3F14B01B6C263750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700909203, "uuid": "4c1da42b-f6c2-4230-8294-738ab525b21b", "value": "4c459b08e177ae567cc13290dc63378b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700909203, "uuid": "96b8b026-5222-48a5-9d05-95276fe5f10b", "value": "6144:a14oeAJzbnvfLxi/igFn5HunLKvfNfcj:a14opJzbvfLixwnLqfJcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700909203, "uuid": "19caf7bf-0de3-42d6-bc85-ae7e5bc4f763", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700909203, "uuid": "ec5dc91e-b290-4855-a1d3-8cd1198d2a36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700909203, "uuid": "e6f290bc-a338-486f-8c79-1e3603cadb9d", "value": "2988fcdac118cb22eea42671064f4ee9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca6e25c-8b35-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700877421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700877421, "uuid": "7c0aadc1-b6d9-4d1e-9032-d7692cf374eb", "comment": "Malware payload (Smoke Loader)", "value": "bb5deee92262d49bb6e59ef24ebd6a2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700877421, "uuid": "659e7f97-ac53-4755-9600-b3ef73cf38ce", "comment": "Malware payload (Smoke Loader)", "value": "f3a13cc76e0912f23dfdf11cf1a9f6b8015b540d1eae809d2a359c9a278ade1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700877421, "uuid": "5a3a5e0f-dff6-4cdb-b544-9d677e68ce00", "comment": "Malware payload (Smoke Loader)", "value": "c75e857eaef2db8acb7f0c16e48b7cc5b0dad199", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700877421, "uuid": "68ec2487-fb9d-4bc4-a106-52df114525c0", "comment": "Malware payload (Smoke Loader)", "value": "2822983f4ce6197f6355b800aff1beb8b29c93583f1b5e8290ccfd6bd0daf37b8a1e96d1da4404353d8763202079fde4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700877421, "uuid": "82d25033-20cc-48e3-a5ad-51d836fb4cc9", "value": "T16E74A54382E17D44EE268B729F2F86EC7B1DF6908E497B6612189F2F44B0276D163F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700877421, "uuid": "050d43d9-f295-4173-a42f-568ee301a613", "value": "ac2a65b4a5041877693100400bbe0f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700877421, "uuid": "e7174a47-34e9-4a38-9dcc-afcfb40be492", "value": "3072:Eyjw4KegV0cohU6cWttqIucNzC29g2OOTu0+eJ35wWLTrYdke0:zk4Ke1UU/qzcNFND+eYkTGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700877421, "uuid": "d66b71a0-d917-44b1-b420-3e896f4c522f", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700877421, "uuid": "15ddca11-9a3a-49e9-b070-ff8ddb43a60b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700877421, "uuid": "2062e029-152b-4d8a-84fd-e7b2f712f47f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3e0ecc-8b3e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700881175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700881175, "uuid": "15997ba4-defd-49af-a3e7-2507be02d8a7", "comment": "Malware payload", "value": "b58f09e2b143c1cf5168f291dc9be9bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700881175, "uuid": "23ee88b4-dcff-40f6-83f0-d2e94a4c78ca", "comment": "Malware payload", "value": "f3afa6e4f4488787b869cf00c891d48018d29dd9239b725bef5109f20aca0025", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700881175, "uuid": "b735c349-37bc-4fb5-abbe-5b2479b8b28c", "comment": "Malware payload", "value": "0bbfa1629e6900bc5664313f9507eb920d130520", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700881175, "uuid": "35f54e3a-42f4-4ada-8a34-54dba1280b52", "comment": "Malware payload", "value": "f268a5aae3b2f4a1534035239018f99252b376744334d630d6190603e4cc7e8935652d70449e2d6ee1402c7062d2c6a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700881175, "uuid": "9205914b-2ae2-4280-8a02-f72cdafe58d5", "value": "T1E074B64382E13D44EE268B7A9F2FC6EC7B1DF6508E497B6612189E2F58B0376D163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700881175, "uuid": "94e3d279-5f46-4a50-b14d-6a286b65be3d", "value": "ac2a65b4a5041877693100400bbe0f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700881175, "uuid": "83c4f367-2ca7-4772-b052-324c3b5b2002", "value": "3072:SjrO0x4UTjNozz8WzwQG9cJsSkOxBittUx94fB9WQfn35wjp1TrYdke0:wT4UPNozwWzwfmAg8NWiqjXTGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700881175, "uuid": "81135f08-0cdb-4802-8726-918cca3f5361", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700881175, "uuid": "4c2d44cb-a582-4438-bafb-c7b8a9069229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700881175, "uuid": "3d0ea92e-b2be-4142-8e4e-b2ca9f761c7d", "value": "b58f09e2b143c1cf5168f291dc9be9bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06cd9e7d-8bbb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700934588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700934588, "uuid": "5adc11f8-388c-4387-8006-1b7c8cef751b", "comment": "Malware payload", "value": "f1316b0adefe587b454b7eeb22eb6d10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700934588, "uuid": "cb5c3e94-1fae-45a9-af76-2c4a1d517079", "comment": "Malware payload", "value": "f43d1ee03318ba3aba928a59de21991625eb55a587e3c29d8452da6fef885056", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700934588, "uuid": "09424114-0c4a-4b6d-a9ec-7422a394623f", "comment": "Malware payload", "value": "126321e2f4667d8073b52be45cd1fec7f4b2c5e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700934588, "uuid": "21ff47f2-7c0c-4088-bbde-203e3052172c", "comment": "Malware payload", "value": "e57a23b954a145289aae96825ecdcf4d42aeef963306feaa42c6471f362441a7cd99550b212a2bd295b6857d39f39151", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700934588, "uuid": "cac5e194-e23b-41e3-bdfa-6acf0155449f", "value": "T1B9D502368A0188AED0B38AFF87673B2D4DEC7F52B318622B62D51EC58731455D4E660F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700934588, "uuid": "0ae2a54a-49f2-49ec-99c0-50439dedefa9", "value": "5b36115ff362711943f368adb695e60e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700934588, "uuid": "5f11a974-07ea-4918-8885-7dfc431a2aeb", "value": "49152:HjVgiG/hT8cm8U2zkpdt0n/s0YRZHPm4poP2UkCsPt/QhUsVm+:HjiNF84UJoE0YRZvm4pk2U/Ahpob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700934588, "uuid": "f2c07f8c-2535-4bae-9e2b-bb1a55575933", "value": 2772992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700934588, "uuid": "ce77b171-73cb-4e9a-988b-2bf1bbc9ce8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700934588, "uuid": "cbe65283-83af-4133-be61-1b49ddb39cb8", "value": "f9b80d34a77f382280115ffc653fe8bf1b821719.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fddbd0f9-8b87-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700912669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700912669, "uuid": "7a3c37cd-8a0a-4dc5-aa56-ad5ecde03b29", "comment": "Malware payload", "value": "058c21cc129a5a5cbf418f2bce2a60a6", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700912669, "uuid": "367bb184-a57f-497c-8144-ed5cca72d6a0", "comment": "Malware payload", "value": "f4a7c4acf61e1ac508b3078bcd0959b604ee9b5d8759e2cdd5fa96e0ac27104f", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700912669, "uuid": "a62b4b43-7559-4604-8e76-d92f309e2c02", "comment": "Malware payload", "value": "748bee5b8fa109877923bdf063796b23a0c241bc", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700912669, "uuid": "70f96393-a6a4-4d7d-8915-b777e36e7147", "comment": "Malware payload", "value": "65513aa9fbc4a1897a9942e2c9a437636ae7e94ee82ceb4da9d64713c32180acd346e2439832f6851060b2193e6c012c", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700912669, "uuid": "8fa3e5df-2aa5-4fdd-a733-947b86a65691", "value": "T1D7957023BE97CAA3D2892737C5A614580776F6826713DB0B394F236A5843BF75C4321B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700912669, "uuid": "5df4dd7c-9d9e-4ac3-ad65-0c24b1243e93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700912669, "uuid": "d4b00416-3d05-4542-9375-ef785e7ba896", "value": "24576:UJNZPN2tK5URKBGv8Rw+MVCBdwJtLxCt0xzM5ZkAvWHhiv/:UJNZPN2tK5URKB88trwJtxz9M5Zk5Ho/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700912669, "uuid": "c5379117-7ed9-4d11-866a-59551e96443c", "value": 1888744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700912669, "uuid": "cd3f982b-a55d-4225-8b97-df3886da8ea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700912669, "uuid": "49315514-7eaf-4ea9-a0c4-2e67f5b0c422", "value": "Clylm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf24e2f-8b97-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700919215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700919215, "uuid": "b812bd60-1ab3-42b3-a012-d199c7f918e5", "comment": "Malware payload", "value": "c495370c41ea9e8089e63311b6b70d72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700919215, "uuid": "cd9a3c15-22ca-4067-9a4e-7c139896052e", "comment": "Malware payload", "value": "f4a9c54fcfd61cbb3e3e46332f3af3a29b70d4ef2090eeb8e338924e2cf5a762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700919215, "uuid": "a37ad9a3-c133-4919-86e4-bbd77ec086ac", "comment": "Malware payload", "value": "f25dce5329ccdb7ed1bda9a2ed23e557b2af607e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700919215, "uuid": "c61a34ba-aa96-44bf-a24e-4e63660cd0e4", "comment": "Malware payload", "value": "f26533d12f5439a3303981de9c26f79e75f47c9abc57655382a1e7d25374d5f7ea5fabc7d02b47d51a6ee15252e7d18c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700919215, "uuid": "c31040cc-c932-43d6-bda6-f1c808a6e34a", "value": "T189D5B71AFE215CEEFC5D13F0A97548446EC0CCC69768949A25EA73CE863D383705BA87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700919215, "uuid": "aaa567a0-21e6-47b5-a230-425bb65f6d78", "value": "49152:8ghZ+2dUDxTghSZBfXfYaQ88Ay1IZsWP3+b/sVBYP18R4V8cvd/DypDoF0BipdL0:cRvIOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700919215, "uuid": "4bb362ab-8e48-4d2f-862b-6cf9a99fd0a1", "value": 2936832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700919215, "uuid": "e9922daf-f439-445c-8e5a-39363054767a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700919215, "uuid": "d090cbce-5b48-4eec-be9a-244bc41a8cf2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86610f66-8bad-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700928789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700928789, "uuid": "d5a7cafe-feb0-47e4-b144-06d4cc39db36", "comment": "Malware payload", "value": "df261d141cdb424b73c960d4ae4357a5", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700928789, "uuid": "19e877ba-2c1b-49f0-82b3-a5ae77c9689e", "comment": "Malware payload", "value": "f4cf566217708d9c5e6d7bb3c39fa2acb5ae2ee86fd0fed9d19999f4b7b22eab", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700928789, "uuid": "bb44d695-50bd-47b5-b6f7-754f1c696d6f", "comment": "Malware payload", "value": "e109f9dfb5b8371f8a67fc8b087bbe93feef843b", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700928789, "uuid": "30dcc644-1fa6-406b-909e-285285119acb", "comment": "Malware payload", "value": "eda67f0526e34d82752e5a928cbe51e457aac2cf7b2e0241f5a1f7156d9b85d093fe07e139c158ad1eeb2b96485f16d6", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700928789, "uuid": "5a09e12b-05c5-41d7-8413-1915b99389f0", "value": "T102D2D009A1197E6CC85628F9202C42F3750E67D6C043EE8E3091F1FE7A926FA635D57E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700928789, "uuid": "9a37d1ee-f134-49d9-a253-2cf126d16965", "value": "768:knZcXFrWYpbDNbYWCpjyxDd7nXgMe+rX3JxS:knZUN5pbDGWCgkwNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700928789, "uuid": "b1068baa-9db8-43e2-a2a8-67d2a671ae1d", "value": 29373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700928789, "uuid": "b74ad0aa-8245-4ede-8018-92eb111ed0d6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700928789, "uuid": "e31316b9-2f5f-4a70-a68c-57e47b6c0801", "value": "Metamask Main FERMA.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef1f8a8-8baf-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700929582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929582, "uuid": "60e8c23c-349e-4aa2-b431-2e6bf82227ce", "comment": "Malware payload (RedLineStealer)", "value": "3bbdfbcc0bf3dddbd6e8706113d81a36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929582, "uuid": "f0ca24c7-df62-49f4-8f4f-843fa5ea7f4b", "comment": "Malware payload (RedLineStealer)", "value": "f641a3e31afa3b0502d4490f22bb56b480f8a50a45dd38e41d53370d325943a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929582, "uuid": "3fd25acb-9fe3-4544-a12f-ab81c02e4ddd", "comment": "Malware payload (RedLineStealer)", "value": "119bf65626c051a451af1d1d1bc4e1b3986ab052", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700929582, "uuid": "5908e123-de54-4daa-b590-ece1eb11e2ab", "comment": "Malware payload (RedLineStealer)", "value": "ffbb29fcbfe1d7e2635e5b9316c6b1e73a02b6d3e07fc647a61cc2eb8e80d65545a72c183ef9211ebf5a1bf73d32e1c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929582, "uuid": "ee61fd1e-eff0-41ff-b77d-fd3ff9240090", "value": "T13E458D3D3D8C81B2DCAF11B609FCB766175DE1B00B1446DB92888FEEFB542C2AA71552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929582, "uuid": "4ef38c86-7ea7-4ae9-ad87-3198ccb1903a", "value": "9ee1669563594b7c955925e47aab0ef0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929582, "uuid": "de3deeaa-4b07-4b55-aa04-b57463c603c7", "value": "12288:cQYUdZzN0OFYvMeTVRq6TFXJdzIEKJGnaQXiugklpJPK4lopDlQFeJ:3dZh0OFYvMeTVRfXcdJG5hevM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700929582, "uuid": "f2f664b3-6197-4c5c-8a16-6de9e6907aea", "value": 1191936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700929582, "uuid": "5c8d5e21-92b2-4e26-abb1-9f6eea6dd823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700929582, "uuid": "ce10c00b-93ee-45f6-9da6-6bdd621faee4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3877c38-8bd6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700946528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946528, "uuid": "261c3503-3db2-4287-ba94-20b70b9278c9", "comment": "Malware payload", "value": "370764244952b851c1f437dd691dd3c0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946528, "uuid": "5a6a2f14-8a7e-4628-a5a9-1d920938f679", "comment": "Malware payload", "value": "fc439c7817b85b5e9e13ff8f63392e28f20536ae2b74715bfef07a8ee0624c18", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946528, "uuid": "14fd8a6a-f396-4fa9-a349-a05439ea176f", "comment": "Malware payload", "value": "629fd72dcd144d922ccac64ce94bdd672463052d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700946528, "uuid": "9aeb1305-45e3-46cc-b0d6-03e1aef5a571", "comment": "Malware payload", "value": "4fc97cfce35de8b03b429beb639f67454cfde6c2f7718e8efd9e287d0bbc356174cf614382e0a46140c3047d03ab1a7c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946528, "uuid": "526295aa-fad4-4b2b-93e2-94edcab4eab6", "value": "T1CE43851E6D168FBCFB59863447B78E219A5833D627D1D642E16CDA002EA034E741FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946528, "uuid": "2fd30f02-4da7-4f4c-9e5a-297cc864cae7", "value": "768:bvaLxUxyQpPT5rhmu3rFtmmSnoh2Lt3ug+j1EZi0e4fyMnup//dujgtywvz:bvJFP1jtYF+j1x0lk16gtLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700946528, "uuid": "b132e2c7-fcfb-46ec-92ce-3a738dc63cc4", "value": 59768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700946528, "uuid": "9bbf4767-915e-4b3d-96f4-cec302519d59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700946528, "uuid": "c608033c-ebe4-45d0-98ff-4233168c6dcc", "value": "mips-20231125-2108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f7d4ef-8be6-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1700953209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700953209, "uuid": "1640396c-4db8-43d3-9205-5b0c75fde4b9", "comment": "Malware payload (Stealc)", "value": "a1c7172671d0a3c5a5b61024a0570071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700953209, "uuid": "6fc54c4f-a624-472d-8202-2c8574cfa03d", "comment": "Malware payload (Stealc)", "value": "fc640eccc218468f096e9d977b7d2c94bf56877089b64d4f3f56ed894dda0cdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700953209, "uuid": "c4ced5c3-f5c7-4b24-858d-7ff27f4bb463", "comment": "Malware payload (Stealc)", "value": "b51e9948a79b45e864f25aa5040b4f56266b7041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700953209, "uuid": "c7897c8e-3074-4f49-902e-be0b2252e274", "comment": "Malware payload (Stealc)", "value": "d996c687e3c6a1c0b2e4970a323f910da278d91e6330bce51fe1a101584f5a12cd0f275e1e6f77121b1585527a243210", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700953209, "uuid": "c000bcde-ff12-4b6b-a67d-1614fe5a2cae", "value": "T10F74B50392F13E44E9268B729F1FC6EC7B5DF6508E497BA932199E2F14B0272D263750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700953209, "uuid": "5b144be5-d9df-43d8-aaa9-24ee1e6f3ca4", "value": "4c459b08e177ae567cc13290dc63378b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700953209, "uuid": "12ce0d35-6e8c-4243-baa5-b6bc08d3f30b", "value": "3072:5q2t4keCJ0cE+Sx9QZOwLwENTpdFB5NChRuO71vP5wSf5XyBk3eFx/RKgB:oY4keIjg8wgNdF4W0aScj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700953209, "uuid": "893bbf36-c482-40d3-adfe-3677d2677182", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700953209, "uuid": "7de97125-1e58-4d5f-9990-77063dfe3b0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700953209, "uuid": "c00f7aee-e63c-45f4-abe9-ba12a97631b3", "value": "a1c7172671d0a3c5a5b61024a0570071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b5e449-8b55-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1700890806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700890806, "uuid": "c8f32227-48dd-449c-abe3-6f0474b33e4f", "comment": "Malware payload (njrat)", "value": "075e49ee69a826d394bc2a5844d27a12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700890806, "uuid": "54b3970f-0937-463b-8dac-236c58c55530", "comment": "Malware payload (njrat)", "value": "fd0026d4c45a28a6a810b3c8fe9b9f0e5929a52144088398c7994dc7ae40807a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700890806, "uuid": "927606be-994e-4a55-bd39-9b5935048f3f", "comment": "Malware payload (njrat)", "value": "b4d86cb80270c5644365b501e214828cd84a26d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700890806, "uuid": "355f75ec-0da9-4b65-b768-70a1e587a76a", "comment": "Malware payload (njrat)", "value": "e125c2dae470e00042dedf5779f56b430ab353816c5123da8483946ce3f5fabc5c1bd9cd93a99ac68a3f1e6b737b8c7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700890806, "uuid": "40a8a924-b4d6-427f-bfce-3026fa240d80", "value": "T12E26331736B88562D176D7B106F140E32836FA612F79C1EF53DEA8291D133A46A32F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700890806, "uuid": "7d85576e-dda9-4f35-b929-bceb64372f21", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700890806, "uuid": "607bb9bd-1966-407c-86df-dcc3394fbb02", "value": "98304:RH0aix0hofBIJA91WExIRxar9cNqqCNtpa:RHvW0DAfWSIY+rCNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700890806, "uuid": "7ef22044-c47a-40d6-87ed-56020314cb23", "value": 4820992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700890806, "uuid": "9b921f1f-2810-47a9-8e6b-6033a1379b4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700890806, "uuid": "913235e3-136b-474b-9ef5-c2b7c64c2d28", "value": "075e49ee69a826d394bc2a5844d27a12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c046d9-8b45-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700884208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700884208, "uuid": "1ee8b596-8743-49c2-aada-c91c5107eb40", "comment": "Malware payload (Mirai)", "value": "7b80cc56b6539a3d1008f33448ed0638", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700884208, "uuid": "3650b502-e4d4-482a-9b80-451e34144001", "comment": "Malware payload (Mirai)", "value": "fd9907bc40df5f29882708435011cebfa34d7f830290ae00f8abc0f16502c474", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700884208, "uuid": "7f9f21af-5526-41b0-9506-a5e4016453ed", "comment": "Malware payload (Mirai)", "value": "f96d12495e7d1616087c55cbbee58eefe9fd8df1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700884208, "uuid": "d5e115c4-d5c7-42ab-a57c-b7c2335d9c89", "comment": "Malware payload (Mirai)", "value": "69c26b7f941d9886469f55f48ed5a2201510cebad246a38791340b2215c05b806e4633c907d679ace0ff970105c48187", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700884208, "uuid": "a3548a24-a35d-402b-8258-5a66c97db01c", "value": "T10FD2D17096D928B6C25006B2E67867C4BE074F7CFAFE2C5011048BBB7941D4539DD9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700884208, "uuid": "c571f297-9bcf-4908-aa66-d9b299c1726f", "value": "384:gSt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE33OTmdGU5eT6Nuk:gSsoTAZ3alkXLvFh8nNE3+T3UQe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700884208, "uuid": "aad524ec-1ca5-4ba1-a4e3-975388907b60", "value": 28312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700884208, "uuid": "f1af8dd4-c296-4ed4-b807-9ce270e2a56d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700884208, "uuid": "17d4760e-ed84-4575-a5f4-d2299669fee6", "value": "syms.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }