{ "Event": { "published": true, "date": "2024-01-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-01-12", "timestamp": 1705104181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4b02b48f-ef78-4fce-a2ec-58caefbb78db", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0bdfc5a-b14a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1705064457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064457, "uuid": "79fb1c1d-2f8c-451b-bd36-1d3d74d99d8b", "comment": "Malware payload (CoinMiner)", "value": "bc23098ad63a24de76298c05572af578", "object_relation": "md5", "Tag": [ { "name": "arm8", "colour": "#E274BC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064457, "uuid": "9e9dd3d7-c965-4ada-a245-1bd76feb4692", "comment": "Malware payload (CoinMiner)", "value": "0046342a57cfdc865eacd99b3fa62d4f6365ddc3392677b730f96eadb0a497e6", "object_relation": "sha256", "Tag": [ { "name": "arm8", "colour": "#E274BC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064457, "uuid": "5c9874d8-f887-4101-8585-cd9c9db5a6af", "comment": "Malware payload (CoinMiner)", "value": "5db7bc0fbf4df3c3c7a59b3a43ff12aca7a05dcd", "object_relation": "sha1", "Tag": [ { "name": "arm8", "colour": "#E274BC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064457, "uuid": "ef32ec2d-e99e-4d35-b2d9-1662ade52cc1", "comment": "Malware payload (CoinMiner)", "value": "8e36b11dc1456a9d76e3c58863ec3d2fa6deb953fa995dc43cd0a56a5cccdeecced16865ddd1fb551f0399cce940f285", "object_relation": "sha3-384", "Tag": [ { "name": "arm8", "colour": "#E274BC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064457, "uuid": "dae45422-ac20-44df-a01e-975527695391", "value": "T1BB753325AECA9662F89E0C31F1D436072E1A75E5DD31397F20A593B6B84A60F109FDC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064457, "uuid": "48f1136e-f6ac-4b20-9bb6-645355bc57ce", "value": "49152:dzoMJ5oSG4W/Xj1s6ejKEvq3LVLBqjOCV1SXNWW:GMH/W/Xj1wjy7VLBqjOm1Sd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705064457, "uuid": "e2eaabf7-97eb-4b7a-9cb0-a98e5150955c", "value": 1586712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705064457, "uuid": "81c322b4-6b49-4c2c-93b7-5571fc7b6bc2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064457, "uuid": "c3099862-8bda-4ce7-8eb2-af5aae65b5b3", "value": "redtail.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8b2409-b149-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705063994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063994, "uuid": "f9b865db-84da-499c-8bd0-5171b56493df", "comment": "Malware payload (AgentTesla)", "value": "d27c90a847b226711e92abdbe00a8caa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063994, "uuid": "06e8c190-89d3-4e64-afea-6d9af1012384", "comment": "Malware payload (AgentTesla)", "value": "009c7f2dc41140abf1c9f318059a101118bb134fc16da828dbf436babe35d31f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063994, "uuid": "aa20776b-eec1-40f5-a044-82adbdf1b2f9", "comment": "Malware payload (AgentTesla)", "value": "8a7b9d16ab163abda62135ad15f66596be0028b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063994, "uuid": "6cbe1c15-53a3-49f7-b25e-94b232d1b7c9", "comment": "Malware payload (AgentTesla)", "value": "a6f6db89231526ec4ce832fb3c3a2a7f527deaadda5c64c84b89649c30a8751ffd2528726f1848933d4f77fea167baff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063994, "uuid": "218df9fc-22d5-40a1-b606-294c263fd403", "value": "T177841218B12AD23BD85F43750EE0508B5B2DFC61FF887187346AF39D5839B94A605F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063994, "uuid": "c27ec932-c68c-475e-936f-59e4fe11cd1e", "value": "6144:N1cBC6QREcis2JS5JACg1gG30q4SXR1zifiCwpCAkL3XgUhoBl9M666z/:NmBC6uEHsu8JAC4g0dTPMrXgUhqPMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705063994, "uuid": "888924db-cf7f-4f40-861c-9756cc722612", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705063994, "uuid": "fdaff85e-19ad-425f-bce2-6e28e85ae6bb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063994, "uuid": "df24ff14-9c15-490d-9de1-44f5c4b4e4b2", "value": "Recibo de env\u00edo de DHL_Gu\u00eda de embarque Doc_PRG211003417156060.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ae36d7-b0e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705020310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020310, "uuid": "cc0e0ac6-4d16-4be0-99df-77aed555f200", "comment": "Malware payload (RiseProStealer)", "value": "41f1e7b1995f2d46803b550ee31774a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020310, "uuid": "91edfd2c-6069-4be9-b922-e82c80b8d4e3", "comment": "Malware payload (RiseProStealer)", "value": "00ca497ab0c4a5512a229bc533d71354bf2ef6736154b7f80a631bf50a353ef6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020310, "uuid": "bbc39f4f-b9df-4298-b201-c3d0032cff83", "comment": "Malware payload (RiseProStealer)", "value": "19e48e8492709867152759b97a980bc2a8e019f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020310, "uuid": "85f0e3f6-d563-4132-8937-74aebb4f91b1", "comment": "Malware payload (RiseProStealer)", "value": "741e4d4ce59a5fccbcca7f8c59eba997175c2e0a7070f462cc5effdfe282f48aee04ca6e75adb33833f61df651aa0325", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020310, "uuid": "347c142a-1a7f-45a1-9073-71f9164c3c73", "value": "T136E5330BB2D495B4D8F5777111F14BC30A38FE93671E532A82CCAA5B1CB266DA035B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020310, "uuid": "e440d210-9d87-400c-86a7-fc8b07611e95", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020310, "uuid": "7895f349-c58e-43c8-9e8d-052a6f4bd3e7", "value": "49152:gKAV7NcCRd0Qb+qOTHq4Nh/F2efIHiz6Ti8Mt+A2Hon6dwFPerT+Y:AhuNQGDNNht2T7m6dmPCT+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705020310, "uuid": "9d68f02e-69fb-4df0-9c63-853be9d68b0e", "value": 3063808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705020310, "uuid": "97285bea-0e6a-4603-90d9-e95584abe40d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020310, "uuid": "f7f41c5a-5129-4dfe-8a4f-cacb602a902e", "value": "WX2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a89038-b16d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705079464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079464, "uuid": "11a04880-c1bb-435a-a3d8-791bf87683b9", "comment": "Malware payload (Mirai)", "value": "c23abbab5a59ff505d8537e4554c31aa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079464, "uuid": "10867b80-2770-4487-aff6-9a29587b376b", "comment": "Malware payload (Mirai)", "value": "02268aff2d4d3677684c804db674bb28921fe71d0286397454d9006cd3ab34b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079464, "uuid": "3f5a6227-5cba-4cc5-9a69-639b8084c46c", "comment": "Malware payload (Mirai)", "value": "32d5e3350237f01d6c752bb9c9e692eca6fa4fe1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079464, "uuid": "37db2db1-186d-45b4-937d-e35256b822f6", "comment": "Malware payload (Mirai)", "value": "5a64b56edbb202d005d9f8cb59a553e8552f9f1476d8a91ecf5ae60613b2e367a6c96f7ed50084ce9050e5f6276b0267", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079464, "uuid": "cae844b7-a293-453d-845d-7e6135e44eca", "value": "T159142A45EA418B13C0D727B9F6DF42463323AB94D3EB730695286FB43F8679A4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079464, "uuid": "48a7463b-298b-4f23-88f8-8e05c8c7f609", "value": "6144:6yRB6fkq3aKdNKEYES99ZS/3HeFM/R8MN:6yCkq3aKdNKEYFZS/eO/aMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705079464, "uuid": "b7eb351c-62e7-40e7-ad21-523114cb24ce", "value": 202814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705079464, "uuid": "16b5e372-879d-4e4b-8875-f99f3c966fea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079464, "uuid": "6375ae3b-b0e4-4cea-a0d3-aaf2c0a9dfee", "value": "skyljne.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837dcd3b-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705065267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065267, "uuid": "92107f23-61fe-4d27-b37f-9b349c112bd1", "comment": "Malware payload (AgentTesla)", "value": "c1c23ca20799388647ca8e51fcd46346", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065267, "uuid": "19c87cb9-663d-446d-a1f2-e4b6d95d6e62", "comment": "Malware payload (AgentTesla)", "value": "02627926659db4d45ce8b82aa90ee2ff84681c9bd55d2e0a2f7b457d68d8349d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065267, "uuid": "28a6f1bb-5e48-4249-912d-88d789ff7d5d", "comment": "Malware payload (AgentTesla)", "value": "8eac2fd7d78a7393fc59c6fea9cd5488c8a02ccc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065267, "uuid": "e2e4a33b-6d14-49a3-ae3d-e341078cb049", "comment": "Malware payload (AgentTesla)", "value": "a16d49d32a32c6bef1e92ac5f9b06c45a2c6cd5a59698176ec71078b60b12b7591f4c979f5c40df552fae80f0b6716a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065267, "uuid": "55e4f3eb-a082-40ce-9ec0-e9f38c8588dc", "value": "T19F93E560CDC716394A06379BAF034421CFBBE52942B580DCA89957FE31339EC877B669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065267, "uuid": "1d29a626-2d6a-42b6-8770-fd960844ca89", "value": "1536:EnDzyo3Ojgj8TABMzQjjQH6CnBvN4+ozQK0ul5xKi:ODumYgAT50jMacBvN4+ozQKzl5xKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065267, "uuid": "61a7779d-a4a7-47b0-8f4e-a470e7a49416", "value": 91951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065267, "uuid": "d64af468-af19-4637-a649-30ff62522ce3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065267, "uuid": "09934689-cc15-4aef-b412-065314bde344", "value": "Pedido de cota\u00e7\u00e3o -Lista de materiais_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "576eec37-b0e4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705020526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020526, "uuid": "10dc0843-febd-41da-997a-bfb125fcb5b8", "comment": "Malware payload", "value": "5272daca12ee17be3edded2adee88485", "object_relation": "md5", "Tag": [ { "name": "139-99-114-151--file", "colour": "#E1D69B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020526, "uuid": "2d625a03-1110-48fb-a085-3f38ac1de2cf", "comment": "Malware payload", "value": "05386f3b8d8c87bf3609a65d5306483f65529ed355aedc2c62d52847dd12ec6e", "object_relation": "sha256", "Tag": [ { "name": "139-99-114-151--file", "colour": "#E1D69B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020526, "uuid": "2655aa96-39db-4ca6-ad1d-a79a46fb7bed", "comment": "Malware payload", "value": "93bf1438f000088a0f101da4fc216f2fd5bb95f6", "object_relation": "sha1", "Tag": [ { "name": "139-99-114-151--file", "colour": "#E1D69B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020526, "uuid": "1b959060-4334-4e78-a662-f249430c9836", "comment": "Malware payload", "value": "62ca27b86b26bc6a3189046ff9716c3c6221dd5498a7979afc4887f8cad91970635dcdd4cdfd1fb637685f836d2a8368", "object_relation": "sha3-384", "Tag": [ { "name": "139-99-114-151--file", "colour": "#E1D69B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020526, "uuid": "58ddc05d-8794-49dc-b52a-47bef87fc3c1", "value": "T1AA07333DB0BE947DCC638975998FBFF2B23DB8668E28D073429C25D4E2917A146213D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020526, "uuid": "4821e55e-d67f-4fb5-86bf-3bd875ed7819", "value": "a7b0793ae6dd3f16ef244d19e4de0c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020526, "uuid": "0feb195b-090c-4432-961d-01d6ad90c74a", "value": "393216:wFwD1VLhgk+QfTCZas/c8V8SKbv4Hya5cY:wCt+kYtwQSamY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705020526, "uuid": "cae8c0c2-eb52-4588-9fe9-051215039f4b", "value": 17969664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705020526, "uuid": "7f443ba7-8eb0-424c-ad6b-530aa9a9bffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020526, "uuid": "135a6700-2867-45c9-93f1-6d9cebafa067", "value": "explorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95527b4d-b149-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705064009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064009, "uuid": "e725d323-04a3-4415-aba8-a60956810f9f", "comment": "Malware payload (Formbook)", "value": "34f51a5d469aac18095bc281a2fb1a2b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064009, "uuid": "8ca7af7d-be30-4fa1-9c40-cb27e1cfa35f", "comment": "Malware payload (Formbook)", "value": "05c081f975c82f8a51774b2a4a0472bb3a212abace29ce28b78b85c69eb915a6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064009, "uuid": "065bd42f-f234-4959-81e7-78be9dab6671", "comment": "Malware payload (Formbook)", "value": "1c4318975eabb24dca3fcea15898d78b8413df32", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064009, "uuid": "2893d942-8dac-4726-aa66-6f91dc2b6ff5", "comment": "Malware payload (Formbook)", "value": "86735ebe1a41b8841c223ba44ccb30cc73f04cb1d515c69f528bc4b4a7941d167c1a5fd90dc8493883e8b9adf5931471", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064009, "uuid": "8e7f533c-c1b0-4f60-8b5b-a8ae4d7237af", "value": "T1B9841224BA19D27BD51743714DDC408B1A2DFC22FF98955B3036BB896C3EF68A92124E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064009, "uuid": "e2f6a9c6-a007-41b6-abc6-b8ba79305f93", "value": "6144:A0cBC6QREcis2JS5JA8g1gG30q4SXR1VE+UXx2IQQvaO2EYcWi4:ArBC6uEHsu8JA84g0d1cxb3nWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705064009, "uuid": "9b00735b-8fc6-4834-bc4f-c467aa4cdfc5", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705064009, "uuid": "34956db0-77a6-447e-a0c0-e0f0a92e27db", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064009, "uuid": "6791fe0e-da0d-498b-96be-62e6180802b5", "value": "PO-288424.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49d0354-b198-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705098072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705098072, "uuid": "f4c1f2e4-e7ca-41e1-bdc8-d8cf0e11fa55", "comment": "Malware payload", "value": "086861b22c764a38a18ce084f47b8447", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705098072, "uuid": "810d3523-7a8b-485d-a47e-27dc5757a145", "comment": "Malware payload", "value": "070e800de6c83d551f92272fbe848fc5e66ba5865521131eea114fe330f8f0fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705098072, "uuid": "d92f8cab-88eb-47dc-b109-1129195a38fa", "comment": "Malware payload", "value": "22b3bc521428f19a747a0c793e0f8bb7069c919f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705098072, "uuid": "b59da5fd-1294-40ec-9dbe-d6903e882d82", "comment": "Malware payload", "value": "8b21d7e03674070a30f7346b44a1a988e8984ae42571569d692da2cd1d5958813f1682d64da10df4e98ebaba6a9fcb72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705098072, "uuid": "940fefbd-5ce1-43b6-89b2-3175c685dae9", "value": "T1F19523F83AF8544DC1D4A7F517BA849402E18DD0DF059EFAD8E7694A33879C11F2A88B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705098072, "uuid": "fa392740-027e-446c-81b0-e95d84317a63", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705098072, "uuid": "407f7c62-8b5d-42a6-9854-a0162ebdaae6", "value": "24576:Rdn9NWaBzaKXxQzgNVKbMVWG98H6ZJuFbGx3hakAo4Jw3NgCibUi5eskzNW/5uQp:TjWKZX2zgNVuTuJuo3hMw9sbUbskzNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705098072, "uuid": "17373f02-23e5-444a-9278-a3af08271008", "value": 1876480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705098072, "uuid": "e5f5a146-b78a-47cd-bec4-e9df1f877894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705098072, "uuid": "d0fa8adf-2088-4e5c-8dbb-20c09f812a71", "value": "SecuriteInfo.com.Win32.TrojanX-gen.7471.27163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deae2b19-b168-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1705077446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705077446, "uuid": "1292ca97-1e90-4d0c-ae72-c3c411fc340a", "comment": "Malware payload (BlankGrabber)", "value": "445021eca48d79fc2bfb5e03baa0eb85", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705077446, "uuid": "8bbec691-0037-43fb-a55a-b510e6678dd1", "comment": "Malware payload (BlankGrabber)", "value": "07b287f1869f3d49a2cc13efbf581cc5c1f640aa64aac4877ee7ac40f971201c", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705077446, "uuid": "cc9b87a4-ceea-45f5-a5c1-ade5d57a8729", "comment": "Malware payload (BlankGrabber)", "value": "42bdde81ec4a9d517ad5bc836a9cdb5cb08bebf7", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705077446, "uuid": "93f0fd2c-e395-4004-8fe1-579913f32604", "comment": "Malware payload (BlankGrabber)", "value": "eb9d7ac1c825177d07b8ef5e46dc27a8b2c002d67030373773f53cbfc70967adb829074226f8d4c246270796c864ee4c", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705077446, "uuid": "51646bc3-b4b0-4e99-bf57-d6c3c687ad7e", "value": "T1C0763310B3A85CE6F9519639C586C622DB333A5123A0D5CF07A847B35F172AD8C3AF5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705077446, "uuid": "c1881d83-b84e-4c89-8a0a-a5b312bfc25e", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705077446, "uuid": "e55f9574-5d04-41bf-8a23-89bb92646030", "value": "196608:6pYS6WOshoKMuIkhVastRL5Di3u41D7dJy:gYSJOshouIkPftRL54VRDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705077446, "uuid": "60c5783b-59cf-4769-81d8-2a9516c54b4f", "value": 7682202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705077446, "uuid": "d997bb47-4177-4d22-ac74-22d57e414520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705077446, "uuid": "5a93acae-45fd-4733-a09f-f31677864bc8", "value": "Agonied_Grabber_V2.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75723028-b10a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705036897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036897, "uuid": "e9893e68-8df4-4d32-8c92-97f5496eeb18", "comment": "Malware payload (RedLineStealer)", "value": "83f286344dbf13539b525954bbc7b525", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036897, "uuid": "af16b1d1-44dc-4d51-9bc8-ac11594474a9", "comment": "Malware payload (RedLineStealer)", "value": "07b5d39b67400f7b7b3ccee2ecf254cbe564880677f14172a39255d3d5cbf4af", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036897, "uuid": "49cfada1-16df-4684-ac36-cc4290891426", "comment": "Malware payload (RedLineStealer)", "value": "835c53333b289f438a0be2274c39ff5d07a40f1b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036897, "uuid": "e9683cd1-8b5f-4509-92fc-ac3b82f94825", "comment": "Malware payload (RedLineStealer)", "value": "86e283aa0d3c2b969c6dc597c8af56adbcc5725689eb5b35797eec87bb5582747a8ed986cb8705ec8ea12a7b25ea4482", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036897, "uuid": "e00ed866-3202-4758-8d52-25e9dcc37030", "value": "T1D1F34A186798C932F67E03B6E1F1628AC774E013F146E36B5ED518F52D12794AB022FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036897, "uuid": "d98f45f1-8fca-47a9-a38a-865fe1ba2e46", "value": "3072:22JLXfYoQk+nJLMbI7NKeiZixKMD4UydbXcnDaAxKR5AgkC:7NbIEn1bMZxKPAXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705036897, "uuid": "d3a18b6f-da88-488a-b960-3f71cbc077a4", "value": 169724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705036897, "uuid": "88dce965-2dc6-4be4-a273-4ff80ad87be1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036897, "uuid": "fa330320-1566-41ae-b6dd-498efad56e78", "value": "myexec64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a776450-b149-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705063990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063990, "uuid": "5646589a-5da6-43fc-abc8-0fa772187fda", "comment": "Malware payload (AgentTesla)", "value": "d9fafef123248489ca3fdf5eea3d645f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063990, "uuid": "4801eae3-3008-4b60-adc0-32daeaaa3f06", "comment": "Malware payload (AgentTesla)", "value": "08d9ecad2833cbb7c9b45b3d355ffd4cf5228685c33658d6ed5d547a91cf964d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063990, "uuid": "eda545b1-d1d3-460f-a383-a574383d1baf", "comment": "Malware payload (AgentTesla)", "value": "38ccf5ffa352f372b2b275b7cdf947b83499f887", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063990, "uuid": "2a9b46ef-f4e2-41aa-8568-f34d8f595ab8", "comment": "Malware payload (AgentTesla)", "value": "3ac5a34483de1c0e41364f0ad5e9b325a431da252c798febd9ca8d33609435ffed5cee245e302571238f963ca1457300", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063990, "uuid": "487a680d-7a73-4a8d-a57e-447467d429a2", "value": "T110F3796DD34B02698F625336AB1B1E5542BDBA7EF34052B1306C437933EEC39A1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063990, "uuid": "fceb8b6e-d693-4bbf-b8db-59b230c019a8", "value": "768:+wAbZSibMX9gRWjtwAbZSibMX9gRWjWsEYLVSnP1EJ+seK0Obj/Ll:+wAlRkwAlRbs5iseDSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705063990, "uuid": "75cedc74-d4f9-4cae-8943-24014683204e", "value": 162048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705063990, "uuid": "e610c6b3-82a3-4ac4-b755-0300480b89b2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063990, "uuid": "5b2d4fb2-69b4-4806-817b-272693f287e9", "value": "SD8319778482.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02252ce-b101-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705033130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705033130, "uuid": "f4228dba-627f-4de0-ac03-2db90b3a8fda", "comment": "Malware payload", "value": "8d29b1bff674ae48a7b54dec9aaae08f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705033130, "uuid": "8a897751-8b23-43b1-9618-48b2757dd688", "comment": "Malware payload", "value": "0b598088d167fb7164ac44ff6ec04bc8d4ef8b7299502db3120ebb1e1e9440b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705033130, "uuid": "6ee50a24-dcd6-4cc5-8de9-268abf795ef7", "comment": "Malware payload", "value": "19172eec5eee11a0556481d1ab97427ddf3aa898", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705033130, "uuid": "c01f1eb0-b6b5-4897-ba7f-dec8c8e1f22e", "comment": "Malware payload", "value": "07dcef39fe6ff8dae6616fb7bc436e38d73168f12968b383c66b2853637d857f2899f455fdbaf279f9a595ae2876e762", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705033130, "uuid": "0af7d07e-f195-44b4-b472-f8350970945f", "value": "T1831301780A123527EB34FD71FE9A12CB11E41D83DD6B798362CC9BE8D1EA2930518DB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705033130, "uuid": "e0a52ea4-87d5-46a2-b2c1-ce4ba54ba178", "value": "768:sDyvJhGPRfKjKaPkbhRKZJ2RIS+YB4VHaRsfYHL6SlNAxSl7KDPSNYSkg5QfaAVp:sDyfGPNM8bhUe+8KHa7WwWsFKrUBAQRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705033130, "uuid": "c50612b1-756f-4c28-a303-7ff08eb594b2", "value": 43688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705033130, "uuid": "af1f8232-0f02-464f-908c-8ad30f307f64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705033130, "uuid": "e2631876-130c-4e96-8819-ecad7d8ca829", "value": "SecuriteInfo.com.Other.Malware-gen.28959.13374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dfad641-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (StormKitty)", "timestamp": 1705065231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065231, "uuid": "0f7778b5-1dff-4bad-a0b0-d0dccae17278", "comment": "Malware payload (StormKitty)", "value": "901065aafa6934c9ef544f46a78f2832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065231, "uuid": "48c11798-3a63-45f0-8823-95e9e103280f", "comment": "Malware payload (StormKitty)", "value": "0c482a3a2510cf8f323c5c4d9097850be9e77f09cf163b1de2c2220cfad3beb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065231, "uuid": "729dbf57-e3fa-43b0-8fc3-c64bd4fd5f10", "comment": "Malware payload (StormKitty)", "value": "7e190c3185d1be75d7d09b76076f912fd19118a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065231, "uuid": "d59f063c-8a22-43ef-af4e-bf03fa6ab2be", "comment": "Malware payload (StormKitty)", "value": "29034adc7582d7fff99940496ec5a4e99954e5e518d26981a24f43880fadef97b246ce94bf041144d81f33a346ecd50a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065231, "uuid": "e4650049-29ce-4109-904a-6b0bec2f5861", "value": "T1EC46AE15B7D505D8E87BC630CA2A8732E6B1B8590735838F0538D35B1E37B958F7B22A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065231, "uuid": "c3453e19-24b0-429e-b0f5-a055d02a2472", "value": "0751433fb799ff99dbf59b2d0c85d83d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065231, "uuid": "9946abff-02de-4543-a4b1-f02d82b878f0", "value": "49152:VbpDdWsKJkV1gzdCQXXxmcQsDhKmuFo/4gqvYEyOezjC89i9ruA0iHxtVXrOx+al:y4kpqvYEyFFA0A5Xax/88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065231, "uuid": "a74a6787-9a32-4353-8a17-ce07bc0fa6b6", "value": 5529088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065231, "uuid": "a80f2d3f-debc-4340-9a53-e44cf35ba65e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065231, "uuid": "9d861e9c-ff86-44de-b576-40f13cc190fd", "value": "PAYMENT-COPYao\ufeffs\ufeffi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700af7dd-b1a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705101312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705101312, "uuid": "ec28e0ef-7e06-4226-a108-0cf3f5189913", "comment": "Malware payload", "value": "3b0f77aee543e7376c23c920ecf6f5c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705101312, "uuid": "633d569e-ae52-4778-8257-d9aeb7b27179", "comment": "Malware payload", "value": "0c77140267d3698f825ef41a02a49a8593bd5df4db00c1bdbe0fcc15bfee3df5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705101312, "uuid": "c44e4ab3-7b1e-47bd-b5c0-be68028020e6", "comment": "Malware payload", "value": "06e178bfa3d349e955c2a65f1ed40ebda56da96b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705101312, "uuid": "387ec433-3322-41b8-8910-7d9a552fa91d", "comment": "Malware payload", "value": "e09534d831cbf8c886f9f9b5348c2d57ee79119c3419a8f277a9910d1cc1981fdd8499b21542712e168dedea530a47d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705101312, "uuid": "0a34c1ef-0803-4455-875b-78a071ba1b6f", "value": "T1289523FA7BF8098EC8C44FF04372A66662D43DC6CF455DE6D5B71A1A33176C0AA8604B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705101312, "uuid": "70912387-5b35-46dc-951f-cbef10066a3f", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705101312, "uuid": "5755d7b3-385e-4894-ae88-ffc151a57e7b", "value": "49152:FfHlEif0i720HFA20mNQayp4DqtdDYwGEbHghMi:Fvl7fK0HR0GQLGE7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705101312, "uuid": "c454ddf9-9fd0-463b-b652-b439e119d597", "value": 1876992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705101312, "uuid": "56cb671b-e827-4e8a-b6d7-f7217adc1840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705101312, "uuid": "baab4d5d-b3ba-4b36-b822-5e2e99615d26", "value": "SecuriteInfo.com.Win32.TrojanX-gen.9126.10490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5df1e5-b100-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705032483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032483, "uuid": "80b8373d-5967-49f9-80f2-479257dd64c7", "comment": "Malware payload (Mirai)", "value": "65c2e1c2c86710bb0b8c56e104aecd15", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032483, "uuid": "ae7bc7d7-a0a3-45fc-a15f-95446bda3fbd", "comment": "Malware payload (Mirai)", "value": "0d906c688218ee0a23bfc6974eb6005991634dcd38c7f491a4f4dbeda43da71d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032483, "uuid": "e594c689-1cc4-4cc0-94af-482b78810263", "comment": "Malware payload (Mirai)", "value": "403fc28aadb545308a3ae7ba242f92e726955922", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032483, "uuid": "f982cd32-c216-4648-a57b-232b1de53701", "comment": "Malware payload (Mirai)", "value": "05c905d5daacc32018f1856a59983b13fecf6e3391df63f22fd02d4fd2f08d0009bce391b38044a2c82a8aeca041b4fb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032483, "uuid": "059e2d09-5138-4d7d-8798-92a4268fc2b7", "value": "T12F83970A6E219FBCFBAC863447B38F21975823D627E1D685D15CE6012E7034E641FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032483, "uuid": "372037d0-189d-4e4c-8360-10b7fe60e3d8", "value": "1536:kuME36xlfx7YWOe+9t3qsDFXUusHvT1laedNMe:Df3olpOt3dFXUusHvT1lRMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705032483, "uuid": "5a8590a4-fae5-4507-9270-c9322554326f", "value": 85584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705032483, "uuid": "41a6f903-65c6-4086-8f4c-e6c99737670d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032483, "uuid": "a76f40b5-fdaf-4532-aca3-ac1333af83bc", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e041caed-b12b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705051249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705051249, "uuid": "fd459d39-51fa-489c-84b6-2053b5ccf25d", "comment": "Malware payload", "value": "3b09033a5cb7c3eff545b9c961682643", "object_relation": "md5", "Tag": [ { "name": "139-99-114-151--file", "colour": "#E1D69B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705051249, "uuid": "8a7becfc-5c8c-4bf4-b30f-ec4199f285a2", "comment": "Malware payload", "value": "0e000ef1e6b003ab317f5db358215eba1111fbe1ce90e911c85595dee3b682b1", "object_relation": "sha256", "Tag": [ { "name": "139-99-114-151--file", "colour": "#E1D69B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705051249, "uuid": "758db779-3a07-4a21-87a8-fdb113610bed", "comment": "Malware payload", "value": "773123ea8426e29292c9415b16af5ba6b132f4db", "object_relation": "sha1", "Tag": [ { "name": "139-99-114-151--file", "colour": "#E1D69B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705051249, "uuid": "2e0cda0c-ed20-4479-9a70-6d56f1340c03", "comment": "Malware payload", "value": "6454ec55f0dd18783c34bd834d6d5cf80a18dbaf75f2ad278e8886db279687fc96145f88476bb4bdc6f4443dda7c72c4", "object_relation": "sha3-384", "Tag": [ { "name": "139-99-114-151--file", "colour": "#E1D69B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705051249, "uuid": "9c7cb493-13e3-491d-8d77-64772dcf8a8c", "value": "T19A526721AE9C3D4FECD9E17B9A375A750CBE0888006A554B53D876CC3DCAC04D6A1B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705051249, "uuid": "99ee5438-3b9d-471c-8c7e-2cfec04b0d07", "value": "192:uVG45vGsss4hSnmA0KCDP4JQxWGPl79621D:UGyvXt4hSnmAYz4JQLt7962R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705051249, "uuid": "66602162-ebae-46ea-a39f-9ea48d5e618a", "value": 13341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705051249, "uuid": "b79d7b55-a577-476d-9b71-a8bcc220b5ee", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705051249, "uuid": "e85824bf-fc62-41c3-8074-80b9e11dde0a", "value": "hh.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36754b83-b16f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705080170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705080170, "uuid": "de6fbb92-fbc8-437a-a15d-5373a1a95ca2", "comment": "Malware payload (Mirai)", "value": "9e0ad1172ffb1d9a9024264a970d3573", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705080170, "uuid": "d8c7e469-d7db-4cf7-9b88-cfd8bf326b8f", "comment": "Malware payload (Mirai)", "value": "0e7d08b6fb10ab0cde7281fc25962710608a9fc1508c7e3593194d768e48331d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705080170, "uuid": "45c66f1c-cb06-4a76-bbe2-2dd4fba03211", "comment": "Malware payload (Mirai)", "value": "2a16a3fd375ca3795a617773407a18aaa0f33841", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705080170, "uuid": "27a93ce2-d1a8-4716-ada8-8538d752712a", "comment": "Malware payload (Mirai)", "value": "7fcfa639605f4d937f8f8faf21e041425d6ccc12d49184ba23d6e870142598905da982806a10ea1f2bbe8a91ecfcc0b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705080170, "uuid": "eed73ca5-216d-4df0-a129-c3e4172e9e9b", "value": "T1D4E33A02B31C0B07D1932EB43E3F6BD093AF9AD121E4F684655FAB8A9271D325546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705080170, "uuid": "1b307d0f-2997-47d1-9790-0ef3a89c4a0c", "value": "1536:XDs8NhE1FZaANrUY6DrxppvuR5ViwmbX4nFrwevAEWrEalvn8qEpW4YTOUIl1dTU:JE1jNWrxLG1YX6ruELYTBIpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705080170, "uuid": "d9a081c8-eba2-47c9-951f-90965ed36e54", "value": 152508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705080170, "uuid": "6c3f14a4-39be-4ce7-ae7b-a6e81b882b7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705080170, "uuid": "e4c28035-3aa1-40e4-af88-1c6aaa4ab17a", "value": "9e0ad1172ffb1d9a9024264a970d3573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c52d5aa-b11f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1705045901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045901, "uuid": "d1153b88-1d10-4bad-bfe1-a43b2a129593", "comment": "Malware payload (Gafgyt)", "value": "3c6b6f2e543fa224b3acaa95e0ed12b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045901, "uuid": "4b7395a3-944a-4838-ac89-f42212b71acc", "comment": "Malware payload (Gafgyt)", "value": "108615c0884401ca10eb2a9cf205766e2554e0001c7c67570e19d20254362bf8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045901, "uuid": "b3baec9c-d1b2-4d6a-b31f-f3a388c5e612", "comment": "Malware payload (Gafgyt)", "value": "5d3874d39e184cf3f5591af3a1403352acbe0e17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045901, "uuid": "aef0c676-4f92-449c-b57a-b10bbcdd5e99", "comment": "Malware payload (Gafgyt)", "value": "163c599f861636d3e6d19b80423b0ade5087adaaa7a0e4d07e1d47a17c3356ae683136f92b3ed00f5a6bae797cef7bd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045901, "uuid": "c8ac12a3-ed4d-4355-bd4a-95bfc37878d2", "value": "T18AB3942A3A22AFFFE16C86310BF35F7097D5219226A19385F26CD7581F6128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045901, "uuid": "ac2d688c-b4d2-46a6-8aa0-33b1c00a5741", "value": "1536:27j+1Tohq+XZ6NDmGf/Yo7exVXM5MNeUdPIUmkiIF8iCKrmne:hK4f/Yrc5MrPIUmkiIF8iPrmne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705045901, "uuid": "d3e3a161-1356-43e4-a348-15a9b57b3da3", "value": 108974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705045901, "uuid": "cfa82e6f-9692-4d2b-8757-7b8f3722dc4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045901, "uuid": "cc7c7ec9-9dfe-4d5c-8049-5b9508725c57", "value": "3c6b6f2e543fa224b3acaa95e0ed12b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763fe4ec-b11f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1705045918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045918, "uuid": "cf71db19-fd5e-4458-8e75-4e2f2bc1fccf", "comment": "Malware payload (Gafgyt)", "value": "502b54c443010dad9c1e8f916de7c790", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045918, "uuid": "c40feece-e515-4d8b-884f-fd32c0adc50a", "comment": "Malware payload (Gafgyt)", "value": "14b5be85dfdb18553e9bd92160a7107a89fb7df0dc8a8be450a29c3607d86ba9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045918, "uuid": "aab5694e-e55e-46bf-92af-d5fafe370420", "comment": "Malware payload (Gafgyt)", "value": "7c2b51cdd713f04c879b8c202f47d82adc1ee6f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045918, "uuid": "8871dd2e-71d6-4452-b669-fac046714fbb", "comment": "Malware payload (Gafgyt)", "value": "6f4d4eaf61128faa1cb32c1aec5b35ed08ed6d9b9f9875f5992f3555008a59d6560605b1dac065c6cd203518066afea0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045918, "uuid": "bca200c7-ed50-44eb-ad1d-4eb4d35e7cfa", "value": "T1BA831A41FD418727C2D337BAE7DF435D37356A54A7973301AA286EF42BC6BC91A2A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045918, "uuid": "c8fdc87c-20d2-4af0-abd6-5903e40035e2", "value": "1536:gIjDVhNQmvfzHfvfekyjGe66fxtOgy1ePPxoNemR2qQzK/2AKtIe:BjvfyklP6fmePPxPmR2qQzKOAKtIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705045918, "uuid": "6fe7d3f9-2fe1-440c-89b1-ed332859310c", "value": 88243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705045918, "uuid": "d7bcd673-2277-439e-a78a-d65e076647ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045918, "uuid": "56c3494b-71e3-45eb-9929-77472c0edee7", "value": "502b54c443010dad9c1e8f916de7c790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b19112d-b172-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1705081493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081493, "uuid": "686a6b2b-0a32-4a41-b264-0063fb315ff0", "comment": "Malware payload (zgRAT)", "value": "a69e9fba99f717cb811554e1985f45c2", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081493, "uuid": "d431cf0c-5ddb-43b4-9c7b-278224fff744", "comment": "Malware payload (zgRAT)", "value": "14b900286ac776a901ff3beb49507b83cb7902276d51c011360f837669ba7a66", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081493, "uuid": "20c8b6e3-bd2b-4b43-99b3-c78e8670ed81", "comment": "Malware payload (zgRAT)", "value": "f8057be04f9e0a00a53a6b5fc66e43345592668f", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081493, "uuid": "d0d54e70-09c4-43b5-bfa3-c803f167b76a", "comment": "Malware payload (zgRAT)", "value": "735ebbfeec0cffb5eeaca6286a2823e5384d54ea5d925cec6c09ac4a2768255f1b607a43f59bcc16c01c614d4d2664c4", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081493, "uuid": "d52a5b58-7e4a-4baa-9846-79ba4c78c729", "value": "T1AF666C07BA888E11D0696B37C5EB101443B5EAC26337D70F7ACA236915433EE5DCE6DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081493, "uuid": "d3f33d7e-0d70-4cea-b48b-62fa3d5433b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081493, "uuid": "da778a39-3595-4512-bc76-c9f3ab347c0e", "value": "98304:Du8DZiccE2uEwXDiPz9G2rYIDujbOW9acwIxcGieIxcGiP:D1mEUuWbQ2VOawgpGNpGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705081493, "uuid": "58c6f59c-de00-45ef-9bda-f8f6a963d5fb", "value": 6484296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705081493, "uuid": "48b1de99-c38f-4781-974d-775e23cc3439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081493, "uuid": "20770733-73f0-44c4-a59c-dd676f31e1c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f109fe4-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056616, "uuid": "4e39d694-de05-4930-8746-414972e979d2", "comment": "Malware payload (Smoke Loader)", "value": "6e8775e8089cba93802f59d506afa09a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056616, "uuid": "2a0fef9e-cab2-4b17-8d9d-b8585dcb9a33", "comment": "Malware payload (Smoke Loader)", "value": "14bf7a5b4420073171f0cb75ee7f7bbab035ec7a0695ff0f1493c1a648f29a5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056616, "uuid": "6a834ed6-8c40-4ddb-84ca-5becb8273564", "comment": "Malware payload (Smoke Loader)", "value": "2ab1e3ab1fd32770c5825a589bb7f849af31ba73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056616, "uuid": "3d1b4ecf-4cd4-4424-8954-55be9e06b420", "comment": "Malware payload (Smoke Loader)", "value": "4f4e2a56063b4ed58dab92a7a2b948f2b0f3927b5b12bce1cc69693021ceb35dba8b83a8723bb1057436ed4fd1569cf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056616, "uuid": "2423995b-ae2e-47a0-9b22-19013ecea027", "value": "T17B247C2175F58432F3F35A765670C3B04E3B78B76931AA8E1AC606B94F256D2CE2030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056616, "uuid": "6dedc1eb-44e0-41d6-80f1-d571c3ffb6cd", "value": "38fa8b403d6d5217cfc0f8fc65c9b6e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056616, "uuid": "483a57fb-9d41-4fa2-bad7-96d6d55510ef", "value": "3072:TI/htLJYeiJiiK8XBk//pIp7b2YBdmDkAw6xRJvBL2A:0TLJYeuByahb2Yy2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056616, "uuid": "70698dd3-5be1-4a5f-8cf9-210ea90d4ac9", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056616, "uuid": "22dcbccc-3953-4581-aebc-91c88c5fd157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056616, "uuid": "a5904202-ed14-48f4-8944-8fd5f704ee2b", "value": "6e8775e8089cba93802f59d506afa09a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1998c002-b13a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LockBit)", "timestamp": 1705057359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705057359, "uuid": "417492a8-48b9-4116-966d-d242f16ca779", "comment": "Malware payload (LockBit)", "value": "7a83a738db05418c0ae6795b317a45f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705057359, "uuid": "e9ebf3a8-8394-49fb-b19c-c219c99ba32a", "comment": "Malware payload (LockBit)", "value": "1520e4cb2748aa5725d8b6c242ff6cf365f6672db35df2745c920ed228666317", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705057359, "uuid": "6640c787-cbf1-48e5-9086-41760e08825d", "comment": "Malware payload (LockBit)", "value": "bbd1c1fe4a01b698963c28a2231c33d70338014c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705057359, "uuid": "dc372822-a835-4378-b275-3d06565a1e63", "comment": "Malware payload (LockBit)", "value": "86a931b021e55102170ebe3ae316b739a1575df81f153827d0c1f4c23972c8e2f751bc926f6075d0ab39481494106039", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705057359, "uuid": "fa7ce375-4f88-4db1-aea7-112241243caf", "value": "T10084AF1136F08132E6A35EB54924C3B04B7F7C626875555E2ACF1BB91F3A6D18A303AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705057359, "uuid": "80620b7b-2e82-46e5-bbce-692a440b0d67", "value": "41664c42ec8e82b6bc77023fb19fd70a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705057359, "uuid": "af0db216-ec73-40ae-acaf-3de00151dbec", "value": "6144:xgLn8r0KXqq+l8OUK06rIhRzQE+fTgYn79oUq:xggr0KXqrlhfuZP0n7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705057359, "uuid": "f64b6c56-ddca-4ea1-86f8-bf4d304b1b20", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705057359, "uuid": "2601f9b4-1d53-4b98-836b-59a4b792c290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705057359, "uuid": "2779a9fe-9287-4ca1-b430-9d2b83760890", "value": "7a83a738db05418c0ae6795b317a45f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287a424d-b100-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705032473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032473, "uuid": "29647215-d391-4c7e-afa8-53b051dccc28", "comment": "Malware payload (Mirai)", "value": "9bd4d36533d949356d3dd813c92624b7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032473, "uuid": "84e0eb9e-53ec-412b-aa7e-361d8c165949", "comment": "Malware payload (Mirai)", "value": "1580e549e2df14253e701b7f032623000d69e1c729614654d8d94f11dde8f40a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032473, "uuid": "be013585-f5bc-495b-9052-f5d80cac5c3f", "comment": "Malware payload (Mirai)", "value": "e5652bb81bf1e1043860608a52cdfbd8d2c7a3d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032473, "uuid": "588407c1-0ac9-4815-9995-788500d89600", "comment": "Malware payload (Mirai)", "value": "67ab4c0b878fab3e5a00160972259bcff782d532a23122a1b0d144296e51e2039b3fca2100f6063d7b02870ab1b16fd0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032473, "uuid": "12fb1870-94bd-4d90-a9c7-fcbb5b828ef8", "value": "T13E435CC19583E8F5EC160A752137EB738B76FD3A1028DA53C398A932AD41B02E5533EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032473, "uuid": "93417f4d-cbc1-4272-bc25-bc6f2cae76e0", "value": "1536:o77N1k4XrwOUXI5OUg0WDDr2bivdV3GLmW7jSMfCzW:U7XfXrwOUXI5OF0WL22vfS17tfCzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705032473, "uuid": "7a3c706a-2280-4e63-953e-3dc94239302e", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705032473, "uuid": "64a293b2-6b17-4afb-8d16-9dbcffaff880", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032473, "uuid": "b7ad1fe5-c48a-4723-99e4-5d8f1c4ddd73", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6355a3-b124-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705047913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705047913, "uuid": "9f2bff9d-8acf-41f7-94d0-28475d6c0477", "comment": "Malware payload (AgentTesla)", "value": "6230cac7f800eabe9b984bc6d57588e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705047913, "uuid": "cfaec5b4-e506-46f2-93d1-e911e5c90f58", "comment": "Malware payload (AgentTesla)", "value": "1657a01593f2f519b59e0b94007cf1909940ded07bb6022bf4f39be173a64b61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705047913, "uuid": "a91a6c6f-5edb-4e11-9510-1245d10271e3", "comment": "Malware payload (AgentTesla)", "value": "694794110b37c35a3611627782e58bd9cc75fee9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705047913, "uuid": "60c55914-de21-40d0-b1f6-2b47ed27022b", "comment": "Malware payload (AgentTesla)", "value": "232ed236067a5fb3096028bcecd72153a06c07d03e18f49520d02f1c00128c951d9f7ef8a44f2e9377a2a5bd916fcf95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705047913, "uuid": "81382e29-749b-484f-9b66-b86e14ec9dfc", "value": "T126E4D08963650A23C7A3B7749E7397020556F9B788A2D34753D5E43AB01B2BF1FE1B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705047913, "uuid": "e495e855-421b-462d-86fa-a0e87c4bb98a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705047913, "uuid": "cb2a257b-3d27-4f64-b14f-c4468346065b", "value": "12288:LF10iqqNOutncLrqBUHZmsfUJ5AVO21dsP2I/pGqSlgOceeUtdN:07IvcYUHZmsfUJLwm4XVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705047913, "uuid": "dff1cc00-3a45-4ca4-8b2f-0005d604e699", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705047913, "uuid": "55ab3f27-c554-4fa5-b038-b50baa29db75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705047913, "uuid": "679bee9e-5a0d-435f-8045-7c027bc4365f", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692ff746-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705065223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065223, "uuid": "d2f748a4-ce51-4530-be80-4bcd25a7a2a9", "comment": "Malware payload (AgentTesla)", "value": "f77774b71cabad6cca37da8bcc05b690", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065223, "uuid": "4024cab3-f86c-426e-a1fb-22412d573da3", "comment": "Malware payload (AgentTesla)", "value": "166b798b46ade1deb2065fdae79134537ca4eaa83ad3a4598878b07ac94c8861", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065223, "uuid": "c2718f5b-095b-4e35-bc98-c26180097a18", "comment": "Malware payload (AgentTesla)", "value": "0accc8a913fb5bcc7625f411137767b27e5a63b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065223, "uuid": "a5f75a5a-f4e5-461b-89c3-d139e5d6d4ee", "comment": "Malware payload (AgentTesla)", "value": "2736f72da064477936a6114a10fb8c777b6d340782c637e22df42a9146839e7b7d75a58427012b1a7e69a34bf051cfd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065223, "uuid": "a6cb8af6-9628-43e8-a1cc-d65c3bc3e492", "value": "T11246BE25B7E405D0E96BC631CA2AC732D6B1F8590B36835F0569E34B2E337914FBB225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065223, "uuid": "481d9c47-ee6e-4506-9b0d-c6b40caec7f6", "value": "0751433fb799ff99dbf59b2d0c85d83d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065223, "uuid": "25469ce6-a866-41ca-993e-fe3b7da28776", "value": "98304:sJz8j6ni/bQv8EYuYsXvK0y7l40rABR4x:sJ8enijQvFIsfxy7xAwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065223, "uuid": "0fe3fff0-0228-4800-8a42-2c78af2a7a68", "value": 5601504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065223, "uuid": "0ff2bf4c-f3f9-40a7-907f-1d1564ea4d99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065223, "uuid": "00810860-3eac-4013-991b-d2adb8a1cec3", "value": "SJDsd4R6jVZhfNg\ufeffp\ufeffj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42689acc-b173-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705081908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081908, "uuid": "b4e02cea-adc7-4025-b74b-2fa8b2a82231", "comment": "Malware payload (AgentTesla)", "value": "48c2a0d1afe9e00ef29b2fc7b45aa971", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081908, "uuid": "b416b758-3d45-4f94-a742-dacd6aa574ac", "comment": "Malware payload (AgentTesla)", "value": "1730345fea7a9812b05c73cc2fe4791597f87d7ed40018c127c94f7066173353", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081908, "uuid": "502ed38a-17ab-4d69-9bc6-fc18de4f54eb", "comment": "Malware payload (AgentTesla)", "value": "7d3d3a71d71c35a3b4dabba168454089e3b19823", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081908, "uuid": "bbe74f82-b147-4ed5-b1f7-7fcc1601008f", "comment": "Malware payload (AgentTesla)", "value": "233a31d7512fdd75e7196bbc305e71f462d7bab5d8bc2214c518e4b22f77abc89e98534024c2dfca5cd7820a4c062c15", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081908, "uuid": "4e4ec2c9-7e4c-435c-8e38-96a5afad2428", "value": "T1E545AE027391C022FF9B95330B96E7115ABC6A263123ED1F13E819BDB9705F1563E6A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081908, "uuid": "a00fca47-d539-4ad5-8582-86d05a970168", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081908, "uuid": "e33c1799-058b-49da-bb49-ca9afd62f7c1", "value": "24576:PqDEvCTbMWu7rQYlBQcBiT6rprG8a95zPuz0DAPuh:PTvC/MTQYxsWR7a9Z2fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705081908, "uuid": "887e77d8-09b1-4f10-bbb2-da7b42aa049a", "value": 1189888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705081908, "uuid": "28a7e622-2a5e-47c8-9c63-8176c7a46bc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081908, "uuid": "f21f27cb-9036-43f6-a69f-3d85b83848bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c494867-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056638, "uuid": "483840da-b3e7-4053-87e5-765dc55b33c5", "comment": "Malware payload (Smoke Loader)", "value": "866c6faeaa820ec56550404cd3d0f1b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056638, "uuid": "b5379b70-f838-4ae0-aa04-a1e1e2c2f5f1", "comment": "Malware payload (Smoke Loader)", "value": "1a0885223c50263c153be36ffdcccd5c217e00a2e1f04893a836a37a6c0cd8a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056638, "uuid": "9abcb85c-fd1d-439f-9771-9a450fad87a4", "comment": "Malware payload (Smoke Loader)", "value": "66b73e1a7f9d59fe260f138347bfd444e865abd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056638, "uuid": "dd552daf-622d-4265-b1af-39697bb2794a", "comment": "Malware payload (Smoke Loader)", "value": "e07a0120e9fc8b4c63398f5ad65be379576196ff64c1cfbe66adfb79d8f94ac4127b0e0e72553d9e10c72197c8516eff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056638, "uuid": "981e87e5-7ee8-4c79-9a44-fe52b96bd978", "value": "T17C548C1172ECD432E2F31A314634C7F50A7BB8726825546FA6D42A795E60FE2EA34337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056638, "uuid": "3b59a207-a309-4bef-9443-7d54e6d5d462", "value": "d3be11f6df42332786a4c0379b6f9121", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056638, "uuid": "399463db-836a-43d9-a863-64d8ce4aaa72", "value": "3072:xec4fYwGFV0RLr70+sJiaUEvhqwRFNNqeh7BsLDgdc/6WCJ5FTaQ4bRXp6AlAl:xec43GFV0RLNzEw+tMAq/69MbRXMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056638, "uuid": "918647ae-d96e-467d-9aa6-60034fa7094f", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056638, "uuid": "8eee771f-f331-4a34-8737-e44916758466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056638, "uuid": "c6e20016-605e-42d9-9874-ddca137a9d4c", "value": "866c6faeaa820ec56550404cd3d0f1b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b5e5f8-b174-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pony)", "timestamp": 1705082424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705082424, "uuid": "039e5790-9958-4a7b-8ed6-db8481e9c42d", "comment": "Malware payload (Pony)", "value": "bc3b825872e371ba9a7eb6df5921dd33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705082424, "uuid": "40665091-eb3e-41b4-9a78-63c8fd294acc", "comment": "Malware payload (Pony)", "value": "1a1dc33fae444afdd54f6f50dd47ed4b9f673fbc5595dad7b48e78cac0458465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705082424, "uuid": "607f0902-adb0-4d57-a9d7-13335a47a763", "comment": "Malware payload (Pony)", "value": "98a7df4ca2ddc14c28bf8bf4bcab79fdf2a088d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705082424, "uuid": "d594bb3e-3c09-4ebf-bf43-52036ccd471a", "comment": "Malware payload (Pony)", "value": "2bd1143517a1dff0a7d160bb2e6d7bef392e7214dc3b7d3f3f17aa3ef8133d992c3855bc6c03b010b29087818d8cd3a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705082424, "uuid": "83d62626-a5a6-4daf-b1ee-b49295682444", "value": "T18A64C5643ADA5075E473EB379BE4F193CD1EBFE22B92945E1081334A1733985DDC222A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705082424, "uuid": "066a5bfe-4a14-4701-870a-d3b0c3facde8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705082424, "uuid": "e6620194-0d89-4e13-b4e7-50f3a4d01fa7", "value": "3072:oO81elGlBalZgxcDTa/b6vgcDhJNBqOAxx4naobZWDGbJQxSdrPf3aNQ:HElBhxaGyFhJNBqNxWayrbJQxwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705082424, "uuid": "884d3014-16e4-4611-a646-0dcdb9bbfcf6", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705082424, "uuid": "38af5e74-6725-477a-afa0-6d68cef238ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705082424, "uuid": "cfd5a6a8-f3c9-49eb-9820-6e6542ecade8", "value": "bc3b825872e371ba9a7eb6df5921dd33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4cd39a1-b137-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705056438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056438, "uuid": "ee95a5d4-db66-4064-95f2-005761eaf20f", "comment": "Malware payload (LummaStealer)", "value": "c59251e07c20ac6cbfa7b345bd646597", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056438, "uuid": "6622962a-05b8-4176-90af-ca991727e1f8", "comment": "Malware payload (LummaStealer)", "value": "1a689eff429db78a6232912e5c6fb5be880b89f6016f26a1886331f174cb4086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056438, "uuid": "aa4d1213-9328-4b98-ac34-f254903fee41", "comment": "Malware payload (LummaStealer)", "value": "7012b53e738657d442670c6efb2c214cdf203c9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056438, "uuid": "8bb60f84-2b06-4ab9-bdc1-d29036417585", "comment": "Malware payload (LummaStealer)", "value": "d82a3bc6f21fcba34d65da41c3ad7b39eb14dd93214bf72a78ec3b27c1739696b15b489fe49e430c1332960fdff49a11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056438, "uuid": "2ce177c6-adb5-457b-954d-53f6d59e35c2", "value": "T1A82623924ECEE1C8EDB87B714017FD0D3275BF654A206A5D58A13AB78CB3B46E275803", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056438, "uuid": "c651e97d-1f89-4be7-b219-fb2f29a2cb27", "value": "634b53c711215e62c238bd89eafece96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056438, "uuid": "d448d4dc-b944-4f56-b47f-08fc2b2f757e", "value": "98304:0PYIxk31wZL1hrN3OwOIPGYcAUAMqhIGLfblqm/GpSGQ0QPCcOa:0gN4L1hrNfGraM8jzw8OSEQP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056438, "uuid": "6c152aa3-e14d-4c3f-acd3-ad96e6b08523", "value": 4421952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056438, "uuid": "39bcf53c-76b7-43a1-8c45-ffb635a9615d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056438, "uuid": "b6093443-7a4d-4730-897d-718d901d1972", "value": "c59251e07c20ac6cbfa7b345bd646597.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e097a25f-b152-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705068000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068000, "uuid": "b02b3974-f65f-4547-addc-1dd95e097caf", "comment": "Malware payload (AgentTesla)", "value": "fc57b73d5c56ac3d2728786854fdb746", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068000, "uuid": "8605b122-7a54-4e80-a11d-57fc6d141083", "comment": "Malware payload (AgentTesla)", "value": "1c6d1ba8637609ef14bb12400b0f2a705d27f71907603349385a63327345e8fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068000, "uuid": "d1c1a6d9-63e8-4612-9bfe-279aeb0b4645", "comment": "Malware payload (AgentTesla)", "value": "0d70b8aea51db3e8f91900b1cde3a2de5f846327", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068000, "uuid": "bc8a8d02-d15e-49b5-90cc-6ae751ea329b", "comment": "Malware payload (AgentTesla)", "value": "995b777862c258ca88c010584fc9cbfb3deaa5a51ad2d679a5615ea7b44723c0c9e2ede62f04d64fc17e25610759f14b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068000, "uuid": "0e629d5f-d2a0-45b1-9623-1f494bef2715", "value": "T142E4120C17EC6F35D5AE237C6064101253F9E2126197F7AD8F96B1E93CA3B918A14B8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068000, "uuid": "9860c22d-6fec-4821-866e-b9731c82dcea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068000, "uuid": "940c857b-b8b7-475c-9cff-fe74d40754e9", "value": "12288:F0woIc03ePMnJjs//LjZxFfHmYRvb5G6Y4jKQ3JYgp2bB:+woIc0bi/jjHVHmYRXx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705068000, "uuid": "d7d25226-3a5b-4ba9-adba-221f4c576db3", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705068000, "uuid": "33b84759-26c2-49fc-8240-d9a8ae313af4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068000, "uuid": "8b02a9ab-c5f0-4f54-88cd-caa47f62490b", "value": "plugmanzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24362072-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705065107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065107, "uuid": "30e1710c-31ab-4c1c-9deb-1427ea94d9ed", "comment": "Malware payload (Formbook)", "value": "420a19ba92dae49e030a9d63181e3d2e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065107, "uuid": "f95a94ac-9e68-4cfe-b750-d60cc9906328", "comment": "Malware payload (Formbook)", "value": "1d411c7bc92cb31171c0f02d34491ce6ee96eed6181e5cb075092209fdd60733", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065107, "uuid": "1e5274d9-5988-4d5b-b8a7-ab92f43483e7", "comment": "Malware payload (Formbook)", "value": "403d5a5501535b37db42dcbaeb61e74517295f7c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065107, "uuid": "4ea11411-b6a2-44c9-ad77-a8f5b5999a91", "comment": "Malware payload (Formbook)", "value": "7cacf203fcd37ba6d3d1a264e2dc67d0d18aa750828fcaf1017ee8e3a567ce7fa00aa109a1153c668e9421c43d91264f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065107, "uuid": "3328b3f2-e8d7-4be4-a3f2-36598bc42988", "value": "T1495529D322C061FAFD5F7032CA0DA3A516F95959082EA70E53CAEF656D3E090452F6F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065107, "uuid": "8428695f-25a1-4582-858f-0aefe3e98957", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065107, "uuid": "61966415-b4dc-43f2-b932-b7fe8b9fc53b", "value": "24576:7qDEvCTbMWu7rQYlBQcBiT6rprG8a7mTxD+/R2hIIy/rzC:7TvC/MTQYxsWR7aGxCZIty/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065107, "uuid": "237b293c-c787-4e41-9986-17b3baea46d1", "value": 1283584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065107, "uuid": "25583558-8908-43a9-8374-dddbea75f3f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065107, "uuid": "5dc33d78-1891-40e1-bf08-9c0f74370cc6", "value": "Recibo de env\u00edo de DHL_Gu\u00eda de embarque Doc_PRG2110017156060.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ddec49-b184-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1705089221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089221, "uuid": "14eb4ce1-e5ac-4c08-b75d-af10c967accf", "comment": "Malware payload (CobaltStrike)", "value": "7e5266046b2d6898d3ab0a96424a5714", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089221, "uuid": "2bcb4b19-1f5d-477d-948b-70a6de830b28", "comment": "Malware payload (CobaltStrike)", "value": "1f1edc47a46a190a08befb1cf3e24d90cc832f44c5df7ca1280d45408d00cfb8", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089221, "uuid": "8e7b7f92-ac61-45a0-8386-d687f199761e", "comment": "Malware payload (CobaltStrike)", "value": "037dc678328587cf813c27ed780b10015a4ca3ec", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089221, "uuid": "983f124a-9093-4764-bfd0-0183ce3492b2", "comment": "Malware payload (CobaltStrike)", "value": "eb80a67d30d3539cfcc07e3c3f3cebdd5fb9cc8036c0697230a7efae9c5f133e78c4b6114f32ac05315102579db5e2f2", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089221, "uuid": "27c1e615-85ed-4bf7-9ba6-09f4542d2756", "value": "T1D492DA3FE71358E9C106D57845FF3733DCB23DB385A6A32E1724D2B42E106A46E6AA14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089221, "uuid": "956bae23-21ee-4aa1-91ca-8f59fa5bf73b", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089221, "uuid": "f769e5bf-b52c-4aa4-a002-a09b6ff9b942", "value": "192:SV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2NFS5pWF8qa1Dojjgi:cqaCF31cix+Dc4zjd50FF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705089221, "uuid": "190834a5-effc-4102-a8ad-ab48e11b3d7b", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705089221, "uuid": "b090fd59-5cf4-44b0-ad11-e9e6719acf07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089221, "uuid": "55501e34-2e3d-4b55-8ec6-064360591ba8", "value": "Do_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af53d64-b15b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705071561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705071561, "uuid": "3b8370eb-8dd3-4f19-9143-75e47148790e", "comment": "Malware payload", "value": "fbec77e680f4ca80b02efad89f565db4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705071561, "uuid": "7a61dbde-5107-4593-8325-e4a9caa4f0b4", "comment": "Malware payload", "value": "1f6b987df79234bbf48b62410263ca081a8340b2102b1934b0d01dfd4188f610", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705071561, "uuid": "abc06f1f-80fb-4a75-965e-5d260a287252", "comment": "Malware payload", "value": "41bb51d9d918541b8d4ffe998254cf3f2aa39e29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705071561, "uuid": "66fe9401-67ad-460a-8039-42f871815b9f", "comment": "Malware payload", "value": "bff5eadcef49e1322ff519871bed862cea64e7a4137f9b3823593ae6dc0b094408d6b0b6a53c943380d33f61e4cd9878", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705071561, "uuid": "f7150d70-5a97-4429-8013-9011fa893d31", "value": "T1BE9523F176F8955CE9D123F89B35DEB402E18DCACF524ED2E4AB6C427B032C4A56046B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705071561, "uuid": "d279f107-2fd4-441a-8112-150942a6c99d", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705071561, "uuid": "cf0a83cd-1408-481b-9bcd-b2c7af386db4", "value": "49152:vZl5F4wdcn+MbpxMMQTkg+odQmzqGTLrR6WF35:vZnF4wdc+Mt/QVVRzvv166p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705071561, "uuid": "020dcb6e-5225-40cb-a67a-b424140feab1", "value": 1876480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705071561, "uuid": "b28ab96b-8e20-4721-8e1d-62e7d1027947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705071561, "uuid": "3890469a-7854-4cb1-99b7-f38dd99ed1d9", "value": "fbec77e680f4ca80b02efad89f565db4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54596d3-b150-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705067122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705067122, "uuid": "06d09884-6d26-4f49-b15c-5e823a027dd1", "comment": "Malware payload (DCRat)", "value": "b6229695d985886bba02cff6677df2ca", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705067122, "uuid": "3b9fa8a9-2eec-40d3-b26c-88a14919e284", "comment": "Malware payload (DCRat)", "value": "1f80a5027a30b618996426f0c02d630d7b275351f524fd9b5644e9f6db779be9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705067122, "uuid": "c86a2d80-c77f-4e23-b374-217aa4a4bf8c", "comment": "Malware payload (DCRat)", "value": "750a79c28091f2e1242f960f236b71f728b0fa85", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705067122, "uuid": "f12ff867-a2b4-44a1-a767-ae178ada42be", "comment": "Malware payload (DCRat)", "value": "0f6900a0a256357d956743427a8b2f5f582a7eb727d4f6393c38877369204068f4a2a57f48c0deb71dc8067a5691d1cc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705067122, "uuid": "f9db936f-5c9d-4270-a0b0-f18461c7ef4d", "value": "T18A5533B0D6B64061CBCB1F741333CDCD0DFA1819C4A673B89E9A0D1F77644AA894BA5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705067122, "uuid": "f01bb9ba-8d83-472d-933c-0df48e004428", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705067122, "uuid": "685bedf1-4082-4f7d-af73-8e2ca4ef3d0e", "value": "24576:IvGLtTM3hq7t17N1E7Ey7pVPcdKGx36JWCHfA1GqagTmOBI5fK8TPrTrDIUJjv:Iv4qQH7N1OvVwh3E9NOLBmPX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705067122, "uuid": "6beff668-ecbe-4be6-91ee-0598af0c62b4", "value": 1363456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705067122, "uuid": "4228ec42-fde4-49b9-9f71-ed95e31b5473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705067122, "uuid": "ce66004e-1d8f-4f92-8d33-0319100102af", "value": "b6229695d985886bba02cff6677df2ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004fc871-b14b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1705064618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064618, "uuid": "02e04931-2f91-4e87-991c-95818839a14e", "comment": "Malware payload (VenomRAT)", "value": "3c78cef4203a47012167be0877274540", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064618, "uuid": "c3964c8d-1a83-418b-8443-29d82ad32234", "comment": "Malware payload (VenomRAT)", "value": "202ebcf24cd4b6a4394e7dddd7ee98bceb9ac2b8c281e9f4610c7a93dafaa959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064618, "uuid": "6775f2d6-5156-43ad-8442-ae31e6e5d3ca", "comment": "Malware payload (VenomRAT)", "value": "8fba278e3fbcfcf5dffc871a92aa0a5a382edda8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064618, "uuid": "3e8bec55-bb46-4690-8d9b-952f93d9410f", "comment": "Malware payload (VenomRAT)", "value": "c723964f25b9e261ed4139579570432ce4ad493f0b1b4cc06fbc2a5b7da37522868270d0e752cf9536a80a9d30de28bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064618, "uuid": "837c194c-6d34-4cc1-a455-71b125dc8be4", "value": "T1B8A35D20679C9F19EAFD1B75B4B2012043F0E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064618, "uuid": "8d384f2c-488f-4a26-b711-9cebf1d9c270", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064618, "uuid": "25fcf734-8b43-4000-abfe-4b708f0bb7b3", "value": "1536:9qs+NqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2jteulgS6pY:rqMOY3+zi0ZbYe1g0ujyzdvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705064618, "uuid": "831d0301-fc5f-4af6-aa04-3f4a048d5fcf", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705064618, "uuid": "419f1782-6b29-4212-8898-905714c347be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064618, "uuid": "d05977d2-e149-4f56-b0cd-46de92046c23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "357b2e46-b132-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705053969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705053969, "uuid": "f099c6a9-2afc-49ce-82ef-68311cb5eb2e", "comment": "Malware payload (RedLineStealer)", "value": "6f0514c3f2b51fa40370e83dba9a31f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705053969, "uuid": "8f38b8b9-418a-4358-9e11-544db25168a5", "comment": "Malware payload (RedLineStealer)", "value": "209fb76e62610c2de55f2c539ef64f1ed58b00109579c4b3cc784c526bb2518a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705053969, "uuid": "a6432e1f-b3b1-47f7-a828-89c4a39ef210", "comment": "Malware payload (RedLineStealer)", "value": "33cf6e394c8c52767624f015a44c8ccdc2d0fb25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705053969, "uuid": "30cc085d-7dfb-42b9-b138-ead2f8fa612b", "comment": "Malware payload (RedLineStealer)", "value": "3eca1060cfa17bc8a04c726fc2cd0a7c9e4f7db00feeb9b37692ca2052255ea21e010bc2172ff48b1a737e90f4a3b5ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705053969, "uuid": "2a133df9-de72-4770-915c-707017639ffe", "value": "T16C4633D3C64D24A6DBB986F18D5917275B08EA53F0BDE7B26CBCF004830521F3A68D99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705053969, "uuid": "585212a1-4208-4a5d-ae39-deac9559543c", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705053969, "uuid": "e37c1c01-1620-4245-81e7-e71f1de2acd0", "value": "98304:1skBZ48KRLYijJJmV6I1jyyMpM6II16pbV0OfrFXyobxHQs0LYdYtcQ93wH5:1fZwvJBI1upM6IIgbV0SrFC8wRL4uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705053969, "uuid": "4c1c7c13-a343-4aeb-9933-8098251f7152", "value": 5850480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705053969, "uuid": "2d8d96a6-cfea-4c48-b39d-65ce45bdb553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705053969, "uuid": "f833bc74-682f-4794-9b91-d373f842d99c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caca20dd-b137-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705056367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056367, "uuid": "71861197-88d4-4530-b0eb-3e34afb4e3d7", "comment": "Malware payload", "value": "f7aa8fbe5826351166c863d1edce8105", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056367, "uuid": "61bf0ad4-4c96-443d-949a-c70088f62ad2", "comment": "Malware payload", "value": "2145cc1bb4315c608aa187ccbabe3aa5699d71727aa65a2b0fef88f01e21c377", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056367, "uuid": "26337763-8346-48f4-af57-077320873ca1", "comment": "Malware payload", "value": "5a07b24e0c065feeafa6a833853ddfa31da122fa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056367, "uuid": "be44511a-2e80-4ecb-ba41-65c46e3e4bf9", "comment": "Malware payload", "value": "bd95230627a91d0f7a9f51b6ed1773ae05a92bd1a3fa35d6a7b7b92c4e8bf6f190482ab7b79ddf730e428dfc2590378f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056367, "uuid": "d67dffbe-3bf7-43dc-b87f-9d5997c93581", "value": "T131A5231022092238E9698EBF04FCF6FD00297657AFA952C7BE85D525E671358CF3C716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056367, "uuid": "58220308-553c-4291-a94a-3c77b91fabb1", "value": "a4f80594f5feb06379c671d7bf991716", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056367, "uuid": "c3dce55c-1de4-4356-b315-a4992b4ffa89", "value": "49152:CSvlFunQ9ZC1c/wBR2xIgpGc/Ln+dywOcLZFjtKP67HPle:CS3uQPxxIgpv+owOUHj8P6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056367, "uuid": "039684dc-72ee-4fdb-9b18-a4dd862cf7ee", "value": 2248704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056367, "uuid": "15f2cae3-3668-4efa-98b5-b12a75621e55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056367, "uuid": "84f1540e-e5ae-454d-a695-3ecf4c8d6d5d", "value": "f7aa8fbe5826351166c863d1edce8105.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca9e9b7-b134-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1705054814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054814, "uuid": "8e9b3043-37b5-4e27-9cf8-bf72e584777c", "comment": "Malware payload (NetSupport)", "value": "ad8dcc208be118c2aa52f2d5ed84c79a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054814, "uuid": "84da491a-2cd5-4545-8133-55a8514634be", "comment": "Malware payload (NetSupport)", "value": "230a116655f27e771451e599073e25ccbc3bb560c6f041089d896966d253539c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054814, "uuid": "0543e7b2-4499-4e4d-8f93-d49213da6cbd", "comment": "Malware payload (NetSupport)", "value": "468b334eea7ff5522dc401a5e523a2a6e6e9dd10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054814, "uuid": "e3b2135a-7949-4cfd-9547-89c658e26575", "comment": "Malware payload (NetSupport)", "value": "f8244911d971b8cd90280319320f5ed081a58b95c9eef1df7e931799f5a731b858216cf4de4028973eeace8839a7d52e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054814, "uuid": "b4297cb0-40aa-49b8-9207-87b85c6210e8", "value": "T150F52301B7C489B1C2B11D3A66767B20D9B83C205FBAC1FFD795391DEEB41C2A631626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054814, "uuid": "842a5ee9-0ae0-4034-897a-9c489ad88bfb", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054814, "uuid": "fd9d94bd-9e10-4973-a960-c36c714efb48", "value": "98304:ccl520NC/+l520NC/YGjkfSrmXcA7p8l6GKDTbD+tJMnb:pE/+E/JL217x1nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705054814, "uuid": "8b8bbd8f-20fb-4593-8dfa-7e6a3878d775", "value": 3559435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705054814, "uuid": "6c42fa5f-b015-412e-b8c5-7540b77b378d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054814, "uuid": "8e636c09-508f-4f0f-97e0-3f0564a89bc4", "value": "ad8dcc208be118c2aa52f2d5ed84c79a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f18392-b190-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705094400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705094400, "uuid": "17efdee7-559b-48d5-a258-0321c987446f", "comment": "Malware payload", "value": "5ccb399bbdddd3393cffc6581b345c68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705094400, "uuid": "d9d55266-590e-4371-be13-100b3adb6f41", "comment": "Malware payload", "value": "25526f42bedae2b4788fb2a547ca8a100770f2d0bf8f13b483899eaf52b92130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705094400, "uuid": "ad769974-29ca-4ea5-8c6d-1234a60f8c65", "comment": "Malware payload", "value": "41145cb48cbad6e2760e9e1a4fb19fd4d6793691", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705094400, "uuid": "222095b8-f9ed-4f30-9208-a2a522170d17", "comment": "Malware payload", "value": "a320ae84df0ffd7c81d337bd89efcb1a21ea7d0dfd2208458dba3afdfaec568f246b450cd9ef5864adb3cdd93ad36dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705094400, "uuid": "1041a9b5-c2c5-42c3-b321-c7dd5c9d4f79", "value": "T1F89523F67AF6541CD8C15BF12772A23212E8ACD2CF604EDAC0DB5C617B978D22A5B503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705094400, "uuid": "84f6668a-582c-49f3-8fee-3a39024bbb14", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705094400, "uuid": "a5bbe02a-65f5-47d0-a410-82eed971b5d0", "value": "24576:udya+I6b+bYmUxRqDkNLv8UqSGACKqa2SqF93XuN0tM0tY1OQ8jo13S9+TMlUvdf:udR6ykakdSACTBSIG90tMOQH13SUolq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705094400, "uuid": "1d258d42-e19e-47da-ab88-994b092d957e", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705094400, "uuid": "e34beeb9-298b-4b5f-9dda-75f112207e8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705094400, "uuid": "c9e50aff-10ea-4ab3-b939-1a6d3fdbbd92", "value": "SecuriteInfo.com.Win32.TrojanX-gen.11992.28884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1cdf05-b11b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1705044287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705044287, "uuid": "8e887c09-3e84-4f27-b693-ba497fe8619a", "comment": "Malware payload (Vidar)", "value": "c4070da9f9b0581171af16e681ccdff8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705044287, "uuid": "f52edecb-1982-4b53-b711-cd343d38ca14", "comment": "Malware payload (Vidar)", "value": "26063c78e5418610471a9f3a00a155d7d1e5b29856e1979ba3bdc42681a871d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705044287, "uuid": "7692f6bc-3b5a-4687-9b7a-f79dc2f880be", "comment": "Malware payload (Vidar)", "value": "3fb4182921fdc3acd7873ebe113ac5522585312a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705044287, "uuid": "18c73ed5-95ad-43ed-95bf-1d26bee15cbe", "comment": "Malware payload (Vidar)", "value": "854f0d21d755a55c201db4fcc995592d1b007b63221e5060c41cf5cbb24b811f0c25e55e71816be85353c64b58878a0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705044287, "uuid": "ac21a272-d1c8-4952-a59b-bdba04830403", "value": "T1CF74AE1135E2C036E2B779754931C6B8DA3BB8627931798F2AC52AF91F246D2CE31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705044287, "uuid": "efe9d1db-ccea-4463-a0c2-f8dcd21c0369", "value": "000df336b102b7e013d9ff8d13e523f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705044287, "uuid": "cbf5305e-6da9-4d34-a1ec-996abff7f6b8", "value": "6144:pfLgtyckjU51Vc7lLUvTlR2agQAYNMQSnjbeg:pfMtycGU5/klLUvTlR5Aiuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705044287, "uuid": "c115974a-aeb8-4e3f-a060-5a2229298a23", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705044287, "uuid": "ad23a725-32ef-41a4-9a01-57221421f45b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705044287, "uuid": "10de60e2-7f21-4104-b9f2-2b6ea35cff24", "value": "build2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ddd82bb-b14e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705065956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065956, "uuid": "18ca0411-cb48-4848-9da1-1b9ead2bf0b5", "comment": "Malware payload (njrat)", "value": "90761d7a9ac41a9602b7094663921f42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065956, "uuid": "5de2e175-07f2-4575-ac39-e6dc4cb50ef7", "comment": "Malware payload (njrat)", "value": "29f281cac20928673a516da70a1495cf217aea2dc386d7719de2df7c2053fb9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065956, "uuid": "2d37cbfb-5fc5-4c94-9a2f-bd115fe5cd96", "comment": "Malware payload (njrat)", "value": "eb2357f00f922719f261a97ca1f4350a7c3d168a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065956, "uuid": "892713e6-902a-4bb3-b467-3b552d81b004", "comment": "Malware payload (njrat)", "value": "e9a9213469055ce877081075fd053af695cde3aa6225285ec71136cce75c3f2ad01c3355587dc960f00a66e5f06eaa08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065956, "uuid": "4b340f0d-d40d-490d-9007-6c3ea2fd9a6e", "value": "T127369E527398DD11E0792636D8EF411047FCF9863B73EB1E3E8E32AC25527E61C0969A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065956, "uuid": "596d4810-a19a-4ca6-8db6-49805ec4f915", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065956, "uuid": "196e4e84-e172-442b-b64b-f8cb85f6be77", "value": "49152:bWgm+tevgmkSG2srQHYNGFF0v9AUKoXjuqqn0F2TmoGwHP2px3V:bWgmsevgm+QQFvDXFqXRDOrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065956, "uuid": "6bae8914-240f-4bcd-98c9-0b87925d4251", "value": 5254800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065956, "uuid": "12577d2f-1d50-4a44-98b6-d23f9d6ab4cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065956, "uuid": "9d787873-2116-40f1-b814-917fc6321f4b", "value": "90761d7a9ac41a9602b7094663921f42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243eac11-b14f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1705066396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066396, "uuid": "d2c456ac-db58-4593-95e7-ff1e07e167d5", "comment": "Malware payload (NanoCore)", "value": "9d285823ad7aa977bd20fd0ff377b896", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066396, "uuid": "72bc6aaf-c60f-430a-b68d-6d677a625422", "comment": "Malware payload (NanoCore)", "value": "2aef241c8c48579042670ef2dc6f1cf81fb9b83528c00332daae95950e97dd41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066396, "uuid": "f892686d-3284-4a27-aa59-f0b997a7a97c", "comment": "Malware payload (NanoCore)", "value": "292ef70038f1566a6063ec6019d79151da727c9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066396, "uuid": "2285b110-4737-45b4-a6e5-80dbee2a72c1", "comment": "Malware payload (NanoCore)", "value": "f50b4f6a5178a76525933d49464ac74e85228ef543b98304959b0ba35a55432d13dc030b2a29125b0a6abc6960e9ecad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066396, "uuid": "b49f2e15-ffd1-4fe2-8fff-6eecaf4e8bc8", "value": "T14AE4CF9D7214B5EFC41BCD7289981C64EA20387B930BC243A45B25EDAA5DADBCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066396, "uuid": "abac7cb2-169b-4ccf-a877-853b42b33f68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066396, "uuid": "cc748643-ab32-41d8-bcf9-2b7098d5f4b7", "value": "12288:PPmxkebOe6hiU381FprjgAjqCn0Nt4qzSJqw+Q08UdPEmPVz6RQh0Hf/mrLk9bxo:GxV56N81Hrjbj5n0NCqJwYEmPVD0//WC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705066396, "uuid": "3205a812-268d-478b-afd3-a10639e55fc2", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705066396, "uuid": "eb96f214-4dcd-4db7-bd37-8ea433584c54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066396, "uuid": "0729ac46-6d49-43b8-88cd-013b1814e98c", "value": "linczx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7281497f-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705056649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056649, "uuid": "74cf2b9e-e9a6-45b6-901c-f7de8f262fe2", "comment": "Malware payload (Stealc)", "value": "57afac7145d80f6cfe698185f16f1573", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056649, "uuid": "b71003c5-cd49-4acc-92c4-d58343900818", "comment": "Malware payload (Stealc)", "value": "2dfc49dd156ddbc9999f327d2577ecb7f573f15bd03903f3795e1319d21b0ec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056649, "uuid": "7a40d910-d79f-41eb-b5bb-6e5e9c3d3379", "comment": "Malware payload (Stealc)", "value": "fd9fd8db0e972c475d5ca9a00d75d7cced843270", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056649, "uuid": "ba37dd34-fee9-48e6-8c3d-76b33985bda5", "comment": "Malware payload (Stealc)", "value": "2b42cd9ee690e0a9f45e403c16bbdace28afc877ed047d741e42b57d9e450e411299b58bee58a1091927139057ecbe0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056649, "uuid": "bddfdc5c-9a1a-4289-870d-4a3fbaa7f9d2", "value": "T189548C1132E8D432E3E319314634C7F50E7BB872A825556FBAE01A7A5E24FE19A31737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056649, "uuid": "133cc831-cf50-4040-b117-b4e2920f3827", "value": "3f1b99f6c9d48ec11c52365e30efb398", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056649, "uuid": "a2c78e2e-6450-41c7-83c4-5c111cd8121d", "value": "6144:sPP0mmxvxfLrrSVUcngijy1ShzpfK8bRXMA:sEmmXfnrSVUcgiW1ShNK8bph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056649, "uuid": "75d4e492-8933-4f74-a49e-373814ada7f9", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056649, "uuid": "8f268f5c-ace8-4d35-9c31-136f7969589e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056649, "uuid": "b753ed3d-aef3-4e5e-bb1b-eb8bdc01a048", "value": "57afac7145d80f6cfe698185f16f1573.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f6cf0a-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705065196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065196, "uuid": "c36b88ee-da7d-4523-8527-37240a2d65bb", "comment": "Malware payload (Formbook)", "value": "1ce60bdb0fa8691cb82f51ed461ef673", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065196, "uuid": "8c9f85f7-6f82-42d9-ba7e-7dcd5546e913", "comment": "Malware payload (Formbook)", "value": "33e2197c8f024767830350d957a058e21d21b14574d846b88bc1bae507fc5933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065196, "uuid": "4550a1e6-455d-46a6-be3e-b1537e443dd5", "comment": "Malware payload (Formbook)", "value": "3c05b36c012ef6c038a619467b9d483d98f73a6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065196, "uuid": "f761ff5d-b731-482a-941b-61c03b34e1ef", "comment": "Malware payload (Formbook)", "value": "1ce67058797b0c4b6a001d8f5b2eb57f41392baf6222c0111ac1661e9a3ae88fa8ffbe444adaf301d33a7ca3fd9cd08d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065196, "uuid": "ea7f28d9-d740-4202-87eb-9930547b0063", "value": "T1F8257ED5F150CC9AED6F06F1BD2AA53025A3AE9D94A4810C569DBB1736F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065196, "uuid": "790ba670-bc2f-41f5-9171-ecd15c25c954", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065196, "uuid": "24f40813-faf8-48a2-ab4b-49d3bd1d0949", "value": "12288:VVwoIc0zQMM0cNnqr49tIl44ORRDG62trGlx+EXoul61zJdX8Usbh:rwoIc0FFcFJ9tk7ORRSyLoW61787h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065196, "uuid": "9986a0cc-2808-4be9-842c-fbb463860308", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065196, "uuid": "f1a24ae4-fe04-4064-9174-266e3fb45b29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065196, "uuid": "503f2442-8e45-416f-a55a-1819653e08df", "value": "Halkbank_Ekstre_20230426_075819_154055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687795cc-b11f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1705045894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045894, "uuid": "c7942ff5-c4be-47be-889d-892e5adda5be", "comment": "Malware payload (Gafgyt)", "value": "03c11d407f41c81d5957358617d0cb71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045894, "uuid": "c9540e6e-c162-4f2d-88f3-984685792677", "comment": "Malware payload (Gafgyt)", "value": "33f83de3b8d1ce29956b6e993566886843343408a2601f637a53e9a6310a8155", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045894, "uuid": "4d5c7fc3-fc92-4070-91b0-ec434038168e", "comment": "Malware payload (Gafgyt)", "value": "862ef4b0c4fd44e7174ad2da7ee19b0205fda845", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045894, "uuid": "ad2d96b1-b420-4443-be36-e56800e0bea2", "comment": "Malware payload (Gafgyt)", "value": "05ee4e688105be3736ca496ba572e48449772c75081aaf33ad2cec68b10c49506a265b03beba4390a9c3150ae6a51859", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045894, "uuid": "bc57a0c2-41b8-4c30-9400-873fbff8d904", "value": "T13A931B41E9018727C2D327B6F7DF439D37326A5497973305A6297EB42BC6BC91E3A220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045894, "uuid": "7fe8a67b-77a8-47e0-a8ce-c52133f1ba8a", "value": "1536:sIGGoQCjYB8k/pSEYsNd0BOTWvU1Pg7rKlM+Io9mC9rQhqW8LKFKe:gfjWpdSU1PLM+VmC9rQhqHLKFKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705045894, "uuid": "9e2bcf1a-287b-4937-8e9a-107ecf6b71b5", "value": 93645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705045894, "uuid": "39209957-9cd4-4f0f-b817-bf9a83b46ad5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045894, "uuid": "8c94f6e3-f87e-4ae7-acd7-9958d5f1ea7f", "value": "03c11d407f41c81d5957358617d0cb71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f11a336-b183-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1705088909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705088909, "uuid": "c2ee6b0c-d5f5-4607-a319-3af7976771d8", "comment": "Malware payload (CobaltStrike)", "value": "3111f225c10f35464bd4f944683a00c8", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705088909, "uuid": "75317161-2944-4c9c-95f3-2b57688a8987", "comment": "Malware payload (CobaltStrike)", "value": "34e44036ffb7d1681428bafb62a28fa844dbcb7fad9c79fda98a20f25de94112", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705088909, "uuid": "3910df26-5df3-4b47-a4c9-19615b62119f", "comment": "Malware payload (CobaltStrike)", "value": "9fd2700467f3a55dd16446da06ff9aec2d26ce84", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705088909, "uuid": "39a97f0d-3d74-4184-bfff-60655bc61866", "comment": "Malware payload (CobaltStrike)", "value": "0acde020c1504a0470b21e40e045b7ec72320e5767a47cc78c10fd53753c1087855f5d905039ec2f77caae2dbed56f12", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705088909, "uuid": "e3dbd027-0c88-4115-a8c7-e9a15605497a", "value": "T14192DA3FE71368E9C106D57845FB3733DCB23DB385A6972E2724D1B42E105A42E6EA50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705088909, "uuid": "96bf1531-ba39-4ba2-b06d-917d3b329c57", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705088909, "uuid": "b9ff0e2c-139c-4d20-8cbb-3dd84b8dcef7", "value": "192:cV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2W5XZ0EtpWF8qa1Dojjgi:+qaCF31cix+Dc4zjb5Xdt0FF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705088909, "uuid": "ad055bc8-b0d7-48bb-a842-66face43d982", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705088909, "uuid": "03179411-6afd-4f34-94ea-43f4ffb11639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705088909, "uuid": "5464e5f7-41df-45d5-99fa-6ec67d744b58", "value": "Ali_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278e7de7-b100-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705032471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032471, "uuid": "ae9e3918-459a-4965-814b-f8500faa9f9e", "comment": "Malware payload (Mirai)", "value": "6263f13924fda6de7ce20ea4ae9cc3d1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032471, "uuid": "fbc3c8cd-984f-4d34-9b59-25c19c5893de", "comment": "Malware payload (Mirai)", "value": "36cf30394dc0ad898487a17fd80bd82c80405035e677c4d4c02389fe5278fc4d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032471, "uuid": "6acd2c0c-4196-4c58-80d5-6a6888136d39", "comment": "Malware payload (Mirai)", "value": "1bae4e917ab0a73b7f591fe44d5a3ffcf18d2b91", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032471, "uuid": "cfdf24b1-3a5b-4611-a1b9-61ff580094db", "comment": "Malware payload (Mirai)", "value": "fe0132609505a6d7a50432e0ab51ee4b26a66ec7639b5d52010b7127e301593ce532e63b6831128c734f41517a32c760", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032471, "uuid": "b6dfee15-b1bc-420e-ac61-3e3b6af2a456", "value": "T18BE34C46FA808B13C4D51775BAAF42453323AB54D3DB73069918AFF43F86BAE0E27605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032471, "uuid": "868ab98d-8b77-4f67-a737-4afabae53618", "value": "3072:tOgWO6ulDakMT8sdFjcOPRJDsje1fqn72M/95qAY5308:ggfrDakMT8sdFQOnR1fqnaM/9M08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705032471, "uuid": "e2e46f30-7c03-412f-828b-2daa8ad67b0e", "value": 149949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705032471, "uuid": "fd4200a0-5e54-4c09-a10f-995afbc5d09e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032471, "uuid": "24497f4c-5cf8-4a58-b0e3-5f36559b97b6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b1c996-b16d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1705079355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079355, "uuid": "ba2acd84-95e5-4f0b-9fc0-d2f0837302a7", "comment": "Malware payload (GCleaner)", "value": "86232cc808947e695bc6c37b7bed508a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079355, "uuid": "61649629-6bce-4183-9b0f-90821726fb4d", "comment": "Malware payload (GCleaner)", "value": "36ec44ea896af1e6cf3bd5282b0cc6147a4955d85ee507230bf6fb4fe0adb4e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079355, "uuid": "8e66e1f1-a356-4fa3-9ebb-2ecf0d980f68", "comment": "Malware payload (GCleaner)", "value": "e7958df61ea17715fb85a7119b6fad732566f44a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079355, "uuid": "705660ae-ac25-4ebc-8870-eb6909f0486a", "comment": "Malware payload (GCleaner)", "value": "3e055ead885c28b63588f73a3e9d8a31e927e4c3ef53342a3ee4fdf4418e6e13199d1fb5609b24ad0589faf58185f732", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079355, "uuid": "0cadb265-17d3-43eb-adc4-e998a3f37bf0", "value": "T1B364AD1076F1C032E6B369760A31C6B44E7BB8677A3AA98F2AC517794F256C1CE31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079355, "uuid": "5ce469bf-934c-4e9f-a3a7-9e297ecb0362", "value": "d8dcb51c50d0ca58adf96a087830e3b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079355, "uuid": "550a9f63-272b-4664-b5b7-673d81d2f93c", "value": "3072:eC3/rwY5p7otJiZ91K+1em+8oURcDCt/0m1LtPK6Gh7C0yAW3IW2Xnj9RCRvA:eC3LqBTm5BGhOPY/ncA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705079355, "uuid": "5fb4b78c-9953-4130-9594-259172533a3e", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705079355, "uuid": "12253f6c-03ee-4203-a37e-f5623991189d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079355, "uuid": "7432f16e-8fe1-4218-8d6d-f3f5740a1609", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e2fbf6-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705065060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065060, "uuid": "6fa18f68-374a-4245-ac14-48c1116b9618", "comment": "Malware payload (AgentTesla)", "value": "26d0c89b8d8157bcf26f78333014a8da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065060, "uuid": "a1b9672e-7ad8-4e26-8e4d-c160d809726e", "comment": "Malware payload (AgentTesla)", "value": "38d39c15641084a58a9a1f43b91eb80a6f0f0d4209e99a22e1b4d3360d910b6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065060, "uuid": "f966b6e7-4186-4761-b2ea-6e979c8d00ee", "comment": "Malware payload (AgentTesla)", "value": "5e9e46ffb6ea457c8c6eef9797392d76d6ee651c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065060, "uuid": "26863fee-e845-4027-97ab-37a11e63cb29", "comment": "Malware payload (AgentTesla)", "value": "67934dd3e8297333eb948335cc9da1e23b560cf7a3677102f0dce20ffa771ca4969962ae43ee5692bc1b3db651432bc4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065060, "uuid": "4bf2edc5-99ac-477f-ab50-26460a7cb7f8", "value": "T1AE93C578C9CD16FD0E0606BAEE4BE44184BD85AA423540FDEC9B075E11B2D5C8F7E62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065060, "uuid": "ef2b2b5e-26a7-4bef-b6a4-c46cafaea32f", "value": "1536:xsPMJ5M/bOnVVjdTVb0FQP0F2D1KN1JiZVJf7FNVJay:GPUMKnVVV90ueU1KN1JiPJfxNVJay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065060, "uuid": "0767f54a-8b78-4a3d-8269-e28c20338829", "value": 92589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065060, "uuid": "1547732c-481a-4e67-9175-05b0234545c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065060, "uuid": "8f85f29d-8704-4279-8f49-ce418badab9d", "value": "Spedizione 5082489347_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbca4ef-b15e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705073173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073173, "uuid": "1163b0a1-4704-415d-ba6a-812dd3a30488", "comment": "Malware payload (Stealc)", "value": "0039262b6698136212f36afb6a6cd826", "object_relation": "md5", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073173, "uuid": "65478d80-0b2f-4884-9c4d-b1787a3a00c2", "comment": "Malware payload (Stealc)", "value": "3a48d9b040719351dd7db3007ee74433577647efbfe025d12bf52d817fd7ca3d", "object_relation": "sha256", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073173, "uuid": "3d17a28c-6026-4c2c-9688-e162c246c01d", "comment": "Malware payload (Stealc)", "value": "1e631965da1f269bc5f1ba89f511e64de3228b78", "object_relation": "sha1", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073173, "uuid": "6f8a97df-5d1a-4f2f-a5a3-74460401741a", "comment": "Malware payload (Stealc)", "value": "e976257d8d9650d5e37a5a2a84f999f3e35c692c94a71526eace89f215baa557b821cee1e3affb81d3372843b2eef88a", "object_relation": "sha3-384", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073173, "uuid": "e8c921d8-4362-4c9d-a481-8edac80616c8", "value": "T151918D0780F744ECD91B32F6C0228832A610461AC2E75E8A6D13094E4EBC27A0F350FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073173, "uuid": "30c2436c-e34f-49db-832b-304b53813349", "value": "96:aP3ZupW6E6T9shDPgDOoudE3WibRUmbiLU7mv5TU650yAB2P7G+B1F:u3opWX6TCFPg2E7PqUIDP7Dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705073173, "uuid": "84368a1b-59f5-454c-99f0-4636d9346cc4", "value": 4304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705073173, "uuid": "86bc3562-4e54-4e06-ae99-86ab4a9bc48d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073173, "uuid": "b72f1c04-4cb7-4337-a5bf-8513ca8148b9", "value": "2058.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f621a7a-b154-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705068616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068616, "uuid": "d0b09bdc-0792-4609-a697-27bbca1d39fe", "comment": "Malware payload (RedLineStealer)", "value": "0fa8c3a81d1bbf12d1beb0ca64a558e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068616, "uuid": "a2fbda68-cd63-422a-8739-9a62cc77a90e", "comment": "Malware payload (RedLineStealer)", "value": "3b28b6404fda828b7d9e9ea3c375fa4b14837a52ca341c71fb183b58c3f0cb09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068616, "uuid": "7aca3f74-9800-4dea-b4e1-2edd78fd6168", "comment": "Malware payload (RedLineStealer)", "value": "a320ca5787e157de6981e0708092893d4924bfa9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068616, "uuid": "dd09f83d-16bb-4837-a14c-f600f156c089", "comment": "Malware payload (RedLineStealer)", "value": "65c2276fd909193619ea0023b0a448d5986c83cfb141c124cd1995679e9045d73b6f757254646f68133e32924d4eb195", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068616, "uuid": "6cc9d14f-b98f-4534-ac6d-53fa8c0b6fe4", "value": "T13094DF68432DC53BD29D8774E082AA8213F5460BE557FB8DFEA418F5085F350AB2726F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068616, "uuid": "7cd285b7-5ec6-44d4-805f-947ab1a93f06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068616, "uuid": "c9d84e57-9740-495d-b434-29dbd8ca29a1", "value": "12288:wnIrX8vLP6HYiXQwxTqGYmJI7VbBqJ76:IIaP64cQwRqGlq7VbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705068616, "uuid": "f006b950-e732-4c7e-9a4e-703657c81d79", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705068616, "uuid": "f09291fa-e726-49e5-bf23-2caa34bc3d20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068616, "uuid": "7aa7a8cc-4414-4c2f-93ca-9ba9944e313e", "value": "0fa8c3a81d1bbf12d1beb0ca64a558e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334ce615-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056543, "uuid": "10495157-5390-448a-945b-d6c10d8ee3e0", "comment": "Malware payload (Smoke Loader)", "value": "566e4b6ed033b3bde8c3087e34ec2d10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056543, "uuid": "6d26ba13-506a-4052-8fa0-faee2d586c99", "comment": "Malware payload (Smoke Loader)", "value": "3ba4a1da7a6ffee3728964d71358824b4648959b55b61c450b4a0267b7006ed6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056543, "uuid": "8047be36-015a-4240-8a79-8a2877d2f22b", "comment": "Malware payload (Smoke Loader)", "value": "5b1d37e86eca4db2badb0325bc9cb539bd3b2985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056543, "uuid": "1424f04a-5198-4f47-88dc-a80ebcf91cdf", "comment": "Malware payload (Smoke Loader)", "value": "d9c2c6fbcfa79ab3e6f2fee928baa1a7cf62566c4217867efdac679f352201a08eb11a58a19a41681e0064c50d3ca785", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056543, "uuid": "68248df0-47fc-4cc8-9c09-e02a05462d3e", "value": "T113748D5172E2C433DAE318358974C7B70A3B78325929558FA6E42F697F703E1A721F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056543, "uuid": "67bc3c02-1af6-47aa-8b84-4ed129723d4f", "value": "ba5e0b10d569bda0bb8cd84584885595", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056543, "uuid": "e231c332-2ec5-48bc-ad0c-3046e091903d", "value": "6144:I28mTEyDdlL1Edry9jK35aoasZpyVPcf2f8zY7I7z3hf3prKXqWU:InmTEydlJ9j8BasZoqI8zY7I7Dov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056543, "uuid": "b16a0a8f-11cf-47f6-b4db-bf10df66cdb0", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056543, "uuid": "08831242-8dfb-4a44-aec0-5921b41069cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056543, "uuid": "90c641aa-68a1-4160-8c35-10cf279704eb", "value": "566e4b6ed033b3bde8c3087e34ec2d10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f57f74b-b15c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705072186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072186, "uuid": "0c2b499c-7801-43a4-8821-d467498c8c8e", "comment": "Malware payload", "value": "4424ebcf4e788b888a5c15c16d2e653b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072186, "uuid": "289595c5-d280-40ca-bd6c-8d2463a7069f", "comment": "Malware payload", "value": "3bf7b7958bc7ab319d2fb078186d1bafe36d58d86291a871ca82a31db5b0cf2b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072186, "uuid": "40e55125-9d7b-4794-9c80-8ed6404ba31e", "comment": "Malware payload", "value": "ad64bd2c4e973b8acf3ebe16f6ebddfaaf7510c9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072186, "uuid": "6b862bb7-ff58-44b9-9b16-b190b8158bb6", "comment": "Malware payload", "value": "431143bf40f13e5d1d0a4759727e36c7876acd2e8e57743442f4c8f4eff07ca2ef7d93bd082cc6b05868983c6b5de442", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072186, "uuid": "e95561dc-9bd6-4b65-964c-fe0a92609a44", "value": "T1DCD523804D75CEB3D92214BE01BB9F9A1F611073D560FDCA2F31EA842AEF5556A270F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072186, "uuid": "c01a184a-6373-4a21-936b-7e2ab14c6761", "value": "49152:nZ8/R21DoLUZsTNCGgyVITNktw8ObzXlnJz6h18ZdqC9HPOfUaiYQ:Z71DoESgVKtw86156n8ZdqC9GUaij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705072186, "uuid": "041c1064-51a4-40cc-a04e-0cf7618eb78f", "value": 2896822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705072186, "uuid": "6fcf150e-577e-4eca-b6c1-d54fe07c82ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072186, "uuid": "5d6899cf-a45e-44b6-afde-3939816534e5", "value": "WTM_AFIP_Enero-4881922854863499.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de433a4-b120-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705046253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046253, "uuid": "f71d5dc2-0f77-4fef-8880-fd8743b9faf6", "comment": "Malware payload (Mirai)", "value": "f229d5089065b97a80d254979a4d3bb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046253, "uuid": "9838efb9-6ccc-432e-ab60-da1d8cc57030", "comment": "Malware payload (Mirai)", "value": "3d3fe37b91744a3e78a907a59dab89da5bd8f7706bcbcb0112e802f93ace8ad7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046253, "uuid": "4fc5b17a-71b8-4ff9-9122-278c19565254", "comment": "Malware payload (Mirai)", "value": "961471ffdf09753c20f79d8bc327bc6418a228df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046253, "uuid": "f403fe95-a526-471f-bd58-7d9ebc6e78b5", "comment": "Malware payload (Mirai)", "value": "f67bf3c1107c361e02262e37e10169cec78077d4b934af69ff47199af2e221eb72962b370749e2775adb6a8a6b65233c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046253, "uuid": "5eaea52a-e431-4e6f-ac2b-7102c68969e7", "value": "T11CF3A61E6E219F7EF7ACC2344BF78A21A35923D627F1C585D1ACDA011E6028E641FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046253, "uuid": "9df1fa29-68f2-4d6e-94e1-62d8c20eae61", "value": "3072:Jjug6OXyjVRsOt7yWA15D5HTe7Ntxhm0tIBL+XsIrw:ofiyjVaT/DJKX+55+8Irw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705046253, "uuid": "f50449ea-913d-4fd7-b008-1523921488a0", "value": 159076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705046253, "uuid": "637dd833-76ba-41b3-9130-8cd77bb9037e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046253, "uuid": "790fe228-0e04-456d-aef5-6fdd3fbb4070", "value": "f229d5089065b97a80d254979a4d3bb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad328f7-b16e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1705079882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079882, "uuid": "45bed19b-ec3f-4fe9-beb2-535a307b6156", "comment": "Malware payload (VenomRAT)", "value": "38312527c8f936445c85e7ddde36f420", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079882, "uuid": "7a23892d-1a27-4bdf-a40d-4514ffd249fc", "comment": "Malware payload (VenomRAT)", "value": "3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079882, "uuid": "fc9449bc-a116-4389-adc9-9c606f9003bf", "comment": "Malware payload (VenomRAT)", "value": "725a7f7522e907878eb84456ccb0424332b5cdd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079882, "uuid": "93610555-aaa4-4920-a30f-df28b4bb8188", "comment": "Malware payload (VenomRAT)", "value": "504a7bcf5708ef172ecd625a99e19404a607e5d3dd203c817e96f3ec16966d5f2192b1d2b1f0c46cace2975869d46ef8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079882, "uuid": "a33c1fc9-59b8-41b6-8eca-5e797a0ab189", "value": "T1DA734A0037D88926F2AE47B9BCB162070EF4D55B6412CE9E3CC454DE5B67BC58A036EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079882, "uuid": "853f2993-4cce-4e8d-8e82-6c81c6b09be3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079882, "uuid": "a19f52ea-abc3-4267-87c3-4c0003feba49", "value": "1536:6aUqAcxVMW7eTmJ9rxjJTkdK4WaxHdSzPMwy/eqmmRhdWVH1bfbCeZkwzUIbVclN:6aUTcxVMW7eiJ9rxjJTkdK4WaP0PMwh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705079882, "uuid": "63d812ec-8044-4ae4-a404-2473483dcd0f", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705079882, "uuid": "989edff8-265f-412d-899d-f9aa13b2afd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079882, "uuid": "2c49dcd3-f44a-488a-b37d-0f7d79444879", "value": "38312527c8f936445c85e7ddde36f420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c328112-b119-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1705043216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043216, "uuid": "27a672ee-50b3-4e2c-9039-5f0160f33d94", "comment": "Malware payload (zgRAT)", "value": "09005d63aadc5f28fbf8b546fed581bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043216, "uuid": "78e74bda-b6ad-402f-ab9f-f63b29976edb", "comment": "Malware payload (zgRAT)", "value": "3e37500863706fceb40ed46a56bf596e0159737679d8cdb62ddec4d4d8aa95df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043216, "uuid": "d3dacc59-bf1b-44cc-8d9c-f9ff3cbac2e0", "comment": "Malware payload (zgRAT)", "value": "3dbe79a39afed0712f9d320ac78bd5e35baf2e77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043216, "uuid": "28b22c0d-9aab-4c58-88a2-70728a406a41", "comment": "Malware payload (zgRAT)", "value": "962ac7b4c04a9ac4e320eecaf841601fbdf3ccbe6fa59c77c963b567dfef1db51f4ac56b06322e59647cb12299fbd60b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043216, "uuid": "765b91aa-b79c-4fbb-9ae7-9028c3749d43", "value": "T1E964282C2ACAEDE5DFDDB77A908494188B7DAC0820C3EB9658B43CA77D07745F211C5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043216, "uuid": "40b9de39-31ce-4b3d-829c-17d4afc2508d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043216, "uuid": "38e73609-7d2f-44c0-b875-b28c4a41a385", "value": "3072:+xnmkwesFA+1e8yDdv9Dv8O+6pcZ0Csem/t/umYOEY2qsCD5UgmmdpPjlnyl/Kn6:+xnmXFA+Qx8AumuY2qPDmabjdSKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705043216, "uuid": "bca904d5-f161-4d9c-8e08-5b8037c4db42", "value": 312070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705043216, "uuid": "361753eb-13e8-4d82-98cf-0e4f12282e83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043216, "uuid": "146b112d-37b8-48fd-b15f-5d73562d006f", "value": "ksiymraiy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22140b35-b152-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705067681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705067681, "uuid": "be802370-15c7-4c44-91e9-f88021810f66", "comment": "Malware payload", "value": "012662883999489e19e90f6c901ff2a9", "object_relation": "md5", "Tag": [ { "name": "ghostlocker", "colour": "#A045C7", "exportable": true, "hide_tag": false }, { "name": "ghotsec", "colour": "#551621", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705067681, "uuid": "827f936e-600d-40c0-b530-f2d135faf782", "comment": "Malware payload", "value": "3ecf05857d65f7bc58b547d023bde7cc521a82712b947c04ddf9d7d1645c0ce0", "object_relation": "sha256", "Tag": [ { "name": "ghostlocker", "colour": "#A045C7", "exportable": true, "hide_tag": false }, { "name": "ghotsec", "colour": "#551621", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705067681, "uuid": "ea81cf4d-ec54-4905-91a1-08bbaf5ed745", "comment": "Malware payload", "value": "806dded54b58ae09e4cd0f0edf9222155369e96c", "object_relation": "sha1", "Tag": [ { "name": "ghostlocker", "colour": "#A045C7", "exportable": true, "hide_tag": false }, { "name": "ghotsec", "colour": "#551621", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705067681, "uuid": "cb9cc255-0e9c-43c7-8380-3068f8173d0b", "comment": "Malware payload", "value": "26bffa0a79e43b7271cce006b43342388a8b9680f13fc0aad27f61dc05a0dc6f70056157ba02de6b4afb5ebc6779e557", "object_relation": "sha3-384", "Tag": [ { "name": "ghostlocker", "colour": "#A045C7", "exportable": true, "hide_tag": false }, { "name": "ghotsec", "colour": "#551621", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705067681, "uuid": "6563d73c-b4fd-4c67-ae31-e7f248d6efe6", "value": "T104F733F73A3539D4E1FE31FF158A97A30FC06208F2142263B6165DAC5AE5B19062ACDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705067681, "uuid": "9ca49748-7017-48e8-9f9e-1f64b3abeb16", "value": "1572864:bWSLP3bsybA9RWrU+8/icPLJE1FJahZ0aBBMjFx90Iwd4x5:bjb7A94U+1cPSk0+cFP0M5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705067681, "uuid": "c83b44f3-edb9-4d45-86a9-fe458abfb0bb", "value": 75173953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705067681, "uuid": "ffb16596-b796-470b-a0b3-5cde8c3105c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705067681, "uuid": "f90d8c35-a3bc-4fd1-a0e0-6746339ab67d", "value": "14161281168.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef69317f-b154-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705068884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068884, "uuid": "96f44fff-6dc4-4574-b127-be6fb1c64cc8", "comment": "Malware payload", "value": "80658043cb97ab9b1c46ce8b18c7d85e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068884, "uuid": "dfef04de-f069-4030-9e5f-39d6a0986c9c", "comment": "Malware payload", "value": "3ee2f01bd6dfc229152e748471f10c2228c715449e98f81ae7e91d065fdbda14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068884, "uuid": "6bb00d2f-aa5a-4d6d-8ffe-797aac225894", "comment": "Malware payload", "value": "0e9332b619feb40f6106525122281d0efac8c600", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068884, "uuid": "af2fbe9d-777d-48a3-a181-a910383c3863", "comment": "Malware payload", "value": "7f6924c5b612731b866c8dec4e415eee8a37fedf642b98336f2334f8285e2fb316793d729ddbe7fd97bbe52d7381a1ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068884, "uuid": "0514d267-2427-4b57-b701-341ac70a0267", "value": "T1E79522FC36F8115EE1D627F09BB5D0A419C46CE8CF11CDE2D6AB6D92B7632C18A60907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068884, "uuid": "26193ab2-64b1-4db9-8053-be500ff2159d", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068884, "uuid": "a3fcdc80-b74e-423e-b6f2-f34256a9fb94", "value": "24576:MWZRtQgEP/OEx6VnNs6EAQERKmjc/cEwxFCdnm6JeXoHvBZZ66WND6vlAE6dorQH:MuRq7OJTshAPmEim6D16Nphyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705068884, "uuid": "bb066234-8db2-4add-96e8-b05e9f3adb8c", "value": 1876480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705068884, "uuid": "c009147a-c65c-428c-9c1d-3b215b08d816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068884, "uuid": "84692b3e-16f4-4827-ae3f-acbc4e40b01f", "value": "80658043cb97ab9b1c46ce8b18c7d85e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a924b6-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705065274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065274, "uuid": "20978e38-ac14-4783-b132-349ca438eb32", "comment": "Malware payload (AgentTesla)", "value": "d9f5c2f416e4640c00688d9e3b365e2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065274, "uuid": "d5c0a933-508b-4d9b-a1dd-a728dbd1a570", "comment": "Malware payload (AgentTesla)", "value": "3fefd283343b7f7c7f4b41c4b1cd4d396db892a5866361722d22b28a632a95bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065274, "uuid": "caf0dd46-af13-454a-8ca4-cee47577f388", "comment": "Malware payload (AgentTesla)", "value": "117a5502ca4309cd115d08d2f61236ad38a69a4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065274, "uuid": "737ab08a-0ebd-4b98-ae5e-115c38255dbd", "comment": "Malware payload (AgentTesla)", "value": "abdd9958d00fee6e3560c90b0fcae30c47cf4c7df751c47db6bb4081b1a86eb5db2a0e2bc7e76a18ee29c3084f372236", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065274, "uuid": "45d68a98-816a-4d4b-9c49-ebd4618c13ee", "value": "T15046BF16F7E40AD4E46BD731C66A8732D6B1B85A0732875F0924C34A2F73B918FB7225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065274, "uuid": "acdf318b-7a9d-45a0-b4d8-f98bc9d2fd60", "value": "0751433fb799ff99dbf59b2d0c85d83d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065274, "uuid": "303771e6-7f5f-4e8c-bd2f-c3b5c869d76c", "value": "49152:+NboBWVP4uWu28SwoQ7391GeDzuFL3jXHwqzeJyG+gvf/5xzNu+KLcAOfLJypxG1:qBCTH+J31vn5xzNjzfLuG+di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065274, "uuid": "cf7c4cb8-8425-4a9d-9c96-e69beb591c55", "value": 5447680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065274, "uuid": "a2d16d10-816b-43da-bc48-9ccaecdb7f0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065274, "uuid": "54b093aa-b654-4a43-99f8-6a003d7151aa", "value": "2nd Transfer Ban.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9cdb3b-b173-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1705081902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081902, "uuid": "c17cbc57-e630-4904-9d75-e0955284bde7", "comment": "Malware payload (Amadey)", "value": "f42d0cefde7434ac7b049de6f980e391", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081902, "uuid": "52391f89-b454-41b8-b679-ef27f979df42", "comment": "Malware payload (Amadey)", "value": "4098768512e0290686ce227b5f60f597b47467cc5dff2f06651d4a7c0a80caa2", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081902, "uuid": "ba432845-9b73-45ff-b140-328273e38df4", "comment": "Malware payload (Amadey)", "value": "0390e02b35e3988ebf82c43cd22ad77479e6d5f9", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081902, "uuid": "8df2f6a1-9d61-42d2-a42e-a4c13d0eff39", "comment": "Malware payload (Amadey)", "value": "63ea772d7e18f80da6cfdc8c6632cfc7d665e85a3e4af31f9463711202ba5abf5946042edcdea3c692d7be239991840f", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081902, "uuid": "8c160ec5-d132-4b29-9ee6-7919931d6dba", "value": "T184469E02BB95CE11D16D6B37C1E7150453B5E9D36323DA0F36CA33A91A133EE4C8E69A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081902, "uuid": "b7d05626-f41a-4e14-9fd9-230c61825551", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081902, "uuid": "efd28478-21f8-464b-977b-8c0f3006de0a", "value": "98304:DbZbBpQtzCYycGg45NfImAUytdiYCWwAj:DbZbBpQtzCYyq45VIptdiTzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705081902, "uuid": "2556805a-0f9c-4cd7-bd8e-5b96bb5358f2", "value": 5802648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705081902, "uuid": "8588ed0c-7a41-4a38-b11f-af388f76bfac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081902, "uuid": "7766eba0-8b97-40c6-ba81-33af08cbced8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32c63a7-b15e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705073185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073185, "uuid": "40f6635e-a8af-4f27-89ec-61541dc1fe93", "comment": "Malware payload (Stealc)", "value": "3859aabec735477f07705e4bdb39ddfe", "object_relation": "md5", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073185, "uuid": "0d9dccf4-6c07-4663-9417-c3916bf51eac", "comment": "Malware payload (Stealc)", "value": "40b6ceac066b778b4d67751217a71f4d57b73d247d09b8b8060bece86f2ea639", "object_relation": "sha256", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073185, "uuid": "c7b71654-789b-4b7c-8e13-612aec5f12b4", "comment": "Malware payload (Stealc)", "value": "e7fc954fe6e336597c2babc677397eec97e3a16a", "object_relation": "sha1", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073185, "uuid": "bfad32f5-087b-4630-a432-1111739aa79e", "comment": "Malware payload (Stealc)", "value": "f10fa8f4f75323026276e8b074a6f931a4a1d7a2f2fbfc846a61e5eff67cc516fb688dbe381fafff2cb57a88a2f2b82e", "object_relation": "sha3-384", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073185, "uuid": "e90a5617-5004-47cf-b9a0-34229ccc2df8", "value": "T1A84533EE6E43DFB4BC4F402A6158D86C3D52503F2612F2588987594FE2D40D9DBACCAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073185, "uuid": "e44bd9ac-0301-44d7-a0e8-e7bd49a8a76b", "value": "24576:GNNkLQLENPAQLmL/Je4ynl7jgMdUh89p77IwWsmC68PhOre7AKPjpS:GNNrgpNoMnlvgNyVLmC753I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705073185, "uuid": "c8c6adf3-5d45-4e1a-b945-30eed9140457", "value": 1266336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705073185, "uuid": "65dd2144-1157-4810-bc36-8b5848061aa8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073185, "uuid": "bc02fe6b-e38d-4f3e-aa5e-30088233fc19", "value": "d.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66206091-b15d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705072519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072519, "uuid": "52686b0c-a6b8-46c3-bf01-4de8836f1347", "comment": "Malware payload (njrat)", "value": "ba01ead08a32fdc4048df2a6cd555663", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072519, "uuid": "7ab3e650-0146-4ef9-8a70-56504f619f94", "comment": "Malware payload (njrat)", "value": "43bdfc9704b3cf395af87f2bee4d8e06ba314e99a545b32a5416249744dc6961", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072519, "uuid": "f974a0b4-bb1e-4fbd-9ab6-442f996e51a4", "comment": "Malware payload (njrat)", "value": "d4e659802b1c9c473c4072cc2450bb31e7719547", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072519, "uuid": "40397614-bb99-4c1f-b40e-e12a10685a16", "comment": "Malware payload (njrat)", "value": "95e8313da477c9a3446fc202e8d7d15887592f6443946eda31737ce74818d9c83b35b83a8d1e78049737d57de5c54b08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072519, "uuid": "d8304345-8dc3-494e-96db-90da7cbe9b38", "value": "T10D032A4D7FE18168D5FD067B05B2D412077AE04B6E23D90E8EF664AA37636C18B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072519, "uuid": "904d5858-081e-4617-b3e1-434ee659ab57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072519, "uuid": "d90185b7-3e67-4932-b0b7-4070f7bb81e1", "value": "384:MySvEiTbTvpWNcZ0y8fvCv3v3cLkacparAF+rMRTyN/0L+EcoinblneHQM3epzXU:tS7TZ38fvCv3E1cQrM+rMRa8Nuzat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705072519, "uuid": "13984804-4e50-4ca9-8053-b6dd15b5670e", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705072519, "uuid": "b4384114-597c-43ba-a89b-4ec1a715f55f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072519, "uuid": "c0abfa8d-7517-4256-a6bc-bab9c5045454", "value": "ba01ead08a32fdc4048df2a6cd555663.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e9ef64-b120-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705046241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046241, "uuid": "cd86b384-9b3e-44db-8bd1-2c9f730cac8b", "comment": "Malware payload (Mirai)", "value": "2f0dd4c74a745736f14c95a74fd5e01e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046241, "uuid": "988069d3-f585-4325-a9bc-714b077cb107", "comment": "Malware payload (Mirai)", "value": "45f1a4a57738e0da4bd7a846b715c346fedcc68f7b9ddc9a76e78a0ae0d120e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046241, "uuid": "97ef669a-ec72-4a54-aba7-e2696b02f692", "comment": "Malware payload (Mirai)", "value": "f859e635d40c26053340b762abc4137107021641", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046241, "uuid": "befb3c7e-eee3-408c-8eb8-a9be1a226e54", "comment": "Malware payload (Mirai)", "value": "c8996560918219afac7a975be0e1ef021665061f1e757af021190e49cd7bc707285bde976444e082b88925f0f5245b36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046241, "uuid": "32180694-b321-4121-8bb8-251e8d0aacb5", "value": "T1F5D36CC7F400EEBDF84AD77A44570E0AB230A3514A931773621BBE67FC361D59826E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046241, "uuid": "0bafa770-2733-47a8-ba0d-f09ab254d955", "value": "3072:VtCLH1A6GoVAhBHNrI6s9PsySmepFypgKTprnHJ6+aLaM:VM+6GwAhBRs2ySlpFyeK9U+aLaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705046241, "uuid": "0c794e12-8d1c-42b7-82f9-8e93c4c7a3ee", "value": 130640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705046241, "uuid": "f25b27d3-777c-41ca-a97d-d1ed00729e3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046241, "uuid": "5a7c1f38-3d2e-494e-94c1-43cf609a20a2", "value": "2f0dd4c74a745736f14c95a74fd5e01e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329a2a5f-b18c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705092619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705092619, "uuid": "da503dff-a552-4e42-8b39-ad8e9ae12bed", "comment": "Malware payload (DCRat)", "value": "4496e23ea38964f755d03126a21d4f07", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705092619, "uuid": "480f3908-cee3-43d5-a3c4-2399196f7d03", "comment": "Malware payload (DCRat)", "value": "46e646dcfb73f26f153653b020f9871da0dc1bbd39b518e159616e352ebee9fc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705092619, "uuid": "b106f9f1-5780-4ed9-88e1-dc02b311c34f", "comment": "Malware payload (DCRat)", "value": "63f63f2ce50a5a98e6ba8a0e67671df967e124b0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705092619, "uuid": "8a388a38-3534-47ab-897d-4565d85960ac", "comment": "Malware payload (DCRat)", "value": "6b884bf88c815dc2630d5324bd2661352ec3225455561980761dc139ca70aebf94eaf24d9c3ad9a67cf031af478db8ae", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705092619, "uuid": "0ba4559a-e39a-48c3-be5d-835131bc0cf2", "value": "T182B5CF06A9B26E73C2A53F35D4E7042D93B0DB223613EF5B360F55D6A8072619A132F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705092619, "uuid": "dce57909-d71e-424d-bcae-88c9ae20b798", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705092619, "uuid": "fc9b4397-e6ef-4e09-bea4-4735ae15924e", "value": "49152:IBJkS7CosHg6RCq7BK0ufaLN8Wt/FTxbW:yuzPlBAaZNNTlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705092619, "uuid": "80b61f56-5361-4703-b7cc-a8e96e89466f", "value": 2434252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705092619, "uuid": "56ecff32-0226-4096-82f3-25025ff2e9a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705092619, "uuid": "eafbab88-c98d-4142-98bd-2edfd9e847a2", "value": "46E646DCFB73F26F153653B020F9871DA0DC1BBD39B51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c9a9b7-b120-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705046234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046234, "uuid": "c2f66edf-61a3-4056-bb9f-9e2c51d7401c", "comment": "Malware payload (Mirai)", "value": "1d7c436cc6f18bccb4debf140e94813c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046234, "uuid": "0b289b92-b801-4113-b833-1e34927e3b06", "comment": "Malware payload (Mirai)", "value": "46fc3bea567b436c1b405b6bd68db3dcc3c8108105dbfa100427d54a5bf4e779", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046234, "uuid": "5255edfc-5d81-4df0-aed6-fc494db12a92", "comment": "Malware payload (Mirai)", "value": "ca04e65e3d486552ce29fd2ba03aa8354687d199", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046234, "uuid": "f877a2ee-38db-4737-81b0-1447d8a4a88a", "comment": "Malware payload (Mirai)", "value": "b51d9e071d75f850ef9788975e56e3e3dfb1d6e9addadf2ab2720120d021befb84f3043b6423dcc6b46808af879c5539", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046234, "uuid": "05de83be-b412-4358-a23a-3676436c6b77", "value": "T140B31981FA8BC4F5C8574874A167F33FDA31D9298031CBA9DF9C5F36DA27A01960225E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046234, "uuid": "a0dd8426-d1b8-4daa-b3ae-781587b11e25", "value": "3072:mVPiDLhpuEMrBIGGBzhelH/Sclc4/t42oOj7ah5+:8PiDLhpuEMlIGGWHWEuOj7ah5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705046234, "uuid": "aed2b958-f4fa-4871-84ec-36cf659bb746", "value": 112776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705046234, "uuid": "ad1637b7-3c9e-4612-bf80-82576f22e437", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046234, "uuid": "2841a459-116e-4755-92df-1accef470c7c", "value": "1d7c436cc6f18bccb4debf140e94813c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0830bd-b118-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705042944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705042944, "uuid": "e8083615-9718-4827-a4ad-1352c5d03634", "comment": "Malware payload (RedLineStealer)", "value": "c32067b76898e1c91795ff2237b2583c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705042944, "uuid": "26495ab4-9862-4dd7-97fb-c8621da78272", "comment": "Malware payload (RedLineStealer)", "value": "48e0f13774ec9d2897e8d6192f16f9b9a5688b770959dc5056864c1048e68de5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705042944, "uuid": "951df38a-cea4-4844-9074-2337c699762d", "comment": "Malware payload (RedLineStealer)", "value": "e46cdb7cd35276db76a962b90e880f910e57b672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705042944, "uuid": "4d8d50e3-6ff2-4003-a174-92b4413a3e59", "comment": "Malware payload (RedLineStealer)", "value": "1f51cb1fd91a07636b2b259985be8866733484beaa84de609169cfa3f0f06d5987e859a54c28ec31f976ad5a9dbdc5f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705042944, "uuid": "28a2cc08-af19-44f8-bcac-27ec5eef9455", "value": "T12DA46CCEB4738075DE7114B27ADBD5924D19A6210B415EB77387381CCA3CAE03DA1ABE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705042944, "uuid": "ec3844cd-37b8-472e-af82-6edf04dd0837", "value": "2cc68961dd8a09287e908343d46b30d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705042944, "uuid": "4088194c-ebd3-45c6-a80a-45ac263a1cad", "value": "12288:EnNeA5SlsBehRin6SUVoNsPJVTTlwwoP8FHmSW7iI94rL:8P5sUehRin6SUVZPJVTTlw1rSW7iI94r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705042944, "uuid": "9d3ae702-7177-4d1a-8f46-e3e46aeb59a9", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705042944, "uuid": "971a8716-c015-4612-be98-b36acbf46f14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705042944, "uuid": "0bc0921a-1f66-430c-9b43-02b3fceb9917", "value": "edgag365.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a373c1e6-b160-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705073911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073911, "uuid": "41a2c0ea-22c7-4364-9fff-79b37f5a25ed", "comment": "Malware payload (Smoke Loader)", "value": "6100b8558ad4a992f3b7036ed65a04ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073911, "uuid": "98f5620a-3404-4caa-9052-ee43f1fe967e", "comment": "Malware payload (Smoke Loader)", "value": "4ac7d8a9a14447f7e60f14699384b340ef2564e6fad91727a0f3f2706c726b03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073911, "uuid": "0942b9c1-6089-4cc7-9c2f-c0515623b8e4", "comment": "Malware payload (Smoke Loader)", "value": "a4e5c4d6695c46bf11c76c097ae03c9b9ab05c68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073911, "uuid": "861f6d4a-327a-4f0b-9f87-559e43506a0d", "comment": "Malware payload (Smoke Loader)", "value": "82bee679b6d3e74f69c71293b51599c24b5107f402a6b5c8aedb7de151e0f2813ea9eefcaf4c8742a46c128ba419ba09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073911, "uuid": "8e3a79ff-3a88-471d-b192-3779a9a768a8", "value": "T17074A64382E13D45EA768B729F2FC2FD770EF2518E5977A521199E2F24B00B2D563B20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073911, "uuid": "311eaacb-d402-4a0c-93db-6779a6b1f7be", "value": "31e36cf00bd38f6118c77fe30a6b7e3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073911, "uuid": "9d0f6e4c-a3a6-4598-ba84-37970eaa213e", "value": "6144:CALPJu3wEeIxE8n9C+1e2VdaAorCgkwb:xzJugEuR+rk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705073911, "uuid": "8240c0a3-e46f-4fd1-9ed3-110b3ebead41", "value": 354816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705073911, "uuid": "86eeb5cd-cc6f-499d-b59c-2c7bd6c0b34f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073911, "uuid": "6dae9bf5-c1c1-4a18-8d52-43e89f75387d", "value": "6100b8558ad4a992f3b7036ed65a04ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed746785-b10d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1705038387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705038387, "uuid": "1cb765bf-9597-4ed4-be90-b37d36a0a883", "comment": "Malware payload (Stop)", "value": "3eeb7b2030517f91fdf0f4c5278d8e76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705038387, "uuid": "c0973f9c-c146-4b75-940f-ad44f397c0b7", "comment": "Malware payload (Stop)", "value": "4ad7b8d228fe32d82b0373ce886f224f47c2e06a59d394c634160c70083b5f32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705038387, "uuid": "e3a5569f-20f4-41b0-8257-c7e2c11b3da8", "comment": "Malware payload (Stop)", "value": "c4c3a4650d278f2f8b9bf871c2ae91508ffae165", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705038387, "uuid": "6caee9cc-20ce-4a96-b399-db59705a3b67", "comment": "Malware payload (Stop)", "value": "3aba84acdb6555fe3077b38f16dbc4971153e51fe7a1f018e0464b47b59acdd58b7af58d48092793afa2b3d55e2d4370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705038387, "uuid": "4099f29d-3e4d-412b-a5c7-64c0457525b6", "value": "T1CB35AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705038387, "uuid": "87a7d59d-0904-407b-a0e2-c9c39e269a75", "value": "0c756c849bc7b459f78f7a5ce46cd4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705038387, "uuid": "aa76d7f5-04ad-419d-a73e-ce491182f56e", "value": "24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/dRPOO8dWQHUq7:F0dwAYZt6C31WeTVRPOhd7Uq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705038387, "uuid": "11e863dd-39e4-4b42-af3e-86716ccfb657", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705038387, "uuid": "c76181ea-da1a-4ceb-be64-69007f136944", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705038387, "uuid": "b3b74056-d213-4789-b41a-dc96b5a3c3bc", "value": "9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c_payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224c20dc-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056514, "uuid": "f5612343-c9bb-4f4b-8408-241937c82c2f", "comment": "Malware payload (Smoke Loader)", "value": "ef0ad9f732f18fcbd7895cfac819291f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056514, "uuid": "053013c4-5d19-40c2-b013-37b2a337bbf1", "comment": "Malware payload (Smoke Loader)", "value": "4c236256dbc5dba5926eda92e6400462301806828b2f56625cd32d1ad447358b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056514, "uuid": "3f06d4de-2664-4db3-bb97-f8c49d96cc9d", "comment": "Malware payload (Smoke Loader)", "value": "ff1d4cc5d6de200e7daf2c156f02f58eda9bc955", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056514, "uuid": "c44fb5af-f59d-4b0d-93fc-196a0ddc3a55", "comment": "Malware payload (Smoke Loader)", "value": "fbdee9dbd6727a33ce7586c9b56244b0458eab26b996bee1cfca9b0c1a608e1c0bdf98abab4dd0e98a34469b15aa0134", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056514, "uuid": "7a79d3ef-6ef3-4e1f-a103-8e7224975356", "value": "T102147D1036F6C432F7F35A764670D3A40E7BB86779719A8E1AC546BD4F256E2CA2030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056514, "uuid": "1da0c29e-f57c-4365-8088-511ed58f89a9", "value": "68a8ea22d5d11f69338a9c3926759f70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056514, "uuid": "c7c1f0fb-d7ed-41b0-bd19-cc25a2ce2872", "value": "3072:qb5//G141eFwJiyIFbmE3to5JFKfasgU0H9iKcIOUIapRMqGA:O5C41eF/6Em5eaE0diKcTUOdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056514, "uuid": "cd9ed351-68a7-4d72-843f-8ce4c896f2ca", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056514, "uuid": "469c0b1b-4458-4318-ae1f-166113cb8662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056514, "uuid": "daf00941-9301-46dd-8fb4-3256e148b2b7", "value": "ef0ad9f732f18fcbd7895cfac819291f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024d3551-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1705065050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065050, "uuid": "04a61041-d7eb-4820-a66e-ce607ba7eef8", "comment": "Malware payload (GuLoader)", "value": "a17ec69343a6dd2bea5416f777a15999", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065050, "uuid": "32e175d1-9bd2-42bc-858b-0df23a8272f7", "comment": "Malware payload (GuLoader)", "value": "4c27b0573dd5fcdfbf89e20d4afacf6ae43ef3b814e0fbb1944e9cbdeaff4c39", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065050, "uuid": "19e42977-fdb9-4437-9b2f-656be70ee38a", "comment": "Malware payload (GuLoader)", "value": "b07dcf56f39c7fe5e0f32cc75ba019d11b98ecc1", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065050, "uuid": "a398ec30-3327-4ac2-a114-baf99a9cefcd", "comment": "Malware payload (GuLoader)", "value": "504a57e612d7cc926b800d9fc09d26b348cd9df1c52f327bb74f25e77fa93f6a4d600a38db2c9b61555262a60f5e6655", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065050, "uuid": "8df5b1d9-da17-47d3-a4b9-5e9d0103a5e6", "value": "T18A93F830CDC5323906420799AFA144818EBFA7A8F23468DFD4B9175E131275CAF7A6ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065050, "uuid": "84c8e101-3042-40b4-8e3b-12bac80c7696", "value": "1536:NSQmvw/HBzgaN8bM+ranWQv7Uq0K5H5yGTzvdc0tg4Vu:EQIGhzgG8fmnlD50K5H5yGTzvy0W4Vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065050, "uuid": "0c0b50ab-686d-4a1c-bf49-5b4a9a179350", "value": 92525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065050, "uuid": "42b5a4fa-8236-41f6-8cfa-589b98b57ca4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065050, "uuid": "fc8578ea-ff2d-49d6-b8b3-0cc4b94b0b9e", "value": "ordine 238 - Euro Pali srl.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea5d6cc-b19e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705100478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705100478, "uuid": "816e3652-dfb5-49b2-9bf2-6dfa1b412878", "comment": "Malware payload", "value": "59d218e1634752279e41b9066895a974", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705100478, "uuid": "a991fa56-870b-4ed2-a021-fdb790454416", "comment": "Malware payload", "value": "4d18c76bb688c0e0e5988c174d8cea453421b051c6c565ffe381c9537516cd30", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705100478, "uuid": "c0101721-e0fb-4986-844b-57621b56b8ea", "comment": "Malware payload", "value": "f5cad9101f5f13bf57efa4f82e4536a4b850de28", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705100478, "uuid": "4f0a6969-b438-462e-a2e6-36bd5157d755", "comment": "Malware payload", "value": "6cb66e1810590582cd6af3ecde438deb1142216c075bad33413263dd7025397182c6117646ec8486905163124a99a706", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705100478, "uuid": "57c9d8e5-62a7-4f30-837c-a4917907ffde", "value": "T139A58D727A808075D5C9213A04967EA866ED7E315BD477C336903B8E6A32DF3EC3D609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705100478, "uuid": "7b046fbb-1896-4b5b-a339-1ca0787a028f", "value": "6bb7ac67ef87ea56f8642c84feb5b9b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705100478, "uuid": "be0792fa-7e01-47fb-bcff-02f47cef01a8", "value": "49152:gbwMwIwxw4wZwBwYw3w+wTwcwBwTwnUKSXwwysP8:gkzv+/GufgRcjuclSXw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705100478, "uuid": "69ee1e1b-049e-4b66-8ca1-01ce87c7c935", "value": 2195248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705100478, "uuid": "6b006041-4d0b-4d8a-8cbb-8533bd7bf7ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705100478, "uuid": "5e1f9655-ca33-4f4e-839e-452f35741481", "value": "29f96d0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37de6b9f-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056550, "uuid": "60bf40a2-d00e-4a74-a06d-2a6caedb0f43", "comment": "Malware payload (Smoke Loader)", "value": "0ab69e2bce4685330888fef06efbe6a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056550, "uuid": "db8d117d-2021-498a-abd7-29fa6b038061", "comment": "Malware payload (Smoke Loader)", "value": "4e0bbc36f494616d41b54f5c393ea04cc854645bde88cee145fbd58874f1b06c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056550, "uuid": "98138921-e05c-4579-83bb-154dce80c2af", "comment": "Malware payload (Smoke Loader)", "value": "aea3ccd05c12ea28ff880a3c816582c633933b03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056550, "uuid": "0fe5cd94-cdc2-4cd2-bdc0-ce86a65a75c5", "comment": "Malware payload (Smoke Loader)", "value": "c4d34e3a9ba97faee22d395acd7d66043eec771dd20ec7582554ff7cc90d5b490cfd6dd89577b74e90f28b5fd914f9a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056550, "uuid": "12aef5b2-2230-4d63-a2a3-659b03076f68", "value": "T17E548D2176E0EC32E2E319758634C7F54A7B78726835998FABD02B794E307D1DA28707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056550, "uuid": "4ff6e9c8-d205-448e-a467-a2e9aa47fdb7", "value": "d646db85101d4befe7a7b7901f149b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056550, "uuid": "62781109-9f40-4078-930f-8009ce92c1a9", "value": "6144:ga+4tfVftL5VLbKwSaR7KGB3asNePUKvl:g4tfFtvbKwhxKG9asGUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056550, "uuid": "195fa64e-b032-4512-80e3-b3a979fdea6a", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056550, "uuid": "49fc4d49-f9de-4a83-bfe8-118affd5107a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056550, "uuid": "c8f7ea5d-1ef9-4aaa-a770-4a6f270241f0", "value": "0ab69e2bce4685330888fef06efbe6a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16948b1-b160-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705073907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073907, "uuid": "50931fe1-debd-4143-bfeb-047f505d01c2", "comment": "Malware payload (Smoke Loader)", "value": "7df8edaa8a8b2412a77e89ad13496b51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073907, "uuid": "e498c152-b1b7-4330-9d9a-7931475988b3", "comment": "Malware payload (Smoke Loader)", "value": "4e58387e1431f77f2fb4f103f82f7e5703daa02e039e352f05384c2ea300d103", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073907, "uuid": "87afbf0c-9d9b-45c2-a90f-19e61988acd3", "comment": "Malware payload (Smoke Loader)", "value": "ee567909d3b5862a02702870f1227e999bf1becf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073907, "uuid": "6fe9b58c-6e09-495b-bc80-27a8aa1b472c", "comment": "Malware payload (Smoke Loader)", "value": "6d6ec8910c80b6f69b40a63d801578d8c78e0e3056d99833ac74ae2899f05d7bd67e80987b19596c019f9f195f0335ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073907, "uuid": "962ee860-5953-4d87-9b66-e7053dce2a9d", "value": "T13874B44382E13D44EA768B729F2FC6FD770EF2518E4977A921199E2F24B00B2D563B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073907, "uuid": "8ccac594-5258-4964-92a4-489171cd06ae", "value": "31e36cf00bd38f6118c77fe30a6b7e3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073907, "uuid": "21da9be2-83a7-43a0-905e-cffdf82c49f6", "value": "3072:dJ1IpLEoO3wZ699/ddzJ2yDRForgjJqUQhM9jb26est5Fh6m5Pa6BV95j:duLhO3wZ699/PJTFqENTQhalhtC6BVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705073907, "uuid": "cebbf4ae-ea6b-4eae-917e-880b9d52c4da", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705073907, "uuid": "2eedbed7-1b43-4b59-a45a-95f100a0ca4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073907, "uuid": "91afe807-6423-4bf6-aa1a-eb32f0fe11e4", "value": "7df8edaa8a8b2412a77e89ad13496b51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b3a787-b184-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1705089319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089319, "uuid": "2f4886e5-9a4a-4ed5-a4c6-0731db237d44", "comment": "Malware payload (AZORult)", "value": "e701d67db9d3705ede459a111ccf89c6", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089319, "uuid": "8d4b8673-6f87-40eb-8fbe-53d6a99c5704", "comment": "Malware payload (AZORult)", "value": "4e77b03fc9937ac68121e3121cf062ba0994ba4aa06d2ccde468ce2a91cda61f", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089319, "uuid": "d099200c-396c-43e6-ae52-025beaf3043e", "comment": "Malware payload (AZORult)", "value": "f08495fb38e4be8bf6bc445bf7296791d6c4db81", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089319, "uuid": "a8170300-9c93-4f3e-b97a-e11a7819d5fe", "comment": "Malware payload (AZORult)", "value": "91bc91293c79ed1a6d93f83751caf4736adb6c167bf2ffe8deef07f74047db1f322a675ce77a09b685782ae080da318e", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089319, "uuid": "9fa00764-a2ed-47aa-a005-a7fd3913d06e", "value": "T111A42325672584B3EB124E326EB417234DF6D0681560876B2BA5CF693B39E12CC4FF8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089319, "uuid": "95a01a29-a4d0-4cb0-8d06-3b715f6699be", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089319, "uuid": "59130598-4799-410d-ab21-3ee7c18fa47e", "value": "12288:EiMpilGo/x8uusxz4Yypk8D8lK+3pvGxuqTypR6snVWvHSb:EiMSGo/x8uus2YyC8olyuqKRnVWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705089319, "uuid": "b68194a0-b5a9-4f52-bc88-6a78191c4409", "value": 449928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705089319, "uuid": "eaa93604-395c-43da-bc45-30cfb86d0863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089319, "uuid": "d4b92b90-ac69-4244-bb16-9a6117672f15", "value": "DOCS-1600017889PO400121-2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7cd9b1-b127-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705049235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705049235, "uuid": "c65267bf-71cc-4f25-afc0-364ba7175649", "comment": "Malware payload (Formbook)", "value": "f691dc5e941a39ff7a0ebce813237338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705049235, "uuid": "6360047f-8052-4a0e-9d7a-fd1b136726ca", "comment": "Malware payload (Formbook)", "value": "4efc9ad66b0d09b4e5ddae9e2c02bd112cb6e8cb7e9881969f231a10768b558f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705049235, "uuid": "e7280084-18e5-4734-8146-c65b233cab41", "comment": "Malware payload (Formbook)", "value": "28d6dbd400822758b88d503c10cb58f7935ab85f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705049235, "uuid": "4e44c871-a12c-456a-a0d1-e9c933c672fc", "comment": "Malware payload (Formbook)", "value": "a41d6d8cc75b9dc219fe7a828351590e2362cf6b9ca2fdc650093c7c9f3b82a360980517b59568642ab1101004d4cb74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705049235, "uuid": "5512a349-5209-4d8d-b040-eb758e02247f", "value": "T13C156DD1F150C896ED6B06F16D3BA53015A37E9D94A4810C5AAEBB1B76F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705049235, "uuid": "82efe631-6be3-474f-a645-a3c8ba25041c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705049235, "uuid": "fd9fe769-afda-4b4b-b404-9e23d8d33ec6", "value": "12288:UebOXc9TquTevX+ay7s6vXFNEMRDqj8uKWKGp2ribui8Q1W:Fcc9TXamsQFNEbj8QKiYA8Q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705049235, "uuid": "f35069b6-844e-451d-8467-d075eb0a70e6", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705049235, "uuid": "34a85bce-1865-4597-8a73-56725d4e810f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705049235, "uuid": "c36fff6e-ba5e-4414-b6e7-01a6751fe179", "value": "REV\u0130ZE ED\u0130LM\u0130\u015e TEKL\u0130F VE SATIN ALMA EMR\u0130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5667e8fb-b11f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1705045864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045864, "uuid": "8723bbb3-c975-40cb-ac5b-b2d2f65bf23e", "comment": "Malware payload (Gafgyt)", "value": "3fed6b677d6816eaa21519a7767e3753", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045864, "uuid": "f29eaa14-47f8-4eac-9817-79bb8a272af9", "comment": "Malware payload (Gafgyt)", "value": "4f0cceb59f469fb50bfbac4d269501407702bf8ac0c25fdce883cbbb1528b4e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045864, "uuid": "ea0e7daf-486b-4571-adaa-d75288eced93", "comment": "Malware payload (Gafgyt)", "value": "d8f826cd624f1ab20c6ee86414cf1cb4d2a42166", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045864, "uuid": "fe6256f8-f869-4446-b040-7a0ce68b44e3", "comment": "Malware payload (Gafgyt)", "value": "b069b7ee971cc99f8142051b0f44473d1225e407428f668218835eae0f5cbfed0a6342e244b71837420b98db1092a024", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045864, "uuid": "f375a742-43b6-45eb-a293-5ca971f0b0e4", "value": "T18B9329377B230E23C0CA547116F30332A7B5D65938BA5347BA906EAC6F1AAC435177E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045864, "uuid": "1bd893e1-305a-4e4a-9336-0c3dc2e85f83", "value": "1536:QdXkIdNM5hgtpctAR7DTrJFcmQ7FhYjDtaeQ4e:nIdN8ecg7rrcmQ7FhY3tab4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705045864, "uuid": "a5dc5320-d6dc-4c08-8460-74736e23e259", "value": 91824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705045864, "uuid": "a1085778-3368-4758-b3e5-00f583b0ae4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045864, "uuid": "64bede4d-0ca7-4ad8-9eaa-41f5e16de7b6", "value": "3fed6b677d6816eaa21519a7767e3753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de376ac-b173-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1705081820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081820, "uuid": "a0b881df-db6f-4027-acd2-2d9e008f6be5", "comment": "Malware payload (Vidar)", "value": "3e9f4a00e8833b7eceb241cfcc46228b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081820, "uuid": "b20ac85a-db41-48ca-95b7-ae81c2037453", "comment": "Malware payload (Vidar)", "value": "4fe911ede9a29b44a66d87b13e1a2218bbd850a8dec352bdc92b25f8f0ba6fff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081820, "uuid": "107477b3-b26b-4939-9ca5-163b62d1a2c6", "comment": "Malware payload (Vidar)", "value": "42e6f68ffb615b613f516acffed5981066d6a46d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081820, "uuid": "f2d52093-a697-4724-b3c1-e59018b8141f", "comment": "Malware payload (Vidar)", "value": "49d3c8013de4524f9d4e55f5df464b24484c07caaae935aa42959a52f522c31305ddf809c9d77531825e56acd147b9ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081820, "uuid": "aa93609b-a115-491f-97e2-8610c48b91e0", "value": "T1EF84C55392E23D44E93A8B73DF1F8AEC771DF6908E4A7B651119EE1B00B14B6C2A3714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081820, "uuid": "06482cbe-8f34-427e-b284-f9164cd04b82", "value": "0e471cb5eb960eb74341ce27e7145bf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081820, "uuid": "e22fa02b-69bc-4638-8b3a-7899261c3bcd", "value": "6144:SlyML+uhkfmXOneWTy+/Hp8SVqfnOffzYAF/i:ayMiuam0vzJfVqW3ks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705081820, "uuid": "0cffc594-c6fa-4f8d-ac31-63488e4fd61d", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705081820, "uuid": "4ff9cd61-4b2c-442c-9592-345c6758d256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081820, "uuid": "75a85098-e4ac-4799-9f0b-0cb994527c13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b2b17a-b0de-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705018075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705018075, "uuid": "c6fd7605-6d9a-41dd-872a-f749ea57f562", "comment": "Malware payload (RedLineStealer)", "value": "d84ddf7e3d38eb30d74875aef7bdf829", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705018075, "uuid": "56f07a80-f248-46db-a526-f56faeecb384", "comment": "Malware payload (RedLineStealer)", "value": "500216109d1c8e0795d241ce4c386483c504ddd19c0bff53e6c820456abb6214", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705018075, "uuid": "f3612d02-9472-491c-ba6d-1aab718b28e0", "comment": "Malware payload (RedLineStealer)", "value": "d7db0a8a78233ae8d876f6b040048e58c1b9ba59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705018075, "uuid": "461a6918-6f44-4d48-bc95-952b6521c744", "comment": "Malware payload (RedLineStealer)", "value": "4e226cb34e95a98a0bae4ec4af055f8cadec9f912136e3f866a962090ba6f5ad870c414393b019d55ba6c114d240213d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705018075, "uuid": "58196d2f-5dca-4983-b5e4-1227aeda52ce", "value": "T11D3633529BD8E8B6DA26C7303CFB164B0A357D73453B03A7578EFE250CD208A667171A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705018075, "uuid": "5436ed9d-79b0-4cbe-bd0e-de8dd97543d8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705018075, "uuid": "644b761c-ae68-425e-b3c2-4b33384c0c1d", "value": "98304:Ehzzk0mNq0DUsqkbJ0hOgNUU0Nk/bkE78k9d8qfamGgzyGZathu71LCVOfervC7:EhPNmNL47QCC/NGz7xUqfaJgzbsLuxhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705018075, "uuid": "383b24a8-5b91-4fa4-9f0c-570c9e7b5db8", "value": 5212160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705018075, "uuid": "8f0514eb-559e-4a86-912d-038f529f7106", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705018075, "uuid": "44987b83-674c-47e3-a60b-68068f17b1c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f49541e-b15e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705072857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072857, "uuid": "545921ee-b3f6-46c3-9dd5-d345034a4321", "comment": "Malware payload (Smoke Loader)", "value": "6940eaedae5546033fe54901228b09fc", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072857, "uuid": "4459a47e-fd82-4716-96fc-0a525776ca0a", "comment": "Malware payload (Smoke Loader)", "value": "521f14c5c2d45f03ca468a5ea3cb1532c0b25ecaa6a8561a8100bdd99f64f9be", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072857, "uuid": "3946837e-0c64-45a3-bb00-4187ab4c07ea", "comment": "Malware payload (Smoke Loader)", "value": "42d88f726387a21d4df233e8e787a14e13a269a1", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072857, "uuid": "605ff1d3-07e8-415f-9c43-a65f20a64e7f", "comment": "Malware payload (Smoke Loader)", "value": "d10189253426ec4fd19c415e7f1fbf9df3a622a8a0226d4745bbab1aee7792b671d52d97f582e39de43e7745e1fb7ddf", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072857, "uuid": "ed5cb0a5-dee7-44d9-88f9-4be1de11dd46", "value": "T17D447D1135E1C032F2B369B988B0C7F41E7BF8672A359A8F6AD416B95F256D19B30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072857, "uuid": "11eeb836-cd67-431d-82e5-c60f4fda536f", "value": "1219152ca9012f009c52738038ecb485", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072857, "uuid": "03ce5dbe-7b0a-470d-9a72-d2ead318c625", "value": "3072:53fR5NBJZmrGhCYMvXJieIiQ1KEeqbqUuR8MYAsHT80VRA0:53fR5NBq9bHMLYUHc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705072857, "uuid": "cdfb453a-5797-4515-95e4-28b18f791693", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705072857, "uuid": "b3945ef0-ee28-4c6c-b168-b5442b16a84b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072857, "uuid": "f3ec9d19-1fe7-49df-afb1-12eea81acae4", "value": "6940eaedae5546033fe54901228b09fc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b65b03d-b100-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705032478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032478, "uuid": "5ff139b9-39eb-48a1-bb72-d5036f85753f", "comment": "Malware payload (Mirai)", "value": "044649aa4cc15c21936339a4153fa808", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032478, "uuid": "13fd7c5e-6fa2-4eb8-8863-ace5ce8a2736", "comment": "Malware payload (Mirai)", "value": "54b47777007f18aa301f9ad1b8bc8abcd128b889e373d7e8f56a7bb3b117a116", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032478, "uuid": "3974f6ae-8bc9-441e-b7a2-2fbf78c94049", "comment": "Malware payload (Mirai)", "value": "b46e1cd31b532710736dd873dad943f532d12032", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032478, "uuid": "625e595e-219b-453d-8430-4319b80d92f7", "comment": "Malware payload (Mirai)", "value": "a0b91e8956cad2dd9f7061594cd41f6c527feb0a77cb9c8e848a965f0f7d1c1433f388961544369e77589e527bb0c5bc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032478, "uuid": "b8dae86a-00ed-4d93-aafc-6a4da2d8354d", "value": "T1E693C50ABF651FF7EC6BCC370AE9174524CD550A22A97B3A7934C818F64B24B45F3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032478, "uuid": "a2219c9a-2ca6-4722-b113-9d193ff27bcf", "value": "1536:yQHPh2iC9dR/C5ZLM0LBuoZ/5y418nrX:yaPhpC10LBuonWrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705032478, "uuid": "b946ecb2-9a8d-4aed-81aa-65703af66505", "value": 89680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705032478, "uuid": "e6c4ae06-aa23-4cac-9954-11b41c4626e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032478, "uuid": "44e1840f-69b5-4bb6-8c2c-47c24403df66", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e23dbf-b16d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705079419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079419, "uuid": "9163cb62-de20-4b19-88ab-bd359ae191a0", "comment": "Malware payload (RiseProStealer)", "value": "61266f99271cd5605d384c2953ac4fbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079419, "uuid": "224a8224-c38f-4987-a94e-b635444fc15e", "comment": "Malware payload (RiseProStealer)", "value": "557c5b6678b5b3badb6a7703e4491a9b354a353cdef83c4f6415b422cd17a999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079419, "uuid": "a3a29172-93c3-4bc7-9dd9-5cf9eca08c01", "comment": "Malware payload (RiseProStealer)", "value": "7fcb8f33884fb424f1a5851f6ed68362997aa884", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079419, "uuid": "3f8731f0-502f-4bca-aa5c-f44a65ab679b", "comment": "Malware payload (RiseProStealer)", "value": "cc831726439e9fe269d985085d8c4a518961ea1f4c5185714333f1b855d0a8262ab9df527bbb3ed58cc52eb0da801f3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079419, "uuid": "2b28f209-2f7f-47e8-a841-8a2e585abd65", "value": "T160769D06FB99CA13C1596A37D1D6141803B1D982A713E74B36CA37A91B037FF5C8E29B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079419, "uuid": "26e13d14-8610-4c8a-9e6d-4e5c3698e28a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079419, "uuid": "5f89a391-c611-466d-a18f-a0d9067cae27", "value": "196608:It8PV1rMoVGrX5PhPLLsGu7uni07ix9MENvpdd:ISV1rMoO5ZPcGxi0w+Gpdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705079419, "uuid": "6b71bed2-03a2-4556-a98d-260fcd51b40b", "value": 7360224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705079419, "uuid": "41e1b77d-89d1-4f19-8444-11909736b636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079419, "uuid": "8a4aa014-5148-4415-9208-62df51378873", "value": "61266f99271cd5605d384c2953ac4fbf.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3d5928-b104-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705034524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705034524, "uuid": "9b460d91-59d9-4ea5-8da1-ed73468f5ea9", "comment": "Malware payload (Mirai)", "value": "7915f56cf0b946a05b65650188f3a91a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705034524, "uuid": "e5fd8586-490e-48e8-ba17-29b67d35c97e", "comment": "Malware payload (Mirai)", "value": "561a61b05c518ff7a2fb8fbb127aabe5b51fc736e1e7285aff3083b494a16004", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705034524, "uuid": "d9f0228f-1e87-4c7e-824d-e56f73fd760c", "comment": "Malware payload (Mirai)", "value": "7abf32ed29aa1022a2761ae0465b442eea66fea9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705034524, "uuid": "fb545acc-384f-415b-b607-be56a4dffa98", "comment": "Malware payload (Mirai)", "value": "78bd4e387a5ac664524f022964c62e5fbba78bf6dacf30ea5489209140ec3091391338cc7770a7e9517c377ccebd6c52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705034524, "uuid": "e65752fc-3e82-4432-893e-b07762a105b1", "value": "T19A6339DAF800DD7CF84BDB7E4463460AB671A35142930F37236BBD93BCB11A95922E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705034524, "uuid": "9569c4d2-cdec-4e51-a64c-8fb732de9748", "value": "1536:H7FEmnbcbKYOUrBIPmYgVBlaq8+peM81SHi59znU1EWG7I:HCmi5rBIPNgLlaYc1+iXAG7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705034524, "uuid": "3dd177b1-7236-48b7-b1d5-5b62f173b9a6", "value": 71148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705034524, "uuid": "edc77afa-5a2c-4dba-b1fe-07d0e2b814b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705034524, "uuid": "e1d5d9a9-2bbc-4a3d-a412-b99447dd1f21", "value": "7915f56cf0b946a05b65650188f3a91a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd7e32e-b150-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705066949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066949, "uuid": "04e48358-da95-468c-b1de-4abab4b74725", "comment": "Malware payload (Formbook)", "value": "396636916356b7860d989fc3b46b2719", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066949, "uuid": "2c44e425-13bc-401a-970b-c6e44539a450", "comment": "Malware payload (Formbook)", "value": "5712d6afcbf5c83892bf3f622e946b7461ad04f3663ef44a29fab1ab3ce67730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066949, "uuid": "21be0858-874c-4011-8041-11903fa1559c", "comment": "Malware payload (Formbook)", "value": "2de1bce4bf42a911f02ebadbaf808f80c706c254", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066949, "uuid": "cbae15fc-7468-4069-8d8f-e9c6fc5faf33", "comment": "Malware payload (Formbook)", "value": "b0456d5878608d10976af1cfab67f206dad3ec2fc1c4b65e8116ff31ba1ed76ef2f965f00db469add387654ba8a3c91b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066949, "uuid": "7fdd047e-7060-49fa-829a-5ee03c26dd3c", "value": "T1D005F19513111A67CB73A7B1DAF3A7020A54F0BA8416DB5B83D56435B12B2FF2FB2B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066949, "uuid": "242dde19-671a-4fd2-ba84-e21db1619245", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066949, "uuid": "8f23bcd3-42aa-4a70-a61f-0a543249819b", "value": "12288:Ik90GViBMwoijWHqm46a2TBI0loBqgS7eNguUV17EYdxEhbnCmd2EPO7m8su1t:Ik9VzwoijExq0Er8WgE5CmRPcm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705066949, "uuid": "bbea560c-197a-46f7-b046-b74cdf5a4556", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705066949, "uuid": "449b6e2e-eccb-47e6-88f5-0a47fe622407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066949, "uuid": "5e63a7dc-0ca8-4d57-8a08-55034dc6762c", "value": "iata_awb_complete_157-98850603.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2671f2c4-b100-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705032469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032469, "uuid": "f817750d-0245-4212-b0d2-91cd8ddcc5a7", "comment": "Malware payload (Mirai)", "value": "a6cd061f05fdcd6f7dec3943f87297a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032469, "uuid": "e5905902-2d2f-4500-b6d1-27e897c37f95", "comment": "Malware payload (Mirai)", "value": "572265e043fcd3068bb32bbc7f495071875cc958f5066a80b47976579fcacb5d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032469, "uuid": "deaada56-0494-40c7-8206-d3f75f2f96a6", "comment": "Malware payload (Mirai)", "value": "f1721d947834d40232bcc710475d563c10a4e410", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032469, "uuid": "8bcb0ea6-2cc0-4317-920b-5d49716e6b41", "comment": "Malware payload (Mirai)", "value": "7f733849f801641665ba1936d383a5c0da69326917e65997fa37ad6c1f24702985546f316e7d4de3b76e5416d7cdbdbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032469, "uuid": "8f11c948-18bd-4c5c-8dc7-d6cb9368ce34", "value": "T19A634B51BC809612C9D5137BFA5E01CD372617A8D2EF321B8D26AF2037CA96F0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032469, "uuid": "1cb4d29c-461f-4c65-a73d-a4553100b629", "value": "1536:gsqDMcMZDCDknn91hTY+OPZjtXoCxqTyQwcKs5SFvyv:gsq4xZDqurhTfGKyhcXSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705032469, "uuid": "16c493fd-1e81-4475-9d1c-e9420c54ce39", "value": 70968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705032469, "uuid": "48c76c92-c961-47a1-9bab-4b8a0484bbf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032469, "uuid": "2f617462-1948-4766-af19-1632c8595ee2", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f80b930-b160-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705073904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073904, "uuid": "f141d489-3f2f-4ab2-aae6-445ba10f73ad", "comment": "Malware payload (Smoke Loader)", "value": "9ac3cdbb52dc74eae6b45a0789da8f14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073904, "uuid": "f959a924-6ea1-4a82-8e37-4aad47b49462", "comment": "Malware payload (Smoke Loader)", "value": "577630ab8871c11387fde67ae8791d81f96e3d3ec8db98a58ed5346c59f51229", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073904, "uuid": "99c918d4-1275-46e2-b5ce-ea62a76cb3a6", "comment": "Malware payload (Smoke Loader)", "value": "5ab7a588422eeddeb2df7a23a51deae2cbf63c2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073904, "uuid": "2b63f39c-f488-49ff-8d48-52f0fbff6de2", "comment": "Malware payload (Smoke Loader)", "value": "28968542aa299f3f7d45e9b89ba1b19f832b88db211ffc155d4062aeb38fcb3ea4f72308718b415d72c29ae5e0dc73bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073904, "uuid": "6afac4c3-a27c-426e-b1d3-560cae0dbcf7", "value": "T1BA74A45382E13D44E9768B729F2FC2FD770EF2618E4977A521299E2B24B01B2D573B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073904, "uuid": "33876f20-b19f-41f1-842f-efd7c84f688b", "value": "31e36cf00bd38f6118c77fe30a6b7e3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073904, "uuid": "58cc8ee0-a76f-4f06-a22a-a512478916d8", "value": "6144:vc/LRuQND5LnqTZfcOlmW+ys/fnC6BVC:E/9uQPnmZEufY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705073904, "uuid": "5f223248-c2e0-45a3-8047-9709d9cc0c6c", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705073904, "uuid": "5abb69fa-5d63-4624-bdbc-fe0127be7ddf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073904, "uuid": "d1b24e36-8e43-418c-88e5-0143436e968f", "value": "9ac3cdbb52dc74eae6b45a0789da8f14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5e470f-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705056643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056643, "uuid": "dfd657fb-35d5-428f-b760-46eb4559c476", "comment": "Malware payload (Stealc)", "value": "ce84981d853f39669969049463cbda03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056643, "uuid": "7046d7f7-8906-40e0-a695-9fc34c2af97a", "comment": "Malware payload (Stealc)", "value": "5777ea688bb402f1f457e10852509ccbe1278a6ff546662516b2f963e8dd5dae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056643, "uuid": "3bb6cf1c-daaa-451e-877b-05de3630183e", "comment": "Malware payload (Stealc)", "value": "3d6cd92044e0802d0f7aaeb4c1bbe1ee478a1da5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056643, "uuid": "3d64f3fc-5d35-43e6-a28d-d28b732dc388", "comment": "Malware payload (Stealc)", "value": "dcbe220a5ca92b361db4aba81e35fdef8777f106a17a7939ba5b1c128447d2fcc5ce82be5196a295af8b78fde7ab10d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056643, "uuid": "5b901029-bd36-488b-b3c7-348a8e72f910", "value": "T100547C1172E8D432E3F319314634C7F50E7B7872686555AFB6E02A695E20FE1AA31337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056643, "uuid": "87a4944e-e48c-4e8c-816c-3536dc417639", "value": "bb47bd5090dd2b8401c8106609617fb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056643, "uuid": "d67ee3e2-7be6-466d-b648-a1e4603fedfe", "value": "6144:/ecUWVV1mLV3UrfUdSPTMxqWwZL+UfKqamhbRXMA:/2WV/mR3UrfEoT/lJJKqamhbph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056643, "uuid": "3cc48627-6de8-477a-9035-54c074484535", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056643, "uuid": "de9ad74e-243a-4c52-9343-5c29b3bfcabd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056643, "uuid": "df1e1888-4671-4056-bc93-957352181c3f", "value": "ce84981d853f39669969049463cbda03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0f706d-b16d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705079460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079460, "uuid": "5ddeaf99-6c6d-4dc1-a41b-c7f92327d829", "comment": "Malware payload (Mirai)", "value": "c9d8969b5015c0cf4f616058da6e8dea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079460, "uuid": "5eb49d90-38b3-4886-a747-3396b65d4f7c", "comment": "Malware payload (Mirai)", "value": "5847b5c5b873f9a26d1aa449603ab7eb76107d6008ba6ed52fb1eff98fcba2d2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079460, "uuid": "c42c51c4-0dd0-4c2e-8640-762f341e2224", "comment": "Malware payload (Mirai)", "value": "117937545fa28dbbd8898f236e52e409baadbaf7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079460, "uuid": "649ae774-98d6-415c-808b-614768635bbe", "comment": "Malware payload (Mirai)", "value": "2595545c9b1a2510fc1d4c12f5a7abce11044cc8dbeb7317afd5767f009c568ca035b8cdae4c62f6f7728809bd149d26", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079460, "uuid": "756ea633-4926-4cb7-b8c1-ca0b5bc1f471", "value": "T1FBE32945F8408E23C6D312BBFB5E428D3B2A17A8D3EE72039D251F65378A95B0E37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079460, "uuid": "16a50d55-7d40-4d31-aa0a-5485b3c2edd7", "value": "1536:xYQW/kOULcitWpCxDcib3sEjYdgEm2IKFzAuGu4VrIPlTfnPvg8iA5JQoHRslYa2:xYQlrKKjj2TFzF4ydbnPvg1qEuG+BIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705079460, "uuid": "eb5e6116-04d3-4399-992e-58e013423341", "value": 152448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705079460, "uuid": "f9742816-8f27-4bd6-af3a-b8c8e332b021", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079460, "uuid": "e67fd8d7-7a2d-4e0f-b4e9-6235bdd36468", "value": "skyljne.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f2210b-b14b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705065008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065008, "uuid": "4f2fda56-cb30-4e39-8f14-01bd28cfc3c9", "comment": "Malware payload (Formbook)", "value": "b1ab7cccdb47e4b3e87b2c4055e203fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065008, "uuid": "d1ed1880-474b-468f-937b-38b7d27763df", "comment": "Malware payload (Formbook)", "value": "5931b9bb54cd619e0e0518c4e61654a3c154b59e72428698ea3f381cabaad213", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065008, "uuid": "28dd91c0-5dc1-4fe1-aadc-b270895399ac", "comment": "Malware payload (Formbook)", "value": "ca27b1b3639e8cb27d82310f95112b5021b8a653", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065008, "uuid": "8e708012-b874-4c23-8966-b836fb91418e", "comment": "Malware payload (Formbook)", "value": "57b75e219fffcb755932364f97e910e465ccff2a753fd86a021e54457b5689d13cd5571450254abf6296d36aed530422", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065008, "uuid": "e0e957c4-4de2-465b-a5dc-560e1f8632ac", "value": "T167E4BE4EA32043E3F0182B75DA6D7E5903202C7C74D2D7D8B9A9769BEEE1B92543311B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065008, "uuid": "6b99d888-9c0e-4b28-a5be-29d6c32906b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065008, "uuid": "5de222c4-6a8a-4890-a155-7a8155b5f5a6", "value": "12288:5ebOcLHhFQd2zjpltAQBmlYTQM+wFiCGZ3wtaqwArx:UVYILmQBmxMJiutnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065008, "uuid": "77f98e0f-3b34-4f9d-bf4a-9137c9ba53df", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065008, "uuid": "b326b826-2856-4e1f-942b-b91471673b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065008, "uuid": "d226c4dd-a76c-4a92-a1df-989f7091ccf0", "value": "Confirm!!!!.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f14bfdd-b10a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705036832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036832, "uuid": "b210c5d4-9f8c-4f8a-9eb0-6a4951359f3b", "comment": "Malware payload (RiseProStealer)", "value": "2fd5d3b2a7365e785b2c08fa4ec811ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036832, "uuid": "69cfcf37-13b0-4385-bf88-9fb02853c7b8", "comment": "Malware payload (RiseProStealer)", "value": "59f63e0e010518db4d6b1d6d1a7e7620fef5e05685d0756112a713278efef5b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036832, "uuid": "6eb44362-5930-44ad-991d-54198ff388b2", "comment": "Malware payload (RiseProStealer)", "value": "fa34a8706cf223218e83341282b9b6bd7e65c520", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036832, "uuid": "f3cccce5-68f9-45d6-9580-15c3416e776b", "comment": "Malware payload (RiseProStealer)", "value": "be13738a4817f3cdf273fcc5cb4d5686e5dfe8d2be97d6e78f67106c4177208486addf8cab23cc498071923dbcc9f5db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036832, "uuid": "ef11ede5-0f61-46cb-b4cb-17fdc4f4a387", "value": "T1DC2633776FCFD0B8E6A5327081E156C32F387CAAA15AB53F0B1DAB8705E129C9174709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036832, "uuid": "f04ba6df-af33-461a-aebb-18e4d522f036", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036832, "uuid": "7986fa47-d6e0-4c84-b14c-e42ae7dba298", "value": "98304:mWMcWhsEJ0qVr+NYnnWewxXeBwno4Q/mHv0XNekrOJ/lBJYrx5uwNog9:k/mEKhYnnC0wosP0XNekKJ/ZY7NoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705036832, "uuid": "24ef7623-ac1e-47ba-b159-ce3e72adadd7", "value": 4537856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705036832, "uuid": "c0e17514-cb0d-4b49-aa08-a11b3b9eb9ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036832, "uuid": "239519cb-d199-4888-be0b-51f68dd2d931", "value": "XWX354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b761059-b16d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705079454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079454, "uuid": "19a0d279-30f3-4ba7-913a-827964c02b97", "comment": "Malware payload (Mirai)", "value": "24274491bde667b124687a6185b10a93", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079454, "uuid": "cc151ebb-92b6-4cab-8079-508ea1b3ad3c", "comment": "Malware payload (Mirai)", "value": "5a4cc38c57bcf72e2bb845ef9e9da6ecd659b565f46605d158c7205d4f4f587c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079454, "uuid": "bc333430-e424-46c2-95b4-0514b7a80c9d", "comment": "Malware payload (Mirai)", "value": "737f5bdcf55054d65498c788ae78494d223e343e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079454, "uuid": "32a3af11-f93d-4e6c-a236-9d01d14cbc38", "comment": "Malware payload (Mirai)", "value": "a47a343f52071278053d7c3a0b7a8531348622f5594ee5ab34503b0372b832f8861dbbe9318f46f6bbcfe68f091bc210", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079454, "uuid": "1826ae9a-bd43-46e1-a154-0d8c78671ccf", "value": "T10014E81AAB610FFBDCAFCD3702E90B0569CCA54722A43B353674D528F54A64B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079454, "uuid": "2ddb978b-22f1-4e30-bc66-d2c4e6a118c9", "value": "3072:QYoPJJ92Xnl0BMF9CKT4P2555pbw3iJKQBIv87Q777777ugfz:QXJRMFN8PQ55NXJNY87Q777777jf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705079454, "uuid": "d7293269-6595-4b5a-9f15-4a682df1c5c9", "value": 200596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705079454, "uuid": "28c6cbd1-a834-485f-97e5-1c0ae13028c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079454, "uuid": "17adca5b-a21e-4e05-a5a1-60814b44ada4", "value": "skyljne.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a84df8-b133-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705054460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054460, "uuid": "6990f509-76af-4fcf-b6ea-10b49a9d6321", "comment": "Malware payload (njrat)", "value": "942df1706c052d73741ec002d96b4fdf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054460, "uuid": "b5076768-43de-4650-8c4c-9e7e886ec611", "comment": "Malware payload (njrat)", "value": "5abd6f4f7252ac98279db7727c79c5600870725fac5f8b883241a0265952fd69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054460, "uuid": "a634dcd5-e808-4d5b-b666-aa283f2a77d0", "comment": "Malware payload (njrat)", "value": "21857f677c914c4599e548fb031578fa6c710f6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054460, "uuid": "96d42a4b-4083-4c22-960b-06addd39a858", "comment": "Malware payload (njrat)", "value": "0320726918798c8f8c57c6296bdd41dff1823be612e5d2f7a278dd7e78686823bbbd0a0afa07db5fe71ea772144060cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054460, "uuid": "b6775910-be6e-413e-ac21-f6d5d353c595", "value": "T12F36AE527388DD22E07A2A36C8EF451447FCF8857B33DB1A3E8D726C25527E61C096DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054460, "uuid": "6305bc5e-9f6e-4ef1-b81d-f395e35a1fa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054460, "uuid": "08cdfd0b-2da5-491b-b535-8534e3dc034b", "value": "49152:TBm8JfTvWWDd6dgBvUNhIx2q7UU0ROfLV8UpY9gBhHaEE50acppKM:w8JmOUogq7GODaUpygBRXrpcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705054460, "uuid": "94699e47-7a6b-4e53-af7e-c3b7459df0b5", "value": 5181072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705054460, "uuid": "23253a20-f487-4e80-a0e0-82b39477bdd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054460, "uuid": "4f12de33-2f68-4d33-8407-5cccca2b752a", "value": "942df1706c052d73741ec002d96b4fdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe0c4ab-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056483, "uuid": "225c62ff-a147-4a70-be65-3b527325c468", "comment": "Malware payload (Smoke Loader)", "value": "ad1e983cf567b1dc01c123b5e90ae9a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056483, "uuid": "296c5156-817c-40dd-9d64-3be70b658a6c", "comment": "Malware payload (Smoke Loader)", "value": "5bd2b2d7fd28e9ae752fd2e5b669d4b7882f733bb22a4217a4822c5325246647", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056483, "uuid": "942a8859-22b4-4eb2-8f01-310a0c6f011b", "comment": "Malware payload (Smoke Loader)", "value": "22bd21477e92f2f914f077016414907c0dc12fea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056483, "uuid": "1bf96aaa-49e2-419a-99ca-d574dcc56f30", "comment": "Malware payload (Smoke Loader)", "value": "94c471dfca123d4dc40f4983b4e2a1ad7eaabef0e897615b58d11327a419487707c4d1ce423ac6edb7fa480556a88d12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056483, "uuid": "24c53e04-ab03-4d22-bfd6-84723c1eb559", "value": "T1F5448D2135E5C032E2B37B7589B1C3B49B7BB8636931794F2AC41E794F256D28B2134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056483, "uuid": "b0d65959-4070-4f16-bdcc-26f4bce66689", "value": "7b1df25cb3b9a53041bb12b024d69535", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056483, "uuid": "87ae5f62-c7a2-45b2-9868-9484c8f8cdb4", "value": "3072:xSfU5wqLWYLlsOS24ZV1TJi9N1K4SSy8PpaeMbZ07KY5Z8GRk3xZ077X+4rm7TV:IfUjLGZV10yWZDnE3xU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056483, "uuid": "193d0eab-c589-4624-b431-bad1f801b95f", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056483, "uuid": "a15bec22-4f75-4ade-87a3-6ce030cdf9b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056483, "uuid": "acf18295-4279-42c0-9885-2e27939018b9", "value": "ad1e983cf567b1dc01c123b5e90ae9a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91890947-b149-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705064002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064002, "uuid": "66702b49-d73a-430b-ae5d-0fc8f4e92937", "comment": "Malware payload (RemcosRAT)", "value": "0409b7d582ce1930c52592346b952258", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064002, "uuid": "d5486d0b-5a65-4d2a-ac78-7dccbbf105b5", "comment": "Malware payload (RemcosRAT)", "value": "5bd5d13f57ca5e62d744ffc05e03a5bafa36a7da3883d9cdda5a594f539bf91f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064002, "uuid": "d6ba9430-32c4-4d06-82da-3a2fb2a736ab", "comment": "Malware payload (RemcosRAT)", "value": "b3543801375b4194a0a38a5729f8922e0353a2e0", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064002, "uuid": "186a4317-f7fb-4425-aa5f-690371f4a14e", "comment": "Malware payload (RemcosRAT)", "value": "7961711f27b5e9bf0019958086b7bb6769eba4b89f460e7480aeaba0636ca47f6786e5dce916fc1fa27a886f27c1b206", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064002, "uuid": "b9dedd2b-eaec-4bdc-b1a6-0a30029d15f3", "value": "T1DA8412147626E2BBC46743B54CD4419F0A0DFCA0EF88A25B3076B3DD583DBA4F92574A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064002, "uuid": "3f9f6434-4e49-4df8-9e5f-7e35f695578d", "value": "6144:4PcBC6QREcis2JS5JACg1gG30q4SXR1dEzY9FVN91tJrUHepG/MmO:4EBC6uEHsu8JAC4g0d9EzkVj1TQHNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705064002, "uuid": "0967cca1-f3bd-4394-a994-33d8284e773e", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705064002, "uuid": "aa261402-d0ee-4748-80ba-c1068abf1e27", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064002, "uuid": "b4de73c8-b6e6-45a2-aec2-50eedecfeae6", "value": "ITEM LIST JAN 2024.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2f259a-b16f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705080182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705080182, "uuid": "4656c403-54ba-452b-a8ae-8a45d7c4bd6c", "comment": "Malware payload (Mirai)", "value": "566f8c4db1d2057a385950941d445081", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705080182, "uuid": "b32fc0d2-9e55-4bcb-944c-a8f200e42ed2", "comment": "Malware payload (Mirai)", "value": "5c696750b0891ee5d962f63464c7196cfd23cc6a9c047747c429c4bf2942b765", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705080182, "uuid": "0c7c6d9e-682f-4003-8e52-d5d519b29961", "comment": "Malware payload (Mirai)", "value": "fbf71071c223798f85a0e3b3a5920fd1c4caffe7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705080182, "uuid": "3a46a4ba-0806-4776-87f8-814a09fafd70", "comment": "Malware payload (Mirai)", "value": "915c5bd3c2dbe0a520b8a26b9742e7a7f34b1f2047e8f40dbd3a9d29124268a05c0df0adc06129ced2eca82635ddfaa8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705080182, "uuid": "507a0b7a-2fd5-4175-9f25-27680fffd96a", "value": "T1D3D36B76CC296F69C194C1B0B0358F7C2B53969081476FBE66B6C2B94047DCEFA067B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705080182, "uuid": "f809673d-327a-4048-9651-eb635dcc3069", "value": "1536:QaIwjLwbGAcXG5oxGjCtrwy2ChKwiuV11BRdM0G/Ws4HufJfDOUIl1d1v:QCMb/o1My2Jw/BRdc/W/HulDBI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705080182, "uuid": "68384c9b-e4e3-4b85-9208-6774de8134b3", "value": 136768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705080182, "uuid": "e8cd03d7-6ac2-470d-a43b-af3839e8afdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705080182, "uuid": "04df57c6-2a99-481e-88da-ffc8d3e72bff", "value": "566f8c4db1d2057a385950941d445081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71b5dd2-b104-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705034537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705034537, "uuid": "775ae6bb-8955-4589-8c53-dd3b1d74e6a2", "comment": "Malware payload (Mirai)", "value": "975288c489dc7396f525cfade384f6a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705034537, "uuid": "659d60d9-6475-4550-a6a3-5403177bfe06", "comment": "Malware payload (Mirai)", "value": "5c7fdef43f5e66c9b01cb2f10b821b681bf1e32a187943bd56c94e22f276e7c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705034537, "uuid": "3e8cab70-63a4-436d-aa0f-056b00118283", "comment": "Malware payload (Mirai)", "value": "4302776dd0f2a31ae8cc50fe03d6591a373c63b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705034537, "uuid": "7ed5f70e-3bf8-444d-8824-a2fab7b997a5", "comment": "Malware payload (Mirai)", "value": "fd1fda185a3fafaf4fd03b7c599c5f313b202bcede88b2986a86cdf6e6e3e789ea4c529ddbf2ccb06f85ce641cab5600", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705034537, "uuid": "d8a0ff83-2633-4a1d-8dd6-caba5b0185db", "value": "T18A534B01762C0E47D5A31EB4293F17E083FBE99120F8FA89255FD74A8676D32158AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705034537, "uuid": "142b1051-7b57-4c0b-a3d2-be956f09e07d", "value": "1536:1c0x2ppewwBCS8/I6qkhUjv7SqXJOZo11vfhU9n5zl:LwY6q2UjjPL1BhIn5zl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705034537, "uuid": "16575c56-9b52-4fe5-b0db-d3f5640417e2", "value": 64132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705034537, "uuid": "c4e86dbc-14b7-4a97-9a6b-a0090843000f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705034537, "uuid": "4c96733e-9355-45de-9ccf-473f99eb97a9", "value": "975288c489dc7396f525cfade384f6a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8823deab-b123-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705047666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705047666, "uuid": "73c486b6-cb25-4250-bb00-2e9d2b0b2697", "comment": "Malware payload", "value": "a1a0339f319382335a7d0b251c665f3f", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705047666, "uuid": "9dc3465d-1c04-484b-87b9-160d58dd7906", "comment": "Malware payload", "value": "5cf337f6889318c92ff236edc99097fa9a3a7a9fc4604ae5fddc079cc13c8b71", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705047666, "uuid": "86f86050-f273-4958-be98-79b9585c29e9", "comment": "Malware payload", "value": "9f552f9092b0c5a060ec3902f34c103cc0bd6ffb", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705047666, "uuid": "c308df74-39e4-41e1-a7dc-6c1253e55d73", "comment": "Malware payload", "value": "51a79aa75757b1f639cdc77cd82104fc9f4d0994278ceee534efb820d873c4b1eaa8a11f128b08b05736a90b5ffe6194", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705047666, "uuid": "9bf6c488-04ef-49e9-ae16-94c95dac5e13", "value": "T137E1A671B1CD4009A5B31177E3327F82D1DFD473036551047ABF297BAFA88B06A42799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705047666, "uuid": "e75798fc-8c55-4283-b68b-d50033fa7e76", "value": "192:8WXVLQFnqqBA8tRayJL7JL59LAkL5qT2qNPCAxLtQ2Deqiw3u:8WjoMyJL7JL59LAkL5qT2qtCAxLtQ2DC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705047666, "uuid": "89c5d94f-5ffa-4d27-942b-a8186fefc5e6", "value": 6818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705047666, "uuid": "8123716d-ec01-471c-be08-789a89dedd11", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705047666, "uuid": "5f747e7c-47bb-4bdf-b264-0dc24f751b68", "value": "0968579374476949039756547.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef50b53-b0e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705020297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020297, "uuid": "482fbf37-9c32-4818-96ec-0dd9ccf884c8", "comment": "Malware payload (RiseProStealer)", "value": "a618605aee5f0b1ecc689f1f27cc0b39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020297, "uuid": "ee4c9eea-6f6c-4cc3-9d92-46852f175082", "comment": "Malware payload (RiseProStealer)", "value": "5ec29e5f8023d0468f7c3d4b45003402a069c7d5017463d2dfad3fcc0f9eeeff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020297, "uuid": "f44a97ba-a1c0-4a3e-929e-1c5d80ca7bc9", "comment": "Malware payload (RiseProStealer)", "value": "d87bfdfb8b844f25209987b84a430fa6f3d7c215", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020297, "uuid": "762845e7-0206-4215-99c7-b0729bd55701", "comment": "Malware payload (RiseProStealer)", "value": "90f75adbaf1d9c2514b15e71431945da700d5bf93ffb89e83e7299ffa317a4fa44c8d83c40e00080b8dc0d63050e9a86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020297, "uuid": "536513c2-688c-45b7-942a-cbb139a5a51f", "value": "T16CE5335B27C99074D5F02B7121F253C30B24BC02A716936A92D4A6FF4DFFA68A43574E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020297, "uuid": "ebf2a06f-c2ea-4d63-81da-f4f919e56eec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020297, "uuid": "4f864786-b1e8-42d6-84cc-0b8974249019", "value": "49152:lSpqtQCRxwQr+auTaNq3xLeLFNFzAyLZg6TuAAn+AAtHCRo/TFnhwF0QbWC:1afQ+KOxLoLZLTz9b/pnhm0QbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705020297, "uuid": "99adf43b-e9dd-416b-93fd-2e42cd1dd61a", "value": 3063808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705020297, "uuid": "96e1564f-437f-4542-a02e-3799c73b0eb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020297, "uuid": "a2e2dcfb-db8f-4331-92bb-78e51f485a97", "value": "WEXTRACT.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e067085-b150-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Hydra)", "timestamp": 1705066949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066949, "uuid": "3d58ad43-5623-4f80-8336-d38554611257", "comment": "Malware payload (Hydra)", "value": "b8f6668a3ba2c07d42a0e7ee61b47d1d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066949, "uuid": "24095f79-328e-49dc-a439-52e53b49d9a5", "comment": "Malware payload (Hydra)", "value": "5f113715e47ddce3f72f9ff69b1aa07ee09225eaf6b501a7b106fa893779a931", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066949, "uuid": "efa23ccf-f2e6-45fd-ba54-ec4a172ec202", "comment": "Malware payload (Hydra)", "value": "7a4f5ff6209ad93ea60d0610bc06669d993f3c3c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066949, "uuid": "365c71d8-f379-433f-b78a-e06d2ceda13d", "comment": "Malware payload (Hydra)", "value": "87eca587c32e798865c2547a79ad2316ed6d8a7b58b97dd056262a016fd48a9807e592554e9c8c89502c601bd92f3712", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066949, "uuid": "ad1664ea-d212-4185-90f8-c0116d08f6f3", "value": "T1B1163340B0DCD815DAFC4B759FA8819A0BB77D99DF06973A3920730D0C72AC16BB8A75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066949, "uuid": "4e580272-cfe7-44af-b1ee-cfc3b9d12142", "value": "98304:BG+Zev6wIczS6HJHq+tr79uEjaoGoFl85YTix4bYsGqs9fAL63:BVZeCwZKQ9z5S8esDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705066949, "uuid": "886959d6-a19b-4446-b300-915e961baa16", "value": 4353749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705066949, "uuid": "18b255a2-0d0b-4bcf-8bfd-4ca54d726ba3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066949, "uuid": "227619bd-73ea-4c63-b090-a5b43d87263c", "value": "b8.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96661cbb-b149-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705064010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064010, "uuid": "506e068e-00f4-4889-8e6f-715c407c549d", "comment": "Malware payload", "value": "d6ed46fe026cb544c76ee58e6a37f219", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064010, "uuid": "e1dd34b5-6b88-4a5a-97a8-0b44f56eb4e7", "comment": "Malware payload", "value": "5fcc7e7307cbe74f1d56ac65ce624d4063782bd058dc8e1c3333ad3d6055d649", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064010, "uuid": "02919143-6cd2-494c-8b52-c1672f4fc48a", "comment": "Malware payload", "value": "2c63719b47c03c0c0fac65ac4c1e36c9225d67c4", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064010, "uuid": "8e5975d2-1ab9-419d-8562-1f335e65e680", "comment": "Malware payload", "value": "db4b0795a47f88ade233c9c9501f6850a9b4b70b5d1b046e6fd97d88f8bebf813138e060ce2969694c0bc4ddd39f8baf", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064010, "uuid": "627726b8-6583-4750-8fe8-f83b7c0e196c", "value": "T13C841211795A933BD05B8B754EE5808B1A0CFC22BF55621B3477F3D91C3EF68D822A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064010, "uuid": "f9a7526a-9184-464d-927f-e8b5c416784a", "value": "6144:PncBC6QREcis2JS5JABg1gG30q4SXR13sWL1DXh8ZMsInHR+8Smd:PcBC6uEHsu8JAB4g0dXsW1OMsi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705064010, "uuid": "3f3db3e9-5925-487f-9011-aa22e5ef85e5", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705064010, "uuid": "79756d36-88fc-4611-bb9d-e070900c343c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064010, "uuid": "77aabe6c-5706-4e91-901e-f54624f40451", "value": "Enquiry No. 2324561.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fb113b-b131-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705053668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705053668, "uuid": "f52c16b9-ab52-4b04-ba25-1163a90432bf", "comment": "Malware payload (AgentTesla)", "value": "ae78fc8b95da71ce8c49499fdb2c9c72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705053668, "uuid": "04f76c05-e893-4ee6-ba3f-5163f783c400", "comment": "Malware payload (AgentTesla)", "value": "5ff8b5b88ae1cd89f6f3d068f9eff75c50dcfd1f0b46ed0a45bdc3aea2721cdc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705053668, "uuid": "2fbc313b-f496-4e0d-91a7-dec9751f3d7d", "comment": "Malware payload (AgentTesla)", "value": "05c2b40dcd2fe41bbc7a10c09931805e20f52eb2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705053668, "uuid": "7ed8c7b7-3d93-4624-bca3-f9dd04440c73", "comment": "Malware payload (AgentTesla)", "value": "25fe4e648b3c4b4c5918b100bee78959e49f4f64b7b51e12c520aac998f6453a290fa5c14f2696a13cfb3162c8149799", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705053668, "uuid": "d6f7edeb-beee-440c-9e7b-4fd2a003849a", "value": "T127341E02BE48EB15E5A83E3792EF6C2413B2B0C71673C60B6F49AE5524517829C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705053668, "uuid": "80c39c11-f502-4a8f-8576-5d8f47c42238", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705053668, "uuid": "07097908-ed1f-4d00-a749-8af0386e10be", "value": "6144:yisPOG+mutQBpuvrZRWulSDWsEnwR0D88alM:jEOG+muWBpuvrtQCqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705053668, "uuid": "2ec369cd-6cd3-4ba4-aa32-27df4c486bef", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705053668, "uuid": "6e13685d-a1dc-432c-92c5-61f508ba8f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705053668, "uuid": "1fb769c2-e804-4428-9179-ae74f8d026ca", "value": "1705053667e0e37bf7561843150c516a052435421207031bf3a850859a332eab9720d53870355.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b92213-b155-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705068970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068970, "uuid": "dd9e5ae5-041b-4cae-969a-944e6156af96", "comment": "Malware payload (AgentTesla)", "value": "673426a63a110d142aeec4b7d6c87e71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068970, "uuid": "714e1b2a-c505-4415-8274-677f1ea59678", "comment": "Malware payload (AgentTesla)", "value": "616429d69e4f317b3c0a45f10489cb6182b36fe714578e6f872780b7dbe9c230", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068970, "uuid": "b377e1c3-189e-425f-93d7-1b7945ffcf30", "comment": "Malware payload (AgentTesla)", "value": "0e34ea0a99c9491020c8c33a4470acda4538da55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068970, "uuid": "3f081add-8042-4302-9930-33e3de5d4349", "comment": "Malware payload (AgentTesla)", "value": "659ec3b14e09b882164245adc04f97a5dc49cbc07084d60e99aa4c5861a8d084de39f936bdb8b1b2a0eb309fbe29f50f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068970, "uuid": "e25192ef-f936-4781-b309-ecd79d94aaa2", "value": "T1EA971242F65CC7B9E2BA07F0442951554BB77863A6F3E3482DDAB0CF69B5B8082D9703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068970, "uuid": "50b25d07-55d2-449a-963d-48408af90b5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068970, "uuid": "4a077ed9-94f0-44af-a721-de7fc8abd0f4", "value": "12288:0ebOUg03FC1G93ymv5I/65RjsuYYFs7UmZ/2RQl7J1zCoi0A5df:lrBymG/652uju7U6/2RQb1mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705068970, "uuid": "6d928af3-911e-4488-bf72-1b287222b229", "value": 40894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705068970, "uuid": "9af1425e-3013-4f6c-9e8f-aa8469f6ce74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068970, "uuid": "b58619fb-90cd-4feb-9ee8-c612022d0b05", "value": "Compass SC-70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e6b2f8-b11b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705044038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705044038, "uuid": "d6d34f77-80fc-4591-8b82-205d1da44606", "comment": "Malware payload (LummaStealer)", "value": "69ba37af776e9bc6d82b92622b643f9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705044038, "uuid": "1443fa5e-4741-4f52-bb3b-086926ebdc31", "comment": "Malware payload (LummaStealer)", "value": "63f30d7f027b58f513b600e27d0120b86041d5fa11134baae00d782c678fa5d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705044038, "uuid": "3277c3b9-b09a-4f70-a9f3-8bc5457f9885", "comment": "Malware payload (LummaStealer)", "value": "82cac280f4330ad49436eadc6ae783ad0f6e437a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705044038, "uuid": "93b37c48-59f6-4a5f-8b24-bfd9e6fe661d", "comment": "Malware payload (LummaStealer)", "value": "423687499521ae5fc505833fa510e38274441ead5fac5f34dc23a2c54b6fa58b4eae572ea2c52a5fd46b56bf1f3d6434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705044038, "uuid": "686b87c0-ec3f-4dcb-9a5f-962b488871f3", "value": "T15776236393721195E1D6CC3A9537BEE534F6436BC702B4BC68DE2AC260121B5E792EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705044038, "uuid": "58f27403-a901-45e8-b013-e0e21e7884a5", "value": "057f073470405518f73f377511b70458", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705044038, "uuid": "ba14f365-ac77-4d69-b6e2-7fdb23bee2cb", "value": "98304:G52m9gOdlluTw+at0E7IuShzwxqsf+8VdMPG5oWjAa9Y7VGUcSPhpCLw/Z5ZBbdA:y6OdM9CKtsf/eu9jAF71cqjFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705044038, "uuid": "a57a6442-eace-4dfd-9e17-bdef826a135b", "value": 7197184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705044038, "uuid": "074e3e04-060c-46e2-ac3a-0304bcac854d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705044038, "uuid": "3fbdf402-7290-41e1-8e8f-4dfd0953cdb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b09421a-b11f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1705045926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045926, "uuid": "f82c60ea-fee8-4494-a2a1-11ed2aceb133", "comment": "Malware payload (Gafgyt)", "value": "b0919eff56117ab399e30d716086a4eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045926, "uuid": "12323139-bde2-4e2d-a672-24cf5811d9e9", "comment": "Malware payload (Gafgyt)", "value": "645866e6fbfeabaeac6d97e3c687a2292a8ba0e0d11b33cafd8b0ec9e5e8603f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045926, "uuid": "410fed5d-c3e0-4508-b338-59a4418c4533", "comment": "Malware payload (Gafgyt)", "value": "2a5ffffebfe1552c6966ba0517d8f7467529273c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045926, "uuid": "356a6e09-9ba0-41f1-998f-e823131b78f6", "comment": "Malware payload (Gafgyt)", "value": "430662f98b0d235c1c683a5a04e0d6df1f1492f119eb762f21a7d972c4ff768480d3d6e6eb986c0e629e6933858d6c63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045926, "uuid": "f7047585-f909-4bf3-9ec2-2f6ab06d4e48", "value": "T1C6B3D707AB51DEB7C85FDE330AAA860120CEE45612E56B6F72B4D96CF70B94E08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045926, "uuid": "2a69cb42-6e80-4eb6-9525-6ccefb36c5ba", "value": "1536:UeeTu2u8IM46rrMNf4ZcrjYYkUNTEM4+ruBlLNzgLUmkiIF8iCKrmne:UEgrGf4d0EMGPZgUmkiIF8iPrmne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705045926, "uuid": "a797109c-97a5-4e41-80e1-8d7642b2ebe6", "value": 108974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705045926, "uuid": "3d22bea5-8653-4b06-b1d1-de650cb06bbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045926, "uuid": "2f48bff2-75e8-4c50-94fe-962976c8d191", "value": "b0919eff56117ab399e30d716086a4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495f3881-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1705056580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056580, "uuid": "bc326712-a680-43c5-b696-6b072ec49421", "comment": "Malware payload (Amadey)", "value": "d73f45a71bd2e748a728cc56468852cc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056580, "uuid": "ef6f98fa-a064-4ade-84a4-539e2f971426", "comment": "Malware payload (Amadey)", "value": "6465402b5a02aa817496718dadffa9885ac091c2b28029b25cda79630abbb45c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056580, "uuid": "aa67075a-f902-4b6d-b970-ee3555ecdc9d", "comment": "Malware payload (Amadey)", "value": "26783d6276879460c69ff476b1ed1bd9c75789b9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056580, "uuid": "e476d70c-0b1c-48f9-af0d-acf128dc7c49", "comment": "Malware payload (Amadey)", "value": "f484c461fa5378f9805870c6f254e062bc91d9dd0f98a4a6b37ea8ffc5ab1de5dd6713c90e7691a5bd611cd4faf00421", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056580, "uuid": "07d0079d-60d0-441e-91b9-b91fd1c55144", "value": "T1AAA4DF3072E2DC32E1F749B18634C7B04E7BB876252A958F67C05B795E707D0EA1A70A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056580, "uuid": "0da73c0e-bca4-40bc-85a3-ba8b36ac4133", "value": "2581d6c78303aee77584be94554614b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056580, "uuid": "90979d11-a1d9-40ee-9854-4d152896e146", "value": "12288:LWMtQFj+0w3aL4FLU4N0LlFolo5q4ROzs:Fti6z3aL4FEjolo5q4Qzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056580, "uuid": "045e6d9f-468d-4a40-b063-1aa8a03bf318", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056580, "uuid": "b6e8dc25-3f4b-4f20-90ce-1d00d4139cb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056580, "uuid": "183ca387-567f-4fbd-beef-d05b534785a4", "value": "d73f45a71bd2e748a728cc56468852cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23dcf51c-b184-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1705089159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089159, "uuid": "e6ce6e3b-8638-4a2c-bafa-16115f7f8bd5", "comment": "Malware payload (CobaltStrike)", "value": "29faf60a5e4334150dcf1188f2cc5d02", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089159, "uuid": "93014227-9d06-4a61-9dc2-1028e4afcde1", "comment": "Malware payload (CobaltStrike)", "value": "64672e440233c0624ba97623be556888f354c3672b6623302be7f2f0e49a8d7b", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089159, "uuid": "65e2a930-b3a7-4c13-9d6b-6a9d36ef421e", "comment": "Malware payload (CobaltStrike)", "value": "38e5b26f846f08c0861086eaddef993b6328a53d", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089159, "uuid": "6a07afeb-60d5-4b17-9f49-313f844b6e11", "comment": "Malware payload (CobaltStrike)", "value": "28e41c50987c9db9bb42765803819a70e4b93aacab1cb02bc74959645f2a03cefa07282aa1d7e74825a6a0645b387fdd", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089159, "uuid": "7eecb942-5074-463e-8550-0750b1bfb841", "value": "T1C062C671E90378B2EA155CF049FBBBB66F33F6938DA08829CF90D8D43910720695B659", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089159, "uuid": "7ebc766f-3d4f-49f4-8056-e5e160d4b77e", "value": "f6243a15fa8eee8ee96b5e1144d461f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089159, "uuid": "cf866dfe-e7f9-436f-90fb-fc2cb277abd0", "value": "192:D3mbPYCfMcrfOIuZmvKQxtzlSIVX6NOQ3shejDMN1:KMCfrfQ6tBSIWceUN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705089159, "uuid": "926e0190-9f5b-44e6-9d6a-3a93ac396f49", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705089159, "uuid": "8b168757-2785-4bb7-82bd-01a63d0b9195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089159, "uuid": "86c067e9-77e7-4941-bb22-bb2397bfa21b", "value": "Aws_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f40b45-b0e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705020193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020193, "uuid": "5cbcf0b5-2f49-4bd3-ab87-be8c2f6547cd", "comment": "Malware payload (Stealc)", "value": "e043e01cab4ca317ba51a8457c92ebda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020193, "uuid": "3b9bcd53-766b-486b-b0f6-e1b7f8742edf", "comment": "Malware payload (Stealc)", "value": "65002ea8e5b2e260c24fc287a5c0a39f271f666b4d2087d3f549cf71397abdb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020193, "uuid": "10e24ff1-be82-465f-b6cc-cbaf67c552cd", "comment": "Malware payload (Stealc)", "value": "57b8cc60310f8f5a75c3a5b83b62f7f33e60463a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020193, "uuid": "a02cc7cb-1852-439b-b5b7-5521c1041e33", "comment": "Malware payload (Stealc)", "value": "13b371f9962ca1c0288a5e279422ed140acb866fe48f6116af8d09edefcbff1d3881f250ed326fce1329ecd3a236d90c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020193, "uuid": "fe1c9812-410a-4d57-9ad7-1f0e052e8a19", "value": "T156548B1175F1C432F2B3797A8931C3A48A7BB8B26839754E2AC52E795F356C2DB21307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020193, "uuid": "04506663-69ac-4050-a2a2-acd91d39797f", "value": "e756b6e1fef872139f6c5d65a6a76066", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020193, "uuid": "93558493-fcd5-4cb0-8c41-22b122ae0cb3", "value": "3072:mBmOBLBgYXCGCwh6DAJiJ2f1KGOZhOaVsEXJNY9A1pnFU0xazLZH/u831A9IRaPK:uLLcwh6DHVXLY2nFUNzLZHhqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705020193, "uuid": "92d85513-f942-4692-8e22-92ee7c61d270", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705020193, "uuid": "9edcb42c-9a8f-4d4b-b36f-9b3036e8bb88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020193, "uuid": "44d6aa8a-eb8b-4dc2-9838-2fdc5cd46279", "value": "HG48GRE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e594d2-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705065112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065112, "uuid": "5b9882b4-e044-4ab5-b820-aa26087ffed2", "comment": "Malware payload (AgentTesla)", "value": "a5c7d0e30bfacbe3cc9eef266ec4240d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065112, "uuid": "405c36ce-abbe-4683-9c80-41e8110cdfd3", "comment": "Malware payload (AgentTesla)", "value": "667ade680488ead36e7e6cd112f953212c964c0dcbef2fe88923811df818e161", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065112, "uuid": "bfd7be6a-231d-453a-ae5e-7bf78df7b09f", "comment": "Malware payload (AgentTesla)", "value": "224416f439be152c8034b638763261bc953aeb73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065112, "uuid": "d54f8a3e-b901-448c-a954-dedfaa7d0304", "comment": "Malware payload (AgentTesla)", "value": "6acf88fa69136b5d7131a85921795e942ff8374a2e75036e49c0ee995994ea96483e70337b194754f5401ba96c5006c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065112, "uuid": "31fdfea1-2ec7-4947-8e4f-9ec5be060108", "value": "T13355AF0133B08111FE775A328A56EE154E797E29083BB52F135CF979FA721A2063DED2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065112, "uuid": "456904bf-9dd4-4c0f-a8ab-2225544dd035", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065112, "uuid": "71839177-d5e2-4f34-870b-7132491b0127", "value": "24576:bqDEvCTbMWu7rQYlBQcBiT6rprG8aB0Pc/qn8Fmg48O+ZUGf:bTvC/MTQYxsWR7aGEyS48pZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065112, "uuid": "cb13d259-a63f-45b0-b425-651cf7312946", "value": 1321984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065112, "uuid": "452cdae1-1094-4bdc-ad7a-2467782e294a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065112, "uuid": "b7905bdb-07a2-41f2-8744-da13d5b092f3", "value": "Recibo de env\u00edo de DHL_Gu\u00eda de embarque Doc_PRG211001715606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244a11ce-b121-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705046639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046639, "uuid": "b838f6b5-24e5-4256-8e92-d314e4cf3317", "comment": "Malware payload (Mirai)", "value": "05845ba2dac462d838406af6fa15aca1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046639, "uuid": "7afcec62-0313-40e1-bed2-7c318b7131a7", "comment": "Malware payload (Mirai)", "value": "66de0381a4186a04dd7c52d8110a4d41f695a1395c78006fe6ce9a6e72e2896e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046639, "uuid": "212f1595-51df-4c48-b53d-36edf3b9e387", "comment": "Malware payload (Mirai)", "value": "f31146bd2eb8d1320694d664b635797e281fb0c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046639, "uuid": "17c86ddd-5e6b-43a5-8ce6-c2471590f655", "comment": "Malware payload (Mirai)", "value": "5549d0fe8ec018b43816d4902668cb2f8cf63980b2a4ec63e0c33cabb7d2216d288e7c4cfd6291b62d1204d158ab05d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046639, "uuid": "a1e2a76b-8ad6-4e14-b7fa-540d2b7a16ca", "value": "T1066308857892A62EC6D067BBEB6F414D3364A7E4D2CE3213CC181B60B38B95F1D53B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046639, "uuid": "fdd9c632-bef1-4963-8ad0-b4d388eeeeec", "value": "1536:sKYfXYTN5w3nCWdToJzQAOuTx8/XSb0RHpsPX51tiq3+3+5:sKYfXYTN5w3nCWdToJzQRiuNRHpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705046639, "uuid": "c86a07db-df60-4007-8eab-19e87a56f8f8", "value": 69368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705046639, "uuid": "1d384b56-7080-40ed-914a-bd39ecb4a9cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046639, "uuid": "d6c784a8-4337-41b5-ae14-82af26240b05", "value": "05845ba2dac462d838406af6fa15aca1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905b3fc1-b179-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705084616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705084616, "uuid": "24a8c958-263f-4313-a4d0-100881a288b3", "comment": "Malware payload", "value": "456dad1f25fefa40f70c152a706316bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705084616, "uuid": "6d1d92b7-32d2-4215-9a6c-2593c4dc1c0c", "comment": "Malware payload", "value": "67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705084616, "uuid": "94fca235-dd0b-49e5-95c0-f911fad3aa73", "comment": "Malware payload", "value": "c741c8e32f1510c175c6d518401f3cf4d4f6d8da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705084616, "uuid": "8748db09-6bb9-4d56-ab8b-640cf9dc14ab", "comment": "Malware payload", "value": "b5965cbbce00c50df964a573d7f1fada347888d4d6dbe28508a641dc328354b18b1e68dcd4f9950d3ceaaffd681e8660", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705084616, "uuid": "e022a576-8a25-41f7-9b28-e49ec112ba35", "value": "T1D7952311B0E1C072F2B36AB948718AB14E7BF5616A79A98F27C5157D8F39AC1CE30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705084616, "uuid": "adb4a8f8-2c61-44b4-b26a-d2284707fed5", "value": "1219152ca9012f009c52738038ecb485", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705084616, "uuid": "0ae74a5d-26d7-4f49-b1c6-b674299d74ef", "value": "49152:F/MBkUJZCcifDFu/6nEkqg1kka+dW0hWk9NQXNF+9uop3biUIgYcoP:FEBkmZofDFu/6nR6SW+woVBlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705084616, "uuid": "afa682aa-bb3b-4a58-a1ec-2fc650892355", "value": 2003968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705084616, "uuid": "c9635110-bb5c-4c30-b49d-759b170231f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705084616, "uuid": "4da0cd39-fc56-4087-b8fa-515c3b577109", "value": "456dad1f25fefa40f70c152a706316bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a5a691-b121-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705046667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046667, "uuid": "5ff9c9a7-5e6a-4ee5-8e4f-8741aca0edfe", "comment": "Malware payload (Mirai)", "value": "e134f2ede107f22b6df120295b0b2b93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046667, "uuid": "2d94d354-1162-40d5-b01e-55ecb7d28e5c", "comment": "Malware payload (Mirai)", "value": "690843128f27403b327803722537c80b6f58990d8ac7a420fd4dae51561d9953", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046667, "uuid": "c7c52ff6-4a16-43a5-974d-3d6ba20ee37f", "comment": "Malware payload (Mirai)", "value": "c487abd7c5be92869ba0c404e9a82ac9f34ee836", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046667, "uuid": "36e6be0d-efb6-4e55-a293-f29cc1886203", "comment": "Malware payload (Mirai)", "value": "633deef7d2b5ff4c0eab1601360e9c8ce517d374b92ccbcd28c3d4fbe6a9818a7c83ac0917f4e86fe157b90238bf6354", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046667, "uuid": "d65eae55-75c3-4106-bb8c-b1a636f3f01d", "value": "T16EF3F60ABF600EFBE8AFDD3745E91706288C592622A97F757634D418F60B24F19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046667, "uuid": "442ff0b8-b31c-48ff-979f-8a13d3c8131b", "value": "3072:1rkfMcZ7cLnEIFD3MQ+4weSYLoZNussn:1uMcZwQcAQh+YLGzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705046667, "uuid": "ec14dad2-2800-43ff-ae37-f0f492ce3303", "value": 159076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705046667, "uuid": "d2dd741e-476a-4c99-b888-c316ea19664a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046667, "uuid": "995193bf-a0e0-4c80-8bc5-227220433b93", "value": "e134f2ede107f22b6df120295b0b2b93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5f4a90-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705065094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065094, "uuid": "ea360772-64f6-45ec-b288-4e3aa0b16b96", "comment": "Malware payload", "value": "d07e398671ac5a1bdbba3da94b468c46", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065094, "uuid": "0ddc85e6-3ce1-4672-a481-eb1b4664b902", "comment": "Malware payload", "value": "6978321a1e0a15c8385eaec5b8141f431bb1161359370d67609cc1542fa61f63", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065094, "uuid": "9d615206-6cf6-45dd-8c68-2b93d4551f74", "comment": "Malware payload", "value": "bb98b4095590c78d60f1e51ece2c2341d6766280", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065094, "uuid": "9459dc83-4b52-4855-828d-c1108b3e2406", "comment": "Malware payload", "value": "68b5045702ac576f39c6490329aad5f29520e505754b7813bda8f224304728094275f33ddc495be4103aa9854684eaaa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065094, "uuid": "196c7c11-e786-4b85-bdf2-d862099b6f33", "value": "T123E174117D9465CE17CB4BAB0B2AD3D7E0E4A4B37D59065BA300BEA07760134CFE1A7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065094, "uuid": "d425e449-cde3-4e0b-8358-8e5f7c709c8a", "value": "192:4+3+9dtBcegmyZZdNPCWXJNJZc48zKWZ4trzcsSIKXuVxmKHlplxd:4+3+NB0Hn5NvcpratrzVJKXoxjF7xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065094, "uuid": "ac306d48-0da4-477f-af35-26e68eb1b5b6", "value": 6948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065094, "uuid": "329390d7-2c5e-4621-adaf-6760111a97c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065094, "uuid": "2e2a8493-3bf8-4cb7-904b-87b60a76fa2e", "value": "DEKONT.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a1171e-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056518, "uuid": "ef918be7-321d-45d1-91c5-deeb20806d04", "comment": "Malware payload (Smoke Loader)", "value": "bca382ae53d61ae12b6e3420cf474f6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056518, "uuid": "ef10c063-54bb-471c-acf1-3b7d7976d502", "comment": "Malware payload (Smoke Loader)", "value": "6a4a7355b992673eecda83e99103ddd832d993ba1e66521a36f69a9d38ce5418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056518, "uuid": "4a509e5a-4eab-4a97-b640-99eee3c1f4f6", "comment": "Malware payload (Smoke Loader)", "value": "1729b577acba8f81e5e0568f1dbd2a95f6c2be21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056518, "uuid": "fe3e577a-90b8-4cfd-bb58-5c5deedd010f", "comment": "Malware payload (Smoke Loader)", "value": "772f1b653d792c90f1d56b05e2de11b99b3fa835560239e06e5d83594d93b70866032c32bd82625f60ac4a35c02f7eb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056518, "uuid": "b47fb24b-bf65-4de9-9b6a-1f1e7a832eb1", "value": "T117548C2176E0EC32E2E319358634C7F50A7B78726835998FABD02B794E317D1EA25707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056518, "uuid": "4db6006c-394f-482f-bf9e-5bb263a6df85", "value": "2581d6c78303aee77584be94554614b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056518, "uuid": "7e76e55e-7b73-412a-8bb2-1c4160da7638", "value": "3072:phSsvz5tse1uLlA8RYUQJSJilheleTQF5KFr/MT//l/q9aENHDBw8lgPJJPUzPlX:ysVtsSuLe88PKFY0Sa+jBbKTPU15l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056518, "uuid": "569a8f7e-4499-42db-b753-bb9bc8a65e1e", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056518, "uuid": "25839cd0-93e4-4c8f-ad17-53a38fdaeee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056518, "uuid": "56b9fa71-22c0-4de0-92c8-362f6821b460", "value": "bca382ae53d61ae12b6e3420cf474f6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f40f6b8-b14d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1705065609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065609, "uuid": "eea2b760-c81d-4aba-a18a-ed70198235d3", "comment": "Malware payload (NanoCore)", "value": "5bd57c1d6bb39c676f29953a9d5f4f50", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065609, "uuid": "8e0ea325-3218-4a2a-a6a9-e91e5247ff93", "comment": "Malware payload (NanoCore)", "value": "6ab25b50183214c0349b233d73b6fe1ba1d8b0dff45ffe2a5b6161da468147d1", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065609, "uuid": "7edc0306-056e-4e50-997a-463bc36e21b1", "comment": "Malware payload (NanoCore)", "value": "c99908ee2a9531390663e934bb14708efd762da8", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065609, "uuid": "6ca31cfa-e65e-47f5-bd1a-65fad7ad918d", "comment": "Malware payload (NanoCore)", "value": "8a32beeb55ea68aa089b2e486c1e4e923e44a02f0d32e74d2f88bec7d0c80bf1c95c071f42fc478b321f4ab29bbde0d3", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065609, "uuid": "2bf0c571-ce02-4922-800e-d6c90382bf9d", "value": "T10114CF2A7BB84A2FE2DE8679712201578378C2E398C3F3DE18C465B29F567E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065609, "uuid": "b9c01ebd-be54-4df9-8a80-66ad637e8da2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065609, "uuid": "735112dc-8a38-44cc-ae32-5220be114fae", "value": "3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIz1fdBFvBeiDYI343auG3UBUsc:wLV6Bta6dtJmakIM54dBFvgiDUEszp9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065609, "uuid": "cca838ea-0aef-4c70-b6a5-ed382b653d8b", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065609, "uuid": "17a2b8d9-bc84-4ac9-8273-ca8f10a8a3eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065609, "uuid": "fd3b7328-407e-4c39-969d-46746002cab6", "value": "1705065607bc7a8204cc9c8909de25ccfa330f0ffd4d63da3743cf2847f84839d88b833319500.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d64c6f-b184-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1705089234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089234, "uuid": "2bca6fd3-9cf0-424f-8bff-c1d947602cf7", "comment": "Malware payload (CobaltStrike)", "value": "1596029d65ed52f5d680da279c4d1433", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089234, "uuid": "6e9a07a4-ed15-447e-9bf4-6f371497e416", "comment": "Malware payload (CobaltStrike)", "value": "6b9698cd2668202190045c9a635e89e4fbd72ecf63d1484f05f92f724fcdd440", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089234, "uuid": "83bb4f80-cbf5-49f0-98bd-1f608f48351a", "comment": "Malware payload (CobaltStrike)", "value": "8755fc18b7debe9145f4087f8416e9ace62b64a7", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089234, "uuid": "51c721e6-652e-4071-be13-3696f71b1935", "comment": "Malware payload (CobaltStrike)", "value": "6510d62332c5cfc0e5360061b862b0a0590f887f179e2ba40ac780865998de6c9d56d2192e6f8d0e0bdb313b0f42ad33", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089234, "uuid": "4dac633f-d49d-4808-a717-4c1823d75da0", "value": "T1A662D6B2D91378F2E9165DF049FBBBB65F33FA938CB08869CF50D8D42910720695B219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089234, "uuid": "5e18fccd-ec71-485c-bff6-3dddd456d630", "value": "f6243a15fa8eee8ee96b5e1144d461f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089234, "uuid": "53651c1b-3a62-410f-a462-e5c8f33ab371", "value": "192:k3mbPYCfMcrfOIuZmvKQxtzlSIVX6NOgWHUl96ejDMN1:rMCfrfQ6tBSIlsUeUN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705089234, "uuid": "8634fb8c-2b0d-4172-90fc-e3cb50c9961d", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705089234, "uuid": "54dcc4b6-80ca-4066-9f68-dc3a3586d5e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089234, "uuid": "507d2cbb-9221-4111-9025-ac7e61bec50d", "value": "Do_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2e4d60-b166-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Empyrean)", "timestamp": 1705076257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705076257, "uuid": "0aeaafb8-2405-4ee9-8e03-f908c04ec9bf", "comment": "Malware payload (Empyrean)", "value": "fb932caf41bd93e0c7e8d7f0b772920f", "object_relation": "md5", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705076257, "uuid": "5da58a42-9e8a-4d8e-9979-f129342f8cb6", "comment": "Malware payload (Empyrean)", "value": "6bca1f55e5acc5b3c5d3848ef558c5e1b5a64ccb6041f3f2c7430dd46fd90f7c", "object_relation": "sha256", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705076257, "uuid": "5f92f66a-bfd7-4c1b-bc5f-a8ced2e2916e", "comment": "Malware payload (Empyrean)", "value": "808933ea2e89bb5b851263ebe5b0af2b0c3ab0ea", "object_relation": "sha1", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705076257, "uuid": "f342a246-2829-41b7-b2e4-1a2afdd1e061", "comment": "Malware payload (Empyrean)", "value": "a7e9ab99dfaa17887c62f2299c8d556565ae3511777307c9e1168185a438b26af140bc96a6874406c2c02f5e341c0158", "object_relation": "sha3-384", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705076257, "uuid": "b591f976-a945-4675-b1c6-6ace17685593", "value": "T17C1733E462880562E8EBA53F5C0FD86A116BFC052394D88E43B1E6385F737651A7FF90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705076257, "uuid": "2fe87287-ef5c-4f22-8335-89e0f6736da1", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705076257, "uuid": "0ef7acf5-54f1-490b-a967-9f71ada704d9", "value": "393216:gqPnLFXlreQpDOETgsvfGFwmgwqcvEbNlutYLJq:hPLFXNeQoEKBq1+tu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705076257, "uuid": "e35e3aab-8a8e-43a2-ab96-9155ddb50924", "value": 18531650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705076257, "uuid": "ed707391-51ff-45eb-a937-fb67acf50b0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705076257, "uuid": "90de8726-fb00-493b-9f41-4bdc8b7b3677", "value": "photo-y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b953318-b109-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705036451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036451, "uuid": "44043bd5-ef8d-4701-b2ea-b11d413192e6", "comment": "Malware payload", "value": "e8f29a662bd003393e7edcf6a548abaf", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036451, "uuid": "73b5659c-56a2-4dce-adf5-36761fb5f075", "comment": "Malware payload", "value": "6d9590b69f96c45064da67850359a0f662f5d7b1d2d427ea679b1e80f31b9043", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036451, "uuid": "44ec20d0-67ba-453a-8367-46e4178b1744", "comment": "Malware payload", "value": "0d6206235f77f4ec958e7649fa532762710244fe", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036451, "uuid": "6ea2b2e7-6ec3-4d56-a301-802149598348", "comment": "Malware payload", "value": "1a91572f1070c9e5d5185f67ec1993c367e64c73889e85265c7b15ce8c4615c53815307f3508e5bcf20968391c8b0c3e", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036451, "uuid": "bf0f0a2c-3232-40fa-8c59-61cc8b68c89e", "value": "T16C74CA5834D6A164A3FB1B434F47F5DAA736A3DB63BC1D586ACC0E8912DC6018C897F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036451, "uuid": "74ffe161-dc5d-4fb8-a5f6-1b9735693b78", "value": "768:Zhr85mfNiUwVSAah5xoPUlmpTBHa8qMNdl4BcJrcSUcwBVY3WXXBzg17wB:frbf0VSAah5xoPHTBHXqM9Tv3W6wB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705036451, "uuid": "8af00358-383d-4112-bb71-a4db321cade4", "value": 353554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705036451, "uuid": "2897b455-edfc-419d-913a-359f0c490987", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036451, "uuid": "0f1f9f3b-4657-4b49-ad53-c7742ea2dc72", "value": "1.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be96e979-b15f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705073527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073527, "uuid": "19b3bb97-8b4a-4ded-84bb-f4022d077ea1", "comment": "Malware payload", "value": "ce0fbfa00d315fa49efc6c3092be2bca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073527, "uuid": "b1af483f-4865-4d55-b388-e3a194d1b0b7", "comment": "Malware payload", "value": "6e36d48c1c2132e2f2069bc973a20e4235c6761e237051b31b3558a4df938525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073527, "uuid": "e85e1b6f-995d-44e9-98be-e767cb596dc8", "comment": "Malware payload", "value": "a810d518f397019cd371306e99ceb4ef5acc4a97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073527, "uuid": "12220337-5e85-4296-965e-780fcf4aaf2b", "comment": "Malware payload", "value": "d5e45895b00a0cc89d59cbb722a54fdbe2379f4726ff2dc24d4e6b3a09791923523e216f64afb22fd6de9b9c4aa4481d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073527, "uuid": "9d167829-60ed-4971-ba06-d2b7c8baf4ee", "value": "T14A94C4B0327D8BA2D17749712FCE49B429F97168B8D1661C24FAC369FBD2341088D9ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073527, "uuid": "78d3e113-cead-4d2b-b486-67d311b32f34", "value": "6144:OPGScdtYwmdNuKFi6uUMyGOGvzWQMelhWJnh0hfVKi:OPGSc4To6W1bEhkfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705073527, "uuid": "618269c7-9247-468e-aecf-964ca680c3a9", "value": 441856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705073527, "uuid": "91740c91-9bd0-4177-b0ec-f2333f7aaa6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073527, "uuid": "5296f489-ffaf-4a95-8dce-353b1069c1b9", "value": "ce0fbfa00d315fa49efc6c3092be2bca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9d9797-b154-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1705068608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068608, "uuid": "a79af6a0-b524-4b2e-8477-647532510ee4", "comment": "Malware payload (zgRAT)", "value": "013dd34c1d52ad6a86419657437e247a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068608, "uuid": "f3c42270-179e-437e-a0fd-80104b92fa6e", "comment": "Malware payload (zgRAT)", "value": "6fc264d3ffc563ee44ae41f7693c1ec08d3d57e19b69b6e59c0a300c7317135c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068608, "uuid": "f8c4de0f-fbb8-487e-8072-2705f38294b5", "comment": "Malware payload (zgRAT)", "value": "7e3e065d69e1217ac0a795989464e8c1266f9224", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068608, "uuid": "fa4e7240-0f09-4021-9644-6c384fc65158", "comment": "Malware payload (zgRAT)", "value": "bf262f8f3d03a29a742ee9a0dfe1790ae937a08ce1a753ad6776859d8fb08caa07084020497012c2dc1bea54aaf9fe73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068608, "uuid": "71ad4bd4-18de-415d-bfd8-f882f9e95cb2", "value": "T178567C02BB99DA12C0592737D1D7591843F5D986A323E74F36C633A91A037FF4C8A68B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068608, "uuid": "6d48b717-76f4-4159-bc4d-080a3dd76e08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068608, "uuid": "842fb1dc-ba61-4f04-8a8e-7a4c1f0ae8f5", "value": "49152:dc7zDiiSwc9hNVVRa79rosQe/POjXVdDyLdTE+mhTjx71YDKbHMGNuBeE:dwDPSwcZVVRiREbUFHmhZ1uG49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705068608, "uuid": "070458ff-0406-4826-8d3d-054ea3420600", "value": 6118288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705068608, "uuid": "38fa195c-2744-4b7c-94aa-931b8d063a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068608, "uuid": "18e62b30-035a-4ce6-8c8c-c0d455e4c79f", "value": "013dd34c1d52ad6a86419657437e247a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9496ed29-b16d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705079469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079469, "uuid": "ac61d474-0b44-45eb-94f2-b636ad8f5b6b", "comment": "Malware payload (Mirai)", "value": "3e4f991a16e5c2859944311aa34a93c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079469, "uuid": "f1f76621-5a14-44fd-94e4-303a763c1f3a", "comment": "Malware payload (Mirai)", "value": "6fc3c3b2019f7b45b78e623adc872986817da0427d273a9bb04c0c44ed8befc6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079469, "uuid": "2c4494ee-c762-49f0-9204-2bffbb29fe8f", "comment": "Malware payload (Mirai)", "value": "628feb2555e6fe2ceb85676fb21ece2133de4161", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079469, "uuid": "63705a84-8aca-4f39-825c-87c96454b6dd", "comment": "Malware payload (Mirai)", "value": "a15bd742c474061bc7bbecb55c95ee576034254c24247358e2b995e9ce3fd0ad5f4c5090da8ca57c0ed62aa18c9ddae4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079469, "uuid": "c04bd7b8-50bd-4092-963d-fc71bb25b3f2", "value": "T117E31945FC504E23C6D312BBFB5E028D372A17A8D3EE720399256F65378A95B0E37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079469, "uuid": "9bb72551-ed6f-4fa3-8124-26c6a5048154", "value": "3072:38cb9ryx7kkNS1Us4m4zpOwYf/6nX3R0BIs:386kk/2s4mqpOwhnnR0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705079469, "uuid": "56761b52-3603-4159-bdc7-826fa2fd0e85", "value": 149408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705079469, "uuid": "463e41d5-e0a4-4048-bfe4-1f034dbe0349", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079469, "uuid": "50435587-980a-4b20-be63-24c409647800", "value": "skyljne.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c8b84c-b132-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1705054297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054297, "uuid": "37de662d-a79d-48d7-bdf5-2147aa27bd18", "comment": "Malware payload (GCleaner)", "value": "8296cbae141373c0eb76bd0c5d026dd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054297, "uuid": "0bf4064a-d527-4f61-93db-2166babfd009", "comment": "Malware payload (GCleaner)", "value": "70c7a7f6c67627aa68aa90151740de9d18661b327d7220cb89ef899974a3384b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054297, "uuid": "9ed6d9e6-a927-4911-be92-5b473c4da333", "comment": "Malware payload (GCleaner)", "value": "d82e4ce4b4bb95dcc59b2559ada5522fab8d065d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054297, "uuid": "b5f6bb96-db60-4b9c-ad26-fda208eaa118", "comment": "Malware payload (GCleaner)", "value": "62a48dd7d2506f1d87737ae98ecbe914bf2f6902b3dfe2ce47b028bf6019fc1d515ee93f718c67200091119e6c6f2372", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054297, "uuid": "b7e90026-bb1d-406e-8830-ba9170cb6080", "value": "T19144AE1071F9C436F3B35A3A5975D3A54E7B786739329A8E1AC502B94F227D2CE2031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054297, "uuid": "ce450ae7-1f6d-4b6e-ab10-e93ad8602fea", "value": "68a8ea22d5d11f69338a9c3926759f70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054297, "uuid": "9a0f637a-949b-481e-bd5e-cee161325597", "value": "3072:UalMjGPW7yLGsJiFtlMt3oaCdC3X/C009Hc7NcNpT4DpRJApEqGA:1lfW7yLGds39Cw3Xy9Hc7NcpkdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705054297, "uuid": "61a3710c-f061-4749-948e-6a6d865abf05", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705054297, "uuid": "6fb89dd4-543e-4b14-abb2-4a9fe3dbfc60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054297, "uuid": "5cbdc497-887a-4368-b5bb-5e3916a5375f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa62ba8-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1705065091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065091, "uuid": "26540518-6b31-4951-8d94-cf52af4107fc", "comment": "Malware payload (GuLoader)", "value": "4962e030bf8c54f9f62a77128f5e8514", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065091, "uuid": "bb1b299f-c601-48e5-9979-47fcf059e0c1", "comment": "Malware payload (GuLoader)", "value": "71b66878e07f7fd1f045ee86c04af2d1ea63717de005893b04741b0fb236bf92", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065091, "uuid": "1302c62a-09d2-4983-ae65-d9630dfa4642", "comment": "Malware payload (GuLoader)", "value": "5b121a2268c02083cade74c2ec9e849e4b88d9f0", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065091, "uuid": "fadffa61-7c4b-4e82-8a56-57b3952749f5", "comment": "Malware payload (GuLoader)", "value": "04fbb6ed07aec32accb7bc4fea74154850dc694ae760f8fc0257c44c5bf0c4fd64c86486e0106c6e034c36c7e22b9bc4", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065091, "uuid": "76b6f245-a224-49bb-a641-1b803ef656cb", "value": "T16393F4E0C9C536398A5E079AAE0144C1C7FB8528633580DCE999F36E1923D5CB7FF668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065091, "uuid": "87c69b40-7bf0-41c6-9772-24194d41859d", "value": "1536:5YdWJ2JF1qusEggFwJm4QV+1HCaViG/u187LrQ5G+P4:ydeW3qFED8mf0FZViGWa7LE5G+P4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065091, "uuid": "9cafba34-1925-425e-9f54-d33d2ee60e2b", "value": 91472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065091, "uuid": "5304a8c3-c1fc-4b14-962f-85eebd8fb97f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065091, "uuid": "1e19c2bd-485e-456e-9fee-00679db7da51", "value": "izmir MA#111-24.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af88bf4a-b148-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLog)", "timestamp": 1705063623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063623, "uuid": "cc45d39c-19ce-4695-8bff-af16b0e33c51", "comment": "Malware payload (PureLog)", "value": "cafeab1513ff424cc79caeca170678d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLog", "colour": "#C5B355", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063623, "uuid": "515b91f8-9846-4391-905d-c76eda3a70e2", "comment": "Malware payload (PureLog)", "value": "71f7d548c9ea57b8c9dcc3f426adabdddb4451e65837b63c4c25dc2a812717e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLog", "colour": "#C5B355", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063623, "uuid": "928009ac-1c91-43a2-86be-70ba956b9ecf", "comment": "Malware payload (PureLog)", "value": "1b0f46593b38a577f56aa617f37413ea1053ffb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLog", "colour": "#C5B355", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063623, "uuid": "1f82839e-5270-48e7-a5c3-8ed7fcd808f4", "comment": "Malware payload (PureLog)", "value": "c8712f71c836bae158f4af2b438d9117018a4595f8198e9f22dae39e7b1b9defa754f069d8904d1b7b713ed3f5f836f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLog", "colour": "#C5B355", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063623, "uuid": "f1641520-13cb-44a7-ac42-2d48f5e1fcb8", "value": "T18BB2F82173AC1733D6BE0BF9587112800772A92664B1FBEC9CC8619E5DF7F804651B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063623, "uuid": "b61d9869-d37f-41c1-9638-76135c271456", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063623, "uuid": "3e54e6c9-3b35-45b2-9fcf-d47a5351b11e", "value": "384:QFluueRTgOrJuhuYEn4e1H8KDg/VTm56NbzbJFNcnAKUQ33ZgsyhLWPQZGSIfffr:QFpRGiNfbT83p1yhiPQZ/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705063623, "uuid": "61aa9fb8-64b2-4e37-971d-c5ccfd3f7256", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705063623, "uuid": "fbcddb09-08c7-4535-928c-c9654fb1dc2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063623, "uuid": "907265cf-f4c2-44e8-b016-98b63a3bb78c", "value": "cafeab1513ff424cc79caeca170678d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3a4b2b-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705065448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065448, "uuid": "ea1f36d9-6019-4071-9e07-790c38e5910b", "comment": "Malware payload", "value": "6fdd60cd2188fa85bc2ca48a8694b102", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065448, "uuid": "d4882579-9f6e-4797-b324-0182e226e2aa", "comment": "Malware payload", "value": "731919b308730b743aaac49f719a402faa76afcfb3d0d52412a1cd1b399b4fbb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065448, "uuid": "423ebcb1-9b16-4043-b3a4-cdc498a8280b", "comment": "Malware payload", "value": "e50a25028d55f1d9047eab9b12010d9cbbb6895e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065448, "uuid": "8700f797-0e0e-4c2a-930a-64e4e793a67a", "comment": "Malware payload", "value": "c925122265a0b2a1c22e4786de213d78260f79426d6bb0c2036c57b22f3d28b6ca3ba18ad822ad3bfd8e0b5991fcaf6e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065448, "uuid": "9ffa433b-04c9-4d9a-aac2-a252a123d2ee", "value": "T176134A13A6E29072EC70CBB81C39A315B77F7C703D7492BA97A459DE4C293825898377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065448, "uuid": "ef41e9ba-ee2d-47a5-817d-89592a636136", "value": "fcdd4a32bbfbd056f8b5642780c0afb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065448, "uuid": "04b9005d-dcc3-4986-829a-baa3c2ca7fff", "value": "768:KCpqFQLwm2VQRIsK6U6UaK+/692xavRH+TKmo1W4ctlDZkM4I/8xTH:tpqFQiVUfHU7aKuxvoWHdX4IUxTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065448, "uuid": "5df59286-aa11-4fdb-9595-cc97f9556cf3", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065448, "uuid": "383f0c60-4322-4531-af42-e792955fae34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065448, "uuid": "b79c4d1e-6160-489d-a498-48e47b0cc707", "value": "SecuriteInfo.com.Trojan-GameThief.Win32.Lmir.22983.4441", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cafb81b-b120-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705046277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046277, "uuid": "266295b5-cb22-42fe-9605-1b1ee4ac1d41", "comment": "Malware payload (Mirai)", "value": "f2499f28010632d16b609462e20d8fbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046277, "uuid": "de9b3037-4a33-4377-9563-8e317403e554", "comment": "Malware payload (Mirai)", "value": "7362348a80fb103636d133cf71ee6eee603ce3c3ecc1168b8715885b595a5fdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046277, "uuid": "40d30613-5dac-47a0-8251-b330c4e85eef", "comment": "Malware payload (Mirai)", "value": "244f739ff96f6bb0414c89a7bfa46ba2920b310f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046277, "uuid": "8c5513ff-ca5d-4459-af66-46fa7a843f98", "comment": "Malware payload (Mirai)", "value": "1ef4586e6d9d55cb3fad3e95fe1281fe1bb32825b21e17483c8d1eade9deb216f3d02af5f745dc74fd9bbb1d31e9e0a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046277, "uuid": "8e002c99-3ef5-4e7d-9563-d37758a4728f", "value": "T127B34C02B3180E47E1A71EF4353F27F583AEE99121E4F649254EEB0A8172D37558AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046277, "uuid": "4bf9b5fe-17d1-4ed0-867c-d4a3b7cdf11b", "value": "3072:/Rnhr/v2DYpXaL6NceXP9lpahYLOQ2fJbrPL/F9tPsnzm+:/RnhrZatQurTF9FMzm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705046277, "uuid": "8f6204af-0b39-4e91-819b-0f706aada4c8", "value": 116588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705046277, "uuid": "dbd8490b-869a-45c3-b84b-c1d71d2b5080", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046277, "uuid": "9add1959-2431-4e65-8f3b-b3cf2d1adc26", "value": "f2499f28010632d16b609462e20d8fbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472334de-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056576, "uuid": "8eee9830-840c-4937-9436-0ab75034927c", "comment": "Malware payload (Smoke Loader)", "value": "238aa349d279e6147d35ecda4459f5b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056576, "uuid": "4f2bde75-9f80-4c30-adb1-f74deb15454c", "comment": "Malware payload (Smoke Loader)", "value": "7381e44bceb1a34fe308780ad1aca1bf5298ef5fcad8e3a1fde188755bcc333e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056576, "uuid": "66851a1a-3b3c-4b2b-bb1f-1ba3cb0da4d3", "comment": "Malware payload (Smoke Loader)", "value": "27316a3c09c289130899898d16b96bdd7f4a06d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056576, "uuid": "50617c7e-6682-4334-ad55-23442b4f52ee", "comment": "Malware payload (Smoke Loader)", "value": "7c303219b10a381aac34ac6987665e98c797d81c09877ff6fbd6b322ec06539a1774c3546cac141d08f10e0cca4dd3bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056576, "uuid": "634dfc7c-6e16-4626-bd0b-baf1ab5b4a9e", "value": "T150548D2176E1EC32E2E319358634C7F50A7B78726835998FABD02B794E307D1EA25707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056576, "uuid": "ab712588-3ec7-4328-8e59-1d33b02dc176", "value": "2581d6c78303aee77584be94554614b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056576, "uuid": "e7fcb38c-5772-407c-a320-76c24e27645e", "value": "3072:hSsvz5tse1uLlA8RYUQJSJilheleTUJwdVl5nWl1dWEfeSopL6GIgP9+PUsPQH5n:IsVtsSuLe88PzGrfekG5IPUK6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056576, "uuid": "b29a4a1e-148e-4bc2-ac17-29b53c63049b", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056576, "uuid": "5b471a01-372b-4d2c-a4cb-a6abf377df83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056576, "uuid": "dfd7180e-994a-4864-948b-a0c65dc313b7", "value": "238aa349d279e6147d35ecda4459f5b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992721f1-b18a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705091932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705091932, "uuid": "759c9286-6125-4018-a42f-fc3a96c484a6", "comment": "Malware payload", "value": "9b20bcceec120045035664d732b3ac3d", "object_relation": "md5", "Tag": [ { "name": "bubblescat", "colour": "#3B91E2", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705091932, "uuid": "7159cf7d-a3c1-4083-bfa6-49bbb835d898", "comment": "Malware payload", "value": "73c156ea9e0695256567a9f2b6a140f9758423880f971b20d5e9e2875a9ca036", "object_relation": "sha256", "Tag": [ { "name": "bubblescat", "colour": "#3B91E2", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705091932, "uuid": "7c86ea15-5d22-4f69-93cb-3a27fa05e3ef", "comment": "Malware payload", "value": "68b3a950141e7985a68d6078931db9d9e3bda030", "object_relation": "sha1", "Tag": [ { "name": "bubblescat", "colour": "#3B91E2", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705091932, "uuid": "9f3c9262-2416-4735-ad4a-72d28552aa75", "comment": "Malware payload", "value": "7caaef98a7b5f8f693818ea757020d6b66105c1970e84792f8340fca408ae46a2e28a42170c543cdb1221bfe252c9d3a", "object_relation": "sha3-384", "Tag": [ { "name": "bubblescat", "colour": "#3B91E2", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705091932, "uuid": "cca6e64c-53b6-4324-8a65-bc293b5871f0", "value": "T19BF6336973400DB2C1DA633987664559A7B3FDA09368CACF13B8B3751E1B4C18C3AF69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705091932, "uuid": "c0f72c64-b5a0-46c5-b25f-a7e3fda2e85a", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705091932, "uuid": "f07dfdff-8bb4-4239-8077-062006d26a66", "value": "393216:qh9S2nnx8q63etEL+9qzT7Ck+7q301Jq1bWXiWCUI:89Dnx3I+9q/Z301mtVUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705091932, "uuid": "ecf9627d-2904-4e62-8992-6ca0b9b26e75", "value": 16240765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705091932, "uuid": "e1879c93-6001-46d3-9093-c05fdc8cf02d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705091932, "uuid": "17d5ebfa-5ce3-4205-b4bc-a490c62147d9", "value": "bubblescat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d66df1-b17c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RisePro)", "timestamp": 1705085800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705085800, "uuid": "9f288e60-a3de-449a-ade4-2c1db6f1ea17", "comment": "Malware payload (RisePro)", "value": "e22bfbe9e13c1c98d40319ba3bdfdf98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705085800, "uuid": "fda3f721-ef12-49dd-a7a3-8a03bdf7422e", "comment": "Malware payload (RisePro)", "value": "77d43860b95e6d41136e4f6e25e9517e9eb15d0b4bf02dde3ffe7a1e5b421a8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705085800, "uuid": "a01d0936-44d5-463b-8225-c59aa295c895", "comment": "Malware payload (RisePro)", "value": "50da446c51ea954b893c0592c80873f82807a2b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705085800, "uuid": "594250ad-653a-43de-8d35-bbd35b608177", "comment": "Malware payload (RisePro)", "value": "4c7e518ba7410254512bc783d38ebb052b7ea3f9494833a9985ac5ce38e20d55bbef7d5cc694445bc5a2764f9f8f13ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705085800, "uuid": "dc4369d9-2e77-4053-b3c4-c45ac184912b", "value": "T1A0856C31A741B462F86314B5725E57E611A235302B92C8D7F7C16FAEB2A2BD39334E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705085800, "uuid": "a2d71b88-75dc-49e3-9306-1aa9ac9e4321", "value": "a391c991ba6330d6ddb5beaa15ef064c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705085800, "uuid": "9b23e048-0278-4ac5-b970-01a5ea2b5a63", "value": "49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705085800, "uuid": "f0f5bd72-a03d-4d0b-a9e0-27dfa768912a", "value": 1711333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705085800, "uuid": "b491e7f7-888e-404f-90cd-8a637067142d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705085800, "uuid": "12d03d87-6bc9-4175-bb49-9b606bb83b85", "value": "e22bfbe9e13c1c98d40319ba3bdfdf98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0115f4b5-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1705065048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065048, "uuid": "582a05ed-7709-4bf6-a80d-70ec84592bdc", "comment": "Malware payload (GuLoader)", "value": "746bd431722c128ebe2d9a9644f3c803", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065048, "uuid": "db09676c-5407-4805-aa22-a2b59cdb6a12", "comment": "Malware payload (GuLoader)", "value": "7879acb2663e937ad8814f20dbcebad794b9defb8e4b6833beb648f9edee6b6e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065048, "uuid": "4c65e9c1-3990-42b3-a51a-b0b8b8f1e17e", "comment": "Malware payload (GuLoader)", "value": "582404ba61ccc3574638aac47b275eec0bad140f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065048, "uuid": "69243861-483a-4559-8753-fb720dce0d0e", "comment": "Malware payload (GuLoader)", "value": "664ed1faf45635e6e571241a70af32c930be026f94184057939fa3e7cfe02c3450222bbdff7cb6311be8c9063128e2a6", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065048, "uuid": "d373263c-d438-46e4-a4b4-1a62509654a3", "value": "T13493F568C9FD12398E5E0FFAEE01440194B9857B8235A0DFF899076E113396C877E7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065048, "uuid": "1b35e731-58e4-49e6-b9b9-a754e9296f39", "value": "1536:WEEerQhxT4ghGMxgmUZrIQ203E5J0w6tg9kCUSg67sRzzfahEz:tEEC94NMHerv3U5J0ftg9ZTZwFzfk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065048, "uuid": "84566896-59a0-43a4-a69e-53bd4be18867", "value": 92328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065048, "uuid": "060b8060-d552-4a9b-af67-ce725ea420d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065048, "uuid": "c88e47dd-c668-4459-9aff-ad44035a9a8c", "value": "Mart\u00edn Vecino S.L. Oferta 1112023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0b2c38-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056640, "uuid": "9338446f-e358-476c-8241-58ddfea76934", "comment": "Malware payload (Smoke Loader)", "value": "9c8cdcad2c02527baabc6021db827860", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056640, "uuid": "42f4e887-c627-4658-b5bb-eab3f09ea73e", "comment": "Malware payload (Smoke Loader)", "value": "792da83612534b65156bbeb82f175987cd969bee28f7c685623048b75a1e0c98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056640, "uuid": "ed77f5ba-84ff-40d5-a0b3-f8b74e06ecc7", "comment": "Malware payload (Smoke Loader)", "value": "595e8b0ca750ffa43b5d33135bd3ac8ad1cdd128", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056640, "uuid": "e110a2e1-fee8-4b0b-8933-da9e1ed92a6d", "comment": "Malware payload (Smoke Loader)", "value": "f88dd5a18a20611f0f7972046a7b298b6ea410ac66e9a9f84411ed89a99e1fa84eca727f91d86fdc5d39c26233cad33c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056640, "uuid": "a493c641-0892-44fe-82b7-1e3c2b12fba5", "value": "T111548C1132E8D432E2F35A714634C7F54A7BB8726825946FA7D42A791E60FE2DA30337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056640, "uuid": "02fdb004-8910-4e35-abc6-aa03f5e33c40", "value": "d3be11f6df42332786a4c0379b6f9121", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056640, "uuid": "6c2b10f5-c065-4224-bda6-c93bd0d4b1c2", "value": "6144:Gec43GFV0BLNzEwFrAcqvUoqcUc5E3/6IbRXMA:Gu3GFmBpzEwMHYL6Ibph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056640, "uuid": "f576c368-bfaa-44c5-ab31-563284cccb87", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056640, "uuid": "c6cec288-f8e7-439d-bdf3-fb463701c0a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056640, "uuid": "3d2ead5f-7526-4163-831a-c76c2ec317a1", "value": "9c8cdcad2c02527baabc6021db827860.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af90354a-b160-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705073931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073931, "uuid": "07696279-4751-4719-9c3b-d42e8d9136ac", "comment": "Malware payload", "value": "1b63b3bf2e0ee3f885d8c33a9109b144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073931, "uuid": "f001fad7-c67d-4f8d-b28a-98af0634a315", "comment": "Malware payload", "value": "797db6f65c21cb64c040a4067ced07167aa3ebf863757e22d18d50df60b6ef2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073931, "uuid": "37f7bd87-7ca8-4609-9653-8c858bf3ee0a", "comment": "Malware payload", "value": "846e7fd20bd8f892012c20699ca20d8d71caa314", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073931, "uuid": "23235c58-97df-4a74-b875-a7948e90683f", "comment": "Malware payload", "value": "c67e5368b2a3aa52a4e1c252df06275ffc3fd36188e52d9649df485bc0bdb62029211f361cdf0f40cee6603902fa4650", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073931, "uuid": "97d9f26b-e96f-4900-84a1-6faad039dbcb", "value": "T14665E1284B7DF95AC2D449F4BEA1B5ACE1789E612EBF02426DE3BC6ED479B4C3D05100", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073931, "uuid": "fc98625b-616a-4318-878d-735965815cbd", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073931, "uuid": "3c4763e3-e6db-4970-b99b-c98a2b60ac0c", "value": "24576:Tpnifg6osvA3Q7kGxpsc3X52LM7c03egQJI0AM2X2bveRnsQ66IyXX0GiJh:9ifg6pvA3Q7kmp33XQg7c03etpAMxveA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705073931, "uuid": "7af08899-b29f-448a-a2e2-74b73b077339", "value": 1531904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705073931, "uuid": "2694c55b-748d-44d3-9287-74c1cb5257cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073931, "uuid": "33de8041-c03a-4e97-bc22-35fffae9e3d5", "value": "1b63b3bf2e0ee3f885d8c33a9109b144.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7343f255-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056650, "uuid": "025215bf-3ac1-438f-8d09-8181cdee1514", "comment": "Malware payload (Smoke Loader)", "value": "55347799ea7c23a52cfbf4d734c76684", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056650, "uuid": "270e3346-ba22-41f6-957c-9620063c8cce", "comment": "Malware payload (Smoke Loader)", "value": "7b97762fc9c518b1b82275e483664a83b23fb7ff33535798b2afb28071581f16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056650, "uuid": "80af2f1f-c630-4ad5-af26-9cce1f1072f0", "comment": "Malware payload (Smoke Loader)", "value": "49f2ae2f9aab36827667dab45615f4e271aac62a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056650, "uuid": "3b27c1de-6e59-49dc-beae-f3aff9d8df64", "comment": "Malware payload (Smoke Loader)", "value": "c8b3542937bb64b165d93acbf0e18b3e4338d5a0e4be81dfd55a1033d5b944f3e6cbca60a85e7c04e2d0d7f21c1f51d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056650, "uuid": "c0e8444d-ce74-4869-ad81-7ef36e3a11f5", "value": "T1A2247C1039F58432F7F39A7656B0C3B44E7B78A77971998E1AC606B94F256D2CE2030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056650, "uuid": "753a1d8e-3f75-4412-b5e3-3582ab2c169d", "value": "38fa8b403d6d5217cfc0f8fc65c9b6e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056650, "uuid": "b5ab5735-5960-4468-b2a1-d893dafe7df0", "value": "3072:s9/htLJYeiJiiKORfDW/BMeALhSy5ABwIxREvBL2A:eTLJYeqipMXLE0Nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056650, "uuid": "0899d008-7b0a-4c08-9370-84e91fc0928d", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056650, "uuid": "e4398d3a-71d1-4b27-a40e-e164bc0ff7db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056650, "uuid": "dd2e39da-ead0-42f9-a20f-c257fe317c1b", "value": "55347799ea7c23a52cfbf4d734c76684.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e67aad4-b126-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1705048777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705048777, "uuid": "918fa245-9562-40a4-aba1-b0c23f8dffcf", "comment": "Malware payload (QuasarRAT)", "value": "75e93cb4b49079936178a1bcbf68c09c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705048777, "uuid": "660cc788-a23e-4f03-ac22-621d1766491f", "comment": "Malware payload (QuasarRAT)", "value": "7baf84b2dc1ef0c69fd51ab29dafe3645c7f8dce60b2f18022ec5270f13a1e2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705048777, "uuid": "510d3f37-d76c-4d4b-8bd2-1153a0e7b52e", "comment": "Malware payload (QuasarRAT)", "value": "455813ab7bb4c7244e8d5dafd39676bca25c8922", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705048777, "uuid": "ae40b3d8-1cd3-436d-ad48-c0fec7cb19e1", "comment": "Malware payload (QuasarRAT)", "value": "52b96e96a3348e5eaa0939c1bd65a9151e97ea60050ef981ac5b8c72a638c979b7d949cfdad4c798e45fb0960ec7e10b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705048777, "uuid": "e2f7df89-51a7-4d42-a96e-859c07687bc1", "value": "T1A9E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705048777, "uuid": "b1ab42ee-ab9f-4894-8614-a5d54f027371", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705048777, "uuid": "85c2549c-ef0f-411c-8751-004d95c415ac", "value": "49152:PvnI22SsaNYfdPBldt698dBcjHCeRJ6rbR3LoGd0CTHHB72eh2NT:PvI22SsaNYfdPBldt6+dBcjHCeRJ69k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705048777, "uuid": "4a2331b1-c764-43ba-9d4a-5066cb1733c4", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705048777, "uuid": "a08f25f9-fd74-4aaf-b2b0-d81e5cc85bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705048777, "uuid": "7ca85348-1932-438d-b846-9dfe20dbf4fb", "value": "gta_sa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56021123-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705065191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065191, "uuid": "f0151038-2ecf-468d-8198-6378cc00ee29", "comment": "Malware payload (AgentTesla)", "value": "8d3a082bcfc43ed90f5097f5a6c34c07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065191, "uuid": "73cb5293-9fe7-4850-add7-e67d34ad5fab", "comment": "Malware payload (AgentTesla)", "value": "7d41863d2e5ab0680309cb11248c4b8dea0cf129aeab87a96eb0ccdccd634156", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065191, "uuid": "832a7e14-1ca6-4a9d-aca4-bd0588c5469f", "comment": "Malware payload (AgentTesla)", "value": "91dff67ba91e0613a31a635fdd4fd25804f6a33c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065191, "uuid": "2f71a019-1a85-466c-8e1d-96b3ab55abd9", "comment": "Malware payload (AgentTesla)", "value": "a5e48a83fac58229ae33ff7b378c1e91ac5c540b6d41c2d7129a4d1289f9092a85d4888cfd0158c7a250fe476cc885f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065191, "uuid": "374ab87d-a21d-4e51-bf8e-b09431fd2d21", "value": "T101D41203F3BC8A71C5B607F01429D582CB76746769A2E35D1DDA70DEAAF1B40CA52B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065191, "uuid": "e99160a7-73c0-4eb9-8869-34054255a37c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065191, "uuid": "5f811c7f-5373-47ac-bf34-d848734a342b", "value": "12288:KWebOU+BJBTRxqW17Zt72hVCIzhi38m5lP3Em6E0lOMFQRQ5lveZI9S4f0:ct+BLTRxtyLNi38MPD6EPC7lhf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065191, "uuid": "94664987-9afc-45f6-97ac-d11c281a60a5", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065191, "uuid": "445849bc-2092-4ce3-b484-37fed1ca58c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065191, "uuid": "04dd7d09-abfb-4dcd-bbc7-ffa915e26747", "value": "Halkbank_Ekstre_202401012_082155_387303.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228eb986-b14e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1705065964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065964, "uuid": "7f673d7f-5618-48fc-bd1e-748f39417b24", "comment": "Malware payload (Glupteba)", "value": "fb545037ab489bdbe428559235a61cee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065964, "uuid": "50bd9f2a-cfdb-4389-9042-1190ca5e6f2e", "comment": "Malware payload (Glupteba)", "value": "7da786b32ec861208fc6a01b94d4eee4867b26dabfe214b66c9009b2f0222050", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065964, "uuid": "771791cf-004a-4539-ad46-17845563e69a", "comment": "Malware payload (Glupteba)", "value": "74b0dccbaaa27d7acc64427be1dee07269d0c71c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065964, "uuid": "a52b0161-f7ff-4bd5-bcc7-fdb8b4fc8969", "comment": "Malware payload (Glupteba)", "value": "890ce02bc899837f51b9107b0c8176609d1d61ef78749a1fa9e94a708ebca081f5ff8f2c5b12b710cdf935af74d63591", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065964, "uuid": "80aaaead-f12d-4999-9061-a1c3b3040340", "value": "T14536F02F5498217FF3C6C3B543A601908E17EEC816921658DCFB837A7A49B53AED603D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065964, "uuid": "67ee59e1-d8f6-4a17-8f4c-1d12de8ca937", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065964, "uuid": "20384c66-5eaf-4a61-b8bb-9a04c45f3e98", "value": "98304:3GA0UBXf1laFPEoSmXMAgpe48eDQZNkMOvr/juAS5i2zNsO:2A1fraU2ueZecTkMOD/juAS/Ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065964, "uuid": "20747fbb-0b88-4d52-8d71-0562b5e5d62c", "value": 4867584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065964, "uuid": "7f89392a-7f4e-4de8-a8fa-b3526257d83d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065964, "uuid": "a3557cbb-0aa6-4239-be9e-6990d5ea0c4b", "value": "fb545037ab489bdbe428559235a61cee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a5438c-b134-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Fabookie)", "timestamp": 1705054822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054822, "uuid": "d9eecc79-9e85-4bc6-8cb3-b297e2cadcae", "comment": "Malware payload (Fabookie)", "value": "d170f7da4c89aff96796a3481f21773a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054822, "uuid": "b488033b-31da-4597-b603-2013aab22359", "comment": "Malware payload (Fabookie)", "value": "8302d62f0ccd3c416440e413b641e698172e5258c81f1271da5fa782c034cc15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054822, "uuid": "81dd6444-348b-4129-b875-f2f7e8334ea5", "comment": "Malware payload (Fabookie)", "value": "fbbf751218aece650eff945afa5553f5e1c06c4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054822, "uuid": "376c60b5-a192-419d-9335-9fb95488e9d6", "comment": "Malware payload (Fabookie)", "value": "5a7fa72ebd4fdfbb30dda22a5a26849267618bb408f8e29f479df5ead3babf903993f2d51c8762ed399fb1a75d129fc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054822, "uuid": "f0a5ecdf-606c-41e4-8ca7-f746c61f6358", "value": "T10C949ED2E34040E5D477C2B982774B62E7F27C285B214ADF4659B6392F337D28936A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054822, "uuid": "01a41a9d-3ed0-436e-aba2-5c0f81331311", "value": "d1884757532ce7b0014241f40262c929", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054822, "uuid": "1a1304e3-d658-45a9-85ae-ec9dd2a3ca6d", "value": "6144:yl0CoZ3gYx1K2teOwrZDWZ4t0+eoJAbB3T+cbJp:WoZwYHKVrlH0+5cCIJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705054822, "uuid": "6f04127f-64d4-452a-91c8-a925b77c5dfb", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705054822, "uuid": "2f7119a5-5247-4992-ba35-42a8d2a16d12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054822, "uuid": "615a5f42-fc83-4787-acfe-ed9105339ce4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9330de01-b16d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705079467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079467, "uuid": "2cf86129-3b43-452e-ab0a-6ac03b94f30c", "comment": "Malware payload (Mirai)", "value": "cf04d0acf1c5b6d711e7b986861475d9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079467, "uuid": "3d0cca62-abec-4f04-90ba-8e5986c7b16e", "comment": "Malware payload (Mirai)", "value": "83d1cb2bacc1020ee409d91d466b6070ecbaf76fb940efc6f9d53ac44df6bda9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079467, "uuid": "819f60af-4a4d-4f31-a3e4-6c48fcf49bcc", "comment": "Malware payload (Mirai)", "value": "c01cd2394ea526aee580bcfab1608fce5fbc5ea6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079467, "uuid": "67b5873b-38af-4894-9586-beedd60bf69f", "comment": "Malware payload (Mirai)", "value": "2cd71c0837c5262d750e5710bcf53386d0c37d37a882d69e4459ba49f5877a3e937136524fd5df1be253244ef6f35e90", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079467, "uuid": "7d95c6e0-c832-4ef0-8802-c871384ca6c7", "value": "T1A8F30A56F8819B11C5D311BAFE1E028E37131BB8E3DE72129D246F647B8A97B0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079467, "uuid": "d1001ab4-abc4-4023-b23f-dc45ed6dc931", "value": "3072:qEPbXmd2/Uj9rhd0X21W3Y1Paw7WVrekSC+utSNBIvEf:fP6WQt0XaW3canUfutSNkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705079467, "uuid": "13b59794-9676-48fd-9656-edac5adbd1fc", "value": 164764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705079467, "uuid": "e915c627-92f8-4b46-b2b9-c0e0f68af3c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079467, "uuid": "833e89c1-ffbf-42d7-89cb-f0c394df1589", "value": "skyljne.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9375aeda-b160-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RisePro)", "timestamp": 1705073884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073884, "uuid": "5343faeb-1d6b-442e-a5c2-1ab47f3484c7", "comment": "Malware payload (RisePro)", "value": "edbbcf2c4e88a5a6f1552ec80e45b93c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073884, "uuid": "5ac8009a-2a5c-4cda-9f7f-d743f1bdc381", "comment": "Malware payload (RisePro)", "value": "84b0e2a4b475fe6eaa507eae7667016a7d3c684d8ba55fcdbcdf00e76fa12fe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073884, "uuid": "2ec9381a-3d6b-458f-a5b0-f4dc9fe58f76", "comment": "Malware payload (RisePro)", "value": "fca8571bec0610b88342011c8dd10c3838a85002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073884, "uuid": "92e1bdc6-937a-4ecc-b864-2d872b57a2db", "comment": "Malware payload (RisePro)", "value": "dc9f96284261e639f96b6860f4812cca5f1c7ab51f76c451629ad453da1714adf5fcae71ae31fd1c894fe826525d8e45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073884, "uuid": "43864bf8-284e-4084-b039-7df4c669fa58", "value": "T192856C31A741B462F86314B5725E57E611A235302B92C8D7F7C16FAEB2A2BD39334E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073884, "uuid": "16ee3a13-82a6-45bd-82c0-0087d9ef43af", "value": "a391c991ba6330d6ddb5beaa15ef064c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073884, "uuid": "348f553f-7ab9-443b-9963-bad3f6d14af0", "value": "49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705073884, "uuid": "ff14db4f-478f-44c0-aa3a-afd0eb469ab2", "value": 1710821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705073884, "uuid": "c0ff4e73-5305-44a9-8418-8a7d94c097a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073884, "uuid": "3a706d91-af66-43d1-94ce-227508e5c6e5", "value": "edbbcf2c4e88a5a6f1552ec80e45b93c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5ea4f6-b150-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705067077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705067077, "uuid": "530844a1-d471-4498-b3ed-70ca7bd1c73e", "comment": "Malware payload (AgentTesla)", "value": "92adec37c820f48c81b8e9bb4a56fe5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Exploit.MSOffice", "colour": "#7F0B27", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705067077, "uuid": "aa26158b-0a75-4824-964d-218510185604", "comment": "Malware payload (AgentTesla)", "value": "851468fddedf53fe23dfc8cbc568741692e8a6f0677069f1d07a3a0d185e08a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Exploit.MSOffice", "colour": "#7F0B27", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705067077, "uuid": "ca6ca7b6-33f4-440f-9565-72cd9b5b2d41", "comment": "Malware payload (AgentTesla)", "value": "cf9c014b0854358de3800014bf3cfe3de9dce66a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Exploit.MSOffice", "colour": "#7F0B27", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705067077, "uuid": "1e8f0186-9060-4925-b237-1de62bb4c985", "comment": "Malware payload (AgentTesla)", "value": "d14afdd6ed8f4111ab7939c6fbfa1ddd49133b51a3ad11a8c5c3e22a28c8cabd63cff642e89a82dcbde9be388df09d26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Exploit.MSOffice", "colour": "#7F0B27", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705067077, "uuid": "cc4b69d0-c935-4ed4-b9f2-1c8270487057", "value": "T11CE38A6DD34F01998F620336AB1B1E5542BDBA6EF38552B1306C433933EAD3DA1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705067077, "uuid": "1fd7a099-e875-41aa-9e03-c035a39fe0b6", "value": "768:LwAbZSibMX9gRWjtwAbZSibMX9gRWjGw093xS7lKPnXHaWayaAVBtTSCkMtu3gz:LwAlRkwAlRnW7lGX6WayaoTUMtuwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705067077, "uuid": "eefc6004-37be-410c-aac1-a4cfaddff186", "value": 150553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705067077, "uuid": "cc00f08e-635c-4ba6-8e34-d95c6aff84a5", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705067077, "uuid": "643a7ff4-a9c8-4808-a4a6-aa7d0dada7d2", "value": "PO6567800079900.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc183dbb-b15f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705073523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073523, "uuid": "47881e26-43a7-4754-b7a6-e165b44f7f61", "comment": "Malware payload (Smoke Loader)", "value": "560413121810458b463f81c6dd92268c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073523, "uuid": "230866eb-b769-49c0-8070-8a8707e3480f", "comment": "Malware payload (Smoke Loader)", "value": "8518533444f9d26fabdd17053c4e69df268c6f3d3ef8be30fd2ab649641b6343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073523, "uuid": "e83a311c-d89d-4d40-b09e-c6abb1d973cc", "comment": "Malware payload (Smoke Loader)", "value": "380fa45a2b2146eecc8465d7f74837ca7b5cf6c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073523, "uuid": "46e61bb3-e42f-47a1-8791-3bde3a670849", "comment": "Malware payload (Smoke Loader)", "value": "033f299c8aba07749b9d9e2858da1c4de1cbe90f17805052903b2b96f447edc265bacec8fd866eb662e5653795242b14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073523, "uuid": "8dea02fd-9847-490b-a4b6-ac4025798457", "value": "T1F3147C1035F58432F7F35A765670C3B44E7B78A769359A8E2AC506BA4F356E2CE2030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073523, "uuid": "9d8979cd-5533-4c9d-85b1-ac8fe35540cb", "value": "7e32959e1e010773874596cbc1a01e01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073523, "uuid": "4ea5feab-3cf0-4367-91a4-23c122d808e3", "value": "3072:mxrEQcahJioaqVAdZODEXaMs9HhMRhIe26KmUQQqRAGGovBL2A:mEQcaZYAEXD0hdHXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705073523, "uuid": "a01b6140-77b0-4dd4-9cad-b6f27c8143fe", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705073523, "uuid": "0a67f9c6-f649-49f1-a83e-7df2c09297ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073523, "uuid": "e81f86ed-a519-4f30-8a21-24408c68931c", "value": "560413121810458b463f81c6dd92268c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5271448e-b158-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705070339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705070339, "uuid": "0072e1f2-f894-45fd-8e1b-d0991b055ef7", "comment": "Malware payload (Formbook)", "value": "b4c236405fde2d29e8fcf24c4dbe8e1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705070339, "uuid": "56de039d-d5be-4c6b-9ccf-f3e957d0a768", "comment": "Malware payload (Formbook)", "value": "85346857515bcff04f4ec8aa4b906e12eff6073de9273d99113621cd30cce659", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705070339, "uuid": "0dd65fe3-29ab-4805-b80e-ed33aa961cb8", "comment": "Malware payload (Formbook)", "value": "cadc9e4432a8c13fc3ee70f2b0a305f1c72d233e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705070339, "uuid": "e57c43e4-5b29-4204-aa40-a958f2f44e37", "comment": "Malware payload (Formbook)", "value": "8dfe8383d9510e042d53e49518fe6e68f732ec102c244b918ce1972822fa80fd2c87c5082c3bbba993d933d4a2f0779e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705070339, "uuid": "f34b65e4-bf9a-456b-8f34-8f5c5bd56fbb", "value": "T16905F16623254A16C7A1A3B5DA73A7010A04F57A9173D30BE3C6663AB12B6FF1FF1701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705070339, "uuid": "aeaa0713-2752-48eb-bcdc-37eb37e8a1a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705070339, "uuid": "9bfb5744-777a-4fe3-a9a3-834b59780af8", "value": "12288:uKGrVPFrs711Lqy0Irgg9H1YmBWEwBdS5UdKHodsaTHNHF3P9CroYx/V:gMZ1LqyJ9V3WfEfIds8HtF3+x/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705070339, "uuid": "3d1616ea-4fb2-47f5-ab41-802ed4b1c884", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705070339, "uuid": "dab2d99d-aab6-49ce-93a0-fd380f72a6ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705070339, "uuid": "17f23a8c-b05b-4a4f-91a3-180cf2076026", "value": "PO #1246720.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7874c1-b114-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705041313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705041313, "uuid": "4423a49a-463f-44ee-8836-ed82dc2c7be1", "comment": "Malware payload (DCRat)", "value": "055f4c397046d84159e3892c6003acd0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705041313, "uuid": "1a5ab8f5-ac0f-41e0-9b9c-39edd7382024", "comment": "Malware payload (DCRat)", "value": "858935b8075312dbe37a7b1916d92ee6c19df3f260d0809b3a97b886297a86e3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705041313, "uuid": "5aac4e44-033d-4de8-9ca2-b9d455d0f0d1", "comment": "Malware payload (DCRat)", "value": "216cebf2eb20ae3392459c4e8dfb254a4e516599", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705041313, "uuid": "31f3c0da-cf6b-44b4-9343-f120c2c77af9", "comment": "Malware payload (DCRat)", "value": "f14eeef21834f52f1e190e17bea178c9af42c8471d424b07dc25082462a4de9a2bd69a1be0b59b286cdf9f5b3df28e5a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705041313, "uuid": "5804d24e-6bea-4d8f-9cc4-fb0c42d0ac5e", "value": "T12106F14765624E73C6A5BF34A4E7141F82B0D6613A13EF8B364B54D1AC472B0EB263B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705041313, "uuid": "6dc384a5-af62-4a0b-b671-40a4d4ea666e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705041313, "uuid": "4f3331cd-7be0-4828-9327-93bb811689d1", "value": "98304:yr9sJnCeNsSD6w6wI5tfXIOix1x0N2G3KcZJI:e9cAZwIHcxj0N2GaOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705041313, "uuid": "7d3d01a2-b251-49a5-b7d3-5a90bc41d1c0", "value": 4018488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705041313, "uuid": "bf4c2048-76d8-41b0-bc6b-19b76ab3ff24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705041313, "uuid": "d44298ab-6aaa-47b8-9cc6-9a072cafb11c", "value": "055f4c397046d84159e3892c6003acd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f8702d-b14d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705065639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065639, "uuid": "8b2f8288-58e7-4fa1-9c80-0cd2e9100609", "comment": "Malware payload (Formbook)", "value": "57ec8609c4c4bdc9c6249a30ba59b489", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065639, "uuid": "f7e4af77-8f3e-4178-a597-6b4e7932564b", "comment": "Malware payload (Formbook)", "value": "861f5ebaad65712e0c699fe6fad2f63cca3f35759ed92f44db0d6d089889d209", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065639, "uuid": "babd6181-6d4a-4373-bda8-51427d65a996", "comment": "Malware payload (Formbook)", "value": "437cfeb671c04f5393cf0732bf602d3fae226501", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065639, "uuid": "935ebfed-667f-4878-8756-821d1fde9648", "comment": "Malware payload (Formbook)", "value": "a9fadad3e1ad884794ca979dc1db2ce64f717c8eb3de62dcfd14178998fb0975056baa3eef3e46c4c392e82d0e44da14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065639, "uuid": "a0611800-a67a-46b1-a9ce-53baaed6c10f", "value": "T1EDC4125573F88B31CA7E4FF9AA65904253797E716222CB5C8ED124EE0662B500F43F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065639, "uuid": "69fdf2e2-2c77-4daa-86f7-4e544c39471e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065639, "uuid": "2ae23a66-d51c-461f-bdcb-b82e1e302d84", "value": "12288:rt7mabxvMpkqMULiBlw6xIZJNSWer9HtiHusQpwc962vpX:R6KxvMKqMMip2J8jiHuso6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065639, "uuid": "a32f9a24-cf81-40f6-976c-9d85cc06a6f9", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065639, "uuid": "a14e9d14-a57a-47dd-aa5c-bdcad786f768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065639, "uuid": "26bb6f56-9d31-4e93-953f-d2151c8c74de", "value": "57ec8609c4c4bdc9c6249a30ba59b489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1b4b2b-b12f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tofsee)", "timestamp": 1705052880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705052880, "uuid": "76efcf44-38b4-402b-83f9-a84db50923d5", "comment": "Malware payload (Tofsee)", "value": "33a5257b9ea7acdc82c83014bf5e10c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705052880, "uuid": "4255a2f9-25b2-4541-bb85-b8881a1768e9", "comment": "Malware payload (Tofsee)", "value": "87dc843c26db143ec9d2869ee4be3e53593fa7b4331a0ceb170f6e2339caa304", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705052880, "uuid": "f3e63207-8cfe-487e-8c25-2b62f6c227ed", "comment": "Malware payload (Tofsee)", "value": "55b35da44a67a5363f56921804defaa084a2265e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705052880, "uuid": "192c20d9-2841-4b49-9846-062cbf4944b6", "comment": "Malware payload (Tofsee)", "value": "31aa2e4598329fa1bb06f3fb9360e5330c8bff050d4fb0ac0eb75c27218456bcc84673092add6b4465a770c2186ef485", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705052880, "uuid": "5855e8ec-d4a9-4471-8699-2faf0ec92956", "value": "T1F6246B1075FAC132F3F3597A5574D3A44E7B78A77A315A8E2A8102B94F2A6D2CF1430B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705052880, "uuid": "dcc04ff9-d9fc-4ee0-8950-3e227bc8087e", "value": "68a8ea22d5d11f69338a9c3926759f70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705052880, "uuid": "44d7ba0a-bfe0-46b4-923b-d9cc01eb2b29", "value": "3072:dSSQtGlfg7lQJi9oFseTH0b5dkOExzi6EgdpRIDEqGA:YS/fg7lETzOERpdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705052880, "uuid": "b1cabac0-873f-4756-a355-c0f2537e5b62", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705052880, "uuid": "99800cf2-4be4-47fa-bba7-945f8c86ef73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705052880, "uuid": "831371d3-5278-4c72-9419-7aab34051bb8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c7b965-b16d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705079446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079446, "uuid": "26ec2697-c94b-4011-b57a-eae4822c30e6", "comment": "Malware payload (Mirai)", "value": "6fe1cbb4bddc6ee851ef53c94dc88dbf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079446, "uuid": "12c6131e-5144-4d34-ad1c-ee38fc1bdbdc", "comment": "Malware payload (Mirai)", "value": "88dc309153f65bd0644c4b91d1141bcfaea7d4e9a0d8069807686e1a1f362433", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079446, "uuid": "e8134ccb-6645-425a-b733-1320cafe0a79", "comment": "Malware payload (Mirai)", "value": "e7b538048d8b748d61bdc0a4938cab0af053b219", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079446, "uuid": "f85b2def-7256-4c11-94d0-70f96b2ff07e", "comment": "Malware payload (Mirai)", "value": "11d59e7635e6cb5ba265fafc5fd4d7b03d81b3c6592b778a840d8567687e2a21fde65e9f7405a27bb527c88d4486a9f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079446, "uuid": "7bd193a7-8866-4606-bd41-0c8754a1b0af", "value": "T1A1F34B17B5C18CFDC4DAC1B44B9FEA37DD32F4980234B16B27C4AA222D8DE215B5EA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079446, "uuid": "f321d558-49c5-486f-9afe-1f0edc5f5846", "value": "3072:ZBcqhQeCSFauYZSDYulrvuSQ22PrApM4ydwQujZAeTjrQDLQv:rcqhQeCSFauYZQW1u/vQDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705079446, "uuid": "96a150b0-b00e-4f7a-a57f-d23c9793df32", "value": 164312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705079446, "uuid": "64b507e4-fec9-49c2-8062-45ea6ffb4ea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079446, "uuid": "f564c812-eab6-4403-aea7-4925c19312e7", "value": "skyljne.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9a89b5-b173-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1705081904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081904, "uuid": "2e7591cf-4d63-4b1a-a2d8-634b99db2944", "comment": "Malware payload (Arechclient2)", "value": "f18bb1edd3ae7b63144e96132ce9aefb", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081904, "uuid": "07f037f6-d105-4f62-a7f6-7a578b1c85b0", "comment": "Malware payload (Arechclient2)", "value": "897b63dc56623c54120c95340a7e8c416786dbc18bb03dae3300ab2fd57e928a", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081904, "uuid": "8415cc93-fd36-4f9d-9d1c-e5f590f7544c", "comment": "Malware payload (Arechclient2)", "value": "c1e427cada1d7c0ffc7196d722ee6c0af82c2756", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081904, "uuid": "eac1aec1-3b25-4f0f-a592-4b1489234515", "comment": "Malware payload (Arechclient2)", "value": "7501b0a5f0b7eb9e68360941fbfd3a1eb8d99e05641cc9fa020ddafed7bfe90ccd933e3a5abf07ef26b02b360f5a8107", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081904, "uuid": "520c62c4-efb9-49f4-b8d8-84a2f9dd4317", "value": "T1E5667C07BA849E21C1996B37C5DB201453B5EAC23327D70F7ACA239516033EE5D8E6DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081904, "uuid": "9b9be2cc-5fe5-4408-a1dc-053b2a463fc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081904, "uuid": "e3e05679-0163-4f92-b2fe-b3052e97e701", "value": "98304:ukWTppXqlbXXSKXiDvrfuh8AN8HJyeZaDN6h:ukWVtYbnSKXSvbSupyYaDNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705081904, "uuid": "b980bae1-f9d6-4f21-95cf-0ee2b4e239f5", "value": 6775448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705081904, "uuid": "ff0ffe48-1f8c-4e42-9b0f-ac37a6ab369e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081904, "uuid": "2b36e483-af07-43c3-99d2-e05ffdb4c9eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64cfb95-b14b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1705065030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065030, "uuid": "f3e6acea-6d69-4d27-93e8-a8d690a4d317", "comment": "Malware payload (NanoCore)", "value": "18a14e17a10caea0050d85f6d977f58f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065030, "uuid": "e73bdf1c-ad6d-419b-bb3d-14e9b6d7894b", "comment": "Malware payload (NanoCore)", "value": "8aa2671c6a60560ef1d5c74a711e3044a8c35d409cc284aefaecbdd15ebe29ea", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065030, "uuid": "d38934d6-a2ad-449b-969f-ca353908195b", "comment": "Malware payload (NanoCore)", "value": "3e4aad1105327efeb101fd02833f4902e0c748fc", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065030, "uuid": "c249a426-df4d-4053-980e-4069e1580bc2", "comment": "Malware payload (NanoCore)", "value": "71c78ff29716c9984fd72b54f512447448474854fdffad3b01125af49a520d40a240800c5f36c0068c32bfe95c91fb9f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065030, "uuid": "2cedfcf5-1ee5-4c25-9748-ebd57109425f", "value": "T191A2EB2026FFA01CB2737F911FE4B6E94E6BFB72692AA46E104403075B63D80CE65775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065030, "uuid": "58979c78-02d6-4308-8b4f-f63c205b8548", "value": "384:xHIJWGNjEfxprTaOKWaADxGAYqRAGAJ7rVGAf7rCu6VWQ:xIzq1uO2AdGAPRAGAbGAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065030, "uuid": "50a2f776-1b23-490b-860b-8da2f9886b58", "value": 23084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065030, "uuid": "733b304c-be71-4112-bc7a-5b503cd3686d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065030, "uuid": "cf2d6fb3-70ad-4a80-84c1-98702e428d17", "value": "Scan_DHL Shipping Documents.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e2ee04-b123-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705047526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705047526, "uuid": "27295824-15b4-4ad0-9caa-7202c82618f3", "comment": "Malware payload", "value": "4fa62e50d86a744db77a05157454888a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705047526, "uuid": "8ddc6152-54c2-4a74-b91d-fed0a83b7dd7", "comment": "Malware payload", "value": "8d9576f6e8f69212d075b96842038e7353b5918919dad3b24859dbf4eabc80a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705047526, "uuid": "ba6b62f6-6d6d-4712-a468-da39fd28677d", "comment": "Malware payload", "value": "d7d4384d29afe659310455d544516849b14dd329", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705047526, "uuid": "53ed7030-bd5e-4332-9b24-397633d78b37", "comment": "Malware payload", "value": "7917d42ecd91f16801b4e09d25f4fe722f900a3c2862fe8df8a73eff9141ed1c59dc80e028aa9d659ab8b3f2b9bcf85c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705047526, "uuid": "229bad97-262b-4602-8e44-b9469dc3f0cc", "value": "T16645CF027381D062FF9B95334F9AF6114BBC6A260123E61F13A81D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705047526, "uuid": "8242c00e-1388-45fe-9346-9641165b5450", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705047526, "uuid": "6ecb8779-488c-4f6d-b837-1864141f4b8b", "value": "24576:RqDEvCTbMWu7rQYlBQcBiT6rprG8av61Ysw8aPRuzERR+e/AFGSghX:RTvC/MTQYxsWR7av8uhREe/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705047526, "uuid": "012f0821-c101-461d-957b-3eab14b6ba5c", "value": 1269248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705047526, "uuid": "fb4bb3f0-dc7a-42f8-86ec-ef537c3d8148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705047526, "uuid": "7f383d37-40fa-4c68-8a3b-1c00de49c085", "value": "MKP-ASL-IN-990817.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f06ee1-b123-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705047551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705047551, "uuid": "147bc9e7-a650-400a-a737-5b3dee1e124e", "comment": "Malware payload", "value": "c0e03c81663371e506c6de67423ecb73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705047551, "uuid": "8047e52a-2a7a-4b88-ae3d-1f5ae5d32572", "comment": "Malware payload", "value": "8e335f903d86e447fb05936d26290e5d7ee0250eef7bc7b1129c0a017db6c538", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705047551, "uuid": "9c512c43-2761-467d-aaae-6c3f4679160d", "comment": "Malware payload", "value": "ffefc427d9599a7ecf35dae8355ac28b5a79149e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705047551, "uuid": "86ffd48b-5caa-4863-b773-216f8d490f2f", "comment": "Malware payload", "value": "0b22b76aab3b0355b5fa2e466ce4eb16edd1bf2698991b490f6c7c06cdefacee1fc56c46ca01cdf20d783194e8d2d21c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705047551, "uuid": "b4c94b6d-28bb-4369-9672-137770aae489", "value": "T11B22FB85F3525692DC2306B6F8AB4701337AFE639C6A97AE284075823DB32511D33E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705047551, "uuid": "7eb6f98a-29be-4a51-b123-3670bc0beba0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705047551, "uuid": "fd87aafe-1622-4c4d-a558-9d0d88382668", "value": "96:9j7TUc6u/h2H4lN0ebFDtXykDhZCgNJVMps3PH7C64ln+flCnWiYNYNQCcFzNt:F7THZ/8H4lN5bLDx2ps+6unyBa7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705047551, "uuid": "7f6ccc51-393b-489f-952f-7f1176d170d7", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705047551, "uuid": "564c78d9-e49a-4702-aa03-d33c3c12c727", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705047551, "uuid": "93646607-d8a4-4b97-9262-30609f9ed2b0", "value": "New purchase Order 2024 6523027420.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48aafee-b109-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705036600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036600, "uuid": "da7d17b6-2a35-460c-b9f4-34a9465ae803", "comment": "Malware payload", "value": "590b95aae98615105cd020a531520b29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036600, "uuid": "95fd4a3e-2987-4fb7-a607-bafedc058f94", "comment": "Malware payload", "value": "8ec4a944f9be73731c55274731bfb2a1fefe13cb6a4c688d013104467aabe170", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036600, "uuid": "d026dde2-4980-4490-a16d-61db2e233f4d", "comment": "Malware payload", "value": "b24c6e1368255f30eab286cebde47d56b1cd781d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036600, "uuid": "135c3ea2-94ab-4494-abcd-8215c674581a", "comment": "Malware payload", "value": "b81a78c363426da5bd1aa009a40242078d8c068af162bfcaccacfa5ab54f4bd25a7df0e1bc76b7ef3b4dfc79143db385", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036600, "uuid": "294fb146-1263-4134-8825-86a21b502218", "value": "T1F034D901D4D68F36FB799D33F7A91646362B5989FC02A325570A93240C2E7839C92FF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036600, "uuid": "8991a0ca-9216-4133-8202-6e204f1dddc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036600, "uuid": "3bcbd164-68b5-436c-87d4-f92e32468713", "value": "6144:CVgSmiDZ4HNnB0JqqVFMg+ARFrSYpTp3smzyQc:kFmzHhd0qYpTp33OQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705036600, "uuid": "ed5e113f-f7f8-4af5-b78e-d01f8cbfa990", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705036600, "uuid": "43cf07c4-ea64-4291-a27c-dc61ac6063ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036600, "uuid": "03189f77-1aa1-47ea-841b-c5e92e8f492c", "value": "sypbdjojrgpthq.dll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfacda4f-b16e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705079998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079998, "uuid": "7dbb4810-6b5c-40d8-84ff-a054340fccb0", "comment": "Malware payload", "value": "e3f6ddc5b4f7fa7e999cd85061734f57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079998, "uuid": "415960cf-093e-42ab-bd26-329fee1c115f", "comment": "Malware payload", "value": "8f9c9b00fc65ab0f943bace26a7c2f921f5eebb04bcfa8fb33708c8fc7358be5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079998, "uuid": "d557a0cb-e9dc-4367-ae34-7a47ecc420ff", "comment": "Malware payload", "value": "0503226ac3c1ddba235a380c2714c77a44c8d2ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079998, "uuid": "6120bbd1-32ed-49a3-9c2c-079ebf085ab2", "comment": "Malware payload", "value": "1bc6ffcbd11e317faaddbd1580b004106dfa89281391fae6662b3b237414faebeae2060767b049535f83c60d30e167f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079998, "uuid": "6f5329fe-6f89-4c5c-9455-430eca1b642a", "value": "T19C9523F0B6F405ACC1D463F08B32E5A952D41CEACF660ED3C4A7A58A7B070C1AA95937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079998, "uuid": "93f8f64c-c02a-4bf9-93b1-75e7be5af395", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079998, "uuid": "749a4259-a954-4cf2-9e8b-6fca9dfe78a8", "value": "24576:HNzM6YBRO65naAebt7wViF+yDFnZfDuOKhvlTkrroxBOQifAQKoRhOjgo+Fc+PoD:RM6YBRO+PebeiRDFZrUSQi0oRHbP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705079998, "uuid": "7c46836f-e8e4-4bc8-9eb0-da164931b673", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705079998, "uuid": "ba482688-81f8-4e13-b74a-67a59a3e716f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079998, "uuid": "ede28ec2-fb58-4794-bf92-f126ce5944a0", "value": "SecuriteInfo.com.Win32.TrojanX-gen.14256.11566", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e487c3e-b10a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705036804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036804, "uuid": "26d939d0-3976-4690-a24c-d7095ca5e8d8", "comment": "Malware payload (RiseProStealer)", "value": "42442b9a9782ea9b4d5b745b0a1576d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036804, "uuid": "82757217-fafd-40e2-bb20-4180013e6325", "comment": "Malware payload (RiseProStealer)", "value": "92d28b540d63ccc0f54b297859ab68896fa9f650e7db459e27a4c7af271257f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036804, "uuid": "d0262f4c-eeb7-440c-ac0d-03f076353f1b", "comment": "Malware payload (RiseProStealer)", "value": "bb50d492c16d39ce50c6328abdf0ff7876bbdff2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036804, "uuid": "592b2056-d458-450e-84ae-2233b52244af", "comment": "Malware payload (RiseProStealer)", "value": "292e3823f316500b9b1457a40963b74d47a4354979a57debff4fbd237df011675666d9c5b58362dc45eb25ef30bf1cea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036804, "uuid": "f7dc110c-f750-469b-903f-6776d47f8b00", "value": "T131E533322BCA91F8FA74367055E647C74F347D6E6629733F060EF58B14B2298A13172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036804, "uuid": "687a7799-5c77-4379-87a1-db900df4c5b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036804, "uuid": "f9751219-7b0e-4ab9-83a7-62ce23dbd776", "value": "49152:jNkShynFIFIYNyWPWTWAPCYqnnBAfEgammU6TqcuR+Ax7E/+6OkzY:SSh5Z1K/P9qnBrYmvTTAwHOQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705036804, "uuid": "c7d17c21-0acf-4b47-9d32-b11c001ff9b4", "value": 3064320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705036804, "uuid": "44b94c12-a487-455f-8755-566d6452cbd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036804, "uuid": "767f89b6-0dac-46f5-8a72-2efde78dc7d2", "value": "XW 31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296f9d1c-b100-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705032474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032474, "uuid": "e20eca13-6384-480f-bd50-7ad3a52455e7", "comment": "Malware payload (Mirai)", "value": "ca0d6053dad244b064bbf4b6f9ed59e7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032474, "uuid": "ca3b9aac-0980-4952-b5a3-cb4fa1f6c7a6", "comment": "Malware payload (Mirai)", "value": "92f16c6b9168dd2bf302f99ee0981885327c91f0ef028749d5242e4ad67598f0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032474, "uuid": "7c2cb8ea-70cd-4afe-95ad-a5caddc635b5", "comment": "Malware payload (Mirai)", "value": "10b174e6e7020b83d6edd7bb6456a86196f42078", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032474, "uuid": "48fa2049-e450-4d4a-9429-2abbe48aa65e", "comment": "Malware payload (Mirai)", "value": "5902c5d278e8a5aeaa4e4d45da01ee56662c4b65ae81bcaaac839bf42dacc14ed7b4ae255dc355db6f023d5ba6405b18", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032474, "uuid": "5e45f7bb-0f5f-4538-80b0-deacd6a2bd45", "value": "T16D732A46B8818B11D9C4127AFA2E118E3313676CE3DE73129D156F2437CBD6B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032474, "uuid": "b9d0ab46-7eb1-4701-87d9-a0fb8f911082", "value": "1536:kin4vHTvEzleqlvu0igxX9WEgVhXha3a5nKMViwBf9X+MPK5nYh:I7yL38naCBf9X+MPKZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705032474, "uuid": "6702749f-3033-49d8-8da1-1187a1d833c1", "value": 79480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705032474, "uuid": "c6aea421-9cdf-4cdd-820a-6e88147b1173", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032474, "uuid": "49be5cfd-c0e2-4d3a-a1d6-e0c3b4ccce18", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e620818-b119-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705043193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043193, "uuid": "e9fdfba1-0f1a-4415-8cd2-754b697cbd57", "comment": "Malware payload (RedLineStealer)", "value": "e25e3ffa8c7477d24baaa2de8fce7da5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043193, "uuid": "1d584f44-ab76-4e0b-8ec0-3d58ae8ab206", "comment": "Malware payload (RedLineStealer)", "value": "94fca89e71f396bf1fd8f97ab027d6f64d443f6e3b8bc6ff259604401f78416b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043193, "uuid": "bc68bc98-238c-48d8-ab3e-3b369b89b6ab", "comment": "Malware payload (RedLineStealer)", "value": "7ccde7e55ec72c9859b96d17f19c6c89656d2696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043193, "uuid": "06048810-023c-4c4f-b659-7a5f073f3bc5", "comment": "Malware payload (RedLineStealer)", "value": "51d93404413dd777f5ef1b1b18547a4784527782443cda5bc06b9ae49e2819cbddbc200c7ee73f42f7857feb819f3776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043193, "uuid": "df49f3b6-9202-4eea-86aa-8b4d2ac26968", "value": "T1ED246B1867D8C922F27F0BB5A1F0A1A58774E413F542E36B5ED51CB63D12790EB012BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043193, "uuid": "542c9be7-4c93-48ff-9260-144d67816c02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043193, "uuid": "acc6228b-1ba6-4a87-96ad-e1fa9425ddf3", "value": "3072:22JLXfYoQk+nJLMbI7NKeiZixKMD4UydbXcnDaAxKR5AgkVMRqT6Dv/YCeqiOL:7NbIEn1bMZxKPAXVMRqT6D4QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705043193, "uuid": "e7724996-8bbd-4286-874b-a2a18f02ecd2", "value": 219476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705043193, "uuid": "25c3ec2a-b025-4b0c-9220-297d4b8fdbdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043193, "uuid": "8198035e-43ef-4276-9fcc-c3c149b20446", "value": "iamdlzkgy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60167083-b150-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705066926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066926, "uuid": "0a355b50-08ae-474e-8242-13e819c15612", "comment": "Malware payload (AgentTesla)", "value": "43854a652a7e8570691b1d212cf56ab6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Exploit.MSOffice", "colour": "#7F0B27", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066926, "uuid": "44cdcde8-bd5f-4a61-a958-dc32a8ebf7d4", "comment": "Malware payload (AgentTesla)", "value": "968b57f65cd5672b816f2cc3ec02568aff5c11d49e0425da1579ae971a9750f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Exploit.MSOffice", "colour": "#7F0B27", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066926, "uuid": "f00d7ad1-7a98-4766-9d52-64ddf4ce119b", "comment": "Malware payload (AgentTesla)", "value": "97a7ddfec69e84fb9125fd46e89ba3e27dbcb6eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Exploit.MSOffice", "colour": "#7F0B27", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066926, "uuid": "ecf449e4-c011-4655-b92a-3364fc13413c", "comment": "Malware payload (AgentTesla)", "value": "a727ce6deb55832680ffda48b0fbe5119a610a4493b73df30460d9f8e3e7fe5e3b8e03bb806b7e72efdf497763cacfc4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Exploit.MSOffice", "colour": "#7F0B27", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066926, "uuid": "7cd5c339-76cb-4ad5-8978-20c4bf2e8491", "value": "T1E8E38A6DD34B02698F520376AB1B1E5042BDBB6EF38552B1306C437533EAC3DA1252BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066926, "uuid": "6e06357d-e3c8-4373-9ef4-8541951c30ce", "value": "768:u4wAbZSibMX9gRWjtwAbZSibMX9gRWjTL7Iy0G6317eqtCBlXZaDJq:u4wAlRkwAlRhy0G63VtGnaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705066926, "uuid": "c0edbef0-0af2-4df4-84e5-de8f37419481", "value": 152266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705066926, "uuid": "a4136c22-293b-42fd-989c-a8adb1c14ac4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066926, "uuid": "8fc7ef5c-7b78-4c86-81fe-32e96315e076", "value": "PO6567800079900.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5759db80-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056603, "uuid": "64e39671-8c43-43b9-8f47-c23585bd15e9", "comment": "Malware payload (Smoke Loader)", "value": "e1b456618d28982614aee2fabebfdefe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056603, "uuid": "a1b4d521-929d-4418-b396-fe45a6700167", "comment": "Malware payload (Smoke Loader)", "value": "972a96f02c44e04dfd1e329aefb50194456f051c7c37c8a507be18869e4c026b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056603, "uuid": "be2ff0a8-d38a-4406-87ae-eabd13c8b024", "comment": "Malware payload (Smoke Loader)", "value": "6a9260a83c94ffc6728a8d33ef327c2bad138d59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056603, "uuid": "504ccf3c-5f3f-419e-8cf4-4d29d52f958c", "comment": "Malware payload (Smoke Loader)", "value": "361b4a45143027c02d839ab6466a541f926103f9ca33eefd0e68ab8ddcd453c586063e9202981e160604d0942bdb7da1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056603, "uuid": "ce874d9b-8e7c-4575-88f4-9ec949ce5b51", "value": "T1D0548D1136ECD032E2F319354638C7F54A7BB8726825946FA7D42A791E60FE29A30737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056603, "uuid": "a8569484-af60-4e0e-9cbc-7019913e4564", "value": "d3be11f6df42332786a4c0379b6f9121", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056603, "uuid": "ee7c84e8-9867-467e-af46-a5213f8f9ceb", "value": "6144:rec43GFV0KLNzEwyZNQh2Na/DO/6hbRXMA:ru3GFmKpzE9Ica86hbph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056603, "uuid": "a59b9dab-a040-431b-8b86-29424b48411e", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056603, "uuid": "a2010ceb-6a99-4b89-81ce-80e6f04adba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056603, "uuid": "6e85bd13-045f-4762-ac59-ff2e5986ee07", "value": "e1b456618d28982614aee2fabebfdefe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311161a6-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056539, "uuid": "03a23c8b-0e49-49f3-b406-a6892f222a94", "comment": "Malware payload (Smoke Loader)", "value": "0e701c161445a38395864a712b2ac5e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056539, "uuid": "454146ad-a55a-4a49-9bc2-dcfc5d4f7409", "comment": "Malware payload (Smoke Loader)", "value": "9744b215300c01b5e7f18199287b2b898bb1a8a7d3b01f9acea6eb6069c62f1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056539, "uuid": "95c009ab-68c6-4edc-ba2e-c7df62fb91d2", "comment": "Malware payload (Smoke Loader)", "value": "69d25f6a747f4b3f85581b553b4ca151f7d91f2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056539, "uuid": "c7130157-1324-481e-9782-a4265cc8f562", "comment": "Malware payload (Smoke Loader)", "value": "be8d887a766561bccc7cf3e4d1691fc4bb50e9a86cdbddfb3c33a9ec5cc4ef25fa8a6661ebb1f738f09e25409741feb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056539, "uuid": "ca97ae46-1ace-4c71-98bc-ade72d4c84c4", "value": "T181548D1172E8D432E2F319314638C7F44A7BB8726825957EBB941A695F60FE2DA30337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056539, "uuid": "0dbc6179-d3df-4968-9442-33f3f6a6a3a3", "value": "8da36e8ffcb4d15cc88a2def2bb4e769", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056539, "uuid": "760574a6-f8c2-4a6b-ba97-146fec1787b6", "value": "6144:M/X/olGzlIaLGX2jSzpSn0sGTL9yaH/62gjbRXMA:MXeGziaiX2Gpf62qbph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056539, "uuid": "1c95b2dc-47e2-488f-93c9-777ae1936eec", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056539, "uuid": "4a40c704-cc25-4b76-a254-c1ec80d4efa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056539, "uuid": "dfdb6061-4aac-4f1f-90fd-26a888c1f5e8", "value": "0e701c161445a38395864a712b2ac5e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e77999-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056646, "uuid": "70099388-9726-4cb0-8019-5d1d63ac5e89", "comment": "Malware payload (Smoke Loader)", "value": "c94100d5d5e70cd886b6c769af99fe2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056646, "uuid": "bb49d807-c1ef-4f90-8056-a46581f498ae", "comment": "Malware payload (Smoke Loader)", "value": "992a18c1acf77c16753e3427ad1b034bb492db056afc0849577559fba16069ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056646, "uuid": "0fde698e-2def-47ba-beb1-12d5c2bc6056", "comment": "Malware payload (Smoke Loader)", "value": "b3fe3fbe5219417512c53192d4a71b53ed254e7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056646, "uuid": "3046ffae-e93e-4820-bc37-020c10c13247", "comment": "Malware payload (Smoke Loader)", "value": "ca0db75a7d335c71eb31208df2cc9147959f2934e9e1a26216e6c2c707a415918624de5e12365680ac356c0a5b5c7767", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056646, "uuid": "39447976-c979-46ff-870d-13f6b242bb2c", "value": "T11F548D1132E8D432E3F319354534C7F50A7BB8726825946FB7942A795E60FE2EA3073A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056646, "uuid": "cdb6f334-2413-4686-9c45-6c6cc7a7eb22", "value": "bb47bd5090dd2b8401c8106609617fb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056646, "uuid": "17548b0d-377b-40e7-ac24-9be1ada312e9", "value": "6144:becopGFVV9LpU7ZmP4EtisyXjp36O4+/6OXuLbRXMA:b+pGFf9lU7oPdisIlDt6vbph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056646, "uuid": "73422a00-d18e-4b98-88d4-62695e4c8d92", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056646, "uuid": "3bdfbd20-f91f-4adf-8bbf-408b5f16382f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056646, "uuid": "e504106b-bb55-48d1-bc8c-59acdcc81e48", "value": "c94100d5d5e70cd886b6c769af99fe2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83898487-b154-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1705068703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068703, "uuid": "fc5aa26c-f10e-443a-95fd-47848aec8a53", "comment": "Malware payload (QuasarRAT)", "value": "8c1e7d74c62a687a236a3262f09269d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068703, "uuid": "be3dd09c-507a-4b1e-a032-21328278a918", "comment": "Malware payload (QuasarRAT)", "value": "9e6fa1f280864e2933528e17984bf2d448b003bda842145f34e63cc8a4b337ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068703, "uuid": "6637bf61-e8b8-472f-8538-d07535d64635", "comment": "Malware payload (QuasarRAT)", "value": "896a403897661d3834f540a10678463f4ef4c81d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068703, "uuid": "5f2ea399-09f1-4bed-a1dc-c63c4127d019", "comment": "Malware payload (QuasarRAT)", "value": "29a9333e376193660bd9f2fa18a24e2361c4ea62c3c822df74d001f1c32aea9f582054cd0207e1b0f41c250c839f0b5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068703, "uuid": "43c48976-344c-4bc2-a06f-a9b3552df3d6", "value": "T12BE56B143BF85E27E1BBE677A5B0041267F0FC1AF363EB0B6581677A1C53B5098026A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068703, "uuid": "45a22d1a-65bd-4b95-bd64-9271967280bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068703, "uuid": "b7d9ad84-5817-464b-b7b9-e8ece6b93711", "value": "49152:Pv1A62jiaQDKwPFlJn3xFQsZQOdmRJ6abR3LoGdMoTHHB72eh2NT:Pve62jiaQDKwPFlJn3TQsZQOdmRJ60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705068703, "uuid": "9b6636ed-28fe-44f6-8e43-19d34f8b7464", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705068703, "uuid": "f1ef4342-d887-4d75-92ac-0ca01cdd167d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068703, "uuid": "d428ec1b-0783-4164-ad8e-a474d8e59040", "value": "api-ms-win-crt-environment-l1-1-0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ff74b1-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (StormKitty)", "timestamp": 1705065182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065182, "uuid": "4ee91e06-2f00-42e2-ad9c-fdcf0245df51", "comment": "Malware payload (StormKitty)", "value": "83ae9b3595c31f63411f49acb821229d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065182, "uuid": "67e78b04-0313-4f8c-bda3-61267a6b67ba", "comment": "Malware payload (StormKitty)", "value": "9efc56963653ce8b7f63f767d39b32d72bbf8d318de43c4434002b853e3728eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065182, "uuid": "082b6198-9760-4838-a8d6-7d0284811ec2", "comment": "Malware payload (StormKitty)", "value": "c4977447c4058a554a5a89364034e2da8037afdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065182, "uuid": "734b1c10-d4bc-4f97-82f5-c1cf3094e915", "comment": "Malware payload (StormKitty)", "value": "cdf16915ba32e3b6d5c6670924e4b63f771e007aa22c243be2e6385b86570c978146cdc4bc6f6d905e0adb18cda09bd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065182, "uuid": "3557900c-825e-4ccb-8868-2218cf7c27f3", "value": "T17C46BE15FBD405D8E97AC634CA1A8732D6F1B85A0631D38F0928C35B1E37B958FBB225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065182, "uuid": "480f679f-feb3-4358-b3a1-c87ec07a1222", "value": "0751433fb799ff99dbf59b2d0c85d83d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065182, "uuid": "a2530403-9d34-4497-94bc-f46d31c1c43e", "value": "49152:YipYLUueABiJvlJ98yaWw0R8TrmCIuFCTdU8ncVt8L+n3f9GflWMv/TfTtu/u6nB:+f3L04d8ncVCL+96J/Um68k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065182, "uuid": "a11d32ed-3953-4a99-b6cb-02a190053f7c", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065182, "uuid": "3aae0fa9-1e18-4d08-bfc9-c7a22d1ed838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065182, "uuid": "e648127f-7fed-49ab-8a20-24d57a828a86", "value": "OdemeBelgeis.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9e5b8a-b119-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705043544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043544, "uuid": "79681099-d6a0-4ba3-9478-b02901f8602b", "comment": "Malware payload (njrat)", "value": "83b47bec30d0d32d2737040ab53846ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043544, "uuid": "44f79041-4f5a-486b-b4fd-da1894829ff8", "comment": "Malware payload (njrat)", "value": "9fedab2bb4115b0afcd184c958283df5b436cbf800fb9de2678719bf9071d9f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043544, "uuid": "a90610f8-0d77-4827-b7d2-40ba4a55039c", "comment": "Malware payload (njrat)", "value": "e2427c0da51f36228a6fc1c7cb95eebd53394377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043544, "uuid": "0875a1c4-1d50-4054-9159-01ba5fed883e", "comment": "Malware payload (njrat)", "value": "99effcc34e50d0fa736d25610dde110e4c0a1bdd76e1082cf349a4b7e9c83e8b3045cf8e1e7a5e4deb2c6a56411142cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043544, "uuid": "662b5a36-33ba-4e85-9400-86a83d550113", "value": "T1B0D49446B304AE28E06B93B50158E3F0D7E49F45A301C65A3EF6CCE77894E8B4E956C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043544, "uuid": "3b141f75-a024-4a36-8825-b4361252d081", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043544, "uuid": "5f9ca83d-294c-4dd9-bc81-12f222155020", "value": "6144:GTTbDL4ctZsa46niaIzs3vxxD0pqatvX7dZw6zL/KEBz860F9Gw:MjL406mnaIcqat//HL/r4Fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705043544, "uuid": "399ac3db-22a0-4f0b-be30-bcd358a0bc33", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705043544, "uuid": "5e4b2806-6c8a-4b44-84a7-2e3573bac403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043544, "uuid": "17376baa-b82f-48a3-b553-0c68a2e2d3af", "value": "foreignfilename.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec29ad7-b15e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705073178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073178, "uuid": "eee8fbd9-6afe-4b10-aebe-08941ee861c3", "comment": "Malware payload (Stealc)", "value": "0cce79c828b6d12831ddc8594ebfc05e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073178, "uuid": "d71ec78a-ab95-40b5-a316-4eca3c2af7b3", "comment": "Malware payload (Stealc)", "value": "9ffcbb79f453876587c2a46a1eb320dae890d548d8bfa3df0f58abaf748c6d77", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073178, "uuid": "78f3ea81-3b32-4a8b-8833-e9cad79281e5", "comment": "Malware payload (Stealc)", "value": "c387e3fb2ff4c0a4090346cba797dca28bc84a02", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073178, "uuid": "608387bd-8821-4450-ac78-38845b03a953", "comment": "Malware payload (Stealc)", "value": "12b82ac22cd7a4046733b43d8671901ad307996fb10cff0105675e9d12723ade29a9c217c1811be4ab2e7c109e640889", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073178, "uuid": "ffc218a8-7676-4e50-8e9e-70ab7afde9bb", "value": "T190B1D23C5EFB501470B7DF412EEABCE55CAE63626934812A40C8125D4BA3E85ED63F39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073178, "uuid": "023accf6-9330-41f5-b394-24dd1a845aa5", "value": "96:rFQ2fQbkEZlo/saSLgmX5xXc0kF4ZzjZRpZ:62fQbkELo/iLvX560rnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705073178, "uuid": "55a4c054-7882-48b7-b2f2-7d22c30cbdd0", "value": 5356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705073178, "uuid": "53084bba-7222-41b1-934d-4bc0142ca834", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073178, "uuid": "b53dc704-add9-4282-996a-81e9b0275fb4", "value": "getme.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fec90a-b121-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705046662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046662, "uuid": "bbd862a9-630b-4860-97b0-dd069204f97f", "comment": "Malware payload (Mirai)", "value": "d7114910c35cf6df4acb5193caeb6209", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046662, "uuid": "64856170-fa00-4b6b-9dbb-495e88a6dd0c", "comment": "Malware payload (Mirai)", "value": "a07e42a6c632f85095e7cc6f87268df742ead45854ca5a65a8d7492d08e76bbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046662, "uuid": "c6c7dc1a-4873-474f-979b-9d6c0bb583db", "comment": "Malware payload (Mirai)", "value": "5553148ad8f977846c918c7d183dfdcbd18b4d4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046662, "uuid": "28e8ec5b-78cb-46b3-be55-9c4e592b50ec", "comment": "Malware payload (Mirai)", "value": "2741fd4568f9662c241f942c477a35effc4680febb6c5650e1fbdb74c9af6ec00887c49338fa48dcd9e924dae405a863", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046662, "uuid": "eb88cc89-c2ca-4cdd-9573-30c3d5eb6652", "value": "T1DAB3BE72C424AE98C5445974B0B1CE3C4B13A911424B2FFA96A9CBAE9043EFCF955BF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046662, "uuid": "69834d62-086c-4382-ac0a-e8d0af36ba85", "value": "3072:wC/C9s/mR4yvSprNXh2oAQL9O0xW9AVST7wiKLu4NTh6q:wC/C9s/mR4/Zh2oA19AEYTuA96q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705046662, "uuid": "8333a24f-dab9-47ca-858f-d4d833a2ebc0", "value": 108064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705046662, "uuid": "c2518b9c-c4d2-4ef9-baf1-6fabb9bfa527", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046662, "uuid": "b6203ceb-43b4-4051-a8b9-89a8d5d23974", "value": "d7114910c35cf6df4acb5193caeb6209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35af3686-b13c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705058265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705058265, "uuid": "f27f06de-de54-465c-af85-bfcfab8aa7c5", "comment": "Malware payload (AgentTesla)", "value": "19456c568f32de851c7cc7416ee24f6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705058265, "uuid": "7780a1ab-eb49-4cc6-a45e-a4e92a722484", "comment": "Malware payload (AgentTesla)", "value": "a1e1569dfcaedc7962d5af6fcb5b022b5faddeef372cd7458fd3f383e0dcd560", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705058265, "uuid": "a5dbb166-1a63-41b4-8ded-c0e837b9c304", "comment": "Malware payload (AgentTesla)", "value": "302e970eb88d10c50416cfb3ca97c38af43d6c72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705058265, "uuid": "55883fb2-3e63-4542-be31-9b999ed0d148", "comment": "Malware payload (AgentTesla)", "value": "2256c0c226db5b59d12570ae761de5399e98db42100dd93dac982c800381fc1443d6328b7a1ed3cbb2368bbc6e6f7ec0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705058265, "uuid": "94059405-2539-4300-852a-511a5fe9e8cf", "value": "T13B530C43A918526CC86EFA35AC2776C05A128DF1A582C3C66CEDF21D1BFA7175C16EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705058265, "uuid": "f272ea95-b1dc-4654-9ee0-75c7c4297826", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705058265, "uuid": "dea358fe-ce39-4b4a-81e6-a4541d9c482e", "value": "384:KbtRPNVHT535J7P1DXsq0EosoEt2foH+qtJAz0WY/OjITPkG0O1q3+MJvbDlViWG:KbtBzDJzJ8q0EosoEkgk7uH0cMJvbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705058265, "uuid": "9eef0bab-383d-4da3-9569-16ee0ca2d02f", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705058265, "uuid": "bbf7d1ac-79ae-4f7a-ab60-00db95337ecb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705058265, "uuid": "1c0bc813-83cf-42e8-bed9-ed8526a26e91", "value": "Dokument Zam\u00f3wienie ZZ2200439_pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943f5f74-b149-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705064007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064007, "uuid": "4d381a23-dc00-4b19-8662-2450fc71980d", "comment": "Malware payload (AgentTesla)", "value": "a6874ce3a2c3aed0a1099a716f4a9af9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064007, "uuid": "4602dd33-250b-424d-b48f-f3f5373c3eac", "comment": "Malware payload (AgentTesla)", "value": "a209f5bb3c05894b6161fff06301f2a12763ec275f4777fbf093c6b094e25ec8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064007, "uuid": "bab4284a-8414-4750-9529-d21407d74285", "comment": "Malware payload (AgentTesla)", "value": "16cd9dbdbd3d5e5e4d5f5404d7be45e284a7cced", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064007, "uuid": "119c0e22-55fa-47ee-ac83-a9f11f700fcf", "comment": "Malware payload (AgentTesla)", "value": "8668004e601169054503bd8d30d1682255dfe794a756edcbfee23a36a2880010fcbc147392351bab1be2569f26f3b0e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064007, "uuid": "89d6c9ea-18fb-4dcf-a8f1-1cf3dd342894", "value": "T1AF841204BA7AD63BD00787714DA44096150EFC66FFCAA2873C7AF78D283EF10AD62655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064007, "uuid": "8a0fd33d-948a-4e97-8538-d90fa024800f", "value": "6144:EScBC6QREcis2JS5JABg1gG30q4SXR1xIH8hrP4+gS0hqoQ7OflR/p:ENBC6uEHsu8JAB4g0dRIH8hrPrihqTo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705064007, "uuid": "01eed942-0e4b-4279-bbfb-938687122b06", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705064007, "uuid": "8a1373e1-2d7e-4a5f-be74-e9e9733a56c3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064007, "uuid": "64e8351f-1a60-4916-8678-1593a4845eff", "value": "OrderList.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88544f08-b16d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705079449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079449, "uuid": "7b9aacf6-5faf-4ed9-a143-df2a33a87262", "comment": "Malware payload (Mirai)", "value": "0a0606c3d3b35c1c68b75c86425af6e9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079449, "uuid": "1cca1bd5-1bd3-4e84-9373-0ce7f07a3552", "comment": "Malware payload (Mirai)", "value": "a2abbd6f00cbce6938ebe0c9766280412054364b3df1da504fe47ef527882fe8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079449, "uuid": "cb27c0ef-f7af-4a79-b4e3-bc69065d7752", "comment": "Malware payload (Mirai)", "value": "6aec9f902b6ecf6425c10d6703cf00a44346ce2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079449, "uuid": "a85f549f-05ed-4ee3-9d47-08885ca3ec31", "comment": "Malware payload (Mirai)", "value": "16134bf5d8fa5f0baa1c14a6b6d778da497f83ab51fa8a5f5c731bef38c29bd2055d945d9d4077ca5c090b1f7cf78247", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079449, "uuid": "440ac962-a075-42c3-be13-64f8b1f501da", "value": "T14114A82E6E228F7DF268873147B74E25976D23D627E1E690D1ACC1101F6438E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079449, "uuid": "83548789-e6e3-48f0-aa4f-6d741e5d4e7c", "value": "3072:f1mFstzE7Wj7UG0BbdK0kxTAAe3Srj54iBIBKV:fMFsT7UvhO8AvrjaiSKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705079449, "uuid": "ee5e269f-7f77-4d06-ba79-0a1eee9441d0", "value": 197844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705079449, "uuid": "0d581ae7-6cd9-4f3f-b7a1-36c091445dfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079449, "uuid": "6de2bd05-6021-43d5-997a-4ed4e1535133", "value": "skyljne.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f33e793-b11f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705045933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045933, "uuid": "754aa86a-360a-4ed4-936a-b864c1e61d7f", "comment": "Malware payload (RedLineStealer)", "value": "90a76df0d5fedb31b8736dd8d765fd3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045933, "uuid": "7ab65e9e-8a73-4e69-b21c-c37697e9d9a0", "comment": "Malware payload (RedLineStealer)", "value": "a75d18534ff8dae63ffb7b62517b7b687342fa2ccfdc29e79a2fc20c62db33fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045933, "uuid": "83b3721b-c0b0-4219-b4de-cf21a667c2ea", "comment": "Malware payload (RedLineStealer)", "value": "c2680d82c8eef8b16210c16476dda217799832af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045933, "uuid": "3a583d43-fffe-400a-8a5d-ad91981d4433", "comment": "Malware payload (RedLineStealer)", "value": "e533650bb72329161c7ff45e6fb790fb295ec057b88aade1b8fd393cce5cd4bfe06dbb9ec1132a3dbe27bc28612be9eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045933, "uuid": "d62f08c2-0513-4968-88d7-1665f6f1a653", "value": "T14874121EB78F033AE85881B940FBE95A17F0A7D77A33D6196D4413864C62BCDDB82385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045933, "uuid": "756cf6ab-e154-4bba-9239-1ad30df0f35c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045933, "uuid": "aad44f44-24b4-42ed-aaa0-0deb9032a5b4", "value": "6144:RS8HIMl+RW0dFJh/aKNkug+Jgvw1X3IGPLq1DlqDJFTIITI:RS8HIpR1PJhyKFg+J3wDl6FT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705045933, "uuid": "86a6a669-cb67-425e-87fe-4ff4aa1c67a7", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705045933, "uuid": "bde866a3-99bc-4e43-85be-055311811a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045933, "uuid": "4586eeae-9545-479d-91e9-6b8d95f0ca10", "value": "90a76df0d5fedb31b8736dd8d765fd3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ebefb3-b137-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705056363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056363, "uuid": "7643cd43-9b38-4b82-bd06-3e739a58fb6d", "comment": "Malware payload", "value": "f50ddcaf5bc8b56906d6f2241ca0ebad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056363, "uuid": "0cc4b618-f943-4a2e-a0ce-895fae179056", "comment": "Malware payload", "value": "a7ffba3e41ce82350677836a511daec0e105d77cc722bafc77007235eab2f1d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056363, "uuid": "ca382914-cb76-4b03-998f-15f63a86e606", "comment": "Malware payload", "value": "c9b9fa042cf45faf7e5d3dc33e351696379fb814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056363, "uuid": "395049f1-205b-45e6-b01e-6943d8453506", "comment": "Malware payload", "value": "13106b273c6ef9877875cab2aa143ccbbb93a597fed616369caeb0fadf29928fecc8ec56d40af71f0741875616d5c5d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056363, "uuid": "93cf7f98-0d03-4514-a4f5-b58eca11fd8c", "value": "T11E25C452F2981D93DDD916773C154FEE5EF2D81C8B438B4E0CDA3EA17A6B2802D4C626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056363, "uuid": "c2d4047b-a153-4e10-935e-5115eada25d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056363, "uuid": "19d5cdbd-ac31-4be5-ad8f-241d524f8ace", "value": "12288:Q3kDGEKq16IT82UhlTlP/cG+TgtX7y08TISFSBa+ltGdElfkMJVqUra/6p6O:9fTzSt9wISgBa6tGal8MGcaSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056363, "uuid": "8fd316c8-5272-4f7f-a5f5-ac9acd71eb9f", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056363, "uuid": "830dde1f-b0b3-4bce-b11c-eb606512fbb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056363, "uuid": "1842cd58-56a1-4f2a-b46a-92bb761a70aa", "value": "f50ddcaf5bc8b56906d6f2241ca0ebad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c19b4f0-b14b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DanaBot)", "timestamp": 1705064718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064718, "uuid": "83dad6f7-43a2-4888-b515-19b3d6f09812", "comment": "Malware payload (DanaBot)", "value": "922e83e52f23027ae00d4ef9294d71dd", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064718, "uuid": "4688f04d-f354-4d7b-a1ff-f2d625318c87", "comment": "Malware payload (DanaBot)", "value": "a809b6ffd9241ec430d4ab5c866566365b642a9e553f811cbf5f3dc5acdd0ce5", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064718, "uuid": "725cda75-f933-48b5-94c2-e45c0b747d8b", "comment": "Malware payload (DanaBot)", "value": "9668d375b80f244cfc1f340188e546485b40de29", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064718, "uuid": "6385aa0a-620f-453f-812a-abd62f1a5196", "comment": "Malware payload (DanaBot)", "value": "d0090e21eaffe402b58bb660b87315a01b85501549030e5121373431f23229507c31bb3e7d1abb09389414df05ffe935", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064718, "uuid": "5b4f9b6e-dcf2-4104-aa7e-d9bf0bc5354f", "value": "T16116339DEFE5C323C097C8B6E7C3E38FA2D4E663A502FB184487C455E9A6B7405150AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064718, "uuid": "60e84b58-716a-4254-a4dc-76bc253f4fdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064718, "uuid": "431e5795-b7dd-4321-abdc-f2b444f969e5", "value": "98304:+YGMTbZifvqUHjvdmdUZNjXbdXuJvCqtiQ6ovaMO9f:bG2wvZVG2NdXyCqZBvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705064718, "uuid": "bbde315c-389b-40b9-a4c1-784d08afd15f", "value": 4052992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705064718, "uuid": "95ca4282-dc2a-4f6d-bfb5-7f26f828a09a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064718, "uuid": "e1edd524-abd4-4230-acf6-5996283f91dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17b6153-b14b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705065022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065022, "uuid": "b61672ae-ff2d-4342-a837-8e48e01ed90b", "comment": "Malware payload", "value": "b10a77609b6420cc5247897d741ab41e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065022, "uuid": "549f62f3-c0c6-4147-8944-5910fb358d7b", "comment": "Malware payload", "value": "a811a2dea86dbf6ee9a288624de029be24158fa88f5a6c10acf5bf01ae159e36", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065022, "uuid": "b3bdef29-1073-43f7-8b13-8be60596858f", "comment": "Malware payload", "value": "f956660e3970f293ef44437a0234c4f5588c11f3", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065022, "uuid": "fd228478-7b36-4912-a3ff-4a314d821d94", "comment": "Malware payload", "value": "a6a7ff53aa54e17668d1426819f619f33c09ae0301e0078992efd627449866e0171150b8f8b9a5723831725aad0d2276", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065022, "uuid": "cb675fe1-e4b0-4541-b162-a67465c75f00", "value": "T1BE3154253BE90715F3F25F3268F7B626997BF806CA03DD1E11C242084851701D128F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065022, "uuid": "10e8921d-e099-4e02-866b-593a0f992e6a", "value": "24:8v7JvbIrMZWRMuRHCCA264jdlRfdd79dsyozXozHfpo:85OKIAadlRfdJ9UMbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065022, "uuid": "990644d9-01bb-4690-bf0f-c69d38a661a7", "value": 1770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065022, "uuid": "032e27b4-c9a1-44d4-82ae-24cb7a54ce5d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065022, "uuid": "1d5f7bad-717c-4213-bba9-1cfcc72bf9c1", "value": "Air HQ PR Policy.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd55b4bf-b15f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RisePro)", "timestamp": 1705073525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073525, "uuid": "8d95e3cf-0763-4401-8bf6-e817b413c3d0", "comment": "Malware payload (RisePro)", "value": "6470cdf2eaacd36836861ac16c4d8781", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073525, "uuid": "6aedc31c-c417-441c-bcdd-97cc54183680", "comment": "Malware payload (RisePro)", "value": "a95da78668adc1684d19248f50fb7ccf6083806cce94f65d3ec3c99bca4662ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073525, "uuid": "935f6abd-3740-4eeb-97b4-992d2a2fae9a", "comment": "Malware payload (RisePro)", "value": "6d8dbc85d28c577d6ff90290bb623abea0fec0fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073525, "uuid": "773fcd94-276c-4ece-a64f-ba3ca4cfc675", "comment": "Malware payload (RisePro)", "value": "d0daf0d30e98b06ce1012364a435dd03dd0f3d68858bec0781e706bef5fd40ffb866335979cb4063d502f840120373e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073525, "uuid": "cb49ed9f-af52-4830-88ce-9da220c63362", "value": "T109856C31A741B462F86314B5725E57E611A235302B92C8D7F7C16FAEB2A2BD39334E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073525, "uuid": "f8e7479a-f41a-4f85-ae9a-21ea33514560", "value": "a391c991ba6330d6ddb5beaa15ef064c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073525, "uuid": "dffd628a-2e9f-49b5-897e-77a6290d0c64", "value": "49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705073525, "uuid": "3c382714-0efe-4913-9b6a-660f5e0024f8", "value": 1709728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705073525, "uuid": "db03f9a8-b51f-4f9d-811c-320535590682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073525, "uuid": "cf543ebf-4820-445e-b197-642e512a4ebe", "value": "6470cdf2eaacd36836861ac16c4d8781.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8310831-b10d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705038378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705038378, "uuid": "1d71e5bb-8b4f-44b5-a8b6-2f91477b5e78", "comment": "Malware payload", "value": "0e1b70942ebdfeb9e95e80db5a008d90", "object_relation": "md5", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705038378, "uuid": "f63cbaa3-7827-4aaa-b299-a248cc2d32af", "comment": "Malware payload", "value": "a9898a3eddf839ae7ae12751100c3d59f9ecc404fc4eebb76bab1f34e4f25ed0", "object_relation": "sha256", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705038378, "uuid": "81072c1e-9b04-4e41-a8cb-cd56d551146c", "comment": "Malware payload", "value": "b88b5b93b6b03760226e7ac00d3079ed72c4bc07", "object_relation": "sha1", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705038378, "uuid": "b32871e8-8181-4d9f-a9a8-0c1db203601f", "comment": "Malware payload", "value": "341721cef73bb7ccd8a246f5c5c0c88dd421c3d9ee8ada0a0a093dd1b429d4a35dba1ee7f8d59be500bcb8fd27508dcd", "object_relation": "sha3-384", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705038378, "uuid": "7c11f207-582e-45d7-bb3b-12030fb9d874", "value": "T10035AD02BB819171E5D341BA0DFE977E883AA9A0933B95C3D7E91C568A306D0673F3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705038378, "uuid": "877dde5e-d252-4aeb-a505-092d15737dfd", "value": "24576:7BUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/dRPOO8dWQHUq7:f0dwAYZt6C31WeTVRPOhd7Uq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705038378, "uuid": "f10ecb27-4344-43d5-933f-f181f742da87", "value": 1159168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705038378, "uuid": "acf439eb-b992-4d16-ac52-da85c2d38bc5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705038378, "uuid": "0a710780-a6e9-4b60-bc53-5b42f2c090e5", "value": "9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c_sc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c287de4-b0e4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705020641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020641, "uuid": "14f7c812-fd55-4442-9e38-a4377d8edb77", "comment": "Malware payload (LummaStealer)", "value": "53a3551c479dcc10ca2ab81e56775e75", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020641, "uuid": "4f9d05b1-68f6-411b-83ec-7f0c044154aa", "comment": "Malware payload (LummaStealer)", "value": "aa29b800e8a344b2917de03c2c6fac3e02730eb46e2a1215bb97f6daef1588a6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020641, "uuid": "3d8005c7-c0d1-4768-8b9e-3f064172df7f", "comment": "Malware payload (LummaStealer)", "value": "a89a3ac60a472bfae1d8696d8a2720de3e1edf8f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020641, "uuid": "337fcbe4-a5e5-4598-88d7-3b0a986a4dd4", "comment": "Malware payload (LummaStealer)", "value": "471e86163a880327e6d4f67c9990fe9aa752d095622b30c9a2e04f1d67131e63229cd949bd0f5972738dbcf3766b35cf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020641, "uuid": "019f7d5e-d6ab-420d-804a-1119b94c8daf", "value": "T19DE48C007C8B3567D8B958B56198E65CB0569A343F0EBF57CA03E93B3F171E0A6439B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020641, "uuid": "664c19dc-bae1-42c7-8cec-105682480c64", "value": "b757da5e2efe61bb640cadcd6679738f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020641, "uuid": "14af1ad8-05fa-48b0-b83f-fead342260fa", "value": "12288:rzo3OMhngjhJmNwvhvbx6boahoOtTSLLk3BPfDe1rOS9gQJTK1vfRnFyvD++S4Ra:rACJmNwvhvbx6boahoOtTSLLk3BPfDeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705020641, "uuid": "37f19afc-4930-4bc8-84a3-1459f26c96b1", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705020641, "uuid": "999eef30-bb3f-41c7-a00b-58885909837f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020641, "uuid": "13446e2b-f65c-43ae-956c-c0ad9c21fd3a", "value": "GADFGH83T64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131c24b6-b119-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705043174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043174, "uuid": "bf21c2f3-8af8-415e-a295-f5433d955255", "comment": "Malware payload (RedLineStealer)", "value": "d1ef37248b66ac6076b4ea6d1223f272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043174, "uuid": "ebebba12-3343-4b6d-b739-b0838c6b4ce2", "comment": "Malware payload (RedLineStealer)", "value": "aa33870935c58f52e135185cea818070c6b4bc4409f5dbc1ed99168c86c0fdef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043174, "uuid": "bbf73c3d-2a7d-45de-b483-c31410c1fff5", "comment": "Malware payload (RedLineStealer)", "value": "1bca5d308cab6013b78653f98971331e0d972992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043174, "uuid": "86c7ffd6-e03a-4d05-9e37-ec54b9de493f", "comment": "Malware payload (RedLineStealer)", "value": "a2e60878f1dcd33d821c7ceada4f2e16aca4f8b0f21bb2b1b3efab14fc7c95ce136d1d53d529a02dc0174fe033b37518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043174, "uuid": "735c2cdd-d025-4b1c-9a71-e0ea2f56ddb6", "value": "T1B1544B18B7D8CD21F23E47B695B0E2B15774EC13A452E74B4ED42CAB3D22784EB111BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043174, "uuid": "037f90e5-7d46-4df3-afec-f75f7ac68fbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043174, "uuid": "08639d60-5263-4319-ad9e-70fe1260f664", "value": "3072:B2KLTnYEQwKvxLrAm0FN+q2pGuhTMo1syKXLn6yujgrxphaAykPMRqT6Dv/YieqP:IKm0/2gST98wjUxpQA9PMRqT6D4wLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705043174, "uuid": "bfc88c48-648c-41bd-9211-b4d40a3b39c7", "value": 294104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705043174, "uuid": "37b12d28-a2ab-47f3-a289-58604a71146a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043174, "uuid": "b3d081b8-932e-4cf9-a947-354c75317be3", "value": "jioafdjgh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6451c6-b15f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Fabookie)", "timestamp": 1705073520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073520, "uuid": "1a7372ee-24b0-4e73-9c78-7ec058fc3e6a", "comment": "Malware payload (Fabookie)", "value": "797344a5766214c49734b8f63f78e797", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073520, "uuid": "91f1f26e-c9cd-4cac-8af2-1ae4e6c790ff", "comment": "Malware payload (Fabookie)", "value": "aafa82fb621b4843c3ae89bb8beddfe66244e203149880b79a4e8f42f5a7c4b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073520, "uuid": "8da1a2b2-230c-4844-b567-482f5cf0cf59", "comment": "Malware payload (Fabookie)", "value": "9635642026072bc12dcc5fdfb017b9c234c5bab8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073520, "uuid": "d09a45d4-3b11-41c1-ac5d-5db2f33af42d", "comment": "Malware payload (Fabookie)", "value": "89e42e4c727a3a81954c55d59e83373e4de908997fdee162be7ce298718c61065d78e8798481d3d04f80fd7afc6f7b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073520, "uuid": "6c139094-cf10-4945-9b5c-d8b77facacf5", "value": "T1E284492DBBA84476D163C57FD9B2E665D77238916F208BCB0212863F0D376D89938732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073520, "uuid": "254cfdca-f0c3-4bb6-a9fd-f202a29e238c", "value": "99782e0cdc1c7b57cdc2cde5daff70c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073520, "uuid": "0a072f93-5f3b-41d4-b995-cd10c91995b7", "value": "6144:uNOy9YUepRcisGiKzD8bFaggXWe0xZEOHHrpm1HUZLxRZEOHHrpm1HUZLx:uE+YUeprv0/tLpm10TtLpm10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705073520, "uuid": "8e6fc0eb-d51b-4e6e-b119-b8e313ce6559", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705073520, "uuid": "1b5b4001-3eb3-4bd7-a85a-c6960b2d3e32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073520, "uuid": "ea974c60-d088-4010-b0df-d7a8da5c9c10", "value": "797344a5766214c49734b8f63f78e797.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8dd5a7-b14e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705066086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066086, "uuid": "e8c27812-08c4-40fd-b79b-53bb8f9debad", "comment": "Malware payload (AgentTesla)", "value": "ca880374372b6ed58158eea44bec4d78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066086, "uuid": "7f7e0f1b-a04c-428b-8124-78fe49a28ab8", "comment": "Malware payload (AgentTesla)", "value": "ab143dacd2bb2cc4c38822ad99b628b5c763b8ea2b01ac6971c7dbf0bdc41fb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066086, "uuid": "18e73307-085e-4cf8-952a-609729c68d2e", "comment": "Malware payload (AgentTesla)", "value": "536d16a53efd4a5a752df03110c121b077abcdc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066086, "uuid": "f9c0976b-3d39-4ad9-82f7-95877add0381", "comment": "Malware payload (AgentTesla)", "value": "8ea1253760113ba334155af6e28138e09d602926a538f9a01051aca89bc7a31da1b566c0f48830d5bd825a9f4d5c7883", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066086, "uuid": "dbcacada-4348-4be5-b8dc-b30650580b14", "value": "T17503B3027F88E729D1957E3B52EF191043B2F2C70233C60F5F88ABA624917566C6DB6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066086, "uuid": "edbb1e34-52d9-457a-93a4-8cf079d23082", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066086, "uuid": "cadc0db2-1424-44e7-86e3-bb6ce2142a95", "value": "768:O3IxEjRE/5eWpWVgR7a+Dey9e8LIhLAguY:O3IxEji/5eWpWsagrICnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705066086, "uuid": "79106999-ed3e-4210-91f2-69ed30123b3e", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705066086, "uuid": "a1e8042a-176d-41e2-89be-8c58f4703f87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066086, "uuid": "04968797-4de3-4cc8-af65-d5826fb9b8d2", "value": "1705066085bdcac339cb08f9dca8e2414f3388e4ab11dbff54a400965f80dc761ef24e08e8967.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8172c69-b132-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705054242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054242, "uuid": "2319e92e-26d5-41cb-857f-c0b6212002b5", "comment": "Malware payload (RedLineStealer)", "value": "934a149a5b670c176df9151be74c8b7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054242, "uuid": "1e8b3a12-cd49-46cf-9be7-87bf1d538404", "comment": "Malware payload (RedLineStealer)", "value": "ab9f7995b911511781cfb226027d60173f2ab8f6482372f51756fa40d93b2f59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054242, "uuid": "a47844e4-02ea-49ce-ab30-5ac5a8503975", "comment": "Malware payload (RedLineStealer)", "value": "1801553170cbf0d4511b0e87a3dd8820e5656460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054242, "uuid": "fab027b4-7736-46c6-af6b-5381c3630ae9", "comment": "Malware payload (RedLineStealer)", "value": "0124eac49128c6efb7ab17cddfdbae05c679b1ccd78b763c2e9cbc983faba3f3ac9052f57099870c2821cb081aba35fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054242, "uuid": "7fd0c05e-f059-4910-b8e4-a27c9206ecd8", "value": "T19894DF68461DC57BD1AE9774E081A24323F58907E517FB8DFAA858F18D4F350AA032BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054242, "uuid": "658e186e-3a70-4810-808e-d3683a761a64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054242, "uuid": "e1f2444f-7b12-4505-a5ee-f3ede6642896", "value": "6144:K59M5pbvywa5Tc8QVzMZUi9xKZjIKLBhOILQc/STFloRM213dYBQ2cgyybxFzJeS:f1aN17gZjvBskMhT213Ocgyybxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705054242, "uuid": "08f0909a-b095-44af-908f-98a2a62fe05c", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705054242, "uuid": "9a44a9bb-d035-41a6-bf17-db5876cf4d60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054242, "uuid": "752a5220-8705-41df-96bc-da11963e42a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fd4782-b154-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705068865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068865, "uuid": "46ebfb9b-f2b2-425f-bcb9-03dc882514da", "comment": "Malware payload", "value": "824aa347ab00bf153a1a9024a7519e98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068865, "uuid": "c3387ad0-b230-4aa2-a18a-f9ec5d5cdfba", "comment": "Malware payload", "value": "ac4ec4cbcf33cf34aaba7c7b1b29c629a6496fc4715037e97a69de1f2cbf0ff7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068865, "uuid": "a099c606-493d-4ebd-b447-314374ebec79", "comment": "Malware payload", "value": "b6b38226b04a3755dd7ae5a86556c3bf3b268a54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068865, "uuid": "ad5f1b4a-0659-439c-b0b0-714f27764ee2", "comment": "Malware payload", "value": "583538432a7a4044cf87092e4b2f705d2984608dc4e0335cc1635c3303d7da4210a9dd33fe72f76b46b48a6231ab2e78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068865, "uuid": "0dff9799-2154-4bf9-bed7-dcb69232ef20", "value": "T18A532A95B9148CB6E5C1B33EA4E7C7B96238B1C187375B53BB30BB3416133E62C99186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068865, "uuid": "665dfc65-6f2f-4d0a-945c-a1a88dad9c6f", "value": "ce082b95020fcf3407515588c66ded00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068865, "uuid": "ab3581e1-cb09-4c0a-b496-09ef859ce6d0", "value": "768:YeQXtYDQjS7R30zApVlsHrdnyT0vwdg9Dqc+D9XW8JWBPBoAgsA27p+3GD:FQ2DQjeLsRnVvKgDqc+5G8Jm5owJ+30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705068865, "uuid": "c6ed861f-283c-44c7-8dce-b64580ed1417", "value": 60811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705068865, "uuid": "5e2ae971-1430-4eaf-88e2-7474d35e3391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068865, "uuid": "8f97b8c3-b6f2-40af-86bb-25af3e2ced92", "value": "NtCreateFile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfa69de-b184-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1705089118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089118, "uuid": "bd292aef-15b1-4b8c-a2f0-f9277d747919", "comment": "Malware payload (CobaltStrike)", "value": "40d3057b2b778b8e00bc869c52f564c4", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089118, "uuid": "3255acdf-8ee6-4e20-b781-2ec2f5f4d7d0", "comment": "Malware payload (CobaltStrike)", "value": "ae4f8c4cf49d93930683e363a285cd39f8d2e2a1bc4ae8e94fe44d8a6d085eff", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089118, "uuid": "07ddc50c-de34-44d9-9e40-a20e9d49d4b9", "comment": "Malware payload (CobaltStrike)", "value": "88d608f767f5b141611bad95ffd97776b22439b5", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705089118, "uuid": "8bc7a7a1-b525-4dd1-a147-b76209c5cfa0", "comment": "Malware payload (CobaltStrike)", "value": "6265ea5be55d83cfe25e7eb7a4ce9d9e3ff52090df6ec86c84c6ae14fa9f533ea4bc5f2abf2e358c3e721a10ab0f8712", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089118, "uuid": "d891d833-2ba0-4d65-bbca-24fde3597e10", "value": "T1D492C93FE71368E9C106D57845FF2732DCB13DB385A6A72A2724D1B42E106A46EAA610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089118, "uuid": "3c1f0b01-9a8c-42fa-825b-b7ef1fa94259", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089118, "uuid": "979b4ff1-e3d5-44c4-9164-3976838befd5", "value": "192:NeV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2cxv9oI0WF8qa1Dojjgi:qqaCF31cix+Dc4zjNxeIBFF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705089118, "uuid": "0d560768-fd10-4aaa-8789-ec70ae395e42", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705089118, "uuid": "e540cc6a-6cce-46de-a7a5-1d6cf3c03fab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705089118, "uuid": "ab2ce80f-f136-4955-8202-1c0b7e535589", "value": "Aws_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1479ab4e-b14e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705065940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065940, "uuid": "f9da00cf-8f62-4642-b359-1b127d54f7b8", "comment": "Malware payload (AgentTesla)", "value": "6cd1956e1f7ddc3d1903e99cd726908d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065940, "uuid": "95121e92-e719-4b10-9704-917a1e7823e3", "comment": "Malware payload (AgentTesla)", "value": "ae7a22bede40e897e2d01ac036f9f16f283082e34ef868443621545ec21d5753", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065940, "uuid": "e5ac6a86-e0b1-4829-9e10-f84752a34353", "comment": "Malware payload (AgentTesla)", "value": "dba7eb339da331eb62a8f44dcfcea7d4a5424c2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065940, "uuid": "894bb7a6-75a0-4329-86b8-5403e8a4f8cc", "comment": "Malware payload (AgentTesla)", "value": "3603f6af130b14ceec417433f561109004b34caae45d46129f6e6d8492d482c0c9f95cab3bd488e47ebdd53ac7ea9d65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065940, "uuid": "81f359a9-eed1-463d-930c-37635ac50b77", "value": "T1D9F4DF9D725475EFC817CC7289681C64EA20387B970BD243A46B25EDAA5CACBCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065940, "uuid": "e982a1b3-b0d9-4a80-8112-86108eecf3cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065940, "uuid": "45a0e5f0-975e-43c8-965a-3b5ee622a840", "value": "12288:7tXX2iebOgT5Nsb5KsFiKLMekQNRHkcf+IeEQAmm8TXfhcX2ztZUaDBylEM:7tXX4jT7eksTUURHkcfRJqfhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065940, "uuid": "f9deba23-e6c5-46bd-86b9-d9be07a2d99e", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065940, "uuid": "933d2206-23c1-4192-8515-21bf44b5d120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065940, "uuid": "997c9dc2-3f83-4339-8166-f1f91f1bf5fe", "value": "6cd1956e1f7ddc3d1903e99cd726908d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84db4b5d-b179-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705084597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705084597, "uuid": "db653873-2636-4813-bab3-f6114c11a865", "comment": "Malware payload", "value": "bd6956a401f861df2bf71548a6d93304", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705084597, "uuid": "aead62fd-b913-4c46-afad-b89ca420bfcb", "comment": "Malware payload", "value": "b0acb9c4b82cf91707edebf55391a6b323870ea3524bc242fd5ab218db25b102", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705084597, "uuid": "5d2b2cc7-f479-4bdb-a0b1-46026e7769a6", "comment": "Malware payload", "value": "4897a02b0a9fc95bcd8aa02bfee0645d0ffdbdbd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705084597, "uuid": "1f36bf9d-3f49-4deb-a364-fead90caad36", "comment": "Malware payload", "value": "4452c23e4170b8cfd8d0d99f280b30ebac991484e8b2e7a37389e6a985f7ac59a171bac70d3718c2e758af204ae6e777", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705084597, "uuid": "ae3a2ce5-182c-4562-ab04-722b257cf56d", "value": "T12CB52361EAC294F9C803117B93D2D37A747FA83F532252CB4A8515BCD6321F7CA9D60A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705084597, "uuid": "729d4ecd-9a39-46f6-b941-776a61c066dd", "value": "457849f2e421f35de672b8c339835fd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705084597, "uuid": "d9f13c5d-0e11-48c8-a92e-abf68da4fb5b", "value": "49152:e1ze1A0sZPi7mUMDYFctUJMTPjqGl0V8At/Imj:e1zeCKqU6kctU2TPjqW02i/Jj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705084597, "uuid": "1663f01e-3b7e-461b-90eb-56750909d66e", "value": 2289664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705084597, "uuid": "7769ea58-8a5b-4ed1-9489-f31eb5e3eaab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705084597, "uuid": "3c338fe0-ed14-49cc-b276-9c26105d57b5", "value": "bd6956a401f861df2bf71548a6d93304.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e2824e-b12a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705050608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705050608, "uuid": "63de1dda-378e-4225-8d85-607a43e9268a", "comment": "Malware payload (DCRat)", "value": "aabe285bf9ed74c40ed04e37548248cd", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705050608, "uuid": "333defcf-1141-4529-8cfd-bd8ddbfd25d1", "comment": "Malware payload (DCRat)", "value": "b107d13d86463788a3f85ae223f77014034229e0a5746bb871c37bc11c1ba0f4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705050608, "uuid": "874b4f13-e369-4990-8795-0e40a6da5508", "comment": "Malware payload (DCRat)", "value": "ae8b5dafa50f4ae926edd6cade5408cee63df3a7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705050608, "uuid": "cb496529-d936-40dd-be94-5dee737e1a01", "comment": "Malware payload (DCRat)", "value": "6142c893d9e175a400c3bdfde0ecd349cd6987c2ac24b6e8480ba79a7d34e7b1e7a1953beda24989a7812b93dd54fd8a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705050608, "uuid": "377366b8-6181-43a1-a504-e00fb3faa111", "value": "T1C7852212BAD1C972C473093626B4AB21B87D7E101FBACADF67D42E5EC9215C0DB31762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705050608, "uuid": "ff871cab-a05f-4ef2-9e75-c5e4d8655cfd", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705050608, "uuid": "76d41c7f-eb59-476c-85a7-6db34a4e4fef", "value": "49152:IBJ/zLUFEZOlqNlBQCNfANwxEAJyCvKfWEu:yJ3RZOlwjmwxP5qPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705050608, "uuid": "0cbe2587-e096-4af0-89b9-bc00e8285158", "value": 1797768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705050608, "uuid": "ec9f280f-0db1-458d-9c5e-517a99e046ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705050608, "uuid": "cf238111-5b39-4ab2-a923-b3d531751923", "value": "AABE285BF9ED74C40ED04E37548248CD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf276d51-b124-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705048214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705048214, "uuid": "2c7d3af8-9dc9-47ce-bf7c-bc3a416ffb64", "comment": "Malware payload", "value": "da2210441a63327aa034a989074aceb0", "object_relation": "md5", "Tag": [ { "name": "139-99-114-151--file", "colour": "#E1D69B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705048214, "uuid": "a4ac0a54-3d91-4f3f-a99b-280164bd6980", "comment": "Malware payload", "value": "b192344ce34120edcbae9a176d8406c18d78a177e5e186f735caa436ec473edf", "object_relation": "sha256", "Tag": [ { "name": "139-99-114-151--file", "colour": "#E1D69B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705048214, "uuid": "f4b9221b-c7df-4e4c-b253-cc63ce152662", "comment": "Malware payload", "value": "99eb23e0acdab0a76981a7d8399333c0001e2383", "object_relation": "sha1", "Tag": [ { "name": "139-99-114-151--file", "colour": "#E1D69B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705048214, "uuid": "4d818f29-6c08-42b2-b5d1-e11524dbb521", "comment": "Malware payload", "value": "af13e2d57d725958edb8a23ea094cefd9073ae1fc4e8c39f2f9db4fc8da9d081eb693f66fb9fbefb1bab81c110459745", "object_relation": "sha3-384", "Tag": [ { "name": "139-99-114-151--file", "colour": "#E1D69B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705048214, "uuid": "ee0266e3-953d-45de-9461-8e5f9261980b", "value": "T17B073318D257CA6DD42B83B9EED69ED9B038343ECD61C45B9A1283787B17B2B5B30314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705048214, "uuid": "b1cc6b70-51ad-49ad-859d-7a16d2a8f74d", "value": "a7b0793ae6dd3f16ef244d19e4de0c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705048214, "uuid": "2c125c0c-ba1c-4680-bd01-3c95afc44456", "value": "393216:zBKFKJqwgnhKF6PdfVrxr3X19+1iZ8K+0rsgSGf1daQc+7s6uOWQ:zBhJ8hq+dfVrl3XH+1xOSGQ0s6PWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705048214, "uuid": "4d5a7b1f-6696-437b-ba58-b87705e5872a", "value": 17967104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705048214, "uuid": "449cd0f9-29b6-4a2b-8ee7-f3175188ec45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705048214, "uuid": "51a6514c-1197-4259-82fd-b40bab7e2cf0", "value": "Windows.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3aec0b0-b11a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705043900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043900, "uuid": "81a97c66-2807-4876-99cf-77d45a2eaa25", "comment": "Malware payload", "value": "94cae729c428258877a25b99520c5088", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043900, "uuid": "31d066a2-7854-43b7-8270-859f2281b17f", "comment": "Malware payload", "value": "b2488b2c5b57839b8dda99b6d19bfed796f37d4493c4ff82abb568ad1ae162b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043900, "uuid": "a4bf8506-ad3c-4cbf-990b-20051a91956c", "comment": "Malware payload", "value": "8e904aabc08d6d22933807cfdbb593b1235b4bbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705043900, "uuid": "70027714-d7ca-44db-81c5-f336721805fb", "comment": "Malware payload", "value": "1eb38dbd455a24ed4e3a0d9b5a8cb11b78d583e4c567054670aedc96afa47c84465277750c28d74149c82d7abbce48a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043900, "uuid": "9247e43e-f1e8-4c46-9d93-0ec84f1da0de", "value": "T114E5E09C622C2597C42AB93AFD5EC6BB90222C3D2AF3C3B6314179DE7561FB45216730", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043900, "uuid": "8a659d0d-022e-4b7b-81b8-9f9d4ac73bb0", "value": "16e02c34c6de9d2a8557379336edfb41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043900, "uuid": "0e6d832b-707b-4a91-a512-191f2ae830d6", "value": "49152:OTNiNPbWfiFei598g4HbExL5ISJSK6naPsD0gKQhYhgQbExL5IuXq:ENiNPbWfNi59YHQQSJSKPF7WSQQuXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705043900, "uuid": "07fb8c4b-43ca-4eb5-a74d-aaf16ed3ca62", "value": 3027050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705043900, "uuid": "bcd7f9da-5168-4ea2-8e58-d0d71d39546b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705043900, "uuid": "b79dfa59-6d37-4394-a403-2c541c9f8388", "value": "b2488b2c5b57839b8dda99b6d19bfed796f37d4493c4ff82abb568ad1ae162b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48802e85-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705065168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065168, "uuid": "27021f5a-9e05-4a22-9db7-8ef5ab921178", "comment": "Malware payload (AgentTesla)", "value": "05ee9be7a107bac0cc588b57b49c0bb9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065168, "uuid": "36c98978-e7b1-410c-a795-b250d5b8b25e", "comment": "Malware payload (AgentTesla)", "value": "b3f9f7c54aabc0d88f16b7992bbad689089a0bb489d6cf1fa0edc1f598246b3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065168, "uuid": "7955ee17-15ee-4241-bac6-7187aa5e0d55", "comment": "Malware payload (AgentTesla)", "value": "86369244a2340741942ffb9030a457f29a236dd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065168, "uuid": "ead9d4c4-aa6b-4304-9fab-a7940df32334", "comment": "Malware payload (AgentTesla)", "value": "47b4f38bd3467b1b126b7b773c641d6df588e7ceebd4d3dd7ee59be2ea79f889eb44858906e193910bef4e2c02a81ce4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065168, "uuid": "805b1687-3e0f-4128-99c8-6a5a68a164b9", "value": "T138052236AE63FED677BB274171896C891C69BA1BC3085A3D73425CD110A1624CF6F8F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065168, "uuid": "fe5a089d-e583-4c00-95b9-d7b77f24d606", "value": "24576:6WqnmmZA5I/ymPnTbipoKscZem607L2QBKRPM2i06:6Nu5W+v1cI06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065168, "uuid": "2de0889d-23e3-48a7-b35f-c47f0176c383", "value": 860501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065168, "uuid": "a9a0fccc-ce22-4d3f-b584-c5728cc78584", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065168, "uuid": "14bdf923-52b6-4217-b196-9f8be82a213f", "value": "DEKONT-DOC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbe1368-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705065227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065227, "uuid": "86bf3fa8-7576-4829-9226-145ab4789a4e", "comment": "Malware payload (AgentTesla)", "value": "5c0c45830d34fbad558399ac8fa439d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065227, "uuid": "b1ceb3f5-049a-41e8-a854-9d544eee882f", "comment": "Malware payload (AgentTesla)", "value": "b42c2d040474f0dcce74562fda0cca005e2be2e9ede6a70cd49f1a2878d8eb99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065227, "uuid": "da636f65-56fa-4f06-98e7-b5ec7b453098", "comment": "Malware payload (AgentTesla)", "value": "7eda0a1e994392b4e816359602cdce7f66703e6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065227, "uuid": "956507f7-504b-4e08-8741-41a64bcf7ce5", "comment": "Malware payload (AgentTesla)", "value": "eabcd981d3ea5654bf9a7d1831d260dba5b05fa5c7efe248845a2e64a34371667a88e3b4d360d647035cbf8645ce89c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065227, "uuid": "4a11fa52-ae69-4c0d-ade9-3ed22c8441a2", "value": "T19146BF15F7E449D4E82BD734CA2A8732E6F1B86A0732875B0528C34B2E737954F7B225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065227, "uuid": "ff69f458-1a26-4ce0-a5b6-85d64837fce3", "value": "0751433fb799ff99dbf59b2d0c85d83d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065227, "uuid": "e345a53d-ce7d-4cd9-ad12-0c1ca238b97d", "value": "49152:AN1r/mTSnuXpZeA1RLaTyZaLh5psyT/MQuFjeRHEbBGzPggMp/ub3+qq9HNe2Yt+:K9K651TibBGzC5ubOHHo2+W7pBMrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065227, "uuid": "c6b0f18f-91c5-4cbd-82f1-94ee7b9121a6", "value": 5447680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065227, "uuid": "c4597326-9bee-4f9a-9dfc-605d16a6978f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065227, "uuid": "5ad61461-25ee-475a-866b-2ceadaab07a2", "value": "FPSD-3214.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d265177-b15e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1705072853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072853, "uuid": "8a24b69d-cfe0-444e-ac80-b13faa257f8c", "comment": "Malware payload (Glupteba)", "value": "3b868a16391e755085177aa73c67f168", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072853, "uuid": "5bbfbe7e-11b2-48f0-80f6-8cb95a0e1537", "comment": "Malware payload (Glupteba)", "value": "b549699feb7101de2a3895a291a9034053b5c8b2e3b369cf947ae467e9239ab7", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072853, "uuid": "c54e9ef9-bc39-45c9-b5ba-f5b9635d444f", "comment": "Malware payload (Glupteba)", "value": "f235e200420363817adca94ca94dcca5befbf3dc", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072853, "uuid": "e936f9d7-9ac6-4c71-abfb-61280ef3ced8", "comment": "Malware payload (Glupteba)", "value": "9f30bb52a15de262dede0e820eb09a7ca187744342917846cfab7e4d6939b5969b80a7019ee116d7d0e4a6659149cae8", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072853, "uuid": "cb02f379-f769-4bf5-a078-c41f91848ffe", "value": "T12866225D95E2C42EF4F79FB20663FB8FC126CF037892E1D0A9D3C86C95561DD6222868", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072853, "uuid": "56bfc73a-9e04-492f-9907-18a54d5e14b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072853, "uuid": "4bd7d523-67aa-416b-8f5f-5c16c75e8fcb", "value": "196608:qvgCxsC5eq496sQ7u3CAMBHcFu0z80DYK:qvZsq48sQazMB4hzDYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705072853, "uuid": "42e4905d-b217-4bf5-9c83-d776ed809385", "value": 6779904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705072853, "uuid": "696950d8-1dc1-45f0-8a83-88cdc2cc101d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072853, "uuid": "73d13811-2d1b-46f3-92db-f8523d92dc29", "value": "3b868a16391e755085177aa73c67f168.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e548e2ab-b198-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705098073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705098073, "uuid": "04a39664-4ed4-4ae4-964d-eecd6607f3ac", "comment": "Malware payload (RedLineStealer)", "value": "49a101f27b36c7ee8a0931a656749c43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705098073, "uuid": "3a7dd744-6ac0-4f26-b482-eda7dd933ccb", "comment": "Malware payload (RedLineStealer)", "value": "b61c3baadd541bcafad124668888e322d70720335a6f46173b489a47d5b66c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705098073, "uuid": "d2a147de-b6cc-4f35-81cf-09cea4c8cd7e", "comment": "Malware payload (RedLineStealer)", "value": "13874d352aa3fbb9a262e29c03ff885714ff8429", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705098073, "uuid": "9c09b5a7-778c-4fcb-a9fa-8f42f6e96b8e", "comment": "Malware payload (RedLineStealer)", "value": "ebf5c8603ccf30838fe4529cc62c089a4eec9e373b81cdaeda7bbe6f272bc9f8c99554156536b8365e2148409dbc5930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705098073, "uuid": "074db007-8f01-4501-99af-1bd629dd14f7", "value": "T1A094D0A8471EC63BE1ED8774E081524313F28A1BE157EB49F9A458F84D5B340EB261BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705098073, "uuid": "f76cb2dd-56eb-4f17-b6e1-01a69b61e551", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705098073, "uuid": "563021c4-3e05-476b-a068-023f941fc3dd", "value": "6144:1T0hyKyHzHfy5joC2zBtT5GNtBFeO1gqcID8kfn5oNfNvX82a7m5BIks:ihiHzHKjo7F/Gt0wLcE5UfNMdm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705098073, "uuid": "c1d440fb-b74f-4eae-ac13-289c6f90536b", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705098073, "uuid": "370e147b-6b62-4fbb-8b65-6e71e41cc8ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705098073, "uuid": "fdc7adfa-6667-48a7-9182-152acf7b695b", "value": "SecuriteInfo.com.Win32.PWSX-gen.23210.9609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26dbcdd0-b188-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705090882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705090882, "uuid": "ed07eda2-3c5b-4542-b46c-73a2dc7ff500", "comment": "Malware payload", "value": "8dad814feedd58a207f3b8b05ee260b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705090882, "uuid": "77bbfffa-d6df-4e36-9e57-806aa8035d36", "comment": "Malware payload", "value": "b685d98c96230b80dfe1b518d77326c513c84af86aa4047602b0da3215574981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705090882, "uuid": "4ec6dbea-4e2a-4f01-b7d4-a293ec462bac", "comment": "Malware payload", "value": "f3b95dd91e4d29d61a4199f91563ae3166149e74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705090882, "uuid": "88620922-b60f-44ac-982c-63d40821c77d", "comment": "Malware payload", "value": "ffb552bad77511458ba1196d08c03b25c456f9dceb65c1ed5c71523ff3026c96c5407d04ed2c27b798ca6aafa60e59c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705090882, "uuid": "02d3839c-a883-49e1-8111-c484a64b5ab8", "value": "T1829523F233F9286DD0D047F89B35D72552E06CEACF122EE6E6E74866B3071D24A89453", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705090882, "uuid": "2b6d269c-ce8d-49a6-b8be-cb2abe6f9b99", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705090882, "uuid": "87bb2efc-feb9-4e99-9326-4bc163ad977d", "value": "24576:lnVCu8JQY2hbGwzipthg1YNtltMpDzOOvACvWxh7HOXTL1HozMU6jf8Hi9J4Bctm:leIbBivi4HWVCOlvWxMXTVo3HiUBAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705090882, "uuid": "654b9dbe-47cd-42f9-b4e3-818347441566", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705090882, "uuid": "7f5e8650-add8-4790-b282-e8a0f76460a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705090882, "uuid": "3e7d9608-3546-42d7-a761-8fb03c47ae24", "value": "SecuriteInfo.com.Win32.TrojanX-gen.29506.7535", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060db3cd-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056467, "uuid": "43d51c61-7e84-4119-b014-832b9d88c2b3", "comment": "Malware payload (Smoke Loader)", "value": "9bfe889b239c6e5125f059c5f8d7bb1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056467, "uuid": "ff301f49-0968-440d-b0ca-89ca59196cf8", "comment": "Malware payload (Smoke Loader)", "value": "b7a53067b4b97c4bcea3aa0e0f7c3366df68f5efc0e7d990dc32a8191fb1f951", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056467, "uuid": "4e52810b-4c11-49ad-93c2-7da44f3b05ed", "comment": "Malware payload (Smoke Loader)", "value": "5508bb3f3c7e426d02d6d51161d6205d35ae012c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056467, "uuid": "db477450-87aa-47a3-84f8-63fa2460895d", "comment": "Malware payload (Smoke Loader)", "value": "60385c15c3c31eebf7ce0284232e635f65e58e0586e2ed93d7346e8951cc95d606f07d288db144184fc60d676798560e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056467, "uuid": "da432dd1-a6cf-4214-b2d7-88f83416af10", "value": "T13B447C2135E4C072E3B37B7649B1C7B49B3BB8666931B94E2AC41A791F357D28B21307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056467, "uuid": "3e458541-1f0a-450b-9ecb-6c5a28b073d0", "value": "7b1df25cb3b9a53041bb12b024d69535", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056467, "uuid": "9b035965-8d00-4e61-892a-c7f73f40c43a", "value": "3072:Nyf/5wqLWsLlsOS24ZV1TJi9N1K4Sqlg6QWF0yLo7fRJAXOZtohKYhx8GRkcLs7Y:Ef/jL+ZV1MVFpo7AXOgn8ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056467, "uuid": "eed60b02-8782-41ac-a8cb-a958d2ceb603", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056467, "uuid": "bb24f9a6-5cc1-48ae-a994-374545da45e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056467, "uuid": "2a5b4ad7-22fc-43a0-b830-8b237cc9a2d9", "value": "9bfe889b239c6e5125f059c5f8d7bb1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc67a8a-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705065174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065174, "uuid": "aab08cdf-729c-446d-9e28-01ed25e8c899", "comment": "Malware payload (AgentTesla)", "value": "1bac84f6418110140133ff30e22f97e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065174, "uuid": "47692441-4516-48b1-b7f8-0d228e3e52e7", "comment": "Malware payload (AgentTesla)", "value": "b7b5a0f0f5e0df2055debbc9e1a5b7c96b0170b24b21cd66ecb272c070d5fa9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065174, "uuid": "392f95c7-b525-4564-8315-d11048e3a26c", "comment": "Malware payload (AgentTesla)", "value": "9f2ab7edd928105059138b3660c66023fbb16aff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065174, "uuid": "373c3f42-9653-4bf3-aad7-5ce1f8051c39", "comment": "Malware payload (AgentTesla)", "value": "9add9d4925d61f534cae4d0fa92ba8034430fbc9f2a24153afffceeb762b039d5f2edbb856a48a437e6c391c141dc6c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065174, "uuid": "c92f357a-edd2-46dc-8d4a-9693f35cc214", "value": "T1A5D4236A3B980F16C1B8C3FD9085285103B5AD270022D76A8FCFB1FA5A7AF4A46D1D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065174, "uuid": "7f988876-3963-40de-ac60-90c61ec9cb8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065174, "uuid": "9a954c72-1c3b-45c4-a219-35183d0cd117", "value": "12288:quUbVFTZqxTdkImcBrVdNuTMeFbf+/sCRcfGijRMR/Ch7VS:tYfZqbkirVDuTZFTTCefGWR0KhhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065174, "uuid": "806c73b4-f94f-4a52-a38d-ff2b63f365bf", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065174, "uuid": "96223615-deb1-4299-8ea3-9cadc22e300f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065174, "uuid": "e74e7ace-2cad-46c4-804e-002d3a7d457a", "value": "20240111030502107-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac48f90-b137-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705056394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056394, "uuid": "07ab2669-6b04-4452-b67e-3eda836651bf", "comment": "Malware payload (LummaStealer)", "value": "4f6c85b1fe3b69d8e187779ed68f38e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056394, "uuid": "d35cb700-5843-408e-9861-112fff2ede93", "comment": "Malware payload (LummaStealer)", "value": "b852a910668d96c99c4871a22e8f12f83c120949e2db5a2daf4123dff6929553", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056394, "uuid": "788607a8-2c61-4833-8c73-4b909d09a575", "comment": "Malware payload (LummaStealer)", "value": "51bf48b1dc262a36a48243ec422a67aa7389b042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056394, "uuid": "a57b02dc-7f14-48d9-bf54-8023c5367d1d", "comment": "Malware payload (LummaStealer)", "value": "c5d75e82c01b4c7f7d66945dde74fad55ca8fe1b0105072d13885c007051428f66004670b96ae7499e38dd75e9974b84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056394, "uuid": "12133e5a-571a-476e-bdc4-5067f555e737", "value": "T16016BF06BB989E12C1696B37C5EB15141375D9837333EB0F39C623AA494339E4D8D7CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056394, "uuid": "6255d1b8-e2ed-4166-93de-fa1296dfc53a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056394, "uuid": "94d9c87d-734d-4b1f-b2e9-db8b28ce9057", "value": "98304:QeXhev9Pmf3br2A1qwd59GORXnXbA4suHSIB:3Xi9Pmf32RwXwAXchuyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056394, "uuid": "2307bdf4-862e-408e-8b5e-aabf6c8c5cec", "value": 4125880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056394, "uuid": "dcd9fe58-b220-47da-b836-a2006fdf4a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056394, "uuid": "d4218403-c2fa-448c-925e-3fa6574e1c8c", "value": "4f6c85b1fe3b69d8e187779ed68f38e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2984dfb7-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1705065116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065116, "uuid": "cc9d1f4a-73e5-4cda-b148-3be08559a8eb", "comment": "Malware payload (SnakeKeylogger)", "value": "260a71e34ba82c09599835024bfe0946", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065116, "uuid": "75ddde9d-f816-4b96-b095-e639e3844a9b", "comment": "Malware payload (SnakeKeylogger)", "value": "b86c596eb340e3083477d65046ace9dbd21a4fe8ff4f3b6e1dd12508ab9099d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065116, "uuid": "798f1da4-b310-4550-9662-c4aa1179429a", "comment": "Malware payload (SnakeKeylogger)", "value": "3ab4b391a449c941f2abcfdad8d66c474b118fe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065116, "uuid": "47558e84-f8ae-403a-b897-43d139a4e4af", "comment": "Malware payload (SnakeKeylogger)", "value": "26b34885d1326af6a213cb7d4b3e51467cb4a199fbb14add517fb0dabfceb9290be613db138cb2f4377c756b1eac8962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065116, "uuid": "9ab727a8-8e9d-4650-b232-8698beda7024", "value": "T133C4016846A4AF32D11F03BD61A4806293B5E721A453E75E6FD1F0FC3CA3B814A25F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065116, "uuid": "a730b22f-1b85-429f-8519-e4ff9f6c690e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065116, "uuid": "e55f3cb5-ec58-43dd-8037-a74ebff6071d", "value": "12288:WE9gwoIc03Nu7+SUKhAjfJtWureN8QQFyc9HjQxYkYipyBbZPUh:l9gwoIc0UCVjhAuyfQnBUYMpyBZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065116, "uuid": "ee711d72-ffb5-4535-9438-66e0dafa85e4", "value": 583168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065116, "uuid": "f51755f6-fd89-46c8-959a-68573f76d95e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065116, "uuid": "9badbb45-213e-432c-8cbc-ce1b1dbc2fd4", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5fb6b2-b11f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1705045871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045871, "uuid": "69961641-2ec9-4619-99c1-06d7b8471ccb", "comment": "Malware payload (Gafgyt)", "value": "8b92e48b7316646e6cfeb3a982e4faef", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045871, "uuid": "1cf8ba4d-daea-42cf-affd-f80a747c5e10", "comment": "Malware payload (Gafgyt)", "value": "b900c521650c7881da93a3cfbb8724e5069a7e50f57da305d17ff1fe99fba2ea", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045871, "uuid": "1b9db0f0-7d6f-4bd3-b5c4-b479efba7f2b", "comment": "Malware payload (Gafgyt)", "value": "becde712c9a15c5f60fcc70964966f06d7646d11", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045871, "uuid": "543ff712-9ff4-42dd-b52d-fe1039f2bf85", "comment": "Malware payload (Gafgyt)", "value": "51ed971aa3f7ae93ab2278b5acb2470087f5136d765eda08f0ddb6d82911a2691744125df359f686afdaf3a111eda9a7", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045871, "uuid": "da5d772d-65a0-49bb-a0db-44738715ed8a", "value": "T119836B23A552C67BC1D747F91BEB95204423B8791F33624A73D8BDED2F1A8C82E5A305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045871, "uuid": "565155b2-576d-46c1-a5ec-4324851aff78", "value": "1536:A74X+IUTRuGwiwp4eRPgCpR3apWU4aa3S3CSVeJxYmoImu9GjDD2Yre:WaUTIvtRP3fCfa3OCSVeJxYmrmu9G3Du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705045871, "uuid": "71d4adf9-acbb-4d1b-83e1-9dddfab1b0ed", "value": 82332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705045871, "uuid": "f13d960e-c142-4628-b9aa-d4bf232315e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045871, "uuid": "b253a4f3-1338-4539-8db6-6bd25a555862", "value": "8b92e48b7316646e6cfeb3a982e4faef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5d0aa6-b109-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705036502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036502, "uuid": "c21bde11-2a95-430b-9c87-051619dbb9a9", "comment": "Malware payload (RiseProStealer)", "value": "547780702449bfcc167227296e3e9e74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036502, "uuid": "1cf37fe6-6432-4b07-8b76-f3e244c17951", "comment": "Malware payload (RiseProStealer)", "value": "b90a5b9a5ee5305fdb4bbaa5992849e15942037bafe241eb965325e5bd056f49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036502, "uuid": "1bb55fe1-4571-4f90-954a-24670fde6801", "comment": "Malware payload (RiseProStealer)", "value": "cd9dda306b7e887046430a3bab13c5d8c697047a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036502, "uuid": "c4c37987-ce7d-48ca-96e1-761e978ec92e", "comment": "Malware payload (RiseProStealer)", "value": "eaa18f0522abe6ed0ce61a5c35771655038784d50ffe9c2324972e5c1d2bf9c919eaa2c5bac502528da7e8f6b35b9a71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036502, "uuid": "87f996a4-cd1f-4186-acfd-d5b71585ccce", "value": "T1702633722FCF92F8DE38323041E68A470F30BDBB6665B73F0219F64B55911A89135B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036502, "uuid": "397f90b7-5a32-425e-9a23-911b6f822f30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036502, "uuid": "6844afdc-04ad-4f6d-8ea1-e47a01d9b66d", "value": "98304:vO/L9WdEtDQVRYCBYi7qtAYNQR1oDguRWu2B2r/wBWI6Y86XTJ+o:0pW6ORYwp2tZDDguR7i2zwByYzD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705036502, "uuid": "7fa37506-30d9-4dee-8c25-aff9a788d225", "value": 4537856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705036502, "uuid": "bac955b3-cfa4-4027-8133-b7eb16b6f2a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036502, "uuid": "0ede7c61-7c07-48a0-bc34-6a5e7c214ce6", "value": "1x43xx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c12a93c-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056557, "uuid": "7ec84820-e1bf-41eb-87a4-63e5cdc826d9", "comment": "Malware payload (Smoke Loader)", "value": "c141057482fbc95a1f100fcf2388dbac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056557, "uuid": "f5b084a2-dc1f-468f-8b6b-3859fc0c8579", "comment": "Malware payload (Smoke Loader)", "value": "bb69773fb9f66bfdf541104d0bcdaa83208c756fad16679eb334c459853897e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056557, "uuid": "56bc7b2a-36cf-4dd7-93c3-0929d0e3170e", "comment": "Malware payload (Smoke Loader)", "value": "d9e6672413022953b834d5325fc4689b46e868ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056557, "uuid": "f835859b-10cf-4c1d-b8a8-1ff4517dec0b", "comment": "Malware payload (Smoke Loader)", "value": "078842471e4bb6b860db8132f8b38c0639d585eb8e332bb833be4ab86a8a6b97e136af0a1e3e6d3a7e0156984a2afd7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056557, "uuid": "21434d52-4cea-40c6-a565-3326701d3a55", "value": "T1CC548D2176E0EC32E2E319358634C7F50E7BB8726835998FABD12B794E207D1DA25707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056557, "uuid": "1f7c7b3b-e41d-47be-a04b-85a2747d91db", "value": "2581d6c78303aee77584be94554614b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056557, "uuid": "a20513aa-ff0b-4305-a5cb-f81369f2545d", "value": "3072:oSsvz5tse1uLlA8RYUQJSJilheleTJENH0JsQkUCPFmAg9zKPUhPnH5SLdIe6qjG:psVtsSuLe88PLEC4Uh0PUq6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056557, "uuid": "60b1a7c4-7562-4820-9589-359a39e58722", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056557, "uuid": "8ce63a57-7b9d-4bb5-8081-a338c3ce6356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056557, "uuid": "6a821ced-b8c1-47ca-8f8d-464b3c9d1a31", "value": "c141057482fbc95a1f100fcf2388dbac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43310de-b160-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705074019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705074019, "uuid": "6675ef8d-4a27-4cbc-85a8-3c1b636e0fa4", "comment": "Malware payload (Stealc)", "value": "bda164229deba9581da386c060171b58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705074019, "uuid": "46d47abb-12b8-4ad3-a94d-c86098048430", "comment": "Malware payload (Stealc)", "value": "bcb2d451f4dfa2303bee79a0ad6b2f060ae508ab7cdd92e6d3f718baf297fca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705074019, "uuid": "9899a8a1-2b18-4e5e-aabb-ee6f161bffac", "comment": "Malware payload (Stealc)", "value": "d20ebeeba93244d740607dfe395d03c387858a6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705074019, "uuid": "61459797-4610-4ce1-a52e-b4a4834817a1", "comment": "Malware payload (Stealc)", "value": "1e25c96d60743dfaf9d4fe12765783daf29d91daedd65f52a57030b22376e88fb0b9ded404b406c05872ef46892eb111", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705074019, "uuid": "2b8e384e-8236-4261-879a-3a1d6960c55f", "value": "T1A4B57D633E50C363C1A70630DA0DF339F2ED65A04ABA85A7779CDA183BB5542493C96F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705074019, "uuid": "cd6696f8-b4e7-4b61-b6f5-1fa56041748b", "value": "d26f674a94688d29e900f6f2f70bbb14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705074019, "uuid": "9426925d-1abc-42ae-9cfe-bca2ea74f131", "value": "49152:ynDcZqvlaRc/Ljj6+fXDHu9IJuD0TfC3o9IuX7K2p6s7Huz5Ig4//L:ynDcsvlaRcjv6+vr+IJuQTfCKIuX7K2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705074019, "uuid": "3d3b4c08-4bb1-4ddb-be38-96b7ff8d5a8e", "value": 2371584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705074019, "uuid": "2d606b73-1765-4f0d-9a76-4d8842914891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705074019, "uuid": "d84785a4-3106-4bd6-9b23-37db3f325b12", "value": "d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34df150-b14b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705064998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064998, "uuid": "94ac4537-1f6a-4903-b7b4-4dae4cff150b", "comment": "Malware payload (Formbook)", "value": "6b03a73bf0ba079b96e65c73a1600d11", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064998, "uuid": "82a09e5b-8f99-4a01-a06e-d6136b926b99", "comment": "Malware payload (Formbook)", "value": "bd9eeea5e3b56e0b6dfe7f745aed091c81a10e55a1504ea443bea0f44a9ff085", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064998, "uuid": "e1d79d54-a9d3-4101-b56b-d5446db9d0c0", "comment": "Malware payload (Formbook)", "value": "45139bb99e3ae87f597431daa30a46fd2961f9ff", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705064998, "uuid": "a64b8bbc-b273-4fc3-94ba-ec933ee80c02", "comment": "Malware payload (Formbook)", "value": "dba382ec6a0de36446d8e5a99770aa4233581135276998dbe579e50cf2ea18f496596c29b2da5a70a7bb9fcff275d7cd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064998, "uuid": "09794d4b-af84-4a91-95f1-1b8858934d3b", "value": "T121C4230B1CC4558D360AE056816A9EAF71FC29D94F5088BB34D86E9FC5A73C28FF9781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064998, "uuid": "e8aaa97f-56a1-4036-9054-f34dee8e041a", "value": "12288:j9xKaS0OhDWvF6onLfOVcBuhtQiQNz541BY5mbx2S5Fx:ROh+3LfIL05Mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705064998, "uuid": "d4b5eb3c-ce93-40a5-828a-f9573792d42f", "value": 561186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705064998, "uuid": "c1f53e9f-34a4-4b94-b6e5-ef4f0b675ce6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705064998, "uuid": "af5ae789-e5b3-446c-a9db-6d08c7868fe7", "value": "Confirm!!!!.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4356210e-b14d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1705065589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065589, "uuid": "fe5df273-a449-4522-ba0f-ee69f0f4ca95", "comment": "Malware payload (CoinMiner)", "value": "4ca7e0358835d3405fbd434410d1da52", "object_relation": "md5", "Tag": [ { "name": "arm8", "colour": "#E274BC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065589, "uuid": "20b3ac3e-a7a8-4a48-8524-afd01693a16e", "comment": "Malware payload (CoinMiner)", "value": "c4d1725c578c93b768db14433e05a68e1068860fb28955341bdd20645698125b", "object_relation": "sha256", "Tag": [ { "name": "arm8", "colour": "#E274BC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065589, "uuid": "f5a2ec77-edd9-4546-9a78-e3a3e22a2437", "comment": "Malware payload (CoinMiner)", "value": "48484e8481ac7fd1976152c35a005c4fdc10ec74", "object_relation": "sha1", "Tag": [ { "name": "arm8", "colour": "#E274BC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065589, "uuid": "d6d02b2e-c67b-42b1-bddb-60ff953989d5", "comment": "Malware payload (CoinMiner)", "value": "f3940c4b9854f8d8f580f5e72b1a6beda93bf89a0858866c1291f6d5a49db3065c15a695d096df6b38b36fe41160352e", "object_relation": "sha3-384", "Tag": [ { "name": "arm8", "colour": "#E274BC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065589, "uuid": "add15dc4-17ad-469a-a7d2-bbb26b42ce93", "value": "T1BE265B9DED0EBC52F7DBE27C9F49D3A2A71B35D0D22390A279820218D1D75E4C6E1E21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065589, "uuid": "6599c5d3-c798-4b48-823d-13131f925a9a", "value": "49152:cxavV5BnaABZyFWFLAyJhJjIU6iSHM5rY0:rvV5RaglFLAyS+SHM1Y0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065589, "uuid": "36b1cd70-ca8c-4914-a7c6-0c845f1e255c", "value": 4499488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065589, "uuid": "3d95a3d7-5bd1-4d10-a800-a0e3c49ea068", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065589, "uuid": "44cf758f-5bfb-408d-af55-31aaf858ec35", "value": "redtail.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca32dbf-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705056532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056532, "uuid": "d91ea615-8df5-4663-92af-0068a1db4956", "comment": "Malware payload (Stealc)", "value": "be61a2bd2278c3c61ce116ad6ad00a6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056532, "uuid": "053b3214-ac3b-4a75-9c64-41e5b03f7a8b", "comment": "Malware payload (Stealc)", "value": "c5bd3735647c42104f1dec6e8deb9a7eba8d0e89302d98baa8089cfb614d5536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056532, "uuid": "855de443-0a44-4ac5-b4b3-51bf1b6a4903", "comment": "Malware payload (Stealc)", "value": "188298a5764c5a41a1ba79b57b00be117f3ade35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056532, "uuid": "5821323d-77bb-408e-b105-f25725ab84c4", "comment": "Malware payload (Stealc)", "value": "e55e80f3fc794860ca537480af8580e3e9b7dacb109f0ca0d56a5d82bf719737557c76f82fc0e947589aaf28894a47a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056532, "uuid": "8bee4f4d-efc5-4def-a52a-e27dbc0d6349", "value": "T169548C1132E8D032E3E359354634C7F40E7BB8726925556FB6E02A7A5E64FE1AA30337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056532, "uuid": "3f9373d6-da4c-4fac-8a67-0abb808f4f91", "value": "3f1b99f6c9d48ec11c52365e30efb398", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056532, "uuid": "fac2d59a-58a8-4299-aebf-829a3071e71c", "value": "6144:pPP0mmxvxzLrrSVUlSU6eGlWTTaHSU/fKpQbRXMA:pEmmXznrSVUN6VqASGKpQbph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056532, "uuid": "6238648c-6e5c-4431-9190-8c3bdee495af", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056532, "uuid": "265e1d5d-6cc9-468f-9b67-b6e3cdd479f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056532, "uuid": "f349b595-ee35-4a6a-8b1f-91d4815665cf", "value": "be61a2bd2278c3c61ce116ad6ad00a6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a16ba4-b11f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1705045888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045888, "uuid": "f6f3e811-df83-46d8-9907-9a21145ad902", "comment": "Malware payload (Gafgyt)", "value": "524b9f3662944d326ff48a1c99a34db0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045888, "uuid": "078d4dc2-452a-4026-b8a3-f3c3d2e6654c", "comment": "Malware payload (Gafgyt)", "value": "c5c2ed7645917b3f43af4f1bf53bbdc7bf60c8fda30839dcc1b9178ebd7ccf3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045888, "uuid": "ed83817f-bb55-495e-b85e-9832f76ff2a4", "comment": "Malware payload (Gafgyt)", "value": "23066f5da75dfbc8e483993c0f00fca4b6805a67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045888, "uuid": "d495cf0f-cf06-472c-9b65-bd40835ca36d", "comment": "Malware payload (Gafgyt)", "value": "5344b5f057be383c0935419b9c32801db70741ac89413ac3dfbf061f2fa6d90b8fd7534edfa251dba8e329e8308ec662", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045888, "uuid": "85efe0b8-657b-424c-918d-b9034a3243b6", "value": "T1ADB32901D5518B27C1D2277AFBAF425D37232B68979B33115A24BFF82BC279D1E3A121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045888, "uuid": "8f3fcc29-6bb4-47b6-9469-5820f62e240f", "value": "3072:OaKh4ut9WuRg0WrGDa5SMXzfbmNQfPfXv4n:OaKh4uFWrGDobmNQfP/v4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705045888, "uuid": "15cead95-f63e-4ad1-a673-3cf765acad80", "value": 107843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705045888, "uuid": "2541ba6d-1a25-4e33-adeb-bedd1a660bca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045888, "uuid": "3f0fc710-f27d-45e7-b988-dc03c8ee8afa", "value": "524b9f3662944d326ff48a1c99a34db0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025e4dda-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056461, "uuid": "4e75baf7-0bbf-4a75-a9ab-7309d38a94ee", "comment": "Malware payload (Smoke Loader)", "value": "ec88c05e8d2e697b023514bade68e311", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056461, "uuid": "22460cb9-b9b3-476a-81b6-a043983d6657", "comment": "Malware payload (Smoke Loader)", "value": "c7cc77635eee4026d68f94cecbd1b92793de6ff0d8506c74b9c3a4bfe0c19541", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056461, "uuid": "43b50950-465f-49d0-b7da-8e1dead7931e", "comment": "Malware payload (Smoke Loader)", "value": "c647c59017b6ded3bfb639c5067118ffd3142d58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056461, "uuid": "dcae023a-b7da-407e-99f3-797ee1c493b8", "comment": "Malware payload (Smoke Loader)", "value": "2163cb8020079e21394e8321413141fb12b207326554159d7b43b09dcc9c2bf8afa1285ffe4cd7eda4f840f2e183e953", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056461, "uuid": "4aa1710b-7e7e-4669-ace8-2a0c6afcd40a", "value": "T102448D2135E5C072E3B37A7689B1C7B49B7BB8627931758E2AC41A791F257D28F20307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056461, "uuid": "dbbed9e7-31f3-46e8-82b6-ef007dcda1ad", "value": "7b1df25cb3b9a53041bb12b024d69535", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056461, "uuid": "1917c785-c8df-48b4-ac43-93e969e41e17", "value": "3072:1HfC5wqLWOLlsOS24ZV1TJi9N1K4SummXbjvyhQV+KCydsSzPCRs2JXKYkX8GRk4:VfCjLkZV13ijeQVv356nTcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056461, "uuid": "1635f08d-7298-4240-bad3-b361614b9637", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056461, "uuid": "924f97f9-3f12-4944-8373-1933cc97e176", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056461, "uuid": "1380bb6d-c2a0-41fd-93c3-a9026d9abc24", "value": "ec88c05e8d2e697b023514bade68e311.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87f53e2-b188-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705091206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705091206, "uuid": "f6051486-dd30-4c23-afe5-b0f2b00364f3", "comment": "Malware payload", "value": "39b1751ea32b36737040d4b4a8fcdfe9", "object_relation": "md5", "Tag": [ { "name": "bubblescat", "colour": "#3B91E2", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd-bubblescat", "colour": "#88D60A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705091206, "uuid": "401640d9-611b-43df-b53b-1b14fcab1f64", "comment": "Malware payload", "value": "c859a8ec23534cb0a28acd9e2975e5b05ccd173d164ce62cf0246e76eb191d85", "object_relation": "sha256", "Tag": [ { "name": "bubblescat", "colour": "#3B91E2", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd-bubblescat", "colour": "#88D60A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705091206, "uuid": "a948c6fa-0a27-47a8-ac6c-3309e9e0cc0d", "comment": "Malware payload", "value": "58ead7ba0f8ceffa24e483ffc48bec7e580b8113", "object_relation": "sha1", "Tag": [ { "name": "bubblescat", "colour": "#3B91E2", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd-bubblescat", "colour": "#88D60A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705091206, "uuid": "0a05b165-5e25-4f8f-8406-9a6c2186b38d", "comment": "Malware payload", "value": "83da65f4a2b46b8b215276f8ef40f1b304eb60ccf9574033b5aac7c3716c72a5e892bed98797c4fdd190447517606e18", "object_relation": "sha3-384", "Tag": [ { "name": "bubblescat", "colour": "#3B91E2", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd-bubblescat", "colour": "#88D60A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705091206, "uuid": "b68a8b43-5e52-4956-b434-4e1bfcc084d7", "value": "T1C8F633D4557EB778E61C458BA36D2B8B71A21CC73CE76C0C22548C4B164A6AF2E3538F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705091206, "uuid": "032c12cf-b7b0-4ec2-a09b-d40765b03183", "value": "393216:yoX9gNvBErl2UmJBTEeWj6ToTn6iqD60MDRJoE3c9Vx+:DNgtOQ3BoI86w0MRV4Vx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705091206, "uuid": "d3881458-ab37-4c1a-ad1c-107b7e768f14", "value": 16074175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705091206, "uuid": "33e1ce0e-e111-42dd-8089-43b0c9b8bcf2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705091206, "uuid": "8da09c78-4f4a-4d56-8521-0baf72de2cb6", "value": "bubblescat.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178c2505-b14e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705065945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065945, "uuid": "0f19d4cf-4155-4cde-b2a3-c58e9df97d4f", "comment": "Malware payload", "value": "fcd4e24abad6d28b87362f760da9a426", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065945, "uuid": "86a373f6-558d-483a-88cc-8386b136163f", "comment": "Malware payload", "value": "ca040efdfa64cf6f1ed4a608427cb7ec730bd521dd54d02847cd45353f7b96ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065945, "uuid": "bf57ce62-a1be-4bc3-8830-93cf599b294c", "comment": "Malware payload", "value": "58b47b59175ff5dffaeba59020182a30716f53fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065945, "uuid": "fa2cdfaf-9545-4cea-a210-c2ada5986ec5", "comment": "Malware payload", "value": "054c0b41f76ab7b575e09564a9ab7b37631c7e585b1fff3d6952c459116d9e7a7086e954130ce20983c7a740a069edd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065945, "uuid": "d272eab7-f167-4d00-9bef-f0489f7d6cdf", "value": "T15D9523F8BAF1554DC9D463FA47B4A67126C06CD9CF218CD6E1A72C93B3075C4ABAA007", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065945, "uuid": "eb109a8b-496c-4a01-a8de-ed1aa46a944f", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065945, "uuid": "53d5d0b6-f069-4e1e-95b7-70d2e665fbda", "value": "49152:BJ5vPTt17CaSCHjjYdtcXmZTfUTA6p2d/ZQKq:/FTXCaSGjsdtcX+TsTz8VZQKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065945, "uuid": "0b4c4c35-f20c-4778-af7c-0d5bd5438c37", "value": 1876480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065945, "uuid": "949740e2-c56b-4bde-9781-33dfcb618401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065945, "uuid": "e5875504-e73d-4748-a642-09cf8aec758e", "value": "fcd4e24abad6d28b87362f760da9a426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5f3900-b172-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705081769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081769, "uuid": "5ce776bc-16b8-4701-b78c-2718c892f185", "comment": "Malware payload (RedLineStealer)", "value": "a9afb4ac1010d7fda67100b4375de286", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081769, "uuid": "6237fa61-42a7-432b-8401-10a66f0733c4", "comment": "Malware payload (RedLineStealer)", "value": "ca0969a10ef9353ff9053efd4033b4d01eceb0c490e9b808108bd7740064f068", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081769, "uuid": "7cbca5e7-8514-4a70-b776-f50b728bdaad", "comment": "Malware payload (RedLineStealer)", "value": "89caf815421a4cb74e2515908a6622e3a2436981", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081769, "uuid": "b2b4f625-0cd3-4517-a757-3bf608c20556", "comment": "Malware payload (RedLineStealer)", "value": "84f8d70590fb97d35b90058f889847ef47ae5efba191702887be1995bd9ebd7f977f0f3be9f7f9360f326b75dfaa264f", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081769, "uuid": "503ece30-0256-456d-b952-9a645cadd80b", "value": "T1F6840142A3DB6331C9844A3CC4EBB91013F6DA9B6373C3197D4C41949F5AB8A969FF81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081769, "uuid": "da6de4ec-c2b7-4d19-9878-4856704c50e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081769, "uuid": "27b76990-a341-4785-b169-0c11e5abb2d8", "value": "6144:03NrR5cpA8B7E1CJzSdZ94LMiG3wGyBk0RuPueiHV79eYr0CaV:0VR5cvB7+SzU9UMiLGyq0RF/1he7CaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705081769, "uuid": "f5922481-3d75-4eb4-8b13-d9cc7773aaa0", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705081769, "uuid": "d429d8b1-88fd-4e56-9875-5b8500047f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081769, "uuid": "73e6af4e-1210-44a2-912b-49d2225592dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430c5364-b19d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705099948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705099948, "uuid": "17855631-d3d7-40a9-aa47-ccac8f104d75", "comment": "Malware payload (Formbook)", "value": "93f01bd10921f4455e9577442cbadcec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705099948, "uuid": "6d61a2a7-f405-448f-9ff6-f491779c657e", "comment": "Malware payload (Formbook)", "value": "ca9b7d7e6c9100b5f7987a56ade722b373343af8be2e498723219a8d6d993257", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705099948, "uuid": "0d7a857a-8f2f-47be-92c7-a22b7ef4360b", "comment": "Malware payload (Formbook)", "value": "c102e4fa585fd6a4005274cfa4150f4ffb59bfc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705099948, "uuid": "819cbd40-e81d-457b-9585-1e777b9d7b26", "comment": "Malware payload (Formbook)", "value": "aaa698d02bec8c1de53dae566cbcb0f55b2b562ee673a374a9d1311eb8062a48527ef8506282fd20291c71bbab648266", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705099948, "uuid": "acdabf73-cb39-41c2-8d41-2b6a30a20d94", "value": "T18AD48C9C3650B5DFC86BC976C9A81C64EA607477831BE303A05712AD9E4E69BCF211F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705099948, "uuid": "ef0107a2-ab93-44bd-b9ae-c6364261df63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705099948, "uuid": "58100e27-4a95-40bf-a480-19a2230656ea", "value": "12288:cfRtBargDbzJAOtQKa04bOuomQwdsHDQ28xs7Fv5n34Fbg9otZVoqYUfy1zpCYzi:cfRergzJAsa04quFiUFsnnQbg9otZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705099948, "uuid": "53fb0b1c-266d-4f74-bff8-91b1f3df6c78", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705099948, "uuid": "4abd0315-1a9c-4850-9610-b915fd2b4124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705099948, "uuid": "a59ce7d4-e54f-4801-884d-b0f6e57b82cb", "value": "93f01bd10921f4455e9577442cbadcec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96355853-b10a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705036952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036952, "uuid": "8bd3e6e7-d741-48be-a427-e87fca2e9faf", "comment": "Malware payload (RedLineStealer)", "value": "87479f625e25580890e46759f1ea4348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036952, "uuid": "87d56ef2-4f29-455c-a7be-963e1cff04e7", "comment": "Malware payload (RedLineStealer)", "value": "cac7ea634c540650c427a4b28bb1cd110f17dddc92ce15c9b7e7d5b118a99386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036952, "uuid": "96227370-bd92-401c-8e35-f0d31daecb6a", "comment": "Malware payload (RedLineStealer)", "value": "04631f34a987deaf69fffad68748ae96ec0555df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036952, "uuid": "0502c313-eb04-4b79-86f8-af7a3f805791", "comment": "Malware payload (RedLineStealer)", "value": "c4b40d049100ea6a0a734f7c3f9d7e0fba182f569314f7e7ed023c200d929f5d639848d93be8f8472b81e799d0ad68b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036952, "uuid": "b5c1e4b8-c382-46d5-ba6d-77e69096be1d", "value": "T16436331775E49833DCE2AF70585222F739383CF2562DC19E2615C68E2D236D9B832B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036952, "uuid": "b6a7adca-96f4-49b2-a95c-c799cb8ac6e6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036952, "uuid": "189ebba8-b47c-4f4b-a02e-9c32684fa906", "value": "98304:Q0gm5obnq9pAi9PJgscaSKdHTWuWIYMrsTMHX/jxdk7lPRR78BWwhW8MHYa5Mr3S:Q0DobnaqeRhzHLWMATeLzsv8BQZ50S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705036952, "uuid": "b54e1bfc-ac1d-4bca-a14d-d42aba4dece3", "value": 5214208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705036952, "uuid": "740da607-3aaa-443e-b3d0-39ee63cdd7b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036952, "uuid": "e4ef2cd0-f043-4392-8fad-acf2afe6845c", "value": "wfxre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de20803-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705065097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065097, "uuid": "df1a6da3-34ed-462f-812b-4bdf30240f16", "comment": "Malware payload", "value": "9e236bd496a13f9f42ea8a38cb4401fd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065097, "uuid": "a5963798-3308-455f-8774-1f9185977ebf", "comment": "Malware payload", "value": "cae6e163dd1038dcc68b31e7012575eaf357b4bec00916b71769449a06ccf5a7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065097, "uuid": "f5d5d1bf-2e92-43bd-bf65-2cf17dc2fdb5", "comment": "Malware payload", "value": "d02b1309a7b888a8d990d8f2e792005d1160991d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065097, "uuid": "3f2c925a-49d0-4c97-bb27-1c077c49246b", "comment": "Malware payload", "value": "322578e780c5b6465ef1ef8c1db787687eaf48d248912ee72a32056f62941e3c3af00909c808da6a9392d8d5878547d7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065097, "uuid": "daedf547-02d1-43de-9cec-7001a3e3c649", "value": "T1E5B1F9113AFBA00C71B37F512FE975EA4E6BFFA6391B606E2010030A4661995CED2773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065097, "uuid": "50a3e099-af6c-4fab-9da5-b2eb42457e33", "value": "96:KrSBvI981Sq1TrSBHq8Gg8GVq1w8GOmrt78GJmrtG:+SBvIGfSBHlyhpmrtQumrtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065097, "uuid": "39a79424-7738-43d4-b36d-6945ce2d7d3e", "value": 5334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065097, "uuid": "0908d26b-1fa5-41ee-9ea2-c6fbc1485824", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065097, "uuid": "1b2552da-0f69-47ca-a269-a01e44e3651a", "value": "New Order 11.01.2024.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a76403e-b100-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705032476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032476, "uuid": "adc6886b-9178-490c-85e3-f64f248c9a2d", "comment": "Malware payload (Mirai)", "value": "0edf78a9cf5b834f3ac382967d94b13c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032476, "uuid": "3f9e102c-6d8a-4393-be80-757c729e817f", "comment": "Malware payload (Mirai)", "value": "cb30f47c6e8148a5a89a61577dd8f3f312d7f434022b4b1f54a1d6e649a236e1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032476, "uuid": "09e6b7bd-2b0b-4892-b87b-41c955306a8f", "comment": "Malware payload (Mirai)", "value": "01b1c2608989ca5f44b3b8586eb56b1283bc1465", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705032476, "uuid": "317875ab-0fb7-4205-8a75-fd6c5e640bd0", "comment": "Malware payload (Mirai)", "value": "4005648daf38176e4f5acc8d0e4b2a64454b1a9bb5ac15d7d8e865cad201c9fe2470d0a70aad6f58130b8ddf97651e90", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032476, "uuid": "34b14d40-b9f0-43eb-b82a-817ff685e8bb", "value": "T1D9130852BC819A2ACAE0237BB96F548E336163EAC1EF72578C215F1437C552F0E67B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032476, "uuid": "d2d557ec-4522-49fa-badf-a9612b5e3a90", "value": "768:rTogpNxrJ0nBEEEFPJShmHYtJL8a+S51pQPhEN1RWBk45EnTsou8NtvBN:rEirGBREPJSoHwL+S5DyhEvRWBdSvuCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705032476, "uuid": "355ea264-963e-4547-abdc-1ae875ae9e6e", "value": 45316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705032476, "uuid": "3407e364-cf43-4928-9b3f-15d79561cc25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705032476, "uuid": "c33e238a-7551-4ad3-a5fc-4b5c8d684fb2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df9a9de-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056480, "uuid": "a58ade6c-a492-4269-894d-3dfa4f30a1c5", "comment": "Malware payload (Smoke Loader)", "value": "8c53237ed51cedf031bc67e52743b611", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056480, "uuid": "d9a784cd-7e6a-4ae1-b839-2278f0ff0679", "comment": "Malware payload (Smoke Loader)", "value": "cce4850cc383b394e43d8c7c4963d75a1611e1db82746b0515659c8db8cf0e1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056480, "uuid": "23a6f01b-fe9e-4a35-9956-f5897ce18708", "comment": "Malware payload (Smoke Loader)", "value": "307c9e259d8b5aae2a11577a393f89f0857758f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056480, "uuid": "723577cf-3d85-438c-963f-5a0ef951f133", "comment": "Malware payload (Smoke Loader)", "value": "7a3e51ce76e3b2675208dd85f5e44b83076ef8119611124cc8eba6c5fa59562403949decb30d132b8af6c64eddf1881e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056480, "uuid": "becfe028-9465-49b4-8a98-aa9c9acadbf4", "value": "T192447D2135E5C036E2B37B7589B1C3B49B7BB8626931B94F2AC41A795F356D28F20307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056480, "uuid": "78b17296-e522-454b-a4f5-1d55302313ab", "value": "7b1df25cb3b9a53041bb12b024d69535", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056480, "uuid": "c75a0b41-070f-48da-b036-0fcbccde82b9", "value": "3072:ykfb5wqLWyLlsOS24ZV1TJi9N1K4S3Ne4InAhTkF3vAblKYp18GRkaJ34fy/77Xk:bfbjLIZV1a4InAKIhnYais", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056480, "uuid": "1c082819-d93c-4fa3-8dc6-25d465a4dc5f", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056480, "uuid": "50648333-9794-43e9-bdbd-4728569afae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056480, "uuid": "221e8a90-9c4c-40be-ace2-2695c12c95c2", "value": "8c53237ed51cedf031bc67e52743b611.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7f1117-b0e1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705019516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705019516, "uuid": "0a594a41-7101-4b78-821c-3c5a0583d46e", "comment": "Malware payload (RiseProStealer)", "value": "099556734bde76d46c677c726cbf2538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705019516, "uuid": "b5c8debf-4cf9-4734-bf61-569a1667e6b3", "comment": "Malware payload (RiseProStealer)", "value": "ccf9ab5f39684f978982e061fe87aacf71bca2b411f8a6e55d776bdc032b36d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705019516, "uuid": "8e3e9e5e-3609-4ebb-ae09-d1794b39bd36", "comment": "Malware payload (RiseProStealer)", "value": "e2e80cd64fdba773aba28913365f837d7ff39e48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705019516, "uuid": "f684b7d7-3fe7-47a6-8346-49f4cf189f1c", "comment": "Malware payload (RiseProStealer)", "value": "13d9946499ead65e3aa3cfe30483a69ffcc657c417204b14c4be1b699cceb86fa06a6faea1bb3df005d87cf22fa43536", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705019516, "uuid": "3286f736-18c0-433d-99ab-bd841e8f64ad", "value": "T1CE659E627292D079D1C113F1257D6FE1C2EC6E719BA284CBB3C01E3AA5B11D2B539E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705019516, "uuid": "b5d16689-7350-41f5-b4aa-8b07096fa7ae", "value": "96fa9927288c4f8325d3528d85326fb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705019516, "uuid": "25cde90c-4731-4de9-8def-81a8dc1d45c9", "value": "24576:nUalkVcJGB7FyCTEaYtT9SfVK5Y3IexDzSf3Z8MQQvTICTNioPUXl7TP8o1Cl8:nyWJG7yUVYtT8RSPKqvTVTHs9TP8o1Cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705019516, "uuid": "8225fd94-04ad-442a-9a9d-f2ff866d6f13", "value": 1509376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705019516, "uuid": "10b29562-9c1b-4c39-85ea-fc15af661038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705019516, "uuid": "d071ec7c-d70e-4483-8f56-5771b5e9be5e", "value": "SecuriteInfo.com.Trojan.Siggen23.22903.27680.19534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ebf5f2-b0e9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705022718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705022718, "uuid": "ad920568-bd24-4e64-8344-9f01990a6df3", "comment": "Malware payload (Socks5Systemz)", "value": "7723676b4b89cff34aae74edb2f4d201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705022718, "uuid": "94ee9a22-a871-4eb4-8fbb-e21d606e70bd", "comment": "Malware payload (Socks5Systemz)", "value": "cd4237029b627009d33bfcf33c18bb7823625d3ba56632196d239bcc03240b69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705022718, "uuid": "38e48784-caa1-40c0-ac92-186235cd2964", "comment": "Malware payload (Socks5Systemz)", "value": "a0f6c8326502154c11f4b42db4b4063533d421bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705022718, "uuid": "e31fb8a2-61cd-46d2-8e6a-490262d3443b", "comment": "Malware payload (Socks5Systemz)", "value": "5e9b72b7521b39b190cd2fae20d2ba266b2bc29ce251a78c4d68bceac0fa5c2295469354f586eb28fa49d5e71c4dffa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705022718, "uuid": "e9d7ea17-d108-4b16-b0f7-462bca30fd1b", "value": "T1FA163354F5681E34DBD18F30ADAB49906327AC33383E8E7D37FD395E0A6A6C14C4619A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705022718, "uuid": "759416fb-c35f-4957-b9f5-1df733039ef6", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705022718, "uuid": "5102aca6-f291-4b0a-be2c-0051a50521fe", "value": "98304:ii7I4fXU6wjNWvYc8+di0ofDaIHkyrmMfkV:H84fXUFxs98AiZ7hHfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705022718, "uuid": "cd2e0a52-d104-4b86-bb7f-140967f1a639", "value": 4105013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705022718, "uuid": "95e6c396-b810-4598-a763-11e907d2b44a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705022718, "uuid": "4d4b2c6f-2b54-48ac-8816-caa6a2d35968", "value": "7723676b4b89cff34aae74edb2f4d201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1eab033-b133-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Hydra)", "timestamp": 1705054661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054661, "uuid": "bbaf2add-3012-46b7-8ee6-345daefa5e03", "comment": "Malware payload (Hydra)", "value": "2e9b0927ae4ded2465f7c1b12d54122f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054661, "uuid": "90f0a546-d9a0-4dc6-97b9-85eac517e20b", "comment": "Malware payload (Hydra)", "value": "ce480d22d9936bc469d46abbcd51bdb74dc201216c29a97ba21c40e0299335bc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054661, "uuid": "15853690-85d8-4469-8ba1-a045289a9dfc", "comment": "Malware payload (Hydra)", "value": "494c308f59843f8f75b7d9c7fbdb9d869c5ff715", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054661, "uuid": "e2c46c9a-5e8a-4c2c-9826-a82b0ad670c1", "comment": "Malware payload (Hydra)", "value": "9e2495df381a6dff55de1c43f058d5c4f8219b699d75d1fe6ce314a1ee3bd007f7681707f7c06a6d684bca69d8e7fcdd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054661, "uuid": "8dbedc6b-b3b2-4017-aacb-ac461ed07720", "value": "T1B9163396B0CAF6A1C9BD07342F6A864906F67E58CF05529B3142734D0CB39C20FD7E6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054661, "uuid": "920e05b3-c233-4291-adcd-ce82b26a1e08", "value": "98304:KGKlbCOD3Tka0Lnu6ZVG+ZeCEj3m6SwosHpdFfjQVdKaICPjFlXLbnO2:KGM+AAaoZVVZePrSeHfN2dYs77V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705054661, "uuid": "fac9967f-d29f-49e3-9d1e-15e956d161ca", "value": 4353749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705054661, "uuid": "cd97ef2a-a84f-462c-a0af-05e176775b17", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054661, "uuid": "0db60bab-42d8-4cab-bc60-3425318cd8ba", "value": "Commerzbank_Sicherheitszertifikat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baeeed0b-b14f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Hydra)", "timestamp": 1705066649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066649, "uuid": "3620b40e-0050-4248-ac1c-26f6424a72c8", "comment": "Malware payload (Hydra)", "value": "d2a56706d97523de32ab15378cc2ae62", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066649, "uuid": "84ece26c-089d-4a24-92b2-c0595ee6ae63", "comment": "Malware payload (Hydra)", "value": "ceb48e4b9d82b2ab7b486393048cdc78c6dfaf88799521e63677b06975f707cd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066649, "uuid": "c567621e-1cfb-4a1e-a2f0-59676c437aed", "comment": "Malware payload (Hydra)", "value": "ce18b7999a30d7d13c23d1ff9b0367b97b6d9d7f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705066649, "uuid": "eb515888-fb7d-4d0b-92cc-7f5710d30a59", "comment": "Malware payload (Hydra)", "value": "297459914e9d154ef8474956d9f14abccf80cae1299711a1bd95026cbbca8cc45c77a6feeebcf2f378fccead63c6c353", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066649, "uuid": "7dd42acc-0767-4f4e-beef-6146c6c90c8f", "value": "T14E3523463952E643DD3C43F46F16D4CD66363E24AFA0A8A77928F76C69736C40BAE0D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066649, "uuid": "6af40ef2-4643-42cd-a646-62dddd17cf95", "value": "24576:ee8QBkiOfXTaBpI7IEPw9NBPqAC+B0MxDgdEjKO:l4DaOorqH+B0MxDeEjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705066649, "uuid": "41b5c539-6917-4003-a540-79b51e6d67b6", "value": 1125884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705066649, "uuid": "a48f1b80-1cd4-4656-ad90-9ef17bf2bef1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705066649, "uuid": "4798ed0b-27de-4919-91a2-04d71c88f708", "value": "Commerzbank_Sicherheitszertifikat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e17e5f-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705065270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065270, "uuid": "e5912b2a-18df-43cf-9acf-d6ba2dc29e54", "comment": "Malware payload (AgentTesla)", "value": "579b40b4b7a10634484506fa4b2d10e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065270, "uuid": "d8f75808-2c64-40a1-b76c-cf3c2c54dc7f", "comment": "Malware payload (AgentTesla)", "value": "cee53b67fc3a98f333647160479fc84b43cf2fe81d7823e827be71575e408841", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065270, "uuid": "ac985d0b-e20b-4f18-b438-329616fecac2", "comment": "Malware payload (AgentTesla)", "value": "c7d86c7d1eb31e68dab4339338dce8df8595882b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065270, "uuid": "714b076b-44f9-4636-bc7b-00c6e02da8af", "comment": "Malware payload (AgentTesla)", "value": "ba1c14da1661173e0ce63af004f73874091ff511eb64e00694c1ce8e2ffdefc4eb03275da0ce2239d54a2397fb899189", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065270, "uuid": "ab192b9a-84bb-43a9-8643-034e663804f6", "value": "T18293F560CAC596398E760799AE014403F7BB853B4334A0FCE999E36E1932D5C877F678", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065270, "uuid": "6220b1be-058f-478b-8010-e0a428b82bbc", "value": "1536:z8Q6nLzHlMBFXdzvnB1iG58Q7EnMdFaKEv3h64LAOfnCyLb5Eo:YQMLTKHXdz/7p5z7OKFaKEv3h64LAO/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065270, "uuid": "a623f915-bf06-41bc-8149-05e368ff5e0f", "value": 91984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065270, "uuid": "d847146a-dadb-493b-8c85-79f034e96667", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065270, "uuid": "30769e85-e827-4c9a-a8f8-b3465404da36", "value": "Invoice MY502043312_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964134e9-b160-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705073889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073889, "uuid": "0927ba2e-c373-41cd-8c13-759d92ddcfaf", "comment": "Malware payload", "value": "d8e7dc43e57929c6d11ffd163a6b2aa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073889, "uuid": "63dca23f-74c8-4d4c-8822-2870e06dd599", "comment": "Malware payload", "value": "d2ff8bef72f7424016a3e20986a20ba4b790de32a6dd300b9e96b59f969ff735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073889, "uuid": "e4d6e6bd-807b-4632-a0e0-bfd7bdac90b7", "comment": "Malware payload", "value": "9438cdd22e0120e238ee475d4967fb1f2b14f672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073889, "uuid": "e18a2fd2-3f58-4ec0-b793-cf6e62e15945", "comment": "Malware payload", "value": "f82e13de1c0e8f9b96eeb11b43421ada1b9cefd6859d5383a2527c70d84917e3a0fba3b4641ad424fe1aa82ffda63a9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073889, "uuid": "7aa25cb2-8537-4a38-a9ea-b436957a50a5", "value": "T1CF74839382E13D64E9698B729F2FC6FD770DF250CE497BA521399E2B20B0176D163B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073889, "uuid": "03e6a1d8-a58a-4b9c-9b01-69d16806ba70", "value": "31e36cf00bd38f6118c77fe30a6b7e3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073889, "uuid": "b2776a82-688d-4d79-9d2c-fcffd0f1beb7", "value": "3072:6np1z2pL0IOQydzR6sL/9eMizFioT1rMKhjPkhwXxMo5VcB8by9Po95B:MALxOQUrCzhhMKhjPkhxwcU2wF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705073889, "uuid": "05a6ce16-6f28-417f-b9d6-26a5f68e0f37", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705073889, "uuid": "87d2488c-60cd-45eb-9a66-375d742064fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073889, "uuid": "6b3c3f7b-9fd4-4fa9-8b67-7d3d5dcf3c25", "value": "d8e7dc43e57929c6d11ffd163a6b2aa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e95a86e-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056562, "uuid": "8bc8cf04-a0a5-4b53-9711-d94eb513843f", "comment": "Malware payload (Smoke Loader)", "value": "614bf403bf44d9ea97810d8a7e29197a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056562, "uuid": "fe46102f-8694-4afa-82ee-54a61b2ef786", "comment": "Malware payload (Smoke Loader)", "value": "d4ccf1fa78f6a843f2f2eb3ade48c9b486247b497fa54e3c9dc28f7c5ec7088d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056562, "uuid": "0ada4e26-424a-4875-9d8e-b5c6295d7c01", "comment": "Malware payload (Smoke Loader)", "value": "a6e16375267ca3756ff09c997940592e701d94b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056562, "uuid": "7a8b470e-05f5-4c4a-a39e-0a56b8295233", "comment": "Malware payload (Smoke Loader)", "value": "11ae8afd5fb69897819574dc50bfdd95e42aa95b1e3bc0753f9345a8a5bf6f7961fa6271a9770bb3180c3d15691f9d36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056562, "uuid": "e83881b2-ccba-4299-979f-5b9dea93cbf6", "value": "T167548D2176E0EC32E2E319358A34C7F51A7B78721835998FABD01B795E307D1EA1570B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056562, "uuid": "1291f3fc-4ed1-4259-b7cc-b8829ec7782a", "value": "2581d6c78303aee77584be94554614b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056562, "uuid": "b084a913-6d37-46fd-92d0-8f3ba57a6143", "value": "6144:6sVtsSuLe88PBJb3d9tiQCegRGCiPUgp6l:68tsRJ8Pbb/tXCegRzsUgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056562, "uuid": "570dee6a-4501-42e9-952c-dd7541daf83f", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056562, "uuid": "b369fee3-ade9-46e4-a8c4-c201d077cba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056562, "uuid": "95073c12-106b-46f4-ae66-c19960fe864f", "value": "614bf403bf44d9ea97810d8a7e29197a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608c09ae-b11f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1705045881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045881, "uuid": "50e75fc7-6673-42ab-a4a0-8320361969da", "comment": "Malware payload (Gafgyt)", "value": "275270981154e210fd887bc9f98f8b85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045881, "uuid": "ae108ed6-3b89-4c87-b657-688a606ef9ef", "comment": "Malware payload (Gafgyt)", "value": "d534080dad4a1f1415a769e5552d61bd55841e20095dc9c9125d9fc5bdbacc4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045881, "uuid": "332b29bf-92a9-4bb6-a15c-ef19b86a0bc2", "comment": "Malware payload (Gafgyt)", "value": "b2d22119e6cdbc590e723c35bdfc0ff11288fc3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705045881, "uuid": "06824a2e-c898-46bd-8fac-c0a8df2a2e77", "comment": "Malware payload (Gafgyt)", "value": "b77c21d06ae516c87a321d18d3c3433312a077c63da7ca4e84870415410a3e3af6308a5f4d53b8586f74324e3e7474a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045881, "uuid": "3c7c104c-e55f-4357-9cd1-a4f0b5c53f5f", "value": "T1CC832903771D0B47C0AB6EF029FB27F1876AF96116A36180B10EFED45772AB42512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045881, "uuid": "a1c15836-4e4f-4c07-969b-e75b8f957f59", "value": "1536:lQ2P4MoLMZ1wl85JuGp7kchcSj3Sv/Rz8RCjGhBEmQ7Vh2jqnaz7e:ldzoLMZ1wltGl/cSj3Uw/hBEmQ7Vh2uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705045881, "uuid": "1166ad4c-0751-46fc-a53e-6cf6ed40fc37", "value": 81327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705045881, "uuid": "74e2b6d0-33ec-4f8b-8213-9a7c3a0a85a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705045881, "uuid": "3dc25647-6f9e-4d52-b312-0bf33e72ff69", "value": "275270981154e210fd887bc9f98f8b85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40cef72-b112-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705040411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705040411, "uuid": "459d254c-0279-46ea-b726-b3bcc65ce73b", "comment": "Malware payload (DCRat)", "value": "01664aa1cee4d979395814e2662d6fe6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705040411, "uuid": "c2b640c4-abfb-4eba-b0b7-a8c1871a9c40", "comment": "Malware payload (DCRat)", "value": "d5c2b2a0efc0a5a0d177937623fa457100cddf5164d901e4a7a5ff7b570637a5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705040411, "uuid": "06a3603a-f06e-46ae-91db-dee75f9cb035", "comment": "Malware payload (DCRat)", "value": "5922161dbf58020d1e4f61bdb26cd8b5e0095314", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705040411, "uuid": "22d886c6-01a8-4f14-bf0b-8ee2fd0ccbca", "comment": "Malware payload (DCRat)", "value": "0530053ce7034c56c823efe5c5c31985509c055430c02b2a1f1c8b19a5c81225157f7c33bb53ecbe1fb1afdb3ee13bf9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705040411, "uuid": "1bab2293-f56e-4a45-a5c5-72af6957ded5", "value": "T1F0C57D3439EB502AB173EFB59AE478DADA6FF6B33707585E205003864713A81DDC163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705040411, "uuid": "648bfbf8-5fe6-4937-b086-9887b93b871d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705040411, "uuid": "9388c56e-8c70-4d51-b576-40c339ac555d", "value": "24576:2E+0fY4MNGCw7sULqPyZwSxIshnWIjm7vZAjX+ez87TkQPI1Q7SGZDLT8Ww6D+:3+0JMNwlwSx9WkiLekTk1JMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705040411, "uuid": "123d8b1f-9371-48e8-8066-c335fefe1ac0", "value": 2518528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705040411, "uuid": "62595d41-8139-4483-8eff-d13df2ce0ccd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705040411, "uuid": "70e995a9-528d-4437-8472-04638eb32067", "value": "01664aa1cee4d979395814e2662d6fe6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8ba4ae-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705065172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065172, "uuid": "50d14165-975c-449f-a86b-b5f48b65578d", "comment": "Malware payload (AgentTesla)", "value": "d53f2fa2528339ebcf0fb94a01d67751", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065172, "uuid": "0e89250e-ab8a-4d7d-bbb7-ec1aecf7fb6d", "comment": "Malware payload (AgentTesla)", "value": "d5d71b4ba13c6a8f154163c71f515dc26f64b61c6849af78e5aadc0356b86f89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065172, "uuid": "a60042a4-0a50-4d74-99c1-bcf4b4c72b13", "comment": "Malware payload (AgentTesla)", "value": "548bd45261246b04752ca85996076b1753f6f510", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065172, "uuid": "1569d3f3-1bed-4d6c-9a0c-0b8aecb3850b", "comment": "Malware payload (AgentTesla)", "value": "86d4c416cb4694e32fab08445ff1f03b9f87aced296d7e0950b67da94a83be65e74091e6026ee9075d1a6c0842a0b98b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065172, "uuid": "1ac3831e-7b0f-470a-96c3-5ead5298de78", "value": "T193D4128572D8DB31E5BEABF56277A2441371BD126291EB3C8D9270ED46A3F100B46F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065172, "uuid": "3b75e3c2-7528-4874-84d7-9e4ae2f4b381", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065172, "uuid": "3c591600-eaa0-478a-9d6b-917c791a9f5a", "value": "12288:g6Uab/tjnQU2+8n0nYkTgLztte1lQ0cVWIbRf4yHoupHd:jUK/jL80tTgLHe16Nf4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065172, "uuid": "b5e36109-fd46-498d-9eaf-cf4e2168ec2d", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065172, "uuid": "fdeaaced-1a93-4652-a0eb-54b99709104e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065172, "uuid": "76b55bdf-70aa-471d-bf5c-78301d8d78c3", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7179b08-b17f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705087231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705087231, "uuid": "29495671-16ad-43d6-9ec4-8b747fd4b0c9", "comment": "Malware payload", "value": "628a8752a5930aea1af82e475f56b893", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705087231, "uuid": "b2ea36ae-0d85-40f6-a37f-06d9e17767fe", "comment": "Malware payload", "value": "d7b86eb0a40bd710bf24b8e66b36d8d65f50eee6a32e4818b5d52d1de13754ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705087231, "uuid": "95d9d67f-f64f-433a-9b03-6dff84c92dd2", "comment": "Malware payload", "value": "99998a6fbae13ac9e0b45ecc649749fcb39c6899", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705087231, "uuid": "27e1126d-84cc-43bd-b8e4-be95cce53fe4", "comment": "Malware payload", "value": "c2cfddd878e21df879b8a04fbe9e306472fa0b59710d2afb49a1bc5cbc32125e86c7b29430a60dfc885a0dfdeb44a9f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705087231, "uuid": "5190d3dd-67b0-4462-8384-40b783d79f95", "value": "T1909523F272F8992EC5C9ABF103B1A12542D4ADEADF148EE7D19B981E7717AC09C71043", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705087231, "uuid": "45e67f19-cb47-4491-9d47-ba289ee66298", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705087231, "uuid": "1e1225fd-cb69-4a20-ab28-a8d3924c1e61", "value": "49152:yy5+gmrmn/kKDFXd5sVRp/QRhMj1nnaqUHQZSu:rmrm8cB0Z4o1YwIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705087231, "uuid": "e9924128-2999-470b-bf78-bb5367e1c2e0", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705087231, "uuid": "c3b1bf6d-d10d-445d-a970-453790f4264a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705087231, "uuid": "a8acbe6f-b4ab-4f13-8f01-4b19c5a148ae", "value": "SecuriteInfo.com.Win32.TrojanX-gen.30807.23563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261dd240-b188-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705090880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705090880, "uuid": "a988ddbe-8c81-44c0-8f81-3d7e3dab6024", "comment": "Malware payload", "value": "50325c23729099d634a6385be93d3965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705090880, "uuid": "17becc11-c476-48c6-b119-1f3cc0e019c3", "comment": "Malware payload", "value": "d9814ac2cfa7d3baafe11e4807c6033314a828ab3236a45fad9a39894d6883e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705090880, "uuid": "db93283b-deee-4a25-b641-accb3874138f", "comment": "Malware payload", "value": "1d99eff38cbd55338b5d90901e0568157380378b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705090880, "uuid": "adc08f17-32cd-4bc6-a557-145f8000ac19", "comment": "Malware payload", "value": "331786548a4c59ead9c7b817d3dba3ea8d0a15ff6c967f1ec3e8fedfa2eb70cb04963c44c32554a7af1d7f90fee0d90d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705090880, "uuid": "7b17133e-beb2-4499-95a4-8cee0ac5351a", "value": "T15507335CE87B584CD5A690F82BB75CC8F5203C32935D5652B680E3B27B12EF0CC5B6A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705090880, "uuid": "76afbdbe-f25a-45c8-ae0f-b2b1920965ae", "value": "a7b0793ae6dd3f16ef244d19e4de0c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705090880, "uuid": "bd06a094-0833-472a-815a-90a2d121d658", "value": "393216:ZrN4ZHatgFLYv0RCgCEzZlnnl3ZvQKKay8Gem28rE/Y:ZrN4ZHAvrgC4lL3doe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705090880, "uuid": "2f120538-1c0d-4c95-81bb-51daf8163eb9", "value": 17964032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705090880, "uuid": "1d4da018-1a7e-407c-a1b2-9a5a65248d7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705090880, "uuid": "6bb4b14a-dd2d-4b6c-9ea8-1b47cb6e1393", "value": "SecuriteInfo.com.Win64.Evo-gen.10784.13987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a47b03-b137-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705056412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056412, "uuid": "421ac082-371f-4331-89d1-839becb7d998", "comment": "Malware payload (LummaStealer)", "value": "6b4f2298f1f1d8dda7577ddf3ad81043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056412, "uuid": "7d76cac0-4b83-401a-b159-5737f3643adb", "comment": "Malware payload (LummaStealer)", "value": "da8c10c9df64141f2e0eccea6bd14a3d836b49e83d6681dcb849d8991a0b44a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056412, "uuid": "9509ae9f-433e-49d8-a176-ebc0bcfc7406", "comment": "Malware payload (LummaStealer)", "value": "fdbc0d13c11dd7d985e340384455ba58cec2824c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056412, "uuid": "01b6da05-a5cc-4dfd-9a56-71c3852283a1", "comment": "Malware payload (LummaStealer)", "value": "91711369c0f4812f30663e5460a55d8e31f618a55d5fda0162de4064410cdb295e2b771d35cad905d9a2c8bb34eb616f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056412, "uuid": "808d3a3b-69df-4f90-9d9e-bf7c08c8ae8a", "value": "T1825622533909DEA4C8AC0134C91EB9BD35A17E3898944AA771B57FDF2DB2660F83F406", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056412, "uuid": "dc33d268-a402-4136-8173-64eb9c189fba", "value": "aac79c7c976b03896709ff6ec883dd9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056412, "uuid": "9f9b6581-c33a-4343-8016-7bbf0bbd0eda", "value": "98304:VZLz5pU45LLTamlZrS2u/A4fXSi4tWP6Tii8TVRRrPLGOYEMMRHGV7E:zLzj/jl1pu5fCiSWSWTHRrPLUMGV7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056412, "uuid": "02a97d3a-9c65-4f6b-9dde-71ee65c4399e", "value": 6104288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056412, "uuid": "05b652c0-b014-40b3-8267-85e669158def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056412, "uuid": "a28f3309-da78-4251-8c3d-f73e080714dc", "value": "6b4f2298f1f1d8dda7577ddf3ad81043.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c93562-b16d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705079451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079451, "uuid": "3e200e6e-ad63-4392-b435-5c2871a7c1b4", "comment": "Malware payload (Mirai)", "value": "59b9f17823753e3c5aa50173162442ef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079451, "uuid": "adf8ae5d-f57e-44ac-b749-be4b6ab16ea3", "comment": "Malware payload (Mirai)", "value": "db597815bfff48483f47b749fe31ecdb7eeff5ae8876ff96af4157b402edf0a4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079451, "uuid": "4b22aa7c-4343-4b21-b671-da634ed2ab53", "comment": "Malware payload (Mirai)", "value": "78f93fbe14a16fdb8f514f078805453d93a21ad6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705079451, "uuid": "d0cd994d-e111-4426-b617-e4dcfc2bda84", "comment": "Malware payload (Mirai)", "value": "ed368267901f46b20411dcbf16bf3cb69d5b19c840357794be3d247192e3849bade85c2684bbf5672e7c1940208ed39a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079451, "uuid": "282d35bc-7334-4bc3-8352-e7dd5a420893", "value": "T143B37DC0F643D4F7E84305B52077EB328B32E479221AEA43D3B89E36AC95461DA17B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079451, "uuid": "c5c1f86d-6c87-4e24-81f7-24180985e839", "value": "3072:081GutVwpSvt6r4FHWCFg+HwdFp5xjY+:0Of+p1u3HApXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705079451, "uuid": "7ab37df9-6da6-4dfd-8535-554b0c4f006f", "value": 108648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705079451, "uuid": "481872b5-8953-441c-a12b-44d113428d4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705079451, "uuid": "79f66e37-ac7f-43e9-8357-7265f6b4ebd3", "value": "skyljne.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2729d9ee-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056522, "uuid": "0835913e-7632-46c5-a8e3-01a90fc2a9cc", "comment": "Malware payload (Smoke Loader)", "value": "990a6d8f565a8df63234c7a9faabe6ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056522, "uuid": "22003702-3b84-4c90-bdee-c2a578e7c23d", "comment": "Malware payload (Smoke Loader)", "value": "db726961f1431fd7343b23e90a146a7fd19233d4980815f2d68d50c36bc1175d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056522, "uuid": "546e4de4-5bfd-47cb-bdf8-c30d10e5faec", "comment": "Malware payload (Smoke Loader)", "value": "328558357bbbafd16fad998fabb4e03c328900e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056522, "uuid": "9d5cf972-b7fb-46f5-809c-fc2d84c7277c", "comment": "Malware payload (Smoke Loader)", "value": "7cfd71b260a260f154f85b648f66c31089f5c25c3444db28b77c9b6fdca3abe76bbfb50e668fca8801f05de1552560c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056522, "uuid": "c7cfea85-6fa8-4c11-89a6-fb7c53344226", "value": "T1A8548D1172E8D432E2F319315634C7F50A7BB8726835946FA7D42A695E60FE2EA30337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056522, "uuid": "4420dc20-de0e-4081-b6ba-2e507a4957bf", "value": "d3be11f6df42332786a4c0379b6f9121", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056522, "uuid": "32580567-38fe-4f88-88c5-a432a045da62", "value": "3072:jec4fYwGFV04Lr70+sJiaUEvhqwuFVEYWQzkWl+tyYA5gi9/6NmJ5b4cQ4bRXp6h:jec43GFV04LNzEw9EYW8+lA/6+bRXMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056522, "uuid": "a911e176-03a6-419b-981e-600f7747c698", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056522, "uuid": "2ee12a87-40cf-49e9-aa58-34c2dc62601e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056522, "uuid": "a961bac7-de5b-4ffd-aaa1-fd7fc00f59f7", "value": "990a6d8f565a8df63234c7a9faabe6ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70249514-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056645, "uuid": "cc063d90-3af1-4ec0-bdc0-d843bbae2b9a", "comment": "Malware payload (Smoke Loader)", "value": "a945da935725b3335b8d532f59c60976", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056645, "uuid": "421fdb10-4c37-4c1d-bebf-e9b101cc16db", "comment": "Malware payload (Smoke Loader)", "value": "dccf17e32afc8abc1e8179411260ffe7971826da058cf4f57162c17560c16920", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056645, "uuid": "c68e2266-0139-4de2-b522-9cb7983f771e", "comment": "Malware payload (Smoke Loader)", "value": "fb99901e205973b26f9af4f1c757524a8aafc4af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056645, "uuid": "6d8cc7c0-3b37-4ed2-aef1-3db931d996b3", "comment": "Malware payload (Smoke Loader)", "value": "b8d5a87c72064a63f61a230e49c3f926f1d4a100e5621e7cf3aa64a603a555e69e2742e68da98a0749ffc4b821c60a76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056645, "uuid": "bf8062e9-37dc-4219-8127-3baafd8aea62", "value": "T163548C1172E8D032E3F319715638C7F50A7BB8726825956FA7D42A791E60FE29A30337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056645, "uuid": "b5270071-a074-40ed-b139-abb96e3f6b6b", "value": "3f1b99f6c9d48ec11c52365e30efb398", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056645, "uuid": "c89dcadf-3e97-47de-83a2-5487b4d817e5", "value": "6144:tPPtW22xvx9LrrylE5EbSDD74EUT/6bd6bRXMA:t9W2239HrylO/DDsEG6bMbph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056645, "uuid": "c857f6ba-6bba-41e0-9c5d-c208edb780d9", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056645, "uuid": "9b3558c4-ff00-4456-8819-d56b39307407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056645, "uuid": "f654d1e9-2b5b-4ea0-aad5-4faa2032310c", "value": "a945da935725b3335b8d532f59c60976.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91fa60b-b14d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705065787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065787, "uuid": "e05a0d87-c6ba-4405-bad6-1c2670a7b11d", "comment": "Malware payload (Smoke Loader)", "value": "c997f2f7258e41b614a73c6ad961f7fc", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065787, "uuid": "283dcee9-ec6d-4dff-8d03-abbf9b73ecdf", "comment": "Malware payload (Smoke Loader)", "value": "dd7f5bd431c5ef84cc58b490eed097e76b800d6c822de3de6d68d88881626a3b", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065787, "uuid": "90402906-b3e2-4646-ae47-10b13e1352d8", "comment": "Malware payload (Smoke Loader)", "value": "35bae15932993a27788979302bd8b328c31eac6a", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065787, "uuid": "901f5e06-faae-4aed-8119-b794e1cbb64e", "comment": "Malware payload (Smoke Loader)", "value": "5442a64eee12e1d09aba01adb4b3d417ed8ccfcc2b29061105be4a8ebc6bca3dc641aa3dc22078b1130955d9811ad3ff", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065787, "uuid": "805d42fc-3fa2-464c-a5a9-6a106fb4bc8c", "value": "T14103C0A3348062BECFD5713404878807971B479143608AE88D759EBE3FD1B8B785F29B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065787, "uuid": "f7614fe9-5c0a-4e71-abe6-eba4ed6e5226", "value": "768:hNZLNmqIfxMHORROsfru8UDBm5VMdH2DFhF8dM3uiLddSW:hkq0xM1sfBUNm8dAPUa5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065787, "uuid": "ffee59a9-65fb-42d4-9eda-5da8b5c05515", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065787, "uuid": "f712d30f-4ff4-4c28-b31e-78cfb3cf07fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065787, "uuid": "71e30975-a794-4354-94c8-213bbfa69479", "value": "1705065785d5a65a86155b3f63cc8cdc5ba849785e8a8184ac2c9e7d08a771f09a39631ea2998.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f74934-b111-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705040085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705040085, "uuid": "e65f0d98-6a05-43e2-86d5-925adf58c918", "comment": "Malware payload (Socks5Systemz)", "value": "5274441ac2f9f526603c91a46c179d17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705040085, "uuid": "c608512a-504a-466b-8448-ca28c7e406e7", "comment": "Malware payload (Socks5Systemz)", "value": "ddb34974223511c96173ac8099a9f7ac85c30773c19257137ade8da83f7d4120", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705040085, "uuid": "ad63af89-32dd-443a-942c-3c440a910cb0", "comment": "Malware payload (Socks5Systemz)", "value": "148096b95ce49b223c6b55e73780f93843060af0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705040085, "uuid": "0148df7f-103f-421e-9016-23c2883878bb", "comment": "Malware payload (Socks5Systemz)", "value": "4afa56d3d9538a834f513208f27c3407b9e31364a895192788d537244a472b2fbf05cfdae34daa6e1a2cfe8d2378d62e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705040085, "uuid": "64d02ff5-f6b7-41fe-86b0-7acf37938a26", "value": "T1A81633C0F795047AE87AE036AB3302FE0623FD551D3E34EA31DD09AE7B726499649391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705040085, "uuid": "1f988713-3970-44ee-9e73-1cebc192a0c9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705040085, "uuid": "9fc94321-fa96-4431-8afa-6322577ecb0b", "value": "98304:Q/tcsJO+n10x08vS7zKyENnSX8jUdqCapYTKjt2lL0UAR/:wlJOoG3q71ENnShgxeTKjt2aUAR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705040085, "uuid": "55243709-af7c-4993-919b-18731b221c99", "value": 4092429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705040085, "uuid": "092efb49-e8fe-4dcd-ac73-fbbb86546803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705040085, "uuid": "3fe4cf9d-204a-4b54-9753-e1cc54b0fb97", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.28515.9783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f047f48f-b14b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705065020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065020, "uuid": "03af4fb9-38f9-4d81-af24-ca478aa6c1ac", "comment": "Malware payload", "value": "170121b443dfb94113e76d0a3125977f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065020, "uuid": "6596c931-6e02-448c-a8f8-1d143c77a300", "comment": "Malware payload", "value": "de37f3b4aeeada22873dfb5fa074bd53e959fab38593ee22b8ab689fa767f8c8", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065020, "uuid": "8ab63ac8-c619-48ee-90d2-1597bb987ceb", "comment": "Malware payload", "value": "a9d3e8971781a70cdf9fb03301b8b68299f3f8e4", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065020, "uuid": "6e6eaeac-8499-459e-899f-9aa28b16a65f", "comment": "Malware payload", "value": "87c5c82a729ca009905f34e1beaa089ccf024bf8f6976706ec5c3640b701067b7f4f1ee72445093aed293e645041d8a2", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065020, "uuid": "2ce86191-0ce1-4d3a-921c-a44b60799ff6", "value": "T13D41BD252FDE4768F3F64D32447BE720D976FC0ACA02871E018485841892714E93BF63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065020, "uuid": "9b8f9395-3a0d-4c3c-a581-24ad72fc4b44", "value": "12:8kLBX5Y0m/tM3rC5VSXYHm34EmrlgROjAjPBW+UccwiicGbdpYrn1Il+Mf8r7GX/:8NJFhwmi8AbA+/Ysdd+i8uXuHY8CbPfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065020, "uuid": "cdeefb85-3904-455a-97d3-50747121ac45", "value": 2413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065020, "uuid": "28bd2898-6234-48f6-96c5-2f40692d881b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065020, "uuid": "04edefa4-9e01-4468-9c09-2678b773f836", "value": "Document.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9345aa37-b153-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1705068300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068300, "uuid": "2aa387ae-61c4-4112-a13e-db5cd659c526", "comment": "Malware payload (SnakeKeylogger)", "value": "6e1d5bed90e07bdc4be5f78590501fc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068300, "uuid": "080509fd-5b10-4192-8ccd-e7ccb11331b7", "comment": "Malware payload (SnakeKeylogger)", "value": "dfc2549bb01c896ce859ef5b081d26128ea36cf31321450ec9c3b89f6fbcd620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068300, "uuid": "bc385b33-8ce4-4cd3-bffb-11c0d3be00a5", "comment": "Malware payload (SnakeKeylogger)", "value": "c12dc24516aa265a21d297bff0b3374e6e90def1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705068300, "uuid": "6ba96937-84c7-4b3c-9a4c-3ce7d4dbf8aa", "comment": "Malware payload (SnakeKeylogger)", "value": "7d397ef3473da8ea855cee8966fe40dd79993d07eb50f62d1a5778a1ad867e093d63f4bd4dda24f3b0880b1e7917d4ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068300, "uuid": "85df6710-983a-4299-8cea-310d55f03e3d", "value": "T1EB058C15B7E9433AE5F24B36F5F642258631F9C92A22C71F03A4C21D2C93F54CD627AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068300, "uuid": "a0b6aa90-9ac6-4d6e-aa94-2030ea97618e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068300, "uuid": "e0788ddc-cfdf-498d-99fe-82948b0bd0dd", "value": "12288:3hsgxttyEQ8Q/NzeFCarqNN+ZlhiOvUjyBlTfZgVeVQbW:3xyZ8Q/NzeFCarRZlhtvUj6lTfZgV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705068300, "uuid": "009ebf6b-aed3-435c-90e5-5d03d4add80c", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705068300, "uuid": "e0cccc5f-d942-430c-b2ab-50a54c6343bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705068300, "uuid": "6f994f05-db1a-4561-9f27-f5aab47d9ba5", "value": "cargo details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25fa54a-b13a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705057642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705057642, "uuid": "33eb8fec-e597-4fee-b380-4f1169810012", "comment": "Malware payload (RiseProStealer)", "value": "e8f45cea03233d4731394f370e9f1e58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705057642, "uuid": "26d34719-90ed-4c8a-b17d-fc461ba3cb24", "comment": "Malware payload (RiseProStealer)", "value": "e296340b2b842ca4367266701deccfa2eb1105a87bca21db8820fd17a07867de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705057642, "uuid": "8f5018ad-e6e6-4246-8acd-a9275a7e0c9e", "comment": "Malware payload (RiseProStealer)", "value": "83538feb7a9b7c9e104401f753c3eb3247549e46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705057642, "uuid": "d4eeae6a-c76e-4763-be50-c63b46f475f4", "comment": "Malware payload (RiseProStealer)", "value": "dd609a66fee41a1c49178f7137bf5a5f07d6c9cfeaac6ec82dc2266b394a85547ee02e1fe549a1a6231079cce9d3e8b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705057642, "uuid": "a3fdc2cb-6687-41ef-a301-dc7e056fcaa2", "value": "T1CC263381698718CDC28D62704661ED2C35B41E3029548F1AAEFCFADBFDF6B67E4B1181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705057642, "uuid": "cf48fd67-f564-485b-8b69-c0c734f735a8", "value": "aaf32b017ad9e013ba3051fb314bf830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705057642, "uuid": "1941ae27-9033-41dc-8664-9e4964a4a186", "value": "98304:jjmVSurPuoxo/sPsH0PhVLJWThWFwhE0W4MVCbFVLl4hxKjpOZP7Gf8o:+V9rLqUkaVsTACQ4JAhxKlSPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705057642, "uuid": "6d506209-81a5-440a-ace2-f8ce4dbda53a", "value": 4663976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705057642, "uuid": "f3d679f0-09a0-4119-896c-87bec0f0e5b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705057642, "uuid": "94a56337-e9ed-43a8-88ca-0e9659a3a6b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325374f7-b15e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705072862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072862, "uuid": "11c41d34-6f95-4838-9962-2de0467ec4cc", "comment": "Malware payload (DCRat)", "value": "cf83b6af9bd8870c07bbfc7c53d2349b", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072862, "uuid": "5bb8db9c-8b00-41c7-8f5d-344f5ddbf2b2", "comment": "Malware payload (DCRat)", "value": "e411f99065fcc88640aa59af80d78e7f593389530916f7461bd63e3edc2413dd", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072862, "uuid": "28c74d08-8a08-4d6f-a6d6-5c2b4a6710a4", "comment": "Malware payload (DCRat)", "value": "70838055c7007ee6f957ebd1cdf5e573150f8df5", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705072862, "uuid": "4f85be07-6a60-454b-96e7-08c8254802ad", "comment": "Malware payload (DCRat)", "value": "78a482f223e3529363f5026f9b919a490d2dd47e1f259bbc22577af2d06ce845c37948b2e90a66ee95935351c311fe64", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072862, "uuid": "7048c446-e424-432a-aae9-777936487407", "value": "T12285335ABB53A4AAC515857C54E3881506F1E7AF17338B5CCCC885842E2FBC6E027B8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072862, "uuid": "1704c7a1-b13b-4e3d-abdb-d6ac4c1becc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072862, "uuid": "8724bd95-aa4e-4fcb-87c8-555392dc8d56", "value": "49152:udJTK9VNjPKAw62BE+pN++kRWdvirVOrQTHUg:SKNvMBE+T+Cd4On", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705072862, "uuid": "66b37192-7909-4416-bf01-4799681facca", "value": 1764352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705072862, "uuid": "27629f54-2d79-4f12-8e6b-ca380763aeb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705072862, "uuid": "9b5c7bcd-8fdf-4634-a88f-ea11b4bcd726", "value": "cf83b6af9bd8870c07bbfc7c53d2349b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd612e0-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056641, "uuid": "123f530d-6267-4370-88e7-4624eae64b86", "comment": "Malware payload (Smoke Loader)", "value": "7dff92e9e8dd4d8e221b8c1d96e989e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056641, "uuid": "9dfb8f77-7b8f-4492-8dcc-15fa901c8c35", "comment": "Malware payload (Smoke Loader)", "value": "e4483d851c0dbc14d70fe4f6b961eaa94fc27acf8f4005fda0cf2b7cb665c695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056641, "uuid": "5fc166d7-e704-475d-9f0a-e3d30da96d38", "comment": "Malware payload (Smoke Loader)", "value": "a9b0f67bff82091751facf04609b48288e2c138e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056641, "uuid": "6d78d67a-dbfa-4c22-8d36-4304b843725e", "comment": "Malware payload (Smoke Loader)", "value": "26ea0bd3ac655ee489a1495c5704e86583a2c0bd55a137319405ad7b7021f69b8e2fbe9952737dd641b534675ddadd3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056641, "uuid": "2313f03a-4102-49e2-89a0-1cbaa09117fe", "value": "T1AE548D1132E8D432E2F319714634C7F54A7BB8726835946EABD42A791E60FE2DA30737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056641, "uuid": "16d24c5c-029d-45a7-9f21-12610118df55", "value": "d3be11f6df42332786a4c0379b6f9121", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056641, "uuid": "c105ec6d-fd03-4b35-b7e9-a87c466af14c", "value": "6144:3ec43GFV07LNzEwTVCEhX8Y0qd/6WbRXMA:3u3GFm7pzECdsYz6Wbph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056641, "uuid": "65ff05c5-d76a-41c2-a666-fe3816ac5db5", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056641, "uuid": "cd6d2f0c-95af-4509-b8b6-8afdd6ffb00a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056641, "uuid": "b8c8dfe3-31a1-48f6-b185-ae9091a35aa3", "value": "7dff92e9e8dd4d8e221b8c1d96e989e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5650ba57-b133-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705054454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054454, "uuid": "f73dfd88-f1ec-4215-8d59-bdec007e0630", "comment": "Malware payload (LummaStealer)", "value": "fab9a49f34ba2e67cdbb4fe8e00fbd57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054454, "uuid": "88a5df08-538e-4aab-b36e-b6a4fe44e94f", "comment": "Malware payload (LummaStealer)", "value": "e47d112f2d69f2f2d49a34a4857604e11bb89ba9c8f24f46fe6ae8bbe9c31b83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054454, "uuid": "110b39dc-9c01-4b5b-9d24-76f9790f2465", "comment": "Malware payload (LummaStealer)", "value": "cfbe4044246162d3c430ad6f5616176762a3350a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705054454, "uuid": "0c4df327-09e5-4947-af7a-6e6a3dc9b4ff", "comment": "Malware payload (LummaStealer)", "value": "8e6c71fb7c464b5c8600c19b85d994386a0e6da61dd16251967097a74b54e0fa700f1e1e5390d7c382bfe9b420116d73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054454, "uuid": "c3a42617-ee7f-43c4-a400-fce3ae43119f", "value": "T19706082591507C43EBE7BAF86DD7809D70E15EB6EF80846E14281E528279FF4EF0126B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054454, "uuid": "43fb05dc-630c-495c-89ea-4c927509c372", "value": "e59ba20e52010294e2c6cec0f9607820", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054454, "uuid": "abba1578-9be2-415e-8481-ea26744c6fa0", "value": "49152:Er2uMazs/4X+qarTsgLe5N66PVK0XdkLT1TSJXx8CuY0f7ryaUcZ9Y/Kf2Rjva:92w/4XirAyw5VdjuTUcZK/KfkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705054454, "uuid": "7d37506e-8aee-437e-a915-fa2c2fa8e555", "value": 3664184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705054454, "uuid": "f179753c-0917-4c04-ab47-cbbcb18e1ff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705054454, "uuid": "2c84e9c0-d55b-4200-873f-fdaf92c7c4f1", "value": "fab9a49f34ba2e67cdbb4fe8e00fbd57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04af013a-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705065054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065054, "uuid": "7054df7c-c131-4d0b-8df1-e7bb6385f9dc", "comment": "Malware payload (Smoke Loader)", "value": "f0d213c32543202c9345fbdc6a360f6a", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065054, "uuid": "92e1d488-da65-4b9a-95ef-c55f1c5d16a6", "comment": "Malware payload (Smoke Loader)", "value": "e4917f153a2282b89c71a540fca33187642d249d743270a703e7c2d1d7b64b52", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065054, "uuid": "58a9c5f1-b086-4de3-9c26-5e0b64ff197e", "comment": "Malware payload (Smoke Loader)", "value": "57dd42eb5e1c1ba475ec5b5a442b54319cfbd9d3", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065054, "uuid": "96e76dbe-cd81-4cbe-be4e-4cbc78a0c4d1", "comment": "Malware payload (Smoke Loader)", "value": "3e2a0a7a6abbc097e7b1eba66cac8986592f3ed7055c2a0af9b34f99ad413098e7fc50ff87388cf1e95b51bdf8018cdb", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065054, "uuid": "1682c578-5189-4821-9a35-fd84f6dfaf36", "value": "T10781D2213BFEC114B1B7BE525FE8B6AA5D2FFBB32608245E2040020F61315C8DDB6A75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065054, "uuid": "dd08e577-7cd6-4820-989b-1550b0cae2a8", "value": "48:Fa1dCQlgR/M9wLawCXxD1laiJwCXxD1lau2a1dCQOwCXxD1lahXUglGlCS/DjLwA:Faikdaedau2aiJdahhlGTda6f8fzlGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065054, "uuid": "cbd2565e-978a-41e2-a5d3-2c1ac4f7a007", "value": 3834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065054, "uuid": "4a535083-0d79-4e02-8813-e063d5aa97a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065054, "uuid": "8517468a-7283-4cab-9623-df8acc476da6", "value": "Image#413164.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b8d2d1-b0e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705020011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020011, "uuid": "83864fad-bbba-462a-af04-dd098318b148", "comment": "Malware payload (Stealc)", "value": "026dc7c174870bd1ccf25a3c58d69440", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020011, "uuid": "9b15d624-da6a-4cf3-a0ca-470edc0a9f2a", "comment": "Malware payload (Stealc)", "value": "e4b81a5e79ff5b6ba6f6eda3b8bda8172409ac2165a23dba8d04f717adf07577", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020011, "uuid": "f83e5952-0b87-464b-86fc-b166950d2be3", "comment": "Malware payload (Stealc)", "value": "4a1a96d34d9b9d57e875c51c68d3c45024815086", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705020011, "uuid": "dd96bd4d-b6c5-4fc7-80b1-c6fcf5988520", "comment": "Malware payload (Stealc)", "value": "622964c4f4240c828167c6b07172288b9985283f1f3ed5be862ed5937e5387ae0037c0b8b7ef322198910d95350d0897", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020011, "uuid": "6d947ed9-3eb5-4665-94eb-442fa6d5e15b", "value": "T19EB5335249C24C62F1A21D70183A70D64BA11EB7A9C5E493D3C2FC985EF3741A38F6BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020011, "uuid": "bc05eb70-0060-4cab-ba26-56059908cb0d", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020011, "uuid": "8da42286-2823-4215-935b-c318705c091b", "value": "49152:va2s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hsM:vCzX71oDCRAZUviAHImDqia7hsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705020011, "uuid": "f48c256c-d587-42f7-a9e3-ee709a2468f9", "value": 2467255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705020011, "uuid": "b9c7d842-cf5e-4713-ab7c-2afc3b0215ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705020011, "uuid": "e14067c7-3b59-4702-8a0f-381fc398c0e6", "value": "026dc7c174870bd1ccf25a3c58d69440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f14f33a-b147-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1705063139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063139, "uuid": "002d2959-b187-4d66-bc2c-6824c008a26d", "comment": "Malware payload (QuasarRAT)", "value": "f675d1feef66a26866699b1280b83059", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SVN", "colour": "#EE1997", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063139, "uuid": "01d0411f-f020-4ebe-a205-fe2e468bb8c4", "comment": "Malware payload (QuasarRAT)", "value": "e5bbcc08742357941d284511b0a7e9528ccc6a7bb9fa8d544cadf2b97f19e8da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SVN", "colour": "#EE1997", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063139, "uuid": "c0c10b7c-ba65-45a0-ae22-f35cede85cf3", "comment": "Malware payload (QuasarRAT)", "value": "57304b04cb660eb32e1c096ea005613be24751b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SVN", "colour": "#EE1997", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063139, "uuid": "fbfef721-de6c-497d-9857-03c0af705db1", "comment": "Malware payload (QuasarRAT)", "value": "5a4c9784c945cb80e64e416fdcc945f93a26f95bec6a4a6d1cb1bcf0ec78bf997ca29069a334064d5e45b5b28e54b849", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SVN", "colour": "#EE1997", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063139, "uuid": "c45cdcf6-590f-4f25-95c5-347679b5e3d9", "value": "T173E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063139, "uuid": "a88505ba-7373-4128-bf68-52de48405a14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063139, "uuid": "c9145028-468c-4d4c-85ff-c290e3492c0a", "value": "49152:evpt62XlaSFNWPjljiFa2RoUYIRVRJ6vbR3LoGd6oTHHB72eh2NT:evj62XlaSFNWPjljiFXRoUYIRVRJ6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705063139, "uuid": "7dab7b6d-ae78-4a28-bf23-9ef1c723eafb", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705063139, "uuid": "0c75d9e0-0453-4714-a76b-56613da7186d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063139, "uuid": "4110d9b8-1c9f-4446-9937-7a1305db034b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b990ab4-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1705065120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065120, "uuid": "a3fcc3e6-362f-4c20-9e8e-dee72e953cbf", "comment": "Malware payload (SnakeKeylogger)", "value": "8a80f25623661e6d839b397280be4ee2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065120, "uuid": "2a4bce60-6828-408f-aefa-593d830cad7c", "comment": "Malware payload (SnakeKeylogger)", "value": "e5fd5bbe986493e44b2d137904fc59ec939113d953c793deb06806dbba3b138b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065120, "uuid": "52882f75-f965-4ccb-85ca-5adaf9121723", "comment": "Malware payload (SnakeKeylogger)", "value": "f7ddd81b9bdd8cf0ee4d32c220efeec982779e15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065120, "uuid": "fac79a08-b25d-43a1-9d67-e84be03fd958", "comment": "Malware payload (SnakeKeylogger)", "value": "024cc21a6cc7bfea1ea644f817c81af9dca9ce0a2fabe086373f515c8e5ddd082600ab0bb14a4e11df036675ffd793cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065120, "uuid": "24f38ee5-c58c-4dc0-b3a0-689076ae9f19", "value": "T123B4124663BC6726C8BB5BFE767044511379BD253022D77CADC670EE2AA2B100B12F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065120, "uuid": "a86b0451-acf2-4e93-8f0c-29b543c1a7ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065120, "uuid": "aede0673-2d64-46a8-b400-d2deba63a085", "value": "12288:8IB/abxDfF9+NCICP2JRLsTOZpJ1a45z5yNHT4:FpKxbF0NC40KZtXz4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065120, "uuid": "51055a54-b484-4095-a2a3-ee50c2ca300c", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065120, "uuid": "995f5f2e-4e72-4d8a-8b5f-6529aff631c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065120, "uuid": "fbb6cdcb-efce-40c6-8f90-27f886878f36", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d59e858-b160-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705073900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073900, "uuid": "071070dd-ce23-4110-950f-1cfd934ac783", "comment": "Malware payload (Smoke Loader)", "value": "a18c5634a16a2dfb8ae46752ce4e4238", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073900, "uuid": "7a0889b2-b6d1-47e9-b19d-43ac1661ef97", "comment": "Malware payload (Smoke Loader)", "value": "e6aa74189e7f0e76c61715f31439a43360b3b66f86e899b3c621c817298623d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073900, "uuid": "77c10d54-8899-4f5c-ac6b-ea89e02cb71f", "comment": "Malware payload (Smoke Loader)", "value": "f290033b1dd5137d026c90f9f4056e13b07a02ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073900, "uuid": "610a2c79-2b44-4326-976e-296a0ce0c871", "comment": "Malware payload (Smoke Loader)", "value": "1129b236157173f2727a7af207bf7034fae9dc1f7f2960cac459b6489857a33c0daf23954cfc9606fe44f5d1c7ee5bc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073900, "uuid": "a629e9fd-dd87-4f85-a8a8-23ac07af5da6", "value": "T13D74935382E13D44E9768B729F2FC6FE770EF2519E4977A921199E2B20B01B3D163B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073900, "uuid": "707ecae1-f4a9-4c66-91b4-7215d8a2c0f2", "value": "31e36cf00bd38f6118c77fe30a6b7e3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073900, "uuid": "62a119b7-4c55-4eea-8348-fa2d3978023a", "value": "3072:Qnp1z2pL0IOQeXR4j+ygDNkdOnXaXmMd5VITRLdKPo95n:WALxOQkRd3BkdOnXYPFITREwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705073900, "uuid": "8cb9392c-b59e-4e55-a2a1-02d27995e198", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705073900, "uuid": "e62058e5-99d6-4806-b546-d3522746b58d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073900, "uuid": "d70683d3-996a-4e99-8408-2daeb792ea94", "value": "a18c5634a16a2dfb8ae46752ce4e4238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d15bb09-b168-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705077336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705077336, "uuid": "3d6d6109-8956-4a5c-9ecd-49193088c4fc", "comment": "Malware payload", "value": "cfea95e7f479426904a6f16b8c62072c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705077336, "uuid": "a8dabd62-c9c5-424f-8c40-3eb0e1d5b2c7", "comment": "Malware payload", "value": "e7258b68c24a165c0c61f1fe16a15dd642cf118eae9a4405d3d3cee174d1c72e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705077336, "uuid": "643d5b3d-737d-4d8f-8175-55007aaba0cc", "comment": "Malware payload", "value": "fdb6fd3763d3d00cfba81df3761e2f96a495aecd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705077336, "uuid": "0e9b0e8e-8c15-4654-9ddb-fea650774eb0", "comment": "Malware payload", "value": "714de9257d262c76d8e7b707bbaf097c4585c3a5fa843fe448d4906830e0568276b272bee9c89b37f6f78e734f8aad4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705077336, "uuid": "7c168087-8032-46b1-baae-89a288300c3e", "value": "T1F9569D20B14EDE6ED56241F0093CDAAA911DAD2A0F6190D7B2DC7D6F2BB04C37636E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705077336, "uuid": "2c06de02-11ac-42fd-aa98-34905694beac", "value": "36aca8edddb161c588fcf5afdc1ad9fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705077336, "uuid": "71f60333-18f5-4962-9f52-d4d66c2215e4", "value": "98304:DazvMgOJRWT7tRyYsQdTEDdoJr7dJDqpbhU4H+u1JNAGcX4pD04Wj:DazvMgOJRWT7ukTE5oNQX1pD04Wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705077336, "uuid": "c59b14ca-f989-407d-9858-7ca42c4168e7", "value": 5994440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705077336, "uuid": "dd0f5c45-afd8-400a-9630-62e57cb2b2c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705077336, "uuid": "5432b58a-e379-447b-9998-0048d836116f", "value": "cfea95e7f479426904a6f16b8c62072c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4228ca1d-b120-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705046260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046260, "uuid": "650daa93-59da-4471-9f07-5a286b49d044", "comment": "Malware payload (Mirai)", "value": "260720a83b1499cb5e6053616eb8903b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046260, "uuid": "caae71e4-fe99-4036-a3d1-e32afc13f723", "comment": "Malware payload (Mirai)", "value": "e766d38ae0ec1ce75fc05559c73f66cd5a66040296d89f8608a0a21034e9f59a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046260, "uuid": "8ae02592-add8-46e5-93aa-28be324d9956", "comment": "Malware payload (Mirai)", "value": "915ea07e9d47817b793a3cf75f3d62691f4157c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046260, "uuid": "99adc737-1d2a-4a6b-aab0-b0a1cc5b9246", "comment": "Malware payload (Mirai)", "value": "d1d41118ba8319334b9df437cd5876ae4aa3e12b4e7403613972eae2fd12cb704e405e2e10ed2b00a01281afeaff374f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046260, "uuid": "d50049f2-30df-4a3a-84bc-ff396648e296", "value": "T147C32886B881AB11C6C116BBFE1E018D332757B8E3DE7213CD185F60778A96B0E7B516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046260, "uuid": "e3a557ea-ec8f-460d-8418-6a162b781f96", "value": "3072:no2W2fPkJ2Pz8ehFS+MNKdaBItHrUlzBN+0jXiB5+CAf:no2hPw2Pzl5MNuaBItHg7NPXiBtAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705046260, "uuid": "47f0bf65-bf7c-4509-b08e-0689d6864660", "value": 129160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705046260, "uuid": "f690fe48-e5a7-406d-9d82-6d1e3d154067", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046260, "uuid": "3195f876-40db-428c-8c16-391b1158542e", "value": "260720a83b1499cb5e6053616eb8903b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31acfcb-b14b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705065025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065025, "uuid": "efa991af-74ab-4dc1-b847-394182c75f58", "comment": "Malware payload", "value": "ca33dd17210813785491799a3c1b37ee", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065025, "uuid": "d2171358-bcd3-4413-b48d-8cbe125bbaa9", "comment": "Malware payload", "value": "e81ca580aa139bc8e2a9273d2dfcf05c1f90d1533eb03852145069388a8d18c1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065025, "uuid": "3c1437bf-1cbb-4595-a8f5-279eb37be959", "comment": "Malware payload", "value": "5baf719f69117fd1ed71e4169f8c0efa80c431d1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065025, "uuid": "2992532c-912c-420f-bcd4-4460383d0ba3", "comment": "Malware payload", "value": "85bef9e2f727744c33ed3dadccfd12713f07872e0a50242cd135b6ad42bb180b73719fe909bc4e29e1b3ecfc709f44ed", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065025, "uuid": "90c8c5a3-c73a-4e80-999d-9af915f3cd60", "value": "T12246232EBA93CA33D2FF95B05B258F9B17196E0CE3B540E3A3C95D0A9031DA0353565B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065025, "uuid": "d14c9972-0d0a-4115-a2ec-fc71c171d905", "value": "98304:8YUtkZAYECAKzxNpm+979xNL/5+yTNTE8bTKLAiHmBXwvDUm:ky1RNNsadUmP2jHmhQAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065025, "uuid": "4f0a5b37-6018-478f-bb12-cc7a9b1c0529", "value": 5592121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065025, "uuid": "e293606e-8fe0-4915-995e-bb306d70b450", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065025, "uuid": "812bc8cc-85a3-4eb2-b616-d2a7dcb04ce7", "value": "_Boleto_01_24_35735757.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d129a2-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705065164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065164, "uuid": "e3604b5f-d8b2-44a5-b711-d88e9949e4ef", "comment": "Malware payload (AgentTesla)", "value": "f5c893339a725f798727c733c4d567f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065164, "uuid": "3fb871a1-16d3-437a-8048-eaca539906b0", "comment": "Malware payload (AgentTesla)", "value": "e9da8094392d8124c615595ebabc8e3ce15c94922c7f5540e12974eee9113a86", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065164, "uuid": "3f3bf66e-1278-4e12-b6c3-317336e381a2", "comment": "Malware payload (AgentTesla)", "value": "85fe17228281359a29151103b8e634c42c238d13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065164, "uuid": "c56745cb-779a-438b-b1bd-2cf0bf9363b2", "comment": "Malware payload (AgentTesla)", "value": "cffb5bc32fc99ca5f977ba001ca084deeff6767b10e762fd62dbd230ab4f872ba8884f0598adf372cbf281a3aa3e9ee8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065164, "uuid": "9621e131-5c6e-4cb1-b42d-38d6dd9fcaea", "value": "T155D41202F26887B1C6764BF0453D99818B767057B4B3E3C82DEAB4EF25B27448796B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065164, "uuid": "11720ad7-45ca-46cc-b5b9-30ce1e649ee3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065164, "uuid": "5ebcf046-bfb0-4e52-96a6-d5c7b45ae32b", "value": "12288:ldebOkkiOCoL8DwjScwOEibfpN3N/m91JYrGRNCwZdgh:OH8VgwjScLVbfXo+rGRNju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065164, "uuid": "a240c71f-6b18-4d37-b09f-5f74e0a9d7eb", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065164, "uuid": "264db33e-7491-4d5d-b27a-f99683d742e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065164, "uuid": "f5116368-9ccc-4afa-aa7e-dc5fc06d6041", "value": "DEKONT2024-01-12-9876678909876567800009876-DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee74dd1-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (StormKitty)", "timestamp": 1705065152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065152, "uuid": "cc66a3bb-8534-436e-905a-561af6938f1f", "comment": "Malware payload (StormKitty)", "value": "356ebfc305d36513855d31777731accf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065152, "uuid": "3bb0ca3a-0594-4c94-8698-91896ef6a0f2", "comment": "Malware payload (StormKitty)", "value": "ea0ac7277d0fdf801972b56bdc57184fc51ac8be47438873396436736f3694a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065152, "uuid": "f3b78f2c-db8b-4af8-aff9-3aaac4fabe6a", "comment": "Malware payload (StormKitty)", "value": "791346b68cc757802f774a00639df3b8e7b88222", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065152, "uuid": "00429e95-0261-4a1a-a49c-7b40e90628e2", "comment": "Malware payload (StormKitty)", "value": "afed66e8e71d639510e6d1e635004400f6c5b04bb60697cba7461af616315ad87aa529601ba4a9e7ac430570dab36a6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065152, "uuid": "fc63f113-ac0f-4fd3-a0e2-ff5a5784338b", "value": "T14246BE15FBD501D8E97BD634CA2A8732D2F1B85A0732938B0928C35B1E37B954F7B225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065152, "uuid": "374903a3-1c04-4150-b79b-6a5236eb6b42", "value": "0751433fb799ff99dbf59b2d0c85d83d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065152, "uuid": "68f0b178-b12a-4875-b5b5-3de13eef9782", "value": "49152:BBOyJgTqnmJIKbHVgaeJ1jyFLWuFjiw3e1BhpJEjtxQ7BiTZGniaoxdAFe2/9uMN:jjye1BhpJEjg7WOMxd6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065152, "uuid": "1a134cdb-bc93-43fe-a9dd-c83202973283", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065152, "uuid": "55401eb9-ea00-438d-baf9-b17de6025d49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065152, "uuid": "07c1bd94-e1a3-4fd6-9d12-33610385e689", "value": "Dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc6e15d-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705065315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065315, "uuid": "a13d045c-3e12-4bba-b2dc-6e0c54d64600", "comment": "Malware payload (RedLineStealer)", "value": "b4b712bd3f230d701d94fb8c9143a73c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065315, "uuid": "983ccb03-d9f4-4a70-a805-a9724316389b", "comment": "Malware payload (RedLineStealer)", "value": "ea0e1edd416c2080d13fffc20ab4648156e4acf792d13f2dd9286a0a2b7bdc0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065315, "uuid": "bbf33ff8-1e4d-4e5d-84c0-2026b114702a", "comment": "Malware payload (RedLineStealer)", "value": "5941014c6e93c75e580e99f639beddb253a56fe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065315, "uuid": "51161a56-9b58-4aba-98a0-1b8e5484524d", "comment": "Malware payload (RedLineStealer)", "value": "4fba6458c95183fa4c26fbd2ba5c876b61b99087e7cb0db98999c0ee5cdd8d4199e82b768aa49d34ac91e806a926811f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065315, "uuid": "ad922b62-d01d-489f-befa-5d1f1e9455b8", "value": "T1E22633176EEC4029E47DA3B048F275B34E28B9779C692696134DED8B1CF2B52B130B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065315, "uuid": "bd335b4c-77ae-497f-8918-b201b7f0f286", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065315, "uuid": "c9b00b95-3648-474d-b6b2-a029ebdbad04", "value": "98304:0dIT5R3jIdMkALmSmjOQdfw/mF8P3BJdKPzyx:oITLoMksmAQVwFHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065315, "uuid": "528a9a9f-0efe-401f-9cd2-3986a4c55535", "value": 4542464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065315, "uuid": "ff44a64b-0bfa-480f-b78e-ba0664542af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065315, "uuid": "1999331f-c8d9-4366-a2e0-e4416d43bd5a", "value": "B4B712BD3F230D701D94FB8C9143A73C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcfcd366-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1705065417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065417, "uuid": "540c8e29-534e-4a6b-b722-75a6397ca0e1", "comment": "Malware payload (NanoCore)", "value": "f77021eed67c954c84ef0df5c54bb8cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "new order", "colour": "#FB7837", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065417, "uuid": "d17fb596-50b9-475c-bfe2-a0f4879207cc", "comment": "Malware payload (NanoCore)", "value": "ea3d85d72960edd0ce292bfdbd190f4a1d2fb1506213d93e1a87e14b72278343", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "new order", "colour": "#FB7837", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065417, "uuid": "0db6a077-5dd3-4c9c-b2dd-077ca7062eb5", "comment": "Malware payload (NanoCore)", "value": "f1b6f72fcdb24b2a09b43df4948b5574d530b6ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "new order", "colour": "#FB7837", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065417, "uuid": "103e0333-60af-41e0-a00a-0a5d0df64221", "comment": "Malware payload (NanoCore)", "value": "1993e8e8bb576232ead6426cd3360b273d3b9360d066ca2ecf5cd508b44f8dc9a9d996bda694fa387b5bdbca9dd9b7f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "new order", "colour": "#FB7837", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065417, "uuid": "f8e4c9ad-1f08-4ebb-857f-2de77ba79c19", "value": "T158D3AC6DD34B02598F520337AB1B1E5542BDBA7EF34452B1346C533933EAC39A2262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065417, "uuid": "85eb4bc7-de60-420d-83bc-d2abfbbe4f8f", "value": "768:KwAbZSibMX9gRWjtwAbZSibMX9gRWjKN7z4zqohRT741tt0SL85CFwji0J:KwAlRkwAlRD+hZ741tt0jjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065417, "uuid": "aa3b758d-d47d-4f2b-a5f1-6e4f49b53f5a", "value": 133066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065417, "uuid": "9ae7875d-a84e-463a-ac4a-17f32c3ea6dc", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065417, "uuid": "689502bc-474b-45c2-bd33-4bda8ac8d437", "value": "New Order 1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec5493d9-b104-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705034519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705034519, "uuid": "632d4d8f-a738-418c-ac65-0fd6eac5e512", "comment": "Malware payload (Mirai)", "value": "ee1b3dc928aa9ca1013fda62090b4b31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705034519, "uuid": "9950a7bc-0c4a-4a30-a7e5-a9d4db6f2b66", "comment": "Malware payload (Mirai)", "value": "ea6f0dd8a16f8b66691ebe44af651b00e9bd4cc76346ad17314cda0672784d7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705034519, "uuid": "16aa4efc-032a-4128-9bef-62f8e1ceeebc", "comment": "Malware payload (Mirai)", "value": "cc1a8c004729e500251313bf48d5c64afd427094", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705034519, "uuid": "79dd90be-f681-4a20-a50f-19916d188d5b", "comment": "Malware payload (Mirai)", "value": "c25a8d234212506d3b7764c72a879f0d039a971fd477404f886c6343b7153d7008e1d77b7199da3f4dbbf783f182fc14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705034519, "uuid": "22ae443d-0bf9-480b-82e8-854ec96adc89", "value": "T14D439E73C8296DC4C1988274B8219E7B5B13F81452931EBB1AFAC5AA400BFBCF6453F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705034519, "uuid": "05deb6e0-aff9-408c-8e57-9ba6660a52c8", "value": "1536:A+ta2Ac7tLHu2+wtO1a/pmKM4kywm2bCiKkPR:Rrr6tN1axZMxm2bnPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705034519, "uuid": "7a3b814a-733d-43a2-8211-c4c536a4dcdf", "value": 60096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705034519, "uuid": "31ca07e1-c4e3-446f-bd5a-cd6c12ef6a0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705034519, "uuid": "19692e47-b2bf-4463-9ad3-cfeb2b1d3158", "value": "ee1b3dc928aa9ca1013fda62090b4b31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb1bc46-b14b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705065046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065046, "uuid": "78f8bce3-76af-49e2-9129-3d6a47e9a4e4", "comment": "Malware payload (AgentTesla)", "value": "b57a3119b362b6a462fc1492d452bc21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065046, "uuid": "ce5a9d21-6128-4696-a046-dddf5c2b6dfa", "comment": "Malware payload (AgentTesla)", "value": "ea77ddd63541bab160c7e455284da99bc83a509d17a15bf325a13f31a6ae20d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065046, "uuid": "6df9097b-66e1-4536-96e4-85ae8fc65eb6", "comment": "Malware payload (AgentTesla)", "value": "78e1ed583109b25c863dfe40777248bf0ad8c3e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065046, "uuid": "1a6d43ce-f3e8-44df-b124-07fd7142c8a2", "comment": "Malware payload (AgentTesla)", "value": "810ad653e8415b17a35f7aa5f7ca25074595393f11e9e273c92904fc3f60f7a25687acfdd367aa4422791d6a5073c63c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065046, "uuid": "9806aeaa-9fe1-489a-a97d-800a76e55d4f", "value": "T13EA23E2136EF910CB173BFA15FE876D68E5FFB751A6AA09D1044130B4653E80CDA2B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065046, "uuid": "61320b05-90b7-4ae1-b224-be4cb698239a", "value": "384:7x+Bm+zcA+gq+1a8888+nK0+zCHtCDZLj3:YxmgzMo/+QELT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065046, "uuid": "3247c599-bcb6-4b62-bf32-22a92b5532e6", "value": 23080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065046, "uuid": "85b5dead-cd08-4595-b9ef-828bdab28c57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065046, "uuid": "f74b87b4-76f6-45a5-ad30-d9a3d67d01b3", "value": "Image#413164.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96152c40-b183-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1705088921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705088921, "uuid": "dca32786-8819-4b07-95dd-9e64019e603c", "comment": "Malware payload (CobaltStrike)", "value": "415a86ca62b1d4f6e3a0904d80a98477", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705088921, "uuid": "26dca95c-f429-4792-a64e-782f583b2bd6", "comment": "Malware payload (CobaltStrike)", "value": "eaa7090b669f319c0668f25a2ae7d78aa1d23503ad6289d0b699acd1ed635944", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705088921, "uuid": "99a4f4a5-1913-4468-bdb4-6b3b1d45423b", "comment": "Malware payload (CobaltStrike)", "value": "dbc1f842a19158c56e59e25bb1fef1a21a2cea2c", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705088921, "uuid": "823a4483-0c98-4051-937a-46a3f86b603b", "comment": "Malware payload (CobaltStrike)", "value": "02d5f5ca548d628461d6826cd853c609a18e88d973b6cc7c716fb66cc6e695332ca34fc47cb998df122d711503f3dd88", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705088921, "uuid": "b1847043-b44d-465f-8d9f-d06f3d16aea9", "value": "T1F562E7B6DA0378B2EA155CF448FBBBB65F33BA938CB08869CF50D8D53910760785B215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705088921, "uuid": "5db9519e-ad62-461c-be02-c9db0b46419b", "value": "f6243a15fa8eee8ee96b5e1144d461f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705088921, "uuid": "b7c173bb-7fd0-4bd7-a6e0-e4b6ec52f3d5", "value": "192:r3mbPYCfMcrfOIuZmvKQxtzlSIVX6NOcy7oshZQejDMN1:SMCfrfQ6tBSIGeIeUN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705088921, "uuid": "9daecccc-94e9-474e-bfea-59dd6610e080", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705088921, "uuid": "6407969b-032d-492b-b444-af8e178f2d56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705088921, "uuid": "86e03578-24d9-40c3-ae7f-bc6a84b9b45e", "value": "Ali_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2d6309-b126-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1705048825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705048825, "uuid": "d75eb088-b148-4f9b-ad15-24c56bb418a3", "comment": "Malware payload (QuasarRAT)", "value": "382027407b4a0167a036707f5d45e53e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705048825, "uuid": "cfdd0e2c-6235-47ee-8c5c-4a15b129ca34", "comment": "Malware payload (QuasarRAT)", "value": "eb249d8b90aa5fa4627166c0a495f1cdb2a66bf59469a5fb7790a7aad13673fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705048825, "uuid": "17ef61ac-efe0-4a6a-8636-954b221f751d", "comment": "Malware payload (QuasarRAT)", "value": "ec962c4c0bd3d4347f41a0cdf7c9164e3712b43c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705048825, "uuid": "2d120b7e-fb6a-4f0e-b4f3-fafc7d048fc8", "comment": "Malware payload (QuasarRAT)", "value": "60f90c22af2be1013b143cbde31f5437729607837ea3d36cb81c379c261ebdacd51854b5589171104fd81ae7a3a531a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705048825, "uuid": "ecd77784-9991-424c-a841-242fa325ebca", "value": "T1A9E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705048825, "uuid": "96146f6e-43d2-4290-bccb-3474ec4752b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705048825, "uuid": "e871798f-f5f3-40a4-aa89-52bd6225ae16", "value": "49152:PvyI22SsaNYfdPBldt698dBcjHlKRJ66bR3LoGdyTHHB72eh2NT:Pvf22SsaNYfdPBldt6+dBcjHlKRJ6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705048825, "uuid": "4ed5a0a7-7570-4b2b-8f66-fb749287f1fb", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705048825, "uuid": "e506f561-b2c7-4ff2-902b-6f2df920493d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705048825, "uuid": "34430ae5-50fd-4a81-a6ca-3945c5469ed9", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eed4837-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705056535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056535, "uuid": "e31476a6-ccd6-4984-965a-5825911c431a", "comment": "Malware payload (Stealc)", "value": "fd6ea3521e1af555bfe543eaa4f9b4a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056535, "uuid": "b42c1453-5747-4fb2-93e1-2d7488f868c1", "comment": "Malware payload (Stealc)", "value": "ebb6ee582848de55de5d4088a59636a6f38d62c87ecdb96a8963046d85252507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056535, "uuid": "b2360790-b7c2-4ee1-99f1-ea4d13ef0feb", "comment": "Malware payload (Stealc)", "value": "e13cf80b545dedb14df1ef20754820bfecf12337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056535, "uuid": "a2cf3347-1117-4635-ade2-a45658109b10", "comment": "Malware payload (Stealc)", "value": "4a8ce87bf00463bf375d4769b5f872780eb3ca78015bfe48cc6455fe142c9e7fcc3f5928b27fd7c73b2ce3472a735fc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056535, "uuid": "ebd187c4-6977-4402-8662-352e26d195cc", "value": "T1FA548C1132E8D432E3F319314634C7F50E7B78726925956FAAE02A795E24FE1AA31337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056535, "uuid": "91adf9a1-8dc8-4029-b1c2-2be484b3cefc", "value": "a2a0817e6392d97a0384682bfc79e3d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056535, "uuid": "ceb9e7e2-cbca-46ff-a9f6-9e1f3405d332", "value": "6144:mPPfTi1BdLSYC1rw/BsoDen2bqfKqbNbRXMA:mvTiXdmYC1rk/DenKqbNbph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056535, "uuid": "f539ed08-79ae-4432-88c4-c36d6cbc391a", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056535, "uuid": "4888ef79-9c79-4216-a39e-5eb71ca75904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056535, "uuid": "b4a697d3-34fd-439c-9636-27d5d7edc8be", "value": "fd6ea3521e1af555bfe543eaa4f9b4a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb261eef-b148-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705063643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063643, "uuid": "66a9655c-c517-4ae7-83e2-dcaf8f5a317f", "comment": "Malware payload", "value": "feb17a5ec7765b49eac95b5638f0a4fd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063643, "uuid": "f626801b-c6b6-4286-be61-31ed76727e72", "comment": "Malware payload", "value": "ec42b246dee5e5f1e7277d57b214a7ba10b5b9158017fd4e7fe684b4b057d6fd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063643, "uuid": "b9f062a7-66a2-4ef2-9502-ecb8e92c7845", "comment": "Malware payload", "value": "c509b62b8a72bdbb212bf3d1c3f1d4ed8d57b4a5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705063643, "uuid": "f8ed74f2-0362-4181-84f9-fa909c6343c0", "comment": "Malware payload", "value": "40ef5e89c880f84cf27b9b8814f2ec26a8cb246bcedcb2d557a9fb2d4d5a933f71ae39bf4b7b8d36d12f7284350ab6fa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063643, "uuid": "f7c455f1-240b-43ab-a277-e3fd9cfecd5e", "value": "T16DE3EE813792B843154B3B32734BB2E6DA75AE58E48A848EF0047C64F4FC536BBD52B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063643, "uuid": "72e834a3-20e5-420d-80a4-54eb9618ca82", "value": "3072:ftkxvx4wEeIAyK1SNG4KJX8UYqDBYHa/EI++1r98vcP:GxvfNIAyK1SNG4CX8ZqDBYHa/EI++1r3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705063643, "uuid": "a5bddb9a-2b12-40d1-8288-7ffbbb2901ea", "value": 153411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705063643, "uuid": "8da99412-844f-4e8d-9907-aa5dfb73410d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705063643, "uuid": "0c07a67b-2ef6-40e7-bd07-76a880ca1944", "value": "app.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faaba1ac-b137-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705056448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056448, "uuid": "32c735b3-bcb9-410d-bae5-0c0510217cf1", "comment": "Malware payload", "value": "50dd552dd3832f1604f71dbea9950961", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056448, "uuid": "959f9694-48af-43f6-a538-6b6d57e277a1", "comment": "Malware payload", "value": "ed7ac88af0b59c8cacfbd17cfa2c85d6648026f95c82efa70e9cb98134f007b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056448, "uuid": "2fb2ac72-05f1-4524-b84f-911426cd5243", "comment": "Malware payload", "value": "53b891160c3980616c796ea2a99f31058968dac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056448, "uuid": "5bc7c8dd-49e8-4af4-bea6-4a280387ec74", "comment": "Malware payload", "value": "f2de72e86159c8dd1167e99ee72db16f6a6bccf182536bbddac8c69cb9fbe43b6f29cdf0145b12d9fc0a701968f01086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056448, "uuid": "5404329d-ed24-49d0-afa5-1fb75b7aaf87", "value": "T18436336227D624C4D41624389B92F9FD76BF3DA63850DECF71F8B6C38E325929930252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056448, "uuid": "e0d0890c-853e-49f8-b689-eea6ae8331e3", "value": "edac19bae7a55f5a30336032d0b4ae67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056448, "uuid": "b1139cd6-c63c-46c6-ad4b-d652d4b3b8cf", "value": "98304:R81t/ki0du6RcX1kfHm8lJAsDDmlUZtrr/iGV46wL:eki0du6i1kPm6/DBnrqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056448, "uuid": "b477303a-0669-41c0-b048-6b5f2a9fb169", "value": 5054032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056448, "uuid": "83b81966-a8ec-43ce-bb6b-a3a76c1a6dde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056448, "uuid": "42a6cafd-121b-40d2-866a-59ce5abe83bd", "value": "50dd552dd3832f1604f71dbea9950961.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665ba58e-b197-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705097431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705097431, "uuid": "175a3370-df49-499e-ac11-11c4c21e7e9f", "comment": "Malware payload", "value": "9014acfca65fca4bdf8b5f561c4a1783", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705097431, "uuid": "64d6ac48-c65c-4d6f-8d3f-e00f4c69a2aa", "comment": "Malware payload", "value": "efea578cdac3d52601d43b6c4570d94e8fcbdd701573b33612551050e8246cd2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705097431, "uuid": "f1c99262-2611-40bb-8ce9-798e3b8f0fe0", "comment": "Malware payload", "value": "c8fcdefb8ba4f700801fc0e97811661fa972de30", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705097431, "uuid": "0788a4d4-e242-471d-9561-629ecad6c7da", "comment": "Malware payload", "value": "c0a01f2cc52080d10c3ce7a08edd030b064163f48c96471efdd39832b86cace76be25f51254c5c0bf95cc0d057bf70b9", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705097431, "uuid": "76d8934e-8ee3-4d77-8bc5-4761d494689e", "value": "T134E5BE25358AC637EB7E42306669D77A65BE7EE00BB104DB63C83A2E1E705C15232F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705097431, "uuid": "a686bf9c-1ef7-45f7-a7ac-6803c028e2f3", "value": "49152:hAKMMZKumZrWq4Fb6HXr1iWnYs4ntHurpllQ6aruxtZyTreUuyZD6lvVz94OCPTG:NKqFnWneuxqTgvVWvPDNUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705097431, "uuid": "f53b1281-6dc8-4652-95fa-c1f7a22a5221", "value": 3107840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705097431, "uuid": "eab50976-7b36-45aa-a2f8-074647aecda7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705097431, "uuid": "3f08a59e-d3d8-47f2-8d66-23e0d7497f9c", "value": "Cheat.Lab.2.7.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4677c721-b10a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705036818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036818, "uuid": "42b46b79-ce7b-409b-afbf-e040d71bcd64", "comment": "Malware payload (RiseProStealer)", "value": "6271ca5a10f8b82104825626512276b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036818, "uuid": "7ba814e8-8cad-4aa1-8541-58cf48d4464f", "comment": "Malware payload (RiseProStealer)", "value": "f12734aeb802ff0928b8ea0297d79d69eb30e93855612d63ca174986384b7311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036818, "uuid": "f183894f-87f3-4800-b343-eb04a651ba37", "comment": "Malware payload (RiseProStealer)", "value": "cc4a4c9c2da373d8fd7b97a3aac8b91afc7d1e3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705036818, "uuid": "03a52e30-aea9-4af9-82fb-221017c23a1a", "comment": "Malware payload (RiseProStealer)", "value": "6bdeed5a854b8b79fde007e7d9118158211338bf928ea033afca805ee67600d8a4fade5aa55e905885b435f4c1fb269a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036818, "uuid": "d3cd7e92-c386-4b71-b1e4-16732fa3aab0", "value": "T14AE533322FCE91F8E97436B055E6468B4F347C6A6625B73F474AF58B44B328C913072A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036818, "uuid": "42446fae-71ac-454f-88ba-f241aa0da52d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036818, "uuid": "b4e1603e-fc91-4331-8312-4adf5ea5a307", "value": "49152:dx0eO8QShynFIFIYNyWPWTWyJTCYinnBAfEgammU6TqcuR+Ax7E/+6OkzY:fiNSh5Z1KBJT9inBrYmvTTAwHOQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705036818, "uuid": "3a8af22d-d3e9-4b21-a48c-94d32702b58f", "value": 3064320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705036818, "uuid": "e29b6c3f-1d85-405f-a389-0d86bb82484a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705036818, "uuid": "955428fc-1677-42d0-9679-5c7d4e95129f", "value": "WEX4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bd07ec-b126-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1705048789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705048789, "uuid": "545633b9-707d-40fa-bed7-11d771086f67", "comment": "Malware payload (QuasarRAT)", "value": "6bc8d53c37313ed609a7436001b7f86b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705048789, "uuid": "1021d4eb-4551-414e-aa3a-d464fd8547e3", "comment": "Malware payload (QuasarRAT)", "value": "f17f41323edce0c031d30cb3806fff82a7adb07cbd653e93316eab84b05fcb7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705048789, "uuid": "e2cc8c61-1b31-44d5-b60c-d7b805ffec3c", "comment": "Malware payload (QuasarRAT)", "value": "0c9d73fc501e7b35c313a25f7454c1a08d8bc880", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705048789, "uuid": "9157cf63-b5e0-407d-85ab-bd147f724b26", "comment": "Malware payload (QuasarRAT)", "value": "0c95de5c9b3557a52424480a0b94f3f08a1eb4935c624f7d74fbcc88323f0d2f29ff955f779f6a6f1b1b69d4d92ad112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705048789, "uuid": "7cc168bc-f34d-4833-999f-e0a83be6f9c8", "value": "T16AE56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705048789, "uuid": "b424911a-d3e0-4ea0-a408-2c832e2d844a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705048789, "uuid": "5521f0aa-8771-4466-8693-1f59bac2fa8f", "value": "49152:xvalL26AaNeWgPhlmVqvMQ7XSKxKRJ6NbR3LoGdTTHHB72eh2NT:xvCL26AaNeWgPhlmVqkQ7XSKxKRJ6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705048789, "uuid": "1aa073fa-3b45-422d-82d2-a39dcc65620c", "value": 3269632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705048789, "uuid": "4381ccbb-5f9b-494d-a21e-2fcd820d139a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705048789, "uuid": "8d2b042f-8da4-4b67-bf75-b682a7db3124", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcc9480-b12b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705051242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705051242, "uuid": "fb33c55b-a892-4186-a43a-528436d824ec", "comment": "Malware payload", "value": "5846617326f051c9d4a62f77a261fa4c", "object_relation": "md5", "Tag": [ { "name": "139-99-114-151--file", "colour": "#E1D69B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705051242, "uuid": "eb7b6e03-a1c6-42c9-96f3-a7146897f173", "comment": "Malware payload", "value": "f223edb4decb48eae8d47e53d12e3d4670f8ac551eb6308209f4b88915e7bef6", "object_relation": "sha256", "Tag": [ { "name": "139-99-114-151--file", "colour": "#E1D69B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705051242, "uuid": "8363966c-370e-4434-ab8c-020849735cd6", "comment": "Malware payload", "value": "cf6f2bb55ffa1acb08e073226a1eac7d9dec8aa2", "object_relation": "sha1", "Tag": [ { "name": "139-99-114-151--file", "colour": "#E1D69B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705051242, "uuid": "a16c7efd-90ae-4890-92ea-eeab8fa45bad", "comment": "Malware payload", "value": "d009c8c0e6ae48a3e7e02e4ccac1bc56f14f75944d59c41dff209fcb66885c1ffd92b8d22eb90eb74c048d646bc339be", "object_relation": "sha3-384", "Tag": [ { "name": "139-99-114-151--file", "colour": "#E1D69B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705051242, "uuid": "01ea0ffb-74ab-423c-a0a7-1258f00d3cd0", "value": "T16352A4516E9C3E4FECD9D17A9A325B750C7E0888006A258B93D876CC3DCAD04D7A1B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705051242, "uuid": "46ccb7ae-e1f1-46ae-85c5-db353bbda154", "value": "384:UTuvp4veOVTvN4f44CO0mNnyeTAdAcPJQQqU9vKz:2GDOV54f44CO0mNnyesScPJQQqU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705051242, "uuid": "1991d722-9fb7-489c-b0c3-a65ddcd540dc", "value": 14421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705051242, "uuid": "59d7bb81-fd4b-4268-9e02-9d725116b372", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705051242, "uuid": "1cf1b9f2-5916-41da-ad90-a6862eefe857", "value": "hhh.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fae3f0-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056651, "uuid": "2eeb1c47-eda9-4e47-9fcb-dd30d6aadada", "comment": "Malware payload (Smoke Loader)", "value": "fbec4956a178bb65221cf87ab537b828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056651, "uuid": "4e3f19c2-d20c-4af6-9801-ce99a1f7a25b", "comment": "Malware payload (Smoke Loader)", "value": "f22e8c6027000f421c70d5733ff537d1e2e49deb5cc1d6ad3287175dffc2668e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056651, "uuid": "80fb6756-03e9-40f6-ac22-75ef92f2790e", "comment": "Malware payload (Smoke Loader)", "value": "5e587f1f30a712e45b35e451af167a5ba54f508d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056651, "uuid": "75c42618-4ce6-498a-ab42-4432dd234b56", "comment": "Malware payload (Smoke Loader)", "value": "6aef0419bfb225093150bf8778c108265e425071a45847747c240eaed3bfd26e87cc977a386e2c8331961a648c8f08e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056651, "uuid": "b42b5ada-5121-4a72-8d55-2f4111a6b5f2", "value": "T1D8248D1035F58432F7F35A765674C3B44E7B78A77931A98E2AC606B90F256E2DE2030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056651, "uuid": "797386ed-f698-4031-abf2-490dd01128dc", "value": "38fa8b403d6d5217cfc0f8fc65c9b6e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056651, "uuid": "03bc9699-0a67-4169-bada-a30fbdd86f71", "value": "3072:Bo/htLJYeiJiiKVYgTemVAJny/8WyrtD7wmxRivBL2A:uTLJYefYgT/AByyug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056651, "uuid": "5f39c891-e5dd-43af-8a3a-3edb1b88f836", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056651, "uuid": "02e391e0-6ee5-4041-857a-9529cd6aa544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056651, "uuid": "6705896c-7c36-442a-9569-aeb27b49fbc5", "value": "fbec4956a178bb65221cf87ab537b828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb41f18-b13f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705059778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705059778, "uuid": "6e6b1103-9f97-4432-9ce9-1277e0d84dbe", "comment": "Malware payload (RedLineStealer)", "value": "70b0b51a38a7a77bf3c1599397975204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705059778, "uuid": "68f90ba4-ed82-4bde-8383-c9ff06e63418", "comment": "Malware payload (RedLineStealer)", "value": "f2965385482045f065caf8a7b212880266f6bd6b360c8248559eb3a12217e27d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705059778, "uuid": "4bb06398-70f1-49d9-9e96-b5c6aed1b8e6", "comment": "Malware payload (RedLineStealer)", "value": "f846ecb1611efac2fbaba6663e2066be12aeb525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705059778, "uuid": "f3693024-9d55-48db-8294-b699628be90f", "comment": "Malware payload (RedLineStealer)", "value": "243da10d37e9a62426b4d920e9c7b159bf8540a8bdb7e13dab6530127b6121602a361f75cd5d931cf9e962ced75284be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705059778, "uuid": "2521687f-1c61-4be6-b5d3-ab6fe4354cab", "value": "T1B9E55A87BCA114F4C0A9A33189669592BB71BC441F2127E72E50BFBC2F72BD09E79714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705059778, "uuid": "78d85ca7-3411-43b5-b7b2-f5cf59a2e6bf", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705059778, "uuid": "1308de14-03f4-4a74-bc79-7626f481af25", "value": "49152:jWhfyOYXQoKWx+gV8jX8X5DSmM6KTxj0TVs6i+Wr5vmHfQHaBeu:agOYXlc45DCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705059778, "uuid": "f820b9cb-cae3-49ee-92db-e5d744de08bb", "value": 3172352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705059778, "uuid": "5836c323-81d1-4499-a5d3-0a9726debd68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705059778, "uuid": "eb15012e-9667-413c-b2a1-f1902ecb44d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f8297c-b120-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705046268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046268, "uuid": "af988994-325a-4eee-b687-757734703739", "comment": "Malware payload (Mirai)", "value": "0e4f3430608d23bddef41494ba5645cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046268, "uuid": "18e1742e-6ad3-4d03-97f6-ebc1d2101496", "comment": "Malware payload (Mirai)", "value": "f350d6c434afc2acfae38863a5581d94fd45620a045e8a9dca056545977d3925", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046268, "uuid": "c1c469c6-d1d1-4d29-b7b9-e8ceec438c68", "comment": "Malware payload (Mirai)", "value": "c8e6cb58b1dfcdf5b5c4ac6fe3fb46b14f84a800", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705046268, "uuid": "0f80c85e-16ba-4458-adbb-ba6f669a4f7d", "comment": "Malware payload (Mirai)", "value": "4239f0f7786c907750aa35804c8ab958045f5ac534c7ed750a6f7c5be0f8a5158b610a183dcce8532ae8e0bd031d53b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046268, "uuid": "82e5f425-ec5b-4f01-9b7f-2d5430525a54", "value": "T18FA37C85EA83E8F1F8021538313BA7769E33E83A5035DA83D7AC6E369C22751C51736D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046268, "uuid": "6d169bfd-eb6f-466b-b5cb-f6b8f09186d7", "value": "3072:pMXJ90DbI13bbqn4Dxd4YzD+41zpzWaZ5+:u590/+SMH+wpzWaZ5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705046268, "uuid": "a992914c-63e4-4b50-8403-c6527bf03969", "value": 104616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705046268, "uuid": "316263c9-b8e4-48a6-8725-10c86115717b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705046268, "uuid": "6ede0feb-4d0a-436b-8abd-c3873b531b36", "value": "0e4f3430608d23bddef41494ba5645cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21727301-b14c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705065103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065103, "uuid": "77db348c-cfa1-4251-a158-ae19b4534102", "comment": "Malware payload (AgentTesla)", "value": "98ad427f740d6d4e58c95521d7fc85e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065103, "uuid": "691b2f16-a814-4e5b-ac34-a9da4836211d", "comment": "Malware payload (AgentTesla)", "value": "f621004ddaf082516c2e86ae9b0247c50309e16b09393694ebd3601a2f4d6659", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065103, "uuid": "74de561a-cb85-430e-9266-20155defe264", "comment": "Malware payload (AgentTesla)", "value": "6a6c4d34c80f9056ef83bb8f4b7b3672d40779d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065103, "uuid": "95ffe32a-65dd-4b38-abd6-4513dc2cebbf", "comment": "Malware payload (AgentTesla)", "value": "b85e865176fd440d151fd3d757c3ecc9e5d075c85663bd680b6f5dcc401c2973b0758717cd47a7826d5d61458c253932", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065103, "uuid": "b3bab2e6-ee97-4f75-9002-f921c4483f82", "value": "T146D41202F6BC4B31E67A1BF005398545877A38275463E2CD1CEE78CF26B2B44DA5672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065103, "uuid": "5baad452-0e26-450c-9211-c3fc95b6a3c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065103, "uuid": "21dc944d-cb79-4905-8d56-338867c18913", "value": "12288:GebOwhJTYFWhAkW+QSZP5GDI1KVhXEN2:rlYFWhAkW+Z54TVhUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065103, "uuid": "cab164f5-8f2f-489a-b95c-d9e8150c4734", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065103, "uuid": "ef8075ea-5759-4cf1-add0-649e55910625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065103, "uuid": "0595eb63-fd57-4265-8464-9d8ef2f6798d", "value": "FedEx_AWB# 8116010123507.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a933f66-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056528, "uuid": "f8c506c9-625e-484b-9430-5431136f9902", "comment": "Malware payload (Smoke Loader)", "value": "b235e9117da103f7ee40148ed47aaaeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056528, "uuid": "f8bf9b78-6518-438a-939b-18a49c623a7f", "comment": "Malware payload (Smoke Loader)", "value": "f6957a035715b303925a5215f2f5b56933aaf0cb3307d3bf8826f2d35515c73f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056528, "uuid": "f539ba98-8230-402f-a833-4757880ff7ac", "comment": "Malware payload (Smoke Loader)", "value": "69bf2c2680062134fcba12cdacff2fb9c762753a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056528, "uuid": "287dff1c-a006-4dcd-b657-954e772d5fd6", "comment": "Malware payload (Smoke Loader)", "value": "bde4cdb3cef862c1789b0299afa0b5446f44fd60b4c848d075fa3f346da92ac4dd208fe3a1b31bb5cb3da35607760c1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056528, "uuid": "15e7da59-69ff-484b-8699-26c192af99ed", "value": "T111548D1136E8D032E2F319354634C7F54A7BB8726835956FAB942A794E60FE2E630337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056528, "uuid": "014a5316-4261-4455-aece-837b3d0a81dc", "value": "bb47bd5090dd2b8401c8106609617fb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056528, "uuid": "3729b7f4-efd9-4be8-b8cc-dd3d3645d1b2", "value": "6144:KecopGFVVrLpU7ZaEqaEtRbyaG/6x+eybRXMA:K+pGFfrlU7YEqNti6xybph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056528, "uuid": "fe3cbc9d-c472-451f-84bb-99373648ee42", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056528, "uuid": "11e4bd29-9cb2-4a5a-ae11-8baa380bc0b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056528, "uuid": "eae3c39f-bdc2-4a7c-8e98-d18e2ab93715", "value": "b235e9117da103f7ee40148ed47aaaeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4766d610-b16f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705080199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705080199, "uuid": "05e22d10-3eb5-4ce7-9d8d-437f181c7d44", "comment": "Malware payload (Mirai)", "value": "08a0ec2761b46d8922b60a91b59d04bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705080199, "uuid": "373a8eb0-ab68-40ce-9890-0ba955e19a54", "comment": "Malware payload (Mirai)", "value": "f82baaec509d26a3548aa4450f94aad8c76722b1f1d41b1efa5b9d808b26c40e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705080199, "uuid": "f3872fd2-928c-4901-87ce-2e60ba7c83a7", "comment": "Malware payload (Mirai)", "value": "f8b889e577d4d75e5cbb89f6495b66ccc4053297", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705080199, "uuid": "ab31c5a9-5467-4be9-942c-7f3eb117adfa", "comment": "Malware payload (Mirai)", "value": "78e32107c12f50c193c2136aebbb0196655ce17b3fe46bb370f510d85931c540ffc9b296afaa91919f6c828ab5fa4705", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705080199, "uuid": "b2560609-1d6d-42f9-98dc-621dd3cdb744", "value": "T17EF339C7F800DEBEF40AF33A48130925B130B7D121925B376297797BED3A1991967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705080199, "uuid": "19b33df5-699e-4441-8cbb-0b120137c399", "value": "3072:sopp2TdUwePVZi7NT5SnBQA8i3JSDwbvpuVrjbi6L7oqYIqyuej/B7:/pe5etP2A8i5SYvpUL7oq+yuOZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705080199, "uuid": "fe290d1f-a8c3-4ae8-bf3b-4c8442148671", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705080199, "uuid": "7edde282-3ef9-42f1-8c95-55468d57fc65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705080199, "uuid": "539b79a0-ac07-4f75-bdc7-f23c4d46aad0", "value": "08a0ec2761b46d8922b60a91b59d04bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb148ea8-b104-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705034544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705034544, "uuid": "7a72c893-203c-45be-93c4-e8eea48a2810", "comment": "Malware payload (Mirai)", "value": "201c4d1fd55a99d7a772a9c8e730522d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705034544, "uuid": "676e21d0-8180-470c-9665-bd2c87f89b7a", "comment": "Malware payload (Mirai)", "value": "f86b41a0974788440d173afdc8eb9a2245edce873b0101c2f39941c3323770e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705034544, "uuid": "338513a6-b229-4b28-b1ae-a90a4c6b2e4c", "comment": "Malware payload (Mirai)", "value": "22cf8c982e95980a724a79c22b7a5b5bce37b227", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705034544, "uuid": "a6a792f8-a52a-497e-8692-ec9a92d3c5fe", "comment": "Malware payload (Mirai)", "value": "b0004be68f8eedd562e554c808f6868f76ac8100628670deab0aed49f32357b476fc254b0296a662ed1840b5ce0fdfdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705034544, "uuid": "49634d69-4cb1-438f-a960-e298baba6482", "value": "T104635C32FA751E1BC4E1E47A61F34715B2F2474E25A8861E3DA20E8EFF2594065872F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705034544, "uuid": "ba81b771-07fc-4ba4-a7b0-bec066441f40", "value": "768:0yo0RtpeCQWpIaSQq90VqKVG9Jfd2Aa4ggFV/qO+75Mdw5ZH3w1tb3I4K:0yhgaSQS0VqKVG9J8Aa4bQ75cptLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705034544, "uuid": "82a19b6c-cb19-4510-b57e-b96770384171", "value": 70696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705034544, "uuid": "5abf6a01-0678-450d-8a41-ba27abecb7bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705034544, "uuid": "84158b24-e100-4546-90e9-df7ea48dafa4", "value": "201c4d1fd55a99d7a772a9c8e730522d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0da347e-b15f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705073531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073531, "uuid": "efbd2828-fd15-4ee2-abe4-a02a62962217", "comment": "Malware payload", "value": "5a0d506358b3411a61f8f1415635844a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073531, "uuid": "098720fc-0540-4825-8302-ff3885eead39", "comment": "Malware payload", "value": "fa102af99cc8e8cf91b02a251eb099637bba2112944c29896c0d40653bd7fe8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073531, "uuid": "4411ef84-47e3-4c66-9da3-770f5e4e16b5", "comment": "Malware payload", "value": "f1ea3ee8117af37b8c3f8cda6f50f990ec0f6a05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705073531, "uuid": "bd709c65-6dbd-41ec-b989-c948ef314868", "comment": "Malware payload", "value": "83885a3f48d46ac0bfed46500919702d1da13c6f5e6084348bf81a228c1b13ce8b9afe0c3582ac34e1e0fd01cd84ff9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073531, "uuid": "86fff3dd-20d8-48e2-bbea-665d606c3ce2", "value": "T1ECB5232137C4C8B2C1B32836153587649A3DBCA19F6A46EBA3E0395DEF706D1A335367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073531, "uuid": "f8305af0-d6f5-44e0-b337-e36e35ec4f27", "value": "10b73c5f7fc148e21f974da703236659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073531, "uuid": "a72b09f2-1153-4d17-b149-f9ca21a71457", "value": "49152:anGImUpcdqr03H57QfMOlS8RVIUO3N2ixQlX3OfQC1iY8rcRNBoz:aGIpe5QkOTIUOdZQlX3OfQC1grcbuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705073531, "uuid": "67cf79a6-d605-44e7-8fc4-634e16f335b9", "value": 2454184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705073531, "uuid": "a86b4bc1-d89c-4186-957f-dd22957dc0e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705073531, "uuid": "5261ce81-eca8-4354-81b0-9dbf1c8d5d2f", "value": "5a0d506358b3411a61f8f1415635844a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e578e3-b173-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RisePro)", "timestamp": 1705081913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081913, "uuid": "57896a98-cf74-482e-a214-ac18805b85bb", "comment": "Malware payload (RisePro)", "value": "a4833386459d8b59aee944d6693701ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081913, "uuid": "b7e1ddec-682f-4c1b-9618-44e745d0671b", "comment": "Malware payload (RisePro)", "value": "fab4d0b0d8e57ed2e88b7336bce24982ac1d0095a750e43a8725342d38efd5fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081913, "uuid": "98a45bb2-c885-4be1-b114-5286b24a06cb", "comment": "Malware payload (RisePro)", "value": "9991a714f4a557d3fb4ced761cd18498e39b9867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705081913, "uuid": "65bf5a5b-4d22-459c-9702-5b38257799f7", "comment": "Malware payload (RisePro)", "value": "cdf4a1582cb1614072ca81e1898a780464006446f715149a8a5b43285849347b184b4bb3cb6b83e6d281445654c9687c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081913, "uuid": "c5ef0d0e-6d8c-4276-b25c-7e9a867547a9", "value": "T149856C31A741B462F86314B5725E57E611A235302B92C8D7F7C16FAEB2A2BD39334E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081913, "uuid": "dcc618e9-ff66-40a5-bb47-449f05c3e4fe", "value": "a391c991ba6330d6ddb5beaa15ef064c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081913, "uuid": "9168938c-1622-4ccd-aed7-e79ba042e530", "value": "49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705081913, "uuid": "021cee72-b7aa-4071-9ab0-a807e49e6370", "value": 1711311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705081913, "uuid": "548ebe1f-73d1-4f64-93e6-0cbe8e0169f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705081913, "uuid": "24675b15-9779-4b56-aac1-1251147517e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bbd259-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705056647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056647, "uuid": "ec886221-4e9f-442b-93d8-df41ce849229", "comment": "Malware payload (Smoke Loader)", "value": "ff5018aa96d03981958cc226c3b2aa40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056647, "uuid": "110f4a89-0556-49f5-b333-b797b0d558fb", "comment": "Malware payload (Smoke Loader)", "value": "fd68ed7ff3adfd19b32efde83d13edb583c7d756d0780d079efac6d09ff8bbb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056647, "uuid": "6cea90af-8c36-473a-a6e7-bbc5647a7658", "comment": "Malware payload (Smoke Loader)", "value": "752bcfea1e97ade90052e0e52be75ede15fe4e24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056647, "uuid": "b2bec4ba-054f-420e-b73f-d9a684a6d87a", "comment": "Malware payload (Smoke Loader)", "value": "0198c6728cb4ccf613c6d018e5a658e8ca167b2348ed2329c1b52accea8dcd8224e2d3deb019cff11a6703666a539058", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056647, "uuid": "619f9964-1b4c-43c8-9588-9297f342f112", "value": "T12D548D1136E8D432E2F319354634C7F50A7BB8726825946FBBD42A791E64FE1AA30337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056647, "uuid": "e300a255-6b2a-4f66-a1ee-ab92b6cb06f9", "value": "bb47bd5090dd2b8401c8106609617fb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056647, "uuid": "ad849161-be1e-418d-8d5b-3cd399411cae", "value": "6144:ZecopGFVV+LpU7Z6OHwWylGHbTI/6i9HbRXMA:Z+pGFf+lU7LHnykHC6Ybph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056647, "uuid": "8095f19f-babc-4bd6-8943-4f8d12cdac95", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056647, "uuid": "964e772b-4bc8-4c89-b80a-4a2e2fd3cf74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056647, "uuid": "de95a83f-e059-4225-8aa8-8f3f65da4ee8", "value": "ff5018aa96d03981958cc226c3b2aa40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9cba9f-b138-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tofsee)", "timestamp": 1705056642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056642, "uuid": "1df30aae-2eea-4423-86e0-6454d52cd93e", "comment": "Malware payload (Tofsee)", "value": "8bcf8cc2c1f767e639cfd2de9ad3d548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056642, "uuid": "f2040204-ed2e-4549-9017-3e0ef3cad9a6", "comment": "Malware payload (Tofsee)", "value": "fd79a1b3b18fca2696c2c58f290a4dadb97e3cdcd6e98d14a63ac3f4a1f2e351", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056642, "uuid": "41f9b0b8-aa7f-419a-90b5-0f2b3de2b752", "comment": "Malware payload (Tofsee)", "value": "bb80c8229723373216bac840f0604402f594bd89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705056642, "uuid": "5495155e-a45c-4039-80cc-ab27a8b30f80", "comment": "Malware payload (Tofsee)", "value": "78f86dab63fdc2c2f26565399925430851677f1e6def0594942b59c3eb688d7aff26d10adea7c785f2a55460e5186a50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056642, "uuid": "05ee67be-23b6-4ad9-82e2-0a4f617263a8", "value": "T111548D1132E8D432E2F319314634C7F54A7BB8726825556FBBD42A791E64FE2AA30337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056642, "uuid": "95119404-f31e-4d9d-b9e3-e852f0e406d9", "value": "bb47bd5090dd2b8401c8106609617fb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056642, "uuid": "2b5400ef-ffbc-4bfa-9f32-fbf30b946c14", "value": "6144:xecopGFVVZLpU7ZKeo24OazMN/6TMybRXMA:x+pGFfZlU7tokD69bph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705056642, "uuid": "1d980a39-f072-4603-92bb-1a0dbcaed972", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705056642, "uuid": "ce78d0cf-a84f-4789-becd-f8750fb077ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705056642, "uuid": "b36caa7b-2346-4597-84d3-0f653ab082bc", "value": "8bcf8cc2c1f767e639cfd2de9ad3d548.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a41a3d1-b14e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705065950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065950, "uuid": "1d7ab4ec-dfd7-4812-824c-d28f7ce1a99c", "comment": "Malware payload (Formbook)", "value": "cdba8c58e4d9e0a5e0b5053b8198f302", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065950, "uuid": "bb1e0ca0-37f3-446b-a735-898730c7ae66", "comment": "Malware payload (Formbook)", "value": "ff0bd362c496178316aa66375828349d11825dd9afaa90c5ece39a401e4e0a7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065950, "uuid": "f4686a8a-467c-4c02-88a1-5fcc68150c4a", "comment": "Malware payload (Formbook)", "value": "f2eea90e6d683f6d9c3dd973c33ccb526160ea05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705065950, "uuid": "36d23293-c3d6-425b-a64e-1bda7b22ff45", "comment": "Malware payload (Formbook)", "value": "40f62545a5388b4c22d5a577beec7adf08554b0a848428f647d5618afcfee7b265aab09c4ab33004dbdc57302d1b3fde", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065950, "uuid": "df6b93bc-47db-4838-b49d-a2672b0b835e", "value": "T19324BF583F958D02E9DD4DB504B3D36C927C9D632E0DC602DA9C7EA52B37E845E223A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065950, "uuid": "413d050e-ab6f-475b-aa50-0e9f9325da0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065950, "uuid": "ad794885-59ad-42b1-9352-44aa45c93e36", "value": "3072:A5zMHfo7HFI9UtOwp8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLnK:ASelI9kUhcX7elbKTuq9bfF/H9d9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705065950, "uuid": "5af0b7b6-21f3-4968-8425-b56b3306e99b", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705065950, "uuid": "1d6fdbaf-4b82-4af5-8022-0d3af0521a76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705065950, "uuid": "c1f1b2d0-890f-46fc-9c06-e7244c9eaa53", "value": "cdba8c58e4d9e0a5e0b5053b8198f302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }