{ "Event": { "published": true, "date": "2024-01-30", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-01-30", "timestamp": 1706659381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4c9f8ce2-dc55-4b08-9db9-449da4b1d764", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e9e588-bfc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706657498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657498, "uuid": "2ee96746-9ea6-401e-b8a8-8abc1fbd27dd", "comment": "Malware payload (Mirai)", "value": "ff3fb63d41d59b09b66077d0d8499eb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657498, "uuid": "ab50384f-8793-4d3e-8682-3b6638e1ccde", "comment": "Malware payload (Mirai)", "value": "000748d27da6ba7851d2d65bb41a6a1635654b11ed6b38f2944c6bf74ff7b67c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657498, "uuid": "f7a90276-9ac1-4697-a7aa-ad434d2298b9", "comment": "Malware payload (Mirai)", "value": "7ed9450e987c695eb953bf6bbb3f461715d1fc48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657498, "uuid": "ecf7b884-a809-409b-be5f-5c8687d063f6", "comment": "Malware payload (Mirai)", "value": "96f1aabe47d425226f47328e33e8cfb82623c855d6e46dcc3b6e78f05b96a0a33cf8b980b894e669c449ed3fcee60eb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657498, "uuid": "ba89476d-395c-4c89-bf3a-1d5932769cb1", "value": "T10703F2A3C05F2E93C4FABFB166261FB167644F883A97EE728A446FE05603F4B45415C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657498, "uuid": "fbe2e762-af50-49b1-aa58-8459a8215d51", "value": "768:30lkEHGFZOSZnU3lfLxJD4xeH6vCka0PM+S65Ly2oR04uVcqgw0t10tLyG:ikEHG7OSZnU3lfL8oH6aiPMMBy+4u+qz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706657498, "uuid": "ef88bdcf-a8d8-459e-8c7c-ef4e00a3b78e", "value": 40504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706657498, "uuid": "7c2de0e2-313f-4de6-a800-2d00d8cbd460", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657498, "uuid": "78411d4a-aa24-4a3e-8187-fedd8786dcaa", "value": "ff3fb63d41d59b09b66077d0d8499eb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dbce35b-bf78-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706623284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623284, "uuid": "d458a93f-7bdc-4ec0-be5a-343a4c6557de", "comment": "Malware payload (Mirai)", "value": "fa8a0cabc40e7f275fd89538959d0076", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623284, "uuid": "0a4e6dcb-5b2f-4006-8c51-f56cde76e5cd", "comment": "Malware payload (Mirai)", "value": "0181f53b2bb578f9c6cf3086f0d335bed6ab7e98a5eb91c1495377b170cff606", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623284, "uuid": "fd997542-a43e-4622-83ff-aa6280aff45f", "comment": "Malware payload (Mirai)", "value": "593fb4bdad0f0a23023bf9abee406b00c4f4dbb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623284, "uuid": "d88a3d61-0f13-4520-8581-70afb6d4df7b", "comment": "Malware payload (Mirai)", "value": "2bb64809faf7d9d47c8e86eb859a0261b035e268414193e386c5cafba22d63670b18bd78e9ee608ca0f09c3a67ad1240", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623284, "uuid": "9850e13e-8b87-47a1-99ac-0f0152ea1943", "value": "T10083C70E6E218FADF769C33547B78A21A79C33C637E1D681D25CD6106E6074E241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623284, "uuid": "435a4f92-706c-43b5-9af7-ec87318f17f6", "value": "1536:+PdCho3TJwEI76/qzgcCkjEN5hWehGGnG:GdChoD2nzgcCkwN5lnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706623284, "uuid": "08cac2d7-a08b-480b-93fa-9c9deb2e7f36", "value": 85176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706623284, "uuid": "5123f8a9-4eff-43bd-a899-9b631cb1f47f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623284, "uuid": "5774d292-7a9c-4451-88e0-1324b38a19a7", "value": "fa8a0cabc40e7f275fd89538959d0076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1820bf23-bf78-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706623301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623301, "uuid": "df94503c-702c-467b-9c9d-bd66f146e48f", "comment": "Malware payload (Mirai)", "value": "3fad1f7262ae50cb54acc0044a695e5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623301, "uuid": "ed479477-9ce4-41fd-9ecf-4c24f9c05408", "comment": "Malware payload (Mirai)", "value": "01aea3f82e09fb1e55c3af6a6bafd3768904fb4d00476d8d2c3ffc84af6bc3b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623301, "uuid": "8d68331f-0241-4bb9-9cf1-2ef173a32a7d", "comment": "Malware payload (Mirai)", "value": "116d24458dc7c53b1fe8efef914443550ba30d94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623301, "uuid": "95dd6cc9-aa90-4394-b32b-ea16964b4caa", "comment": "Malware payload (Mirai)", "value": "85e68067c04f7202ed2b48137744ac8055e53f62657962d390667eadd465ccec0bd48c0c09c570aff562d6fb1ad4162c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623301, "uuid": "7bc0e436-5f08-41be-a55d-bb2effcf9f51", "value": "T131334AC4E583D8F6FD9601712137E7378B32F53A012ADA97D398DA2BFC91601E657288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623301, "uuid": "7e1ec6ba-4a50-4d3d-9b86-e7a228eef634", "value": "1536:/DrJmiYM3MZdUqCqmVDKnI4ZNjk/K4yerDGmevSsUBX:LeM3MZdUqDQDTMFSK4yefje/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706623301, "uuid": "e08c4f4e-0d32-4d4d-b082-30eb5548de68", "value": 54644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706623301, "uuid": "2ca6b988-908f-4e40-86f5-1d4fd905155c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623301, "uuid": "dd6531cc-a404-4173-8582-acf0e663b18e", "value": "3fad1f7262ae50cb54acc0044a695e5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8c042a-bfa2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (MarsStealer)", "timestamp": 1706641562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641562, "uuid": "e79e67ce-a5b9-47b1-98ce-c7de771c700e", "comment": "Malware payload (MarsStealer)", "value": "dca8cceaf9527048e33a1ae7b08151d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641562, "uuid": "a930fba9-bd32-4a0a-9094-36c9e16d59dd", "comment": "Malware payload (MarsStealer)", "value": "026d1018ff9caa454e8fa4c2b1efcbb3dd8745f1bf2ef47c940ea44dbc4c51a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641562, "uuid": "ab1be6ca-6672-436e-85c1-f8bfe9407a87", "comment": "Malware payload (MarsStealer)", "value": "429f0ebf5675dfc2c47d16494fc4b25384cd3665", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641562, "uuid": "e2096a41-5656-47bb-a633-cd7fdd4b5060", "comment": "Malware payload (MarsStealer)", "value": "6731c7742a25cdd68af006d7f0c9828ab67284a4d3fdbe7f4ab19113965787ce553fdf1d682626eae8af2f7bb528d87b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641562, "uuid": "b2f0e306-99da-40d5-bfcc-591bcaab1cbc", "value": "T16CF63367AFF41130F573A8BB651305421EEB81FD9AA343A66B143958FDF3A46CA10B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641562, "uuid": "9bcba39c-05bd-4f0d-bedb-9d67a20b77e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641562, "uuid": "ac0b9bce-5641-422f-9b59-1c9d828b4914", "value": "393216:8Qi5d/MH9yyw9IcQt0Mgrli/2ZOJthl4agjNK:8Qij/M9ud7i/2atf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706641562, "uuid": "d3614854-7d28-4cfc-b322-86bee7029d43", "value": 16197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706641562, "uuid": "ba3009fb-5f24-4654-af63-e10b76aa0836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641562, "uuid": "f2b1b795-4ca7-4f9e-bf7d-c7f67bd4f5b1", "value": "booking.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d70a31c-bfaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.InstallCore)", "timestamp": 1706646959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646959, "uuid": "6040e4ba-08aa-4860-95c4-d655a5c8e193", "comment": "Malware payload (Adware.InstallCore)", "value": "772304d89be6d81b9bb82b1bd5726c8c", "object_relation": "md5", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646959, "uuid": "5663da3b-24d3-4916-84e9-97dd1f60c502", "comment": "Malware payload (Adware.InstallCore)", "value": "0477cf4535bf0c01c3cfd0d49fd5a0c812e480ee3b1d02fb86dc2bb3d1de32ad", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646959, "uuid": "654a2f21-11e0-4b93-9f32-b33645386788", "comment": "Malware payload (Adware.InstallCore)", "value": "34639d79f46be2f6af4df1db44d65f82e7f0655d", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646959, "uuid": "e81bf8ac-0cec-4ae9-b8cc-4e8a347b689d", "comment": "Malware payload (Adware.InstallCore)", "value": "ed2ca02b3d3ad008656b58c58ad57c7b652c110fe9222d7e6af89a38b91f82f3d4c4d6eaa07320dbd9522db2c95cacbc", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646959, "uuid": "f2120924-11c0-4aa2-90af-cdc6be863e1c", "value": "T15A27331FE19EC0B6D264F675DF04F211E2F1AE20693824AAB01E3E4FBE57643DD0A951", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646959, "uuid": "b8408307-9347-4fe6-b0f0-e89b8847f164", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646959, "uuid": "ac1bd318-1adf-4d87-b617-53f429933693", "value": "393216:6aPbs0XXDb+aGx9RxqDTUXHP6eHOMX0USPqwCYiKbIh2:60o6XDbn41qDg3CKf0UZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706646959, "uuid": "cae0090d-6a1a-434f-b63a-1f6bbd81b7cc", "value": 21818583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706646959, "uuid": "f61ab233-9ebb-4a9d-9bf7-70621974319d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646959, "uuid": "ed8ac660-43d1-4f07-aac1-615e21319c49", "value": "SecuriteInfo.com.FileRepPup.13800.5810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194a3ebf-bf5d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1706611707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611707, "uuid": "77bf83d3-07b3-4059-84a1-eebfaffd96b5", "comment": "Malware payload (zgRAT)", "value": "7f158984c1483ebad77c328c445bb284", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611707, "uuid": "33888409-42f7-4919-b07d-56f1e94fca2d", "comment": "Malware payload (zgRAT)", "value": "04fab92c04d2ea52259e50b87b0784baed46796d9533bf4c355a87e29cbed8b8", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611707, "uuid": "92471923-4aec-4fdb-8843-c975f1b19d3f", "comment": "Malware payload (zgRAT)", "value": "85f45c086880f832e7f7da6c25f9ce6012f73cdb", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611707, "uuid": "729fa1f4-1a30-427a-85ad-18cd1ae4de6a", "comment": "Malware payload (zgRAT)", "value": "cac2128e869a03d1cf7d1fedd56795be051686eaa7275c37fb53506420efa736cf37e5cbd125651ad3c01212ffcfe58f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611707, "uuid": "18f88745-1dd7-443d-8e53-60f8268a5eb1", "value": "T1BD6533526D235BAE2669A2094ED247CECF0747362C8265E675CFC7A8D4FB9081BF3019", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611707, "uuid": "1896d6ca-b75c-4665-a8a3-b0519f090d20", "value": "24576:KDlCaoT+IY9kjvm7rq4986dfKpzmUa2LOlqmFcPsAmtJ9QTrXsVv:mCaormC4DC3mFcU9Wr8Vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706611707, "uuid": "56f02919-528c-486c-9961-b1fd01a98921", "value": 1470289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706611707, "uuid": "90feedbe-9eb6-4057-a3b4-aebd6d5bae10", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611707, "uuid": "381ab223-1989-4f50-8b2c-1ac0825ed4a8", "value": "Enquiry list RFQ 02024030013042117374823 PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f6fbba-bf99-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706637664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637664, "uuid": "ab0e19cf-5398-4963-aca9-bfd3f4ebefe1", "comment": "Malware payload", "value": "12cff5e9e26edfaa6e5395a36d64692b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637664, "uuid": "14aa64a9-92ca-4cd6-9cd3-cdaee0673be4", "comment": "Malware payload", "value": "0675e4f8053c0fab9f193059335f9a01f589536fc12eb03ada942c33ca9bfd77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637664, "uuid": "41f2957e-585e-4757-91be-48a8fc08284a", "comment": "Malware payload", "value": "aa8598d11eb914559928b8e1bbe9084d17b43f98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637664, "uuid": "66606906-c223-4d9f-b9ac-f13e9af37255", "comment": "Malware payload", "value": "fa0f2ae523f381b7aa5f05d9e5973bf5ed9dca977bb5a3b7c56a7cc3744f7cb493e6318e0fd7d1cfb71aad2b642e3d14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637664, "uuid": "42df68cf-76db-4389-9c74-d8e63756f399", "value": "T1BDB533D162720AE2E90B6BFA1F5B4542F31B1C73546A6AE42443F1E0873D53F06E9ED8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637664, "uuid": "11540e17-0841-4dd5-a0b0-7e911164803c", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637664, "uuid": "dbe84154-1fe9-48ac-ae28-ae4b88282de2", "value": "49152:ExSeyMPA9vgrddLmfNftOIWym09e79fevhZnbZQh:wyF9qzafzFE74ptbZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706637664, "uuid": "77286e50-5531-4c1d-b8ff-554453ffc220", "value": 2352128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706637664, "uuid": "a1bac636-7902-4466-b077-7514973ca565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637664, "uuid": "ae19309a-d7f4-4c0c-8ff8-aa03e50bbbcf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f66766b-bf59-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1706610214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706610214, "uuid": "a7bcca4d-c112-466d-9458-2e65130ed245", "comment": "Malware payload (CoinMiner)", "value": "e913883eb10ba5b79d8c3bdb9d544fde", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706610214, "uuid": "93a7b560-e305-4ded-b482-50187789f3f3", "comment": "Malware payload (CoinMiner)", "value": "070aeb4f3a80c58bd1d1b719de4a66afcc055141e71aa35b9e6e1a0b092feb6a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706610214, "uuid": "184b1397-1e3f-4873-a51f-bd5633751574", "comment": "Malware payload (CoinMiner)", "value": "da4f862bf2a8ed601166283e3445495848e05f3f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706610214, "uuid": "c035ffd9-dc22-4589-9380-7ad3956c1f09", "comment": "Malware payload (CoinMiner)", "value": "e9124e8d62886bab65ee6b6bd2511ff4b0751ae4cf42c821acc3ec8649ffde96a2e8815bc931e76258739533b20caef8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706610214, "uuid": "ab2ba799-142f-4acc-8acc-a8d4c587e9d9", "value": "T149C4F1113EE58876D5510031D8346FE1A2BAFE960B21886733997E3E3F7E683C235A5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706610214, "uuid": "6a964059-be15-488e-9e05-f69f6e63f242", "value": "e00de6e48b9b06aceb12a81e7bf494c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706610214, "uuid": "8f4ff8d8-3ed3-4a0d-82d2-deb01d460f27", "value": "12288:sG5knZfFKegLf+tCfQNerJnYJNxnj7Ui5lZ/5v19:sG50ZfFKhKtaQNer9yVHUiHRf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706610214, "uuid": "f8967483-88cf-4afb-a5dd-80657b113441", "value": 545184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706610214, "uuid": "433207e4-e80c-4a4d-b32f-f67ce683e49c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706610214, "uuid": "876c9eda-7aeb-45f7-ae92-cd649db44c43", "value": "SecuriteInfo.com.Program.Unwanted.5275.1470.21591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d70fcd-bf2b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706590468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706590468, "uuid": "019d29c1-0fe4-48f1-89fe-f65d9e34bd3b", "comment": "Malware payload (RedLineStealer)", "value": "402698f4b47dac1d6f07b55a243a8fda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706590468, "uuid": "679d7591-92b5-49cf-8fdd-681f4194a883", "comment": "Malware payload (RedLineStealer)", "value": "0810cca0d689f57f714303bffeaa01324688217be220ac6fb5ee579962429e9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706590468, "uuid": "823ee808-a0c7-4f48-9afd-2d6b86b82eb8", "comment": "Malware payload (RedLineStealer)", "value": "f797de249c45230bc3da8ae07bf6b95203e7ec90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706590468, "uuid": "723ef86b-4e55-4414-8282-0af3459e1371", "comment": "Malware payload (RedLineStealer)", "value": "45586857686e86e73df229052fe1d680a00d12f6249572b2e6493266bd0dcdfd6c8727a472f0c4113eb6569c56068a77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706590468, "uuid": "2ffc467c-9dfb-4704-8fd5-64e776a2341e", "value": "T12BA402103191C277C4B7583404E9CB7A9E7A7021576986DB77DC2BBA2F213E6A3352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706590468, "uuid": "06c785dc-c25b-4514-9d18-2aa894156b44", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706590468, "uuid": "b36026d3-1bb0-4e31-81cf-244610c7e3f1", "value": "12288:Bh1Fk70TnvjcWsaI2iFLUaQkePuLmKVJWT7z:jk70TrcW4P+ayuLif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706590468, "uuid": "7058c3fa-3c33-4ef7-9505-88b65318fa90", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706590468, "uuid": "a2cefa8a-1a26-4752-87c8-0d07e705d493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706590468, "uuid": "3cb18eba-aed1-4e8b-9d50-e8041920beec", "value": "Dolphin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640823ed-bfad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706646192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646192, "uuid": "0b5a6c0c-a0c1-4b8c-9771-6ad7e4a65971", "comment": "Malware payload (AgentTesla)", "value": "022915fb589b0bba2d89113ee654c869", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646192, "uuid": "79a45b4b-ae49-4f0e-8962-a5b0b0bcf354", "comment": "Malware payload (AgentTesla)", "value": "0922bbbf638842a281530ad572da59ef6ae2326e49671b1f97b43c9031d95ad5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646192, "uuid": "984382a2-03ed-49fe-abb1-e8f043a0c141", "comment": "Malware payload (AgentTesla)", "value": "d354f0eada854a8be03d3aace00439968c31b492", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646192, "uuid": "74ae90de-9178-4542-b9b1-aaba81ec33f2", "comment": "Malware payload (AgentTesla)", "value": "8c6e687c561319d7cf303a5dbb8a7238e264b780511daa44573dea2937695683347c3886a4de00fc92c2d199b6d73892", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646192, "uuid": "3aee05b7-d9eb-4ffa-9a92-32e1b9e7ad8f", "value": "T191E4221A27E75739DBF54BF194B2101023BA327B5413EA48AD8633CA6DB37A04952F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646192, "uuid": "3dbc7446-cf87-46ec-ac12-53b6ac769bf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646192, "uuid": "c852ed98-a329-4f4f-8cc5-737003d71b55", "value": "12288:sOAAYQ4vWoJeQ/HjpTQAmiDmCy7tQmoGlxiGCYOl7D18YxRFGcwBMBHFBfF7:8ACWCD1MJ7tVjlbhq8YnkcOMBlBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706646192, "uuid": "df7810a7-ec12-4d1f-8663-acea33522699", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706646192, "uuid": "379230f0-0551-43d0-82ee-8459516b679c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646192, "uuid": "f657937a-d84c-48c1-a6f9-b3ce8b403b63", "value": "Order-INV#0498.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46cce0c-bf3e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1706598706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598706, "uuid": "53dafce8-1cb8-4120-a4ba-6e28591c81dd", "comment": "Malware payload (GCleaner)", "value": "d10d80cd25edec42df8255f1485ca883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598706, "uuid": "3a0f057f-6012-498e-8383-a0b01933a1a5", "comment": "Malware payload (GCleaner)", "value": "09848a25f71ebd9cd3bf8a7444d5b8c74fad8f741239615b6da18b5ffabfc1c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598706, "uuid": "9a37d460-aa26-4f33-b449-25afe57a8dd6", "comment": "Malware payload (GCleaner)", "value": "1c202624b90d9e97891a045b71dbd9d8ba24e25f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598706, "uuid": "28ae46e2-90ba-4b09-a2f0-92dd0553e5e4", "comment": "Malware payload (GCleaner)", "value": "ac1df62e7f8e94fe979f21d3a4e04f46b27b4525b08c61afc99dfa72b280a1019c9d69d3995e1214545cc73a7001345e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598706, "uuid": "517b89ca-af88-46b9-a4b5-cb247834246f", "value": "T1E784CF11B6E0C031E2B365304975F7B10A7FB8E2AA3DD58F27D5163E1E246D28A3179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598706, "uuid": "045babdf-c0f7-4d21-bba7-b3751c372819", "value": "0f86209308d034305701c953de1bb53c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598706, "uuid": "c62ff73c-117b-4ba2-a72b-7ccb24402c15", "value": "6144:JJfLfQMwKschFwgbtA39ElHD+LzL/HXN5chMgUQKv/mXGGpYj3:zfTQMwTgbbxD4zL/LchMUXG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706598706, "uuid": "f69c8397-2717-46a9-abaf-52a25aae9eb3", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706598706, "uuid": "1dd3577d-36d8-4a2c-a053-914c30bceb94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598706, "uuid": "d2ae6217-2571-47ea-a217-b3fdb74fb036", "value": "d10d80cd25edec42df8255f1485ca883.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a6f68e-bf3e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706598440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598440, "uuid": "ed56ec3b-6e3b-47c7-a398-66f18d07f17b", "comment": "Malware payload", "value": "2fce3f9638feb3a3efedfc88c4883610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598440, "uuid": "49b281a7-5ffd-435b-bdc1-37fb7c2d295c", "comment": "Malware payload", "value": "0abc1715e08960f39fb0c1c2583bd92dfe842d85859d44bceb100f3d8cd794f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598440, "uuid": "3bbf482b-6b65-4a30-a337-0f92bee706c8", "comment": "Malware payload", "value": "c21eea383367ec337e15d42c85773ea842f36930", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598440, "uuid": "d5bc83aa-6c7c-42db-8ecf-5bc30465dbfe", "comment": "Malware payload", "value": "977e41e33e68bbe6aab53afc1b071be75200cf648a8e909859fc2b0298d486c90df2a094c82d17309f4f54d82feccf34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598440, "uuid": "fa1041cb-8596-4641-a554-539b509eeb78", "value": "T19405F110B6E08031D1BF557D4631F7A10A3BB8A2A639D9CF7B96163E5E346C14A20BDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598440, "uuid": "ab55dadb-5f7e-4347-ad11-406edaef9504", "value": "5ea237ad2870b37476eaf67f17a194fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598440, "uuid": "a17044f1-a7b1-46fe-a7fd-c1acf9bf5324", "value": "24576:0C/tlHLd84DPsb9E5vG/ZGLN0GTvkvWzuX:D/tlrdpe9E1C0L2GQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706598440, "uuid": "fce84d1b-7fa2-44bd-bb37-2e74832f94d3", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706598440, "uuid": "7e65e147-571f-400b-821c-84bde5d093cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598440, "uuid": "4c4cae2b-52ec-46a7-a0d2-8878213cdf9d", "value": "2fce3f9638feb3a3efedfc88c4883610.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3926c7-bfc1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706655042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706655042, "uuid": "cc4b0347-c902-4a8d-9fed-eda75c88fffc", "comment": "Malware payload", "value": "7c175ecc5851c6e52cb6746e670718e4", "object_relation": "md5", "Tag": [ { "name": "colombia", "colour": "#7A75B4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706655042, "uuid": "e6207c82-5aae-487f-918b-a3d567efde8e", "comment": "Malware payload", "value": "0bbc99b6616d6ede103ffb107b835da090861c31452d8f981863472eb06dd8a4", "object_relation": "sha256", "Tag": [ { "name": "colombia", "colour": "#7A75B4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706655042, "uuid": "d2fac3f7-6f2c-461b-b5ff-74b3b8cbd9c4", "comment": "Malware payload", "value": "85036b5eb02ce4d2821d854b6b56c2b190671e48", "object_relation": "sha1", "Tag": [ { "name": "colombia", "colour": "#7A75B4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706655042, "uuid": "976ee784-6550-4ed1-b884-e7c98f133b4d", "comment": "Malware payload", "value": "44479145d446e3fd5cfd5ce266cf0382cce22ce7e0921a911c3316218e1f739cc0790a6419de07881efb8d04d2d699b7", "object_relation": "sha3-384", "Tag": [ { "name": "colombia", "colour": "#7A75B4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706655042, "uuid": "20c16d74-b85f-44fd-a003-28de9ed929d4", "value": "T12392D0A257714FD0AAA090FB365C882D477E1A13C235FC9F3990A353C351061ABC76AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706655042, "uuid": "8a076d22-a2ec-476e-a948-d4f0d242b67c", "value": "384:ndZRHYGGBGPDJfGDhbjYx6ARwWI0G0IrnLC/FbINw/u8k26TmHi:ndZRHYGSGLhGDiIARvIx0IyQx8k0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706655042, "uuid": "8f575884-1426-4e89-8077-622548b60327", "value": 19492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706655042, "uuid": "c7cf1753-397a-4693-8d42-c332b9070966", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706655042, "uuid": "67b452f8-488a-4ee9-86ee-7a3d2b07fc0c", "value": "CHEQUE DE GERENCIA PAGADO EN CUENTA BANCARIA APROBADO.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891f7f42-bf79-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706623920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623920, "uuid": "3c5b81f0-193f-4795-b263-a77a0ad4e149", "comment": "Malware payload (RemcosRAT)", "value": "a2ef1fa3fc2dba0afdad6b8b44daed4c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623920, "uuid": "42872a64-4972-42ac-ab17-1b409ea5bb5b", "comment": "Malware payload (RemcosRAT)", "value": "0c1388cdc24191b4a84c8d6921463232242518bdf212d78a09f7b2b5682e74a8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623920, "uuid": "03044e2e-5da1-4477-88e6-653a4f9e8ea7", "comment": "Malware payload (RemcosRAT)", "value": "25e3402572508e209e2991e42e25d599e87a8267", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623920, "uuid": "a9c5cc23-2ef4-4624-a0a8-29ee0fb9645b", "comment": "Malware payload (RemcosRAT)", "value": "454ab2881b73e9d101129dbd954f43da26e389b3229932fc565102c4c4ae7df8ed70819b5b06fb987a416fbb07530f9a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623920, "uuid": "9be63b3b-7e96-401e-8ce8-79daf403425d", "value": "T11743332AB74E4D69E755E5B74259898E0EFCF73A73C100D0B9BCA3243B2D40E8A711B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623920, "uuid": "bf67fbbd-4a2e-4475-9962-77c85f4d09d8", "value": "1536:govhVaMkNHcXC6ww1mzFzVgNtnlqQaoQqL/3:XC6w462XaoQqz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706623920, "uuid": "c9ae1a4f-affa-4a2a-9070-844d5bdd2f95", "value": 56754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706623920, "uuid": "41f78196-9ed2-4486-b68f-1eaf5d7b6cb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623920, "uuid": "a4387bfe-5b04-4abd-92e4-c76cfecb87df", "value": "microsoftupdationgoingformicrosoftofficeupgradingtonewmsofficeprotoecoltoreducethesys.doC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd807806-bfac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706646020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646020, "uuid": "c279eb0e-dc46-4b4d-bd98-1700db16b2dc", "comment": "Malware payload (RedLineStealer)", "value": "96f646a4b18898abc40f56ecfa685aaa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646020, "uuid": "05722013-d841-406f-a595-4fe23438fabc", "comment": "Malware payload (RedLineStealer)", "value": "0c45069bb632d3b998f8bb77929b491d4b1c62f89b4b907480b259e2507650c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646020, "uuid": "de318574-2589-4276-96af-58b2cd9c009e", "comment": "Malware payload (RedLineStealer)", "value": "a53b346eef768e5e473680c6a60cbf0fa5acec1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646020, "uuid": "d0a00e41-53b6-4d03-8556-c997d8fe3c43", "comment": "Malware payload (RedLineStealer)", "value": "5dab6b43885f19a4618d346d84f6018a8950b36e7a890d24b67e072f8771870c0411b43ae6f5da5143512247d2b9c0a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646020, "uuid": "47c11866-a5a9-498f-8a8b-bbdd90845af6", "value": "T14E840256B6E1CC77E3E3A9710C3596916A3F78266A3AC4DF324447291E322C09F73366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646020, "uuid": "d77742e3-5ae3-446b-9e3e-57c1dee6301e", "value": "9120df538249dfc4533ca001de4a611e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646020, "uuid": "21e5bc39-63df-40d5-be13-640eddfec6b7", "value": "6144:aLAcGozWdw9COYsp7Rszja8isI+jljd82D8WR9JX5ujfkSC735:accGoz0wfdsze8is0oRJEjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706646020, "uuid": "2041e67c-297d-4e49-8c93-9ab55bee0f58", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706646020, "uuid": "c4ffa462-1f59-4c36-b88a-fe05a9fd58d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646020, "uuid": "2a3b3e20-e442-4dd0-829c-67f0fa8f5b40", "value": "96f646a4b18898abc40f56ecfa685aaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955fa594-bf73-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706621364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621364, "uuid": "920955c1-7ad3-42d1-aebd-1d96ddff01cb", "comment": "Malware payload (AgentTesla)", "value": "ca5c4e077a064a17c623244396c77307", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621364, "uuid": "88e18d24-1538-431e-bfbd-308faf2e313b", "comment": "Malware payload (AgentTesla)", "value": "0c6464c591cc6b648fccfdc52a238eff7ffc2e1faebe7b62d9b93dc002fa47de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621364, "uuid": "68cdf69a-f293-4c98-bf58-cf5e6e9efde1", "comment": "Malware payload (AgentTesla)", "value": "b5f88bce99576f162dab3f9e7101e3d00f8279a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621364, "uuid": "9d486ace-7323-4521-b835-091633fe3944", "comment": "Malware payload (AgentTesla)", "value": "5f0ea30d0e39860535c21d5fe419fcc579a49a36f01c49b6f927d627045e1cd20539c595b38fd255ab32e8d869207ea6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621364, "uuid": "55595114-1db5-4236-b783-752a7ed24449", "value": "T1E8240299D55F84C2DD99BEBC8037AF5B0B72AD23561389CB328472365C22397006FA1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621364, "uuid": "2dc50411-beea-46cb-930b-b50b76885e06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621364, "uuid": "1ebdbce0-970f-4b0f-b385-5c9320d4b395", "value": "3072:Qi1iZ5IVYKqtLd/12rzteJxDldHhsM7sHuAiaM2vxSxpU3UHbQ7GmCMY7pdkT:QA92h8cbDl9sOXaDqUEHbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706621364, "uuid": "afb7919f-6e3a-4666-a10a-c7bc21d05c68", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706621364, "uuid": "18d5ae64-b3c5-48f6-b2df-37d1d066e038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621364, "uuid": "857b3ff5-8d3e-494f-b523-8780479a2572", "value": "rorden20226.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0ed99f-bf24-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SystemBC)", "timestamp": 1706587287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587287, "uuid": "3ad919f2-4776-4af4-9751-a08786f416d4", "comment": "Malware payload (SystemBC)", "value": "ed61826b5f7a0e84f803241e6135ca13", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587287, "uuid": "a8c89f91-e41f-42c6-a067-054fbcd07478", "comment": "Malware payload (SystemBC)", "value": "0e9bea8429cee4efcd30dfcdb52c7e043caddf235406bc96dddce309502340dc", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587287, "uuid": "41a9edd7-dd79-4c07-b5e2-2f304133da99", "comment": "Malware payload (SystemBC)", "value": "484d1f8b1bee90329b802f5c006612c59d5a917e", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587287, "uuid": "b4e1d3ca-e61f-434c-82c8-044ea0e817e7", "comment": "Malware payload (SystemBC)", "value": "1946e1d25ebb317cacdf48dbfc33dff94fcdd16d81ca3773f624d606b4da6c7b2b3de008d855707dc51ae961753c6fa7", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587287, "uuid": "78872435-bf41-47ac-9d36-5db35d454ad6", "value": "T1C4E4123C23CC8B23C65DB97EF2B045C40B3A91756052D72AA844A7772EC3BD19E536A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587287, "uuid": "849095ec-b7a5-4e53-9be9-4a95892190e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587287, "uuid": "62ed0009-a725-48f4-80da-464de7c1bf9b", "value": "12288:5qJpJoFmmXXhbdAUbm3KM7Gx72ItrwWizaNTe/W9KX93yooUwk13Z:5q6FXhbdvtB72ItDieNeYDUwkxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706587287, "uuid": "5323583d-5a24-4928-97b7-e25713789647", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706587287, "uuid": "bc5593ab-338c-49ea-adf1-a2f08d5b4d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587287, "uuid": "911059cc-4118-43e6-adef-22907e7e335b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d297cd-bf40-11ee-b7ea-42010a9c0006", "comment": "Malware payload (ExelaStealer)", "timestamp": 1706599454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706599454, "uuid": "feb2dd57-8c71-4b23-90c4-1e17c86501a8", "comment": "Malware payload (ExelaStealer)", "value": "5bf290d7209f17eaee7d8548beaf29f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706599454, "uuid": "0c9829ef-597d-4348-a60b-46193f1a2a07", "comment": "Malware payload (ExelaStealer)", "value": "105f50a076dffc8cc2abafd844a23d2b77b7b8fc3c3b3388202d5681bcacc910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706599454, "uuid": "e963e7a8-33be-4629-9bf4-80811dcb316e", "comment": "Malware payload (ExelaStealer)", "value": "fe6d790f22643fc139ac5a53cadc5554a855bdd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706599454, "uuid": "f50a5b4a-5f1b-42ea-8781-2bd4bace3534", "comment": "Malware payload (ExelaStealer)", "value": "e9255c086ae066d0520ffb17c72759824446b8736f9fa7559fbc3e337d1de0b7ac76729c5044d95135bdaec2345d6420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706599454, "uuid": "1ea94738-92a7-4d18-901f-c9e06fb164ac", "value": "T116B6332873D11EF6F9AB2976D0D28921E372FC510B64CB8B431866FA0F27A505D2FB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706599454, "uuid": "6627e4f7-7133-4214-aaaa-c8ea55744b0a", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706599454, "uuid": "4afc404b-ffa6-47ba-929d-e0ed1f893611", "value": "196608:iPLd8eOaPAEu9on3dDTeeNy+wfm/pf+xfdkReBnfXWKsnPtSDrIWOIWsDaqkH:YLdXeD9et5y+9/pWFGRUnfXBsnYDrIW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706599454, "uuid": "4f959639-34b5-4fdf-9a92-4e465c91ecfe", "value": 11248412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706599454, "uuid": "83d2ecd1-9dbb-4ec1-b176-f2d5cab668e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706599454, "uuid": "3416b558-49a0-4017-83c7-5c812e31bd64", "value": "SecuriteInfo.com.Win64.Evo-gen.20285.22431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908c6ec0-bf3e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706598592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598592, "uuid": "a075ffc4-642d-493b-8d7e-987356177e18", "comment": "Malware payload", "value": "8f0cf7cb89f3088a118b5f80d61bf9a2", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598592, "uuid": "dc968771-3094-4976-8486-502f2a26a128", "comment": "Malware payload", "value": "10c82d46b537faad50de6c2896925fae1b7c3ff0f9f76eaa112f98d30c4e4766", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598592, "uuid": "795f1322-fcbc-487d-9a41-f217114c8fb6", "comment": "Malware payload", "value": "facc517163da7844b440fa386ca6c038eddff011", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598592, "uuid": "b7d42467-2465-42d2-a758-465e7b2a36f9", "comment": "Malware payload", "value": "8c37ea391fd83183b2905312de87c6d105be0992dc1db0738f97875c2da4d683d081ed7b132568015806788c1cc34302", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598592, "uuid": "f7cfb081-7fd3-4dbb-bcdc-c250b548b7a4", "value": "T1AC44CF51BA90C60AE855477148F78FEA6325FC416F924B0F325CF32D3DB42E46E27A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598592, "uuid": "277bdcb4-6930-4ed1-b3a4-25a0d5f35396", "value": "6144:8gNZunHY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVxzMIoxucyc5JPnxnnn:8gNsq3bVxzMIoxuBc59xnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706598592, "uuid": "6708a8a6-89ee-4958-92a3-6b1fc6c66aa5", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706598592, "uuid": "0153a423-f337-45ac-9607-bdb50dc1d9d1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598592, "uuid": "0fcaeb7e-6f2e-467a-994d-61b75be2dbdf", "value": "INV.INSE23090213,23100011.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ff8151-bf67-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706616053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706616053, "uuid": "6387500b-ee4a-42a3-b97e-3b16a5cb9356", "comment": "Malware payload", "value": "b4f10039927b040f0470b956c74a31b4", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706616053, "uuid": "39027c0c-1a3b-4c29-8d7e-b28e7180c265", "comment": "Malware payload", "value": "114935488cc5f5d1664dbc4c305d97a7d356b0f6d823e282978792045f1c7ddb", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706616053, "uuid": "156b93c3-295e-497a-b6f8-5f39fd599266", "comment": "Malware payload", "value": "fa1063d4b00b4ffd9cc1411b653bce3b1ca8123f", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706616053, "uuid": "517a4b13-3809-4afe-993e-11c5e7d3e1fe", "comment": "Malware payload", "value": "41161acca3ea4db8ac57b6a2768969825aa36e6385b32749f565a4154e638c689b46846f07ef89374ec0a2609245a4bf", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706616053, "uuid": "3b4eed9b-f2f7-4af9-a501-c651dc5ef028", "value": "T12F050233AD136D659B0C8B7B27AFD7E96C6B5FAB04A95DEF29265200C07D71310D80E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706616053, "uuid": "f2c29522-fcc8-4fdf-b120-6c3b2da92d41", "value": "24576:JbsUwcxJo6gZsRPO+x+RsyUm0Vimy92n1:fC6ksxOqmDDa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706616053, "uuid": "7552c8ef-4f2a-42f0-8b66-f79bdecb755d", "value": 803947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706616053, "uuid": "2c077241-93f1-4fbe-8897-6d655058a691", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706616053, "uuid": "e316f105-2d31-433a-90b3-c820c402cd7c", "value": "kak-pomilovannye-vagnerovcy-snova.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8261f53-bf49-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706603410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603410, "uuid": "b7625861-fbb2-4127-933a-9953d6485eec", "comment": "Malware payload", "value": "5bfdbb28cc7fed82bf415edac9c9eb83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603410, "uuid": "621cff2e-0cbf-47d5-bca2-a81b6351b66f", "comment": "Malware payload", "value": "12affb37160cf0bb5fe284c7f65ddeea23a788f4d35fbf158a4877c99640e8c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603410, "uuid": "b9f386bc-e5b2-43eb-b7a3-eb39084c6241", "comment": "Malware payload", "value": "c04b108edbb95b75dc1496bed342b937f37fa17a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603410, "uuid": "5bed7d33-72d8-45cb-840a-9ddd6df0c674", "comment": "Malware payload", "value": "582309492413818d9e6e35b71c531105fb12a7ae649610d5ebe12a4154b833f023822a50384bb11361c3da810b0d15d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603410, "uuid": "2ddcb059-9732-4cc8-ada8-945d7eda0687", "value": "T1BAE4125DAA504CCCE896837654237A1FC67DF01A03CF22EF13E0DA71BAA6CD58597782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603410, "uuid": "074eb311-35b8-4e3c-91bb-a52f986076e8", "value": "3b7764a1804c8f2ad22122774fc2bb1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603410, "uuid": "e62ae6fe-2b02-4129-9dae-2479eaded351", "value": "12288:XeamasPpcOQZTOK7AXIfaNpcAlZwKXKCzNCFQpZGtK8HtDdoA/LQXvU7gkXeNV:uamasBcVOK75JKo0EtFHt+yQXvU7ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706603410, "uuid": "d2fa7dca-4bef-4f85-ae96-4972142ea0f6", "value": 703496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706603410, "uuid": "1862485d-07be-43b4-be11-4e2e22f370fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603410, "uuid": "a1f8334f-8287-49ab-a52a-1584deadabe5", "value": "SecuriteInfo.com.Trojan.Win64.Agent.7400.23601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe89461c-bf21-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1706586322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586322, "uuid": "7e5a1e08-c402-46dd-9785-0aafcafebebe", "comment": "Malware payload (PureLogStealer)", "value": "f3ed43acd7d035e8c6035c7d65ec60bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586322, "uuid": "de243c46-391c-4a0c-bb9d-a11ec0c36a92", "comment": "Malware payload (PureLogStealer)", "value": "136f29247b40b1cd3e65d093fd0529d6115ade980092b6a950d461b5c046daef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586322, "uuid": "cd6b590b-30a0-4d88-add0-8f88cb737a69", "comment": "Malware payload (PureLogStealer)", "value": "679c01b051cbd42b740a05f0cd2807b16bae5aec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586322, "uuid": "31345a56-0d6e-4d83-a9b8-cf1e57d85c26", "comment": "Malware payload (PureLogStealer)", "value": "e501b6b9a3afbd380beea57ab7cee429a5c637971e84e710761d4f2370ec55b11760ad370bcb34d1182e30bd8e89c1cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586322, "uuid": "d50e4181-4253-4713-85cb-523e44ee5573", "value": "T10783D70BB65A85F2C2985736C69B40040364FF82F6E3D70EB9BE2355180F7EA9D3564B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586322, "uuid": "f2dd2b94-4287-4f3a-baa5-b750ec007c21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586322, "uuid": "3842ac95-e3d5-470a-bb53-fceb1857d91e", "value": "1536:VfVyEwOvOBB/rtSp/r3fGTTNOXrbpCEviigx2hyke70WgY:uElIUfL3p5vC2hykg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706586322, "uuid": "5fba4dd1-f1ba-4da0-ba87-3ca06ffe0229", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706586322, "uuid": "193744df-842e-4e43-b964-49057873c4bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586322, "uuid": "2384f86e-ad72-4c63-a97f-d22e22070496", "value": "f3ed43acd7d035e8c6035c7d65ec60bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba79d41c-bf16-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706581483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706581483, "uuid": "75d6634d-98fa-46b4-87fa-4e5620bb3bb0", "comment": "Malware payload (AgentTesla)", "value": "aeef1ef69b723855211bd83fe6ae4748", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706581483, "uuid": "99bdd54d-2537-483a-be91-b38d153219f2", "comment": "Malware payload (AgentTesla)", "value": "13f051911ed4249cacf1f9ab207d065bd2b46506b706894889691a1f42a43d72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706581483, "uuid": "4d004a47-2cb3-489c-b915-26a9cb088706", "comment": "Malware payload (AgentTesla)", "value": "49d8ba98b605a10070bc24c78f2a46368d4e6fa2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706581483, "uuid": "7ef500d5-b21f-4b30-a6c7-2d8bcae603a2", "comment": "Malware payload (AgentTesla)", "value": "a5303ed7ce953da36bf33e7eb28e3b111e7bdc52df1e2a4405b49600fd2bfb064914e33852a629492f7f1eef1820dac6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706581483, "uuid": "80429658-745a-48cc-98df-efddba2d02a2", "value": "T1954538016391DC21FEF691324A16A501477B6EE4016B881FD27B3B79AF70FE5326E293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706581483, "uuid": "5a8bdfc2-5358-47d2-b1ff-1a821ede4562", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706581483, "uuid": "6a521c6d-5643-4c3b-b211-6bfacceb69f1", "value": "24576:UAHnh+eWsN3skA4RV1Hom2KXMmHacjUVovx0pmbpR5:jh+ZkldoPK8YacjUV4i0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706581483, "uuid": "7a8cfdaa-fd1c-408e-817b-ed437af0715c", "value": 1224704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706581483, "uuid": "b9148a57-0b1e-4ae9-8fd2-62421f129071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706581483, "uuid": "4336345c-e5be-4908-9843-83a6f62fac07", "value": "SecuriteInfo.com.W32.AutoIt.XU.gen.Eldorado.24716.25277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfdf1d27-bf5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706611610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611610, "uuid": "0f467cef-91b0-4f62-8a8b-7f4c92602e76", "comment": "Malware payload (AgentTesla)", "value": "5a24a4e3f94403370fc5b56c1f933fb2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611610, "uuid": "68353093-e508-4dff-834e-1e36bc00bac7", "comment": "Malware payload (AgentTesla)", "value": "148537a64a8d397f8a92c906f962fcc656b57c9735e7c24c7e92a714473ec07f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611610, "uuid": "f3c38368-28bd-4b5b-a8ef-c4097cde2df4", "comment": "Malware payload (AgentTesla)", "value": "39134ebc41f32b96cb535f6c4dbaa297ee45be14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611610, "uuid": "cd2da6c8-0887-405e-9424-88ca8417b129", "comment": "Malware payload (AgentTesla)", "value": "92680b91379833e64d7bef19d8e1e6af59565a781d90a14271c57c06a686009f89a13e1679b938ee912f5d674869f6df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611610, "uuid": "94c5b3d6-a036-499c-a9c0-475f80d721ce", "value": "T186B42370D1F97C6B788FBBB30FEA271F01CE272064795780E442696C75A38E65627A14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611610, "uuid": "1e80457a-bb34-40eb-b46e-48acbc1eca30", "value": "12288:luuKDiJ+sgSK3PghU41SfJW7TGoQ98NAfu++OBMGy0WJbk:lpQbZ3PgqEwJWftm8+VDBMvJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706611610, "uuid": "93c8d36f-86bb-4c23-9508-9377a930b277", "value": 502359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706611610, "uuid": "7491c609-cd1e-4770-b6f7-2aeb8718fbef", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611610, "uuid": "809be78c-5758-4f06-b709-12672f64847b", "value": "QUOTATION.PDF.Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35397478-bf69-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706616908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706616908, "uuid": "f6476266-62d1-4da9-ab84-7a86e6e8caf9", "comment": "Malware payload (Formbook)", "value": "d8a9194b51f660fe4363dabd66594caa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706616908, "uuid": "c9c8c9de-a162-48a8-a0fd-c08201d200b6", "comment": "Malware payload (Formbook)", "value": "169d2f9464bca00b78b3912920a5b563dcd3ba761e4cbf2c88c18a37f12c60c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706616908, "uuid": "7ecbe401-858e-41ab-80bd-d79d9e020514", "comment": "Malware payload (Formbook)", "value": "1f18129428f843c9433a7ca9c7514d270df5d194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706616908, "uuid": "ba0f6a49-0038-415f-97bc-4e200ba8b20a", "comment": "Malware payload (Formbook)", "value": "6a3d0594e8955717f4414f3941c1dd0e5e2fcf4cd1d87350b066b64ba4c1f462b9c6801b60190bf3eb890bc889e55273", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706616908, "uuid": "2b2bb6cf-46f2-411a-a466-26954a8339ca", "value": "T164E4129659F88B23CBFA27F490A0801447F2757B4D66F70C0EA11ACB1677F424B61E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706616908, "uuid": "71069ab7-5e5f-498e-b9d2-96cc2a370b8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706616908, "uuid": "09b1b0c4-64e7-4406-9557-5967615d198b", "value": "12288:dj4IAYQ40s4lKaH7QaNIzky/VULmK0uzvXO1b+9ad2DAtf0tEfc/2i:yIATt7QaNIzkCJK0uzfwd2DAkB/2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706616908, "uuid": "9822c56d-8bee-4b74-9d4b-0f1518674270", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706616908, "uuid": "90606266-6f32-4911-ac04-cae56d0c03e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706616908, "uuid": "0b5bb88e-206b-4f94-94f2-4cf8ff80949a", "value": "Payment-confirmation-Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc13eda7-bf5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1706611658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611658, "uuid": "e4baffdf-db87-4152-aa47-a0b78e856568", "comment": "Malware payload (DBatLoader)", "value": "3145975572e861bf7e6d52a01a2931be", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611658, "uuid": "07fc8e0f-e63e-4d23-86ac-5f2ce1f6eccc", "comment": "Malware payload (DBatLoader)", "value": "1899d34003f44a734a2c7aec325d363c75c3a9b2db263df8e36f69f26984b936", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611658, "uuid": "635e7fb9-978a-4040-b7df-29a2e5376c5e", "comment": "Malware payload (DBatLoader)", "value": "dafc373c0c669d07093cdc46523a0c13c6316893", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611658, "uuid": "9a20e779-ca1c-470f-983d-be5e8a818e02", "comment": "Malware payload (DBatLoader)", "value": "d48ce8916db4031169ddf24a67ddfbad355e9fab225a88f152fb79b4bf7e388f345b688b8f3db595760a2901b6d446cf", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611658, "uuid": "69678113-659f-4eab-baf0-1ce89a481776", "value": "T173A5D023A2D44432F132A57919977BA5EA1DBD202C267E9527D53D0CBF333407F28AA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611658, "uuid": "274a4f6c-c6d4-43e1-a408-1cb85b169a01", "value": "49152:0qAodhXjnxf2hd7c7mvrq0gOP7aF5P0R:0qAo2hd7Ymu0gOeuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706611658, "uuid": "04a48cb6-81a3-44d1-b1bc-2a8d1cfb1c04", "value": 2099200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706611658, "uuid": "9471aace-e3ea-46c7-b2c2-dc83d16fb33f", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611658, "uuid": "3390d41c-2af7-4f9f-816a-3c98c30a4ae8", "value": "Wire_Transfer_Confirmation_P729200FBQ12.tar.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010c50dc-bf4e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706605224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706605224, "uuid": "fb172870-ee71-4f44-b058-45b609c35c0d", "comment": "Malware payload (DCRat)", "value": "1d4782a0757041f1a36fa6af914507a9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706605224, "uuid": "d39bf118-f31f-46d7-80b1-ef65b5dcca78", "comment": "Malware payload (DCRat)", "value": "190a5a80f6995086ecf237ee6fa3eccae7f4b0b80c5ff0635ff95106708555fe", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706605224, "uuid": "7126ea7a-fe25-45ac-9660-bd5873c92f26", "comment": "Malware payload (DCRat)", "value": "d73e7358506dc5ac50621eedab1a925280941cdf", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706605224, "uuid": "bdd9293d-622c-4760-8bdc-2e89903e5088", "comment": "Malware payload (DCRat)", "value": "a336b1637e4855c552bbbc70100d6a782d44e9318b61fb1ed0fc0f974ae56110bb3233218c409c83d9a2ead2a48e38ae", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706605224, "uuid": "6192a1b4-c172-4dd1-a36b-27e2fd03020b", "value": "T1CC95BF0675914E77C2B45F328697027D4291DB223622EF0F361F25E6A90B7F18B722B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706605224, "uuid": "a1679335-b508-4669-9e4d-47185e49a43c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706605224, "uuid": "9a3fafde-a7b4-4c5d-bdd5-01368326dfdf", "value": "24576:2TbBv5rUyXVLG9Rr1Sbp/lmO10dluzaTByXMhu7O1ueh6uquaClbwYFTPK/caVQ4:IBJLG2tF0af8uSUeh6uqN2zKkZ7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706605224, "uuid": "47482a0e-f314-43e0-910e-fd75a0ddd8c6", "value": 2060145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706605224, "uuid": "8f9e0d54-e885-4838-be26-418ebe85b93d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706605224, "uuid": "ee41b311-bddf-45cc-8790-20f822c0c5e7", "value": "1d4782a0757041f1a36fa6af914507a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467fa83b-bf24-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706587301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587301, "uuid": "9af2e6b2-af84-4e0d-ac90-6c9a8f87476d", "comment": "Malware payload", "value": "91f185b28ea88ce18f33d42425784a04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587301, "uuid": "0bb20ebd-3226-4856-8085-42ca6d857c87", "comment": "Malware payload", "value": "19ba688c417444ae0694c49340a3c8e347c4c992859ff0d1e862efd163231807", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587301, "uuid": "1326e0dd-2b5a-4279-826f-4abd3504956a", "comment": "Malware payload", "value": "db24b9a3b687ac8ee2d0865ebac6e132f907c604", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587301, "uuid": "e3ade71b-3f9a-46f2-b53b-1bdeb3f3d09a", "comment": "Malware payload", "value": "b78c120898a0be231416d50ac9efe600544ef770c64b220d2c3893f203dcd51d97273a5bd71e916c59321c869e0626d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587301, "uuid": "d555865a-f24f-415d-8c60-1236e5e6a057", "value": "T10D75B03FF268A53EC46A1B3245B39250997BBA60781A8C1F07FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587301, "uuid": "1b869442-2c15-4438-9761-906075588a79", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587301, "uuid": "76795617-5ce0-4e53-b827-53d8d0728198", "value": "24576:t4nXubIQGyxbPV0db26Wzrfsv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdOe:tqe3f6LSffPMWrQ0ZkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706587301, "uuid": "dbe31394-f389-4bb9-b291-5e586a13c581", "value": 1668146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706587301, "uuid": "57d712e4-c16c-4403-89d3-db258cb19088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587301, "uuid": "a56e4dee-4108-495b-b0f4-0f29ab4f1a36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1644f980-bf7f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1706626305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706626305, "uuid": "48b8c9b8-3d45-45f2-85d3-75c3b25dfb8c", "comment": "Malware payload (Socks5Systemz)", "value": "5e8dbe3403aa3fe779fb5c60b449f159", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706626305, "uuid": "754e2b4a-3b19-4b77-bce0-cf8c0ed648fb", "comment": "Malware payload (Socks5Systemz)", "value": "1be4849bb428b6e72ecf51370437209e9a11822ac834ab145eb5a3d65397f3da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706626305, "uuid": "41e0565c-a895-4d63-afc2-6d2940ae2d66", "comment": "Malware payload (Socks5Systemz)", "value": "ff589614c244b095ae79ec600efa7b8000952298", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706626305, "uuid": "acc3f1fc-13d3-4567-99ed-f53e4f15760b", "comment": "Malware payload (Socks5Systemz)", "value": "d0d8111a5c60bf3a8e824ca2be530649dc476fa5830641e5d2ffba5c0a18233e8a814c495db230009c1a7fae5ceb7437", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706626305, "uuid": "c9a1021b-6881-4f7f-9bc6-84387f552333", "value": "T19F663392C631F639D1044FB2D528842A6B765EA51B393E7D60CFD02FEB03E882B4D657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706626305, "uuid": "84264f28-b6d3-4481-97b0-c490940f84a6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706626305, "uuid": "f23a6f9d-9c53-40fd-81f7-2d9c7d4d20cf", "value": "196608:blswAg7BTqNvQHAhHnpVu7NUtcPNc/ctZSPGUGh03w:ZeCWNvQEpVuhUtcPNgcjSPOcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706626305, "uuid": "e6dbefd0-c7ad-4401-95ee-16eb0447e131", "value": 6550877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706626305, "uuid": "bcc17ca8-cb2a-4028-b6a7-8d692d4826a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706626305, "uuid": "4d47e777-bf4b-492d-82e9-56117bac7f83", "value": "5e8dbe3403aa3fe779fb5c60b449f159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ee1fa4-bf23-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1706586893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586893, "uuid": "ffc4d873-4871-428b-b6af-2cc3522f5340", "comment": "Malware payload (PureLogStealer)", "value": "31118351b8b0db68e9c1bc3ad1da8e7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586893, "uuid": "fb1f507c-d064-4d95-8c0e-883ba06d1c44", "comment": "Malware payload (PureLogStealer)", "value": "1d72f409f9089ba57b151f5836df00ba70480f1530c67b1a2c81fc9b50b7cbe2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586893, "uuid": "bbbb7a4d-d1d8-49a4-8809-8b3300960d57", "comment": "Malware payload (PureLogStealer)", "value": "adb461d4d199ea7367b65b185f47a10401e2ba97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586893, "uuid": "bda1cb80-bb18-47cc-afa2-fad3e8361b03", "comment": "Malware payload (PureLogStealer)", "value": "c307f33b363d72ade5f0682fec841739d461fb43dd48bf85486738cbd7b7022932f8ab8ec323216ae8c5f351aa5ad804", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586893, "uuid": "04d7703b-e64b-4236-a423-e1eedc7637f1", "value": "T1B0C5F145DBDA1620E1FE4F3294F12A0593F9E423EBDBE34B054962D90E677A78812733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586893, "uuid": "1a7ee3a8-f546-439d-a2ec-a35753b08a2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586893, "uuid": "f22312f3-cb34-4342-b0eb-2351d7744f9d", "value": "49152:ywoUZ8Cps0BJDmN8wjp+ps8M+1tgVO8jrHWvrYz93513:E0LSNFUps8M+MVvr2zMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706586893, "uuid": "72fd6203-5be1-4e18-8282-3486bcf1972c", "value": 2589696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706586893, "uuid": "b9a44fcf-20c4-4976-80c4-e4092b206321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586893, "uuid": "5273170c-f8eb-4c03-826b-ccbbb3b573dc", "value": "31118351b8b0db68e9c1bc3ad1da8e7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44536c87-bf55-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1706608343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706608343, "uuid": "2ee14819-e209-402d-a9db-56766a5748dd", "comment": "Malware payload (DBatLoader)", "value": "78c8b4803e67eda1458c12c21819fa09", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706608343, "uuid": "3c9cf182-e8e2-4dd3-9848-d3ef4db98d42", "comment": "Malware payload (DBatLoader)", "value": "1ec2610c6950c572dfb9973bcb339a8d3176527c51dea28ae111e8d4b0d8af76", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706608343, "uuid": "5c7c94ff-f7db-4943-972f-c29698599ab0", "comment": "Malware payload (DBatLoader)", "value": "82be3115625defd4ce64ed508b69cede56847c3d", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706608343, "uuid": "0294f956-fcbd-4231-9a48-f1aa74f3d30a", "comment": "Malware payload (DBatLoader)", "value": "3b3b4923493cc96f277add234e134f81e1fe2ef0dfbdef6f0a50e44629f2a392d43c2de81ddeff98c14c8e62b43b24ea", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706608343, "uuid": "892ab8db-7909-4d73-b3e8-4edcf9122759", "value": "T10665338FF4D9C79B92BBD91A310B1704BA163E0C1027B4CA52F918B5EF0BD1C6256797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706608343, "uuid": "3ce6c7b6-ca00-4ba4-a26d-fd1f0ddf2c65", "value": "24576:YW8mypdAeGvmTXCnOIQTnYcDibPh5g/L76+B8/81yYI8fqtzY7hV9xP3N02OhYIq:kmjZkkbpg6+e/ipfQ81vxP3NmYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706608343, "uuid": "0205f710-18a1-4d7d-802c-ab09cf5de2c2", "value": 1412249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706608343, "uuid": "d3f0dbc0-e531-4fce-b07c-462d476d5b83", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706608343, "uuid": "60fd213c-8ade-41e2-b0e9-1794507d4cc3", "value": "INVOICE.XLS..tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fd8006-bf92-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706634537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634537, "uuid": "6f3dd8f6-1cdb-4740-82e7-542eb63aeca1", "comment": "Malware payload (Mirai)", "value": "a7780f8848425ec2d0fea90f34ceec39", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634537, "uuid": "739b4256-213d-4c54-bce2-699d02929879", "comment": "Malware payload (Mirai)", "value": "1f5e45d86e1f8b498af73d62b08b73261d9fd5a2e36722ee2cc82cb878f4bbec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634537, "uuid": "a8f9a6b0-1b90-43ec-9d11-bae0aa56cba3", "comment": "Malware payload (Mirai)", "value": "740a47ae680390821f69035854f13b27bbd4ce11", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634537, "uuid": "9ec931ac-9875-421a-a832-99936cf19427", "comment": "Malware payload (Mirai)", "value": "63810150cdb8a44970b3649fa02b18b26a324f0c16e846992b3b5a2e119bdb654a29a832a81ea2ebfcba880d20884394", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634537, "uuid": "b730b9e1-393b-445b-89be-0cc8d79512a0", "value": "T1B2D30845FC405B23C6D612B7FB5E428D3B2A17E8D3EE72039D256F60378A95B0E36642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634537, "uuid": "7cc72d2a-d6fb-4cd5-8029-9693e58b06a3", "value": "1536:1HQeHIjFlGz/r52Qp4/lFcAPWZf4VTyqsTgDxc0vfHu2/m9MdGlxABwyw2FR4gor:1HQeF2Qm9FcT4YZMDxc01YM4gxibX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706634537, "uuid": "cb7016c4-73be-4bc1-9af7-de37ff5ddba3", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706634537, "uuid": "feca0e38-97ff-4f8f-8586-f6f2d818a930", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634537, "uuid": "a78ed332-d95f-431a-a47d-76db9fe30bd0", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722ab7d8-bf16-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706581362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706581362, "uuid": "2c9507ed-a006-4db5-839d-8a41a45528b9", "comment": "Malware payload (RedLineStealer)", "value": "bf2a3e48b0ea897e1cb01f8e2d37a995", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706581362, "uuid": "5f27b117-ea48-4480-8149-a6744737ace7", "comment": "Malware payload (RedLineStealer)", "value": "207c4f9e62528d693f096220ad365f5124918efc7994c537c956f9a79bcbadd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706581362, "uuid": "566d7b7c-bd06-40d3-b05c-1ef514bcf07f", "comment": "Malware payload (RedLineStealer)", "value": "4e7cd01f8126099d550e126ff1c44b9f60f79b70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706581362, "uuid": "2266b5c5-f521-444d-baba-86d5b4f7c2f9", "comment": "Malware payload (RedLineStealer)", "value": "4d9eede4b7b5675d999fa5e3b29d2f7eee699909a145fde39f83bf58e0bac100323b96533c132fa7ae84f2d3322b22ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706581362, "uuid": "6905cc4b-6d6b-4e04-8f22-ae776af6826e", "value": "T19FE412117692C1B3C477017844D686769E7A34B21BAA96D7BBCD1BFB0F203E193362C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706581362, "uuid": "ad8b5f42-af5a-49e0-b129-e78b0ca84c78", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706581362, "uuid": "2bf5e115-5367-48b7-ab14-55791e9919c5", "value": "12288:mh1Fk70TnvjcDopmEUd4+rL4VZvvApKFuzWMfJoacb7hj30Cq7rc4p/2:Ak70TrcDopfE+wUFuzW3NFgdrJx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706581362, "uuid": "c600bb35-dfab-4f34-b52a-cfac1ea6f391", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706581362, "uuid": "ea07faca-16fe-43ab-8122-4e6b6d57fc93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706581362, "uuid": "21a57e68-fea4-48ed-8167-e4494cae0e98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea10ac15-bfc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706657584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657584, "uuid": "d6ad6f6a-6ef7-40ce-ae4c-41e3b5244ae2", "comment": "Malware payload", "value": "ce2e16598e70f2af16920187daafdd9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657584, "uuid": "b1fa342a-f9d7-44a2-b25b-b68b6aeaf08e", "comment": "Malware payload", "value": "21c163aca4dbc8ac605203d9687c5d20428d9aa4b504a7e51303b7bb4f224e38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657584, "uuid": "c47f4a68-4f50-4440-a020-324aa961002e", "comment": "Malware payload", "value": "769325b20221c6ae6d69df4cec8234594f1f51a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657584, "uuid": "5a346a15-2f79-4a49-9c37-2944366841d8", "comment": "Malware payload", "value": "1f33a77cf9e23a158dd38f7aa068db8780331e50ca0974596e86086759576226c8131e42c8df3efcc4cb81266c9c2155", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657584, "uuid": "07423dc5-17f8-4a71-a695-f00581f72ac0", "value": "T1F295017742D8E37AE154213D828DE4E268A41ECCFBC5D9C6FAB57CCEA4FDA134124612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657584, "uuid": "1a79276d-f05b-4d27-b702-0e8edb227eea", "value": "d879a65e465b1c412670e44fbe2d8e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657584, "uuid": "c30339df-5165-47fa-92d8-628c6f4c183e", "value": "49152:GbrmcFtcE61GJadou5XWJU/lGYGwIiRHm1TN3r5d:G/m0t7bcdouCU/lGY9fsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706657584, "uuid": "3ea0d0d5-3644-4a4e-95c7-98f1a03a17fe", "value": 1882376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706657584, "uuid": "de461357-d3ba-47e9-a2b2-eff1c1896a60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657584, "uuid": "022b415b-0089-4f78-8f97-4d87dc891845", "value": "SecuriteInfo.com.Trojan.Siggen22.10132.9977.14465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef90b2a5-bf60-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706613355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706613355, "uuid": "47ea14c1-21fa-4d64-b923-fb2d5ba7e458", "comment": "Malware payload (GuLoader)", "value": "9217000741d062534aef0209b53ade51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706613355, "uuid": "aefa7447-0346-42b8-8d51-e29d475621b1", "comment": "Malware payload (GuLoader)", "value": "22344753caa6f429918bf6df1fe006dad8fcfb3353d7606bc011ff41684f6915", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706613355, "uuid": "796cfeb5-4d9d-4f1f-8f1d-80496a6d408e", "comment": "Malware payload (GuLoader)", "value": "b8d5b75a028b768999567173d1d961d2a215b814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706613355, "uuid": "55e9c617-45df-46d8-91a4-8f5c6b1d0b0d", "comment": "Malware payload (GuLoader)", "value": "a199d917be0039c85f4d1a630de1a9d1183ac48acfee1899cf60c4a3d1df113a1c6f622527e0631b814dc50c9c3482fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706613355, "uuid": "cdffaf71-57ad-4e5f-b127-2a6105336f37", "value": "T17DF533548A18A018E246C1B3C71276799B79B335DCD75FE21F219E1BEDEB327B88C502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706613355, "uuid": "57abb8e1-260e-4953-a024-53251d9a0633", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706613355, "uuid": "95845601-37ab-4dea-9818-a19d369f37db", "value": "49152:f8wxQikZ+9YXg9mVICuNWuSdrfnDkJp6QBnCNdKxUHgIJzU82am0CVVsTeZ4yTeO:wi++qX8iuivYw7Kx0tJI7dKeZICil1jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706613355, "uuid": "8e111eb7-5fcf-42dc-b01f-6d1fe293a722", "value": 3427988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706613355, "uuid": "4ceb9526-af4e-4321-aafd-560dec5acddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706613355, "uuid": "5bb6e34e-0a07-4983-9a9e-2033cce32230", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d0d994-bfa0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1706640687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706640687, "uuid": "ad3f5b3d-acb5-48db-b8cf-b0aaa141015d", "comment": "Malware payload (Stop)", "value": "defd2b4b32a95284081f3fd648e78f2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706640687, "uuid": "b619d3b7-df29-486e-bde0-401330d7e67a", "comment": "Malware payload (Stop)", "value": "235af59d3bc2171c77c0dabcb5add1ef12de8980cf1e700277288982e81eb47c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706640687, "uuid": "4d8833e0-c06a-453b-96a8-1d6a08a10978", "comment": "Malware payload (Stop)", "value": "8de4263395950ceab672677754e42df7391dcd9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706640687, "uuid": "8dd6edd8-d711-415e-a84e-296fd24432b3", "comment": "Malware payload (Stop)", "value": "e172744f89b30acde1428ec8e5b1cbce51e0a26b0d53ee922dc365b082b370f4ff3d9717457039be7f2686061871dfa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706640687, "uuid": "cc223338-9430-4ce2-b8ab-d038995a4fb0", "value": "T1F5E412713DF1D132EAE759775EB5C9A1ED3B7CA7FA78818B2708665B0EA02C08614343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706640687, "uuid": "bee5ca15-9248-40f6-8651-bd745168d3da", "value": "1a1df0030011d2d77bc5a076b2696337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706640687, "uuid": "729c4b73-f91d-4121-a8a9-018dbcfa4cea", "value": "12288:+UGLJPiTT5yPOr8Rw5PZt2FQeKUVQTeGejsPeqOVLYBxovNO6RXcKZ8th:+3PiTT8P4PZoVK6djsPeqOvNOgah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706640687, "uuid": "e296c934-e768-46e9-9065-ddbe5fa1ae59", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706640687, "uuid": "bd834789-f3ae-414e-8d59-1546e9317030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706640687, "uuid": "ae18fa37-c762-47ff-9ae9-0214eb031e03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c492493a-bfc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706657521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657521, "uuid": "a87048da-bfa9-4879-a75b-77fee2ca793d", "comment": "Malware payload (Mirai)", "value": "646ad436bf0bd83926123c1c4a3bacba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657521, "uuid": "0cb0d527-785a-4914-baee-0ab429262206", "comment": "Malware payload (Mirai)", "value": "24708d1ac75d86b74cb57e6223bfda806b66295d3c7f585758ff53bd6b7cd8ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657521, "uuid": "ad3b2edd-f6f5-4bd3-a218-d44523c719ae", "comment": "Malware payload (Mirai)", "value": "a12b954cf88319554dfc4f0481001e98725f3e17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657521, "uuid": "3e3f5da8-9b4e-4141-b6eb-7fdfcbb174c6", "comment": "Malware payload (Mirai)", "value": "a9775bad26edb2b35f00287b8bab2f662d7359eeba701b30f7f1d558fc1b92c36bf0faec502d0ed937b668655e46f441", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657521, "uuid": "0f364721-291a-4c0a-8840-86aa86195630", "value": "T17513F185B24EA931E7B41DF2C7540B02BC511CB4E58A33C410BB87DE7D57AA729B9CA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657521, "uuid": "1c4f73e4-336f-4bf2-a4eb-b41b4bf0409c", "value": "768:YD+zSerWGiNA+KtHkt+j0eaEx26+zs5nb1l7MbCJ4vdmocNR3UQew:YDOXzx+KtEu12xzMbP7B4F0jew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706657521, "uuid": "9f508986-7536-4eea-bfc7-c29b208477af", "value": 41804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706657521, "uuid": "ce220213-c4d5-4b78-a102-ac0737c83f86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657521, "uuid": "9b1b9679-8ad2-4618-93af-bd81d896c4c2", "value": "646ad436bf0bd83926123c1c4a3bacba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f038a9-bf23-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706586903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586903, "uuid": "e99218d7-b822-47e7-bcb0-fc503620115b", "comment": "Malware payload (RiseProStealer)", "value": "1e1938fe44c8cbbea2ac2a19839d6d97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586903, "uuid": "f3640811-b8aa-4ad5-b627-8ae606c16f91", "comment": "Malware payload (RiseProStealer)", "value": "25a45d1d37301ba257800b8a9dd504e2233a5f48a67b3622dad67d0a23fd70ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586903, "uuid": "3b8185f8-5b21-44c4-b469-a42976d69589", "comment": "Malware payload (RiseProStealer)", "value": "d2ba1c4538555adecf0a1c8238a97b02a21c3017", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586903, "uuid": "f31aade6-ee13-4795-a6ae-57e0d35dfc2c", "comment": "Malware payload (RiseProStealer)", "value": "dddeb64dfe587e958d644d16050475ecdad119a95f162196a7d57ac6eb8fee1962deb6aa352744491ecff435c7dc4cae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586903, "uuid": "4ce6817e-fb98-4a40-9312-2eb3bc2a5dfd", "value": "T17B558D71B652C075D19203F1316E6FE042ACBA3257A188CBB7C06E399A711E3757AF27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586903, "uuid": "15c0b27e-c748-4dab-8182-446f48e1ffd2", "value": "30e61d50d6efffd7759aa76925b3b42f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586903, "uuid": "987ac3ab-2c52-46bd-a66e-0fbd6508a25d", "value": "24576:96j6XB1RSG6qbKP2pdLwAhoZOe4F9LjKCTqCtZRtFTFfdB:3XRSGRjWOr9LGCTbZjNFfdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706586903, "uuid": "4014d207-2683-484b-ba34-4e7907077bec", "value": 1306624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706586903, "uuid": "a3ffcb24-024d-4e92-8ce8-aa4bcea8f865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586903, "uuid": "f93c43e4-c596-47bd-a3de-0d22b2ee68b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343d568f-bf82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1706627643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706627643, "uuid": "c72e5a50-8a34-4c32-a7d6-f7e2deea381b", "comment": "Malware payload (BlankGrabber)", "value": "2f3b5b60129dc43350bc54e67d59a4ac", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706627643, "uuid": "3efb50ea-bf4c-4dbc-9268-031d57c8f3fa", "comment": "Malware payload (BlankGrabber)", "value": "268934cf9ac4371ad4e8afdc7e354cce287e9f2ce019df0797cc354b3a2efca0", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706627643, "uuid": "97b5e6df-2945-4078-8c66-641630c4a7b7", "comment": "Malware payload (BlankGrabber)", "value": "08cdc5d4d0628c619897bf465f279f7d30d42b9f", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706627643, "uuid": "a6a843bb-f66a-4f04-b610-ba6e456bb43a", "comment": "Malware payload (BlankGrabber)", "value": "63afaec377aa499bcb2a4bbf2410dbfae2f16413b9b4c4b5c44707710f2d6ad15287c8b5da0b08b94838ac6050d6d9a3", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706627643, "uuid": "1be0fc25-eacf-4a4f-8d1d-03c94fc2ad1d", "value": "T1DEC6F11437F84E27E1BBE27795B0441667F1FC1AB363E74B219167BA1C53B809802BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706627643, "uuid": "c823764b-513a-4d08-944d-17785f3f1eec", "value": "9222d372923baed7aa9dfa28449a94ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706627643, "uuid": "b7dd612e-d68a-4b3d-a2eb-f44510e87141", "value": "196608:+XeSEzpCQdLjv+bhqNVoB8Ck5c7GpNlpq41J2mrl0bk9qtlDfJpNZYXz:q4PL+9qz88Ck+7q3p91JNRqfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706627643, "uuid": "ed98801e-234a-499a-bc8d-d78be3ecdf76", "value": 11955200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706627643, "uuid": "08c76477-6ea9-4bb1-800c-03397d943e3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706627643, "uuid": "fd24a24c-7656-40cd-907d-029bd32525fd", "value": "iostream.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290b9b52-bf43-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706600566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706600566, "uuid": "829176fc-2429-4b26-90ca-092fd63472a8", "comment": "Malware payload (AgentTesla)", "value": "0645eb9460ec8b21c95d1638794ef18f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706600566, "uuid": "61ad663e-4bd0-4d69-8abf-1fd6a22f2cac", "comment": "Malware payload (AgentTesla)", "value": "272349c00a74ffbd27f087a5dbbbcfbb3f4e00f0597c5bdb11eacd44032edbe6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706600566, "uuid": "55fda8e6-7424-45a8-a61a-347f5b7c57b0", "comment": "Malware payload (AgentTesla)", "value": "c47b47704e9f53ceb1574b328e15851a2566d167", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706600566, "uuid": "d36ad9af-0442-45fc-9397-b72966412b87", "comment": "Malware payload (AgentTesla)", "value": "2af4fd2c1a13761b7eb8f0d274c8c78f4da6f998f6580d6d36f7ce06a0c996fcb1920b5dbbb39a34e1578ec9f5b7d946", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706600566, "uuid": "60dc2715-7509-421c-852d-f78386f7490f", "value": "T17B951233ABF9AE12C13D6978A15325945BF0DC410036EB1B2CE420F926FAEC79F65617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706600566, "uuid": "564c7402-1e3c-4356-b1ed-c1ced957a742", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706600566, "uuid": "64b4b688-75e9-4069-8dbe-5c66acfa45d5", "value": "49152:sTC/bc/tENtpdl3aZhN/7MiEbN9c45BkI8ldM0W9:sTC/bc/iNJl3yhJ7Mx/n5BkLRW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706600566, "uuid": "f089024d-f70b-4998-bfee-d38b038989ac", "value": 2003456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706600566, "uuid": "b5289ae1-b158-4f4c-a7c1-3549e5319d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706600566, "uuid": "013ac648-ed84-486e-a060-6208bcfaf8d6", "value": "0645eb9460ec8b21c95d1638794ef18f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c9b9f6-bf50-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1706606379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606379, "uuid": "18377aec-8a56-43c2-8c81-f984e34326f4", "comment": "Malware payload (XWorm)", "value": "8c333750f374d0646a89c480558327f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606379, "uuid": "ae879bf8-1df0-4405-8040-9c56a8f64902", "comment": "Malware payload (XWorm)", "value": "288e02107f94a8366d263d7cf093fc84788156640c0110d9d930c3c7a91fab03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606379, "uuid": "19f50ece-5f03-419d-a735-cd4a8a87e854", "comment": "Malware payload (XWorm)", "value": "bc471663b6c738c459338ca02c70508262e5ad9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606379, "uuid": "f08fb7ba-599c-4977-87b2-87540cc947e0", "comment": "Malware payload (XWorm)", "value": "dec3e7e63dc110c4405a51e61716eedf520f75da61f20ab5f75ed9384e55e1e8526c302385c23c2789663ffc76d4fcf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706606379, "uuid": "a3ffccbb-63b5-48f5-a11f-1b7a007c4241", "value": "T18725AD02B3D6D036FFAB92739B65B2055ABD7D290123852F13982EB9BD701B1173D263", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706606379, "uuid": "541a8902-93ca-4050-a2e6-77247fd8fd39", "value": "24576:iAHnh+eWsN3skA4RV1Hom2KXMmHacJZ0XRSxG5:lh+ZkldoPK8YacT07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706606379, "uuid": "6a236f82-e5ad-435e-b4c8-9da34a71a41f", "value": 1041408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706606379, "uuid": "f0af649b-b1cd-4330-bbaf-164f67c5e23d", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706606379, "uuid": "1e98a307-ffe7-4911-b056-a7b11791297a", "value": "PO NO 01 031723 24.tar.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c322a2-bf47-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706602218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706602218, "uuid": "65acd0cb-ee47-4332-b59b-487eccabf7ac", "comment": "Malware payload (njrat)", "value": "1b0409ed5d8995032240e7508a2a8fb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706602218, "uuid": "a838d1ac-de41-41ee-9fd8-f43a8dcfe304", "comment": "Malware payload (njrat)", "value": "2a2d8cf74f42c24af23e437956dbd4744d898fbba0f286e77057dc204c2f93fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706602218, "uuid": "214a62c3-6640-402e-a6f7-fcfb29e52518", "comment": "Malware payload (njrat)", "value": "ffa484b0585254da619e6e0a35f97acca765bf22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706602218, "uuid": "8be5c665-e2c9-46c1-8684-0b9162ef88ac", "comment": "Malware payload (njrat)", "value": "2383378925208efc6ade3aae4d4f06f2e855cfae87dad6d839f563c4e058bf0508cf4fbc5e85d3257766d1e323c0768e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706602218, "uuid": "31b6fcc4-8446-4e39-8c6a-890ed553d4a0", "value": "T1CE033B4D7FE18168C9FD057B06B2D41207BAE04B6E23D91E8EE5649A37636C18F50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706602218, "uuid": "88fdb6ae-183e-46db-897c-51e990b103a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706602218, "uuid": "3909fa8e-e948-4549-ac2d-ad6f89dc3198", "value": "384:cMWyi0anCVpd3vVmyhKrlbjmgvOcsVQvhrAF+rMRTyN/0L+EcoinblneHQM3epzZ:7eANVdhKrBjmzfVQZrM+rMRa8NugitN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706602218, "uuid": "edaafdc8-ddd9-42f0-9cf1-27dd5e5d8864", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706602218, "uuid": "fee3ee82-f852-4261-8bfe-f7079d49aa28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706602218, "uuid": "e5d714b0-d060-4e23-8eb0-c5acd56586fc", "value": "1b0409ed5d8995032240e7508a2a8fb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519ce8ca-bfa1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706641007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641007, "uuid": "a29929ae-2e85-4043-94d0-e79ba6a150a8", "comment": "Malware payload", "value": "e320a03e4df01230ddd097fa1b0642e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641007, "uuid": "feea8354-5e20-4815-8080-af01813918cc", "comment": "Malware payload", "value": "2c9283e699f8d5c2b08eb5e2727ce5ec0b4bfe83a4b13a92dc0e416cc6ed18ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641007, "uuid": "e2e75876-f6fa-453b-a949-a51c78da635f", "comment": "Malware payload", "value": "1c595ef6d035b18073f67f04d585c275a22adcc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641007, "uuid": "6360ec34-a076-452a-84d1-52a629820641", "comment": "Malware payload", "value": "ed83f6fa1517a7e7ff0d9b0d4e4e27728554544a64f1fd797a444461a6cd1ba82bd33728a9c361f389ad89d976260284", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641007, "uuid": "4d6cf06b-6548-4441-b185-e8dcb90ce0a8", "value": "T126942304736571F6FAE606F51CA08294FB107E34D3617EAE94E2F32C47227D92A4C6B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641007, "uuid": "2c1ee3a3-e0ba-47f3-8668-de02d42ab251", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641007, "uuid": "c8ae097c-ec25-4d4c-8c6d-64fa724827cb", "value": "12288:O0nUp3d1sUa2SNptg+nwb1jfGf2wmKuR+ep9r:puNcQzFef2whMp9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706641007, "uuid": "72a2a3a6-7170-4a2c-9240-937375157885", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706641007, "uuid": "0cf82996-294a-4ade-aeec-9a98d362297a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641007, "uuid": "6840af97-1de1-4f01-971c-24098e8b4e1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58e22ba-bfbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706653684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653684, "uuid": "bcda33e8-c3fa-49ec-a08a-8aa96dff04e3", "comment": "Malware payload", "value": "f9e2ee0ff3bbbae02f85bd47f7efa9a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653684, "uuid": "78a2e027-e11e-45eb-9d99-42e505e67fb1", "comment": "Malware payload", "value": "2dcc4a03e333f16159e8a348ee88211f7bddc762e2c70200ecf8ad7166a257de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653684, "uuid": "4728c281-ceb2-4db8-9178-2494e56291b0", "comment": "Malware payload", "value": "4101e31bd5709de9711f1b221b38e2a92c5f98ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653684, "uuid": "7401807b-9e54-4448-9342-ce1d0e9c0b20", "comment": "Malware payload", "value": "e629666a3e519d5845f23659580f62f595643265a648fddc05361193322b72f02b78f97f8ab1c61b97da09e2acdef543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653684, "uuid": "3bf86b30-4884-43f3-a2db-c4dc55df9edf", "value": "T10C1733F81945E6F2E05C123318BAF955CACA0BD17457A839CD0663ADFEF4B26C66F420", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653684, "uuid": "db1b0829-bcad-42d0-b6f5-83c07dc2bd00", "value": "5318cd03ef5b5da86800f1483484cfd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653684, "uuid": "fda4e087-e599-47f2-8691-16b2c0cacfd8", "value": "393216:9aQAfQT00m7HnVwqiNX72fGg2y/lFIMsbFGeXjdLgzqHydr:9a9fQkLPiNX77zy/RsboIczqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706653684, "uuid": "cb70f874-817b-417c-8275-dfa475bffda9", "value": 18980761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706653684, "uuid": "d4f2969a-d633-43b9-9aac-68afe3e9ae6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653684, "uuid": "b1c5a2f8-07c1-471c-87cd-4bd7300268f9", "value": "SecuriteInfo.com.Adware.DealPly.1906.1397.8248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f05573-bf23-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1706586899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586899, "uuid": "c4e89231-2364-4fad-8329-763c755e505b", "comment": "Malware payload (PureLogStealer)", "value": "b370662ce4e04c96a0b2993c3099ca2f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586899, "uuid": "5d32db45-b502-4505-a253-835cd5ae4b31", "comment": "Malware payload (PureLogStealer)", "value": "2e394ed29ce2cbedb354a174ab2ecf877ae0b2154cb4e9e8160d4af29aff82a5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586899, "uuid": "a14bd1ab-c9f0-4672-a9b0-9e49ea7fb55f", "comment": "Malware payload (PureLogStealer)", "value": "cd3c7fc4ed0555047ad8b150ddf81d9763ea1fe5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586899, "uuid": "10d5b8c9-5c1a-4e55-a5c5-b5c80476d72a", "comment": "Malware payload (PureLogStealer)", "value": "3db5cedcf86902cae689bb227a27037a911512111ef1fa222f10be20d508b03711b572babd30fd2e490afd8840154853", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586899, "uuid": "6f3aed0e-ae00-40f3-8384-5249679319c8", "value": "T1DA83E717BA5789B2C2845B3AC68B9F0003A4D781F7A3D70EB98E235E05437FADC5564B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586899, "uuid": "712dcd95-4e3c-4aad-958f-a830f1ace95f", "value": "1536:n14aJu0MF9srUSxzQzEseRVagB3HTQU47luYc8E6qAUwPIWCCW9bFJ4xW9B51J85:14aIZkUKLVagpkxeuIWjWZFJ4xW9B51c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706586899, "uuid": "daa1e631-e928-44f8-b4cb-aaf789b76d98", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706586899, "uuid": "55f708db-49ad-4acf-aa17-82f629762dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586899, "uuid": "06a895c3-c4e4-402d-b550-6901ac443f25", "value": "b370662ce4e04c96a0b2993c3099ca2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1183380-bf8b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1706631691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706631691, "uuid": "87622a31-8219-4466-8d37-2594d75bd613", "comment": "Malware payload (Socks5Systemz)", "value": "e6c564f02694e6df448ac5656de9dc10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706631691, "uuid": "02dca40d-fd48-4aeb-b543-dc3885e4a6b1", "comment": "Malware payload (Socks5Systemz)", "value": "2e80e2c8019df0690a20a1d73e71078778c49955f4b67378dec98e6ac30c894b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706631691, "uuid": "ad05b22e-bd70-43f3-9c06-88d52517fda9", "comment": "Malware payload (Socks5Systemz)", "value": "a4b65411b93d73b328681dfb350278926280d002", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706631691, "uuid": "24097db8-175f-4888-a548-66d86dd1fd09", "comment": "Malware payload (Socks5Systemz)", "value": "1bb720176fbb041deb3858d33c3c830ec57a0bb67b990d63c586811a8fba1544dcd3737c94fef8837d737cb46dd0621e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706631691, "uuid": "2c17affa-5c1e-4150-bbf1-d06fa759d31e", "value": "T1D35633628009C871D1EFCDF59B29AFD8FD7779C73E08A4A231BA844B0E216B5325D1E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706631691, "uuid": "3f47b721-e85f-4eac-958a-29fd6fe05a20", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706631691, "uuid": "f7de4736-58fe-4926-af36-c8908a255b02", "value": "98304:NI+OawNj08zeHZaMycJaMOtpBYSzrgrjD0/T2UHB+/37RBZArXXmOo4PXbBmEH1f:6+OV6sVMylH70o2BDRBZkCEcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706631691, "uuid": "2764f0f5-6bf8-4579-8475-c5c002ba125d", "value": 6426514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706631691, "uuid": "550b3f9a-ef70-4d4a-973d-975fe78fa87c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706631691, "uuid": "d641c8b7-81f7-4d40-af54-72c4eed17afe", "value": "e6c564f02694e6df448ac5656de9dc10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e35c1d-bfa2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1706641578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641578, "uuid": "54da958c-0c0d-44c3-afa0-693edafa2615", "comment": "Malware payload (QuasarRAT)", "value": "7d4dc99b0ad90aecfc3278686361f1c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641578, "uuid": "9370cb31-3051-43b7-939b-3e11a20d8db3", "comment": "Malware payload (QuasarRAT)", "value": "2ef3ecd1fa1f4f0bf04bf2b98727fc2b7e36bce45b799a30b38e57c7b89ae824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641578, "uuid": "c2450287-0e4a-49b9-92cf-d8ab7df1b849", "comment": "Malware payload (QuasarRAT)", "value": "8cf1664b173fb64dc6a30099617051240842d2a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641578, "uuid": "1bd0d34e-fc26-4b57-b070-755d9b6cb4bf", "comment": "Malware payload (QuasarRAT)", "value": "a970ece0d4b546dbe1bd7e223809edcf1d2e1a3934ee8e2c115fffb41bd3832f0f563a0530fcb4f1a41bb8dc298b0623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641578, "uuid": "7ea3bd8f-14c6-4666-8169-c6fec794fa49", "value": "T11417333951D2466FE23228BA603360106FA3DD3BCC4ABDF25F7375DE7972B088995918", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641578, "uuid": "16f35df3-24d6-4ab4-bd45-2becbc7a8971", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641578, "uuid": "681e15d3-84ce-4ceb-8604-a3256173a18a", "value": "393216:Mj9DRMExSPyw25oTodMI2a8mkglaB0Uk7g5x0Y5tFmAy40FG0lOOMO:Mxq3PZbMdM7mkgiywR5tovi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706641578, "uuid": "c80dcc91-0b59-422a-bfb2-1d887c8cf39c", "value": 18940928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706641578, "uuid": "34970ba5-053c-4ea4-b54f-26492fb89eee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641578, "uuid": "b39d2216-7425-437b-b49c-0e1332d749f6", "value": "Booking_5527_10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9871403-bf49-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706603412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603412, "uuid": "6307e2d7-f2bf-43be-8dea-10a5a015e284", "comment": "Malware payload", "value": "ff15612cd83a8e752b976d45519d360f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603412, "uuid": "ad7e3bba-514b-4e5f-9227-cc1db670558d", "comment": "Malware payload", "value": "2f00745eda6f2d173789c0b948714c5318d676e2eb7b42bed99de71e0edf397e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603412, "uuid": "3c60cfc1-5883-4e74-bb54-ffe448d86d5d", "comment": "Malware payload", "value": "0bbaba59f15d99f96d69d024dc53445ce56cf2c5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603412, "uuid": "16d9aa37-76d0-48fa-93b6-d31fe5e1d488", "comment": "Malware payload", "value": "bce99fffa45c26133e410d19131cfd25ca0d86bc8461c48940506bef03db61272fb48c0b525fc3bf97a210fd3fe5a037", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603412, "uuid": "b7e00b65-7d35-4d93-ba3b-8ee1033f58a0", "value": "T182C423C4F27E2370D4068D7657B9968FDA011149625E6F0FC3AAE38C606731A2FB7762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603412, "uuid": "35d4cea8-add7-439b-97a8-897696f8ebf6", "value": "12b754670ab03329a68f8c990b5150dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603412, "uuid": "4fdc66bd-27ab-4aae-8821-8708907598e0", "value": "12288:kJ2qBYc0sAtLpyyVUtOiHMWsrN+QZisJG/HqGI3o3ToQkHmTrVlOa:c2qBYchAtlyyOtZQZj6tkdH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706603412, "uuid": "5b4be7f9-3608-4953-98b3-710400201de4", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706603412, "uuid": "29f158ce-3cb0-46c3-9864-80dcf33eb5fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603412, "uuid": "d90e6030-0cb7-4418-bf66-50de38ba10c1", "value": "SecuriteInfo.com.W32.VMProtBad.A.tr.770.13798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43f0905-bfbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706653601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653601, "uuid": "2a2460c2-f7de-4cb5-aa04-e94fb8386b97", "comment": "Malware payload (AgentTesla)", "value": "da7f9653755cb1f6bc22984cfc3a37d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653601, "uuid": "2a5c6f9d-0800-43ad-8f8e-11f0654bf04f", "comment": "Malware payload (AgentTesla)", "value": "304f5f10e6586f04beecd03dd27c217893c449cc7a3addb3816e4befb2bff590", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653601, "uuid": "b56f7ef1-4669-4caa-91a9-855ef9ed9db2", "comment": "Malware payload (AgentTesla)", "value": "d443f871dda06ee8c0c242626967705f77abebe1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653601, "uuid": "fb0c5d9c-2b55-4d0d-b3c2-d7e631b251ee", "comment": "Malware payload (AgentTesla)", "value": "ef3268ab9de248f1df55defef4ac5e3bc845e9f9fa4ca4d13e962902b27f10ca8151b0b4b93bc9c57a5ee77f21aa8ae1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653601, "uuid": "e307c55d-3f66-4a2c-8ff5-a6c658a7ebff", "value": "T178E4224C6AC6EB15E5FD8BF8A9BA101417B1A12F5814D79C4E0622D94F72742CE32FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653601, "uuid": "7fd75459-20e6-412c-87a4-9256ab2411c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653601, "uuid": "a8f61172-63e7-4dba-a392-ecb7f5335334", "value": "12288:5XCAYQ4y0R76bYsiAegyCDfcnhiBxInNB/KIzfLQOOw9iCjAloLVF:0AL0UMXKfWh8mNYIDLFNmAVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706653601, "uuid": "82416cd4-9c95-4926-881c-71f5362bb155", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706653601, "uuid": "3c6b1343-d3f0-4712-a167-a415c3701ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653601, "uuid": "7ede194e-c6f3-4fac-beca-c54bd4f45e24", "value": "obizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f8ea3f-bf73-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706621204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621204, "uuid": "b4045834-ef39-4729-af78-6be65cb06744", "comment": "Malware payload (RemcosRAT)", "value": "3cbe6627d771102db3b2ab06cbf6d940", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621204, "uuid": "aa86116a-a827-412f-abc6-f20c117704fd", "comment": "Malware payload (RemcosRAT)", "value": "308d44c8ce98023c0712fe824c49b0d7b82aa6af0fe5e25b78b6b0d3d0635453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621204, "uuid": "c90a1333-baa0-4a82-a2c7-d3a223b1faff", "comment": "Malware payload (RemcosRAT)", "value": "bb546caaa3b089c06cd5ab1ba9b30c35314a32f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621204, "uuid": "1739cd8c-bb3d-41e6-9666-5ce152aa73b0", "comment": "Malware payload (RemcosRAT)", "value": "c22a67b495de16388f0ba49b8042b811e80d5792a78b7fd955b6e3f7347aaa55df7fdc0c8acdc10c65a377c6600f206d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621204, "uuid": "1e1a5fac-675a-4f4f-a1d2-d2495b15d71d", "value": "T1ECF412E5E68E43A7D7D52939FEA535E40AF4F61138C39F2E60A8123F06B37064D1A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621204, "uuid": "735ac4a2-b0bc-4f3f-9f2a-0a5bd7215620", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621204, "uuid": "fb91f16a-f945-4fe0-8207-7f306f1a194b", "value": "12288:Gr0+mHhd9kPZvsWMZzOAA1/mGGYwbbvBJ/Bce0nskIISDlLIkn3RqFFFFFFx+zho:Gr0+mHhd9kPZEWpAWk/Ce0rSY+zh1Itf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706621204, "uuid": "f8038fb9-5752-4d8a-8ae2-4393816efd14", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706621204, "uuid": "236117f2-c1da-409d-9cbc-fef58792e594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621204, "uuid": "4fa80c3a-6427-43b7-8518-c657deb95127", "value": "plugzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696c8d80-bf71-11ee-b7ea-42010a9c0006", "comment": "Malware payload (MarsStealer)", "timestamp": 1706620431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706620431, "uuid": "9e352752-ae6b-4c92-b108-04ef5fb3c1c7", "comment": "Malware payload (MarsStealer)", "value": "28906cf06bd61ebd211c114191a51f3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706620431, "uuid": "2a515a79-15f2-4ce9-988f-14dd93adcbb8", "comment": "Malware payload (MarsStealer)", "value": "333af1642135bfde7828473e429ce00db22f364b8c285bd0167136474cce6255", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706620431, "uuid": "b05c0a26-9b2d-4870-bff0-d606e1101c85", "comment": "Malware payload (MarsStealer)", "value": "78b9b903d34ab5efb298c6ca5c47d001951ee5c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706620431, "uuid": "319777d7-9695-4cff-a0d4-3327b1ee491c", "comment": "Malware payload (MarsStealer)", "value": "f98f2f2c066b88082df9dbdc80a018318405fa1973cd96bd4739c77f21c74f1b222c1a60cf607f2b008bc01c4dc4c1e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706620431, "uuid": "3848510a-0d3b-4f6b-8d6c-30b161b27070", "value": "T1AD36A595960F6F03F8D9B0BCD750C6CB0E420EF1898B81AF69A49F82C7562D71D89F64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706620431, "uuid": "68c5fa6e-b5ef-4a21-ac14-c3e7a41a163d", "value": "051822fb16fd0094e3c2c7657a6a07c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706620431, "uuid": "08bf555d-8729-4dec-808e-59abc41801c9", "value": "6144:jL2C/xRgPE33x7tcPlUbi7lK4kZ/0a3oS1TP4g1f:jL2KxRgPEHx7tcvkZ739y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706620431, "uuid": "2ec3c1e0-d47a-4c33-be62-d8e9d4e2e86e", "value": 5230592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706620431, "uuid": "4434ea9b-e430-4f96-b21d-30d5964130b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706620431, "uuid": "40f49048-2a45-4b32-af80-fc1396b889f8", "value": "28906cf06bd61ebd211c114191a51f3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "545461ac-bfa0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706640582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706640582, "uuid": "0b968617-b3fb-4f29-9196-010f4004a19a", "comment": "Malware payload (LummaStealer)", "value": "95f7571f8421dd0d1e9ae183df6f0b3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706640582, "uuid": "7d37a588-3361-4516-aeaa-69a02b025305", "comment": "Malware payload (LummaStealer)", "value": "334723749423829b3bec1b3d29bd20f6e6c086042223c1838f30ab4544636019", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706640582, "uuid": "8c8664ba-7c8a-4c1e-ae07-e49171edbb26", "comment": "Malware payload (LummaStealer)", "value": "13763645e2ebdecbeb0088a63ff1ec81852e54f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706640582, "uuid": "50e17b80-59ea-4dfe-86e3-fb7f5592d868", "comment": "Malware payload (LummaStealer)", "value": "1287cc66d6091234b1af604d2224b394b5c84c3cefce78dd356da254cad8eb3be9a09d1868acebd5e3f439f7b1521f10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706640582, "uuid": "09c710e5-931c-4bd5-aa6d-be0061e2c63d", "value": "T185E47C6B8638C463EEFBECB5ED6491D6A42740B2195CC08D36CD0D4DBA32E265E9D01F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706640582, "uuid": "fe7d336b-8f98-4c4c-8832-c2e68ace356f", "value": "2b7b16ea6305513a3787fed6f5a40b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706640582, "uuid": "28e37c1f-dde6-4559-9f23-67340a9e8162", "value": "12288:EQZ44xp9+KR+G6p9wKvIAHDhCwQipnjYcUAwAQKufD6t+TfRmyx:NZLT+R5LDYYbQr80mQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706640582, "uuid": "8dc59ba8-a16b-4e4d-a3c9-dff6ac3b8be1", "value": 680601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706640582, "uuid": "549f52a6-b710-4273-a73d-8dd7c8e03bcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706640582, "uuid": "ed942597-6e4a-47ac-ae3b-759cf8b0d8a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6042ea-bf22-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706586350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586350, "uuid": "5dcbbf6f-b819-4f19-a743-9a88ff276f8d", "comment": "Malware payload (RiseProStealer)", "value": "394053225ce68ffda0130ac44b5dd267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586350, "uuid": "18231ea8-4ace-40ff-b702-15c85ebc75b1", "comment": "Malware payload (RiseProStealer)", "value": "33ff064aa88074215128f29b64291eb475fbd49f9eaa915ead4f56dc4501d37a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586350, "uuid": "954c34f5-2071-4e0b-8652-cce8211a0f02", "comment": "Malware payload (RiseProStealer)", "value": "d28c4eb5a5549ee167202632b76d668a481439b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586350, "uuid": "3663566c-f281-43ab-866b-f7b5c89f39ad", "comment": "Malware payload (RiseProStealer)", "value": "31564ad10fd40ce091f31a484fb0926042aa7c767ad82e01265ec0e49f2bd1241c5f2fb24817baf5108eec7af6533ec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586350, "uuid": "477b9936-40ea-432d-9010-3d1e87505a97", "value": "T1E8159E0273D1C062FF9B92334B5AF6515BBC69260123E62F13A81D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586350, "uuid": "898c5268-704b-48c3-96a7-4dadf0822d55", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586350, "uuid": "6399b9eb-94d4-4611-942f-2678c6f4514a", "value": "12288:KqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaE7b:KqDEvCTbMWu7rQYlBQcBiT6rprG8aMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706586350, "uuid": "a307bcc6-b899-4131-a1d5-96ee6a873a11", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706586350, "uuid": "9731c633-2eec-4aaf-ac5e-5cf1f389fa84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586350, "uuid": "948ae53e-0e50-4aac-8f27-f3f20efae473", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de69302e-bfa2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1706641673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641673, "uuid": "c4ddab3f-9d05-4bd9-8a40-279a93dd7f87", "comment": "Malware payload (ArkeiStealer)", "value": "b8289d5a1008a2df190dbc0645473bc2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641673, "uuid": "07fae23b-a75c-4ccf-8101-253299837bf3", "comment": "Malware payload (ArkeiStealer)", "value": "340937ee90623de189051243e5f2e3a065b8a22d7ee8e36c0162506d15c0eccf", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641673, "uuid": "768347b5-15a9-476e-abd0-f9639d046fcb", "comment": "Malware payload (ArkeiStealer)", "value": "5d37893d6decce47e1682dabdd3776de1b6450a2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641673, "uuid": "e575db25-1791-4e0d-a95f-5702a5a8ed17", "comment": "Malware payload (ArkeiStealer)", "value": "e68b5d1caaf925ad14ba7c3dc821c956592816af1c80814a97a29326eacea025ef770d58bba53cd1daa98dd3be6f2004", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641673, "uuid": "d5c73ea2-c31a-43c3-b39b-45041d30dbdd", "value": "T1CDF633B13628FD5ACBDDB63A0F4A0C966B3090687115821908EF1E3B5AFEFB31451F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641673, "uuid": "647d3a81-60be-45b7-9de8-00f0b9301cae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641673, "uuid": "f860d1a3-1542-4c7d-9dae-72924a3b7b82", "value": "393216:l/1xVe9FPIZ6Z39PPmGhu2iD6bRs+RMfsFFdA:zwFPIZ29Ppu2iDMayRFPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706641673, "uuid": "c6d006f3-90df-4c48-aa98-e84b6ade743c", "value": 16665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706641673, "uuid": "3187d775-3895-46ae-b0fb-8dd893b116bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641673, "uuid": "a02b8fb7-9514-4102-a839-f5ff27be054e", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4379167-bf24-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706587458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587458, "uuid": "838e4136-3669-4ceb-993f-2b145dc0d0ae", "comment": "Malware payload (LummaStealer)", "value": "bf8e896716a528d67a5e80c7fbfb8f3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587458, "uuid": "e561d6a2-6efd-4f77-89cd-184144a9073c", "comment": "Malware payload (LummaStealer)", "value": "351bd931d0f189bd6bc2f10ea56d3530bb8a7806ef0836c2a855f4a0be432a23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587458, "uuid": "a8aa3d3a-7f54-413f-990e-8d5f8fec8251", "comment": "Malware payload (LummaStealer)", "value": "f3eca821a761ef34edd6f95b3b3373a0ebbcaa9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587458, "uuid": "059eb014-de01-4273-8c9c-ba54b92fa908", "comment": "Malware payload (LummaStealer)", "value": "b9e895a9987d83eb4bf547ae7db23a9bdddc12a88b3485fdadda2a99b6fe3fb070f7e587e7ac45dc46ffc994b809c929", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587458, "uuid": "566a652e-bb1b-4cff-aee3-25d265ee1472", "value": "T1335633185FAA044CE468E5348A02FB6CF5F90E994509DF1695746FD2BCBFF8298B90C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587458, "uuid": "5753e947-f0ad-43b6-b0d7-2ab92470581b", "value": "92e05c894e0e4c4ea34a22621a9789dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587458, "uuid": "03d80264-d471-4044-88f6-5883f9d5ddb5", "value": "98304:btoKOmW4C9KUZScUTB/jodqdaunoN9r/bShDqB54i6k6K1+:BROmWdKN9B/GqBElehDqBZbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706587458, "uuid": "01dea11a-ab8d-48d6-bdbe-faf302c054f6", "value": 5981272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706587458, "uuid": "0c08f665-7595-437f-bc18-f6767fef9883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587458, "uuid": "3f691371-abe7-49fc-9e2b-0a619ef4d602", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47357f3d-bf66-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706615649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615649, "uuid": "d5dfec38-1c94-44e1-a4ca-a2bd89d9114e", "comment": "Malware payload (RemcosRAT)", "value": "09ed61ac54ec9307db27fe3872bdb9b5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615649, "uuid": "21eb8259-e40d-445c-9698-29f4edb53937", "comment": "Malware payload (RemcosRAT)", "value": "37c8f5e19f127340ffd5813ab06d3e03d2bc73ae862ff0953f30c918fa561394", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615649, "uuid": "0b10b2e8-3c10-469b-8bb1-977cf9c93a78", "comment": "Malware payload (RemcosRAT)", "value": "378439d0e767cf0b917fc86c95330010b3dee038", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615649, "uuid": "e638cfc6-3ccc-4b44-be6a-b2d5f97131b3", "comment": "Malware payload (RemcosRAT)", "value": "bb06efc1ecf1b1d78c334b20fb8b205d75d915a6bf967ba55a1b1b60d5a25be865ff99bb0f55cf8c514afc6dae417734", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615649, "uuid": "225c8170-472d-46f2-8484-b8857cccda32", "value": "T19E634D2DD34B02598F620377AB571E5142BDBA6EF38552B1302C537933EAC3DA1262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615649, "uuid": "c6b1de6b-64f4-48c8-aa19-9f5460378c8b", "value": "768:hwAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjlTTukWvtZLQu5lI2KsK:hwAlRkwAlRkwAlRYe7vvLBdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706615649, "uuid": "25303d8c-92dc-456d-b47f-1145c4e167fa", "value": 70251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706615649, "uuid": "107e62de-e3e8-4366-8d2e-c39eb9404e95", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615649, "uuid": "2379cb4d-009e-4e4d-b883-a1bfbfcb4133", "value": "INQ # 8721.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8239f318-bf83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706628204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706628204, "uuid": "1bc4d180-be3d-4772-b1c7-cccb4efe1ffd", "comment": "Malware payload (LummaStealer)", "value": "372894142599e37c16b10e893cc0f0b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706628204, "uuid": "76c53514-2012-42bb-95b2-694e6a13fda7", "comment": "Malware payload (LummaStealer)", "value": "37e7d37868a9d4c17f153822fc7744c3e4e0617f6cae9697c778da18d0d91cd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706628204, "uuid": "2325b676-0a1d-4d45-b7f9-add0536bb500", "comment": "Malware payload (LummaStealer)", "value": "02f1ad2ed5836fd78d456df8e5dcaf275b65201c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706628204, "uuid": "af95e9fd-bc3c-407a-9471-d104c3581b53", "comment": "Malware payload (LummaStealer)", "value": "62354ea2137753bf83b13a92efb766363689eb32a02611fabc276ad0d668234baf5e81723ffa1263d610ce89463824da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706628204, "uuid": "bcf98137-2bcc-4b93-b688-63117f12bb2e", "value": "T1113512327C54C272F5BA2372CAFC7A7559ADE562033980D367D80466AE503E66B3C393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706628204, "uuid": "e1f026b5-c531-4f78-a59e-d09e43ea7a83", "value": "bf9634a06f63de6e7fa867afb3215189", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706628204, "uuid": "99338f41-9c93-4803-ac4c-3a5104a5137b", "value": "24576:IDuW4f8EQOL58mV7Th8Kp4nD54E0JNS39Egj7C:IDuW4tV8sy04D5R0JNS39Eg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706628204, "uuid": "cb492e83-920c-4e16-b59a-0872d8ee88b7", "value": 1162418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706628204, "uuid": "692382e4-621f-426c-8f22-44f31ff92cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706628204, "uuid": "8cb3fc8b-1180-49c2-b868-8338560c90c4", "value": "SecuriteInfo.com.Win32.Malware-gen.1638.31612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d31985-bfbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706653688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653688, "uuid": "f9235985-c91b-42fd-9938-de69c8249a69", "comment": "Malware payload", "value": "88a277bbba1ac0ed88ce7e8df73614ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653688, "uuid": "15478363-7132-4d13-95ec-b37d90fc8cba", "comment": "Malware payload", "value": "38346750e747a0a5fda8596aa4517bdd91790851a2f8b96a01028f68fdc0bf55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653688, "uuid": "3577e6cb-857f-4787-a496-bbf0a8c72efc", "comment": "Malware payload", "value": "58c8ecfd6a97168ab0d9c8291ef7bcf7244c0154", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653688, "uuid": "1cc810cc-bcc9-458a-89fa-f82b11a2052f", "comment": "Malware payload", "value": "44a80a7aed1a13e0b2fc74831ee1a81a8589687c7f0d5fe07883d1a29da158b54dbf79bb6cc096d12184bb8263e757f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653688, "uuid": "62140c03-27ef-4e55-a445-6ae727e400c7", "value": "T18B56236723660186D5EDC836963BBED0B1F51B7D4B42A87C55862EC227368E0F313E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653688, "uuid": "ef1e9d39-e9c0-439d-9de8-422623423e28", "value": "8f305c59c9f6db5cbb2023bf8b77cb23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653688, "uuid": "8089a8d4-b783-417e-83f2-f22e3002b50e", "value": "98304:CUOUOkO2EBUUyFw0vXRuoqZKKIP+qyLSPoRQuCKcwuAFUbHInISJTjN:CUOUOWEBCFw0vRuoqEvP3ymPMRcwXn1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706653688, "uuid": "9d98c4f5-67ce-48be-b7b3-16e741279eb7", "value": 6172672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706653688, "uuid": "4396e257-efdd-4ea6-b2fd-2353c43650bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653688, "uuid": "b96a6125-399a-40cb-a735-8e5a12827c5e", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.20109.4259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd2305b-bf76-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1706622643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706622643, "uuid": "c7348539-844a-434c-ba98-30c43a955320", "comment": "Malware payload (Socks5Systemz)", "value": "02d4157cb603d38a8f78c9aab6fcedd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706622643, "uuid": "aba4faf5-f6f6-4feb-b406-d1c159a36d18", "comment": "Malware payload (Socks5Systemz)", "value": "394e0d9539926c7a13e02139746e519868c5b1c91cf75df3fa83f0df182559a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706622643, "uuid": "3c63db90-88cf-4a64-a60e-5473c6d134ab", "comment": "Malware payload (Socks5Systemz)", "value": "99f2ccb70a6290f5be5fb6ba521232626bcb8446", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706622643, "uuid": "f13bd7e7-c5ee-4b01-bea6-1bba84416570", "comment": "Malware payload (Socks5Systemz)", "value": "fe0009ae4c8080f4d3ee733e6e2c73ab53972906df74aced06e56029c71eb6b5075f8ddcbceae84dc4f5820210c6b58f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706622643, "uuid": "7c2f4664-cc87-4da3-a7b8-1b276bbc8140", "value": "T121663372B360D6F1E872B27DDB60093486B27F70901CF2715E2BD14A5271A8168DBB3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706622643, "uuid": "538a6150-88bb-4697-bb02-6334628c2402", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706622643, "uuid": "37fd26a8-c5ed-4f29-9eca-1b4b56f3ed89", "value": "196608:AcctzGjXbamB3iD/sDqjuSm9+/O+1EdBKew:AcKzmByRuS0uO+1EdZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706622643, "uuid": "a212519b-cf07-4419-9752-61f2361717af", "value": 6554839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706622643, "uuid": "b3e05c13-cf4d-45cc-8bd8-9a344baf96a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706622643, "uuid": "7dfb189d-34a7-41fc-8946-9145a01fc35b", "value": "tuc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9775a644-bfc2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706655298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706655298, "uuid": "f486f1ec-3f80-44d3-8b55-9dde6a2d12ad", "comment": "Malware payload", "value": "f6740c4d8519df26a8e12e0be5bbed76", "object_relation": "md5", "Tag": [ { "name": "colombia", "colour": "#7A75B4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706655298, "uuid": "03c8a529-6f51-4f8e-9990-028cdb241204", "comment": "Malware payload", "value": "398361c0bea88b45a8c56c777a1175fed9dd6c191760775b61c5bd55eee19297", "object_relation": "sha256", "Tag": [ { "name": "colombia", "colour": "#7A75B4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706655298, "uuid": "175f527a-0ac0-45da-83b6-d297541230e0", "comment": "Malware payload", "value": "bae499a598b179fb8ab0f889fd02db9e2bf9e401", "object_relation": "sha1", "Tag": [ { "name": "colombia", "colour": "#7A75B4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706655298, "uuid": "3878cc70-9a6f-4adc-b952-db7ff6be97b1", "comment": "Malware payload", "value": "1c17a239bc5d6d60ed75d74f295a30145133e445ceae529e0e8a15516196848ab1eef7576dcb58746a85f276bfcedd61", "object_relation": "sha3-384", "Tag": [ { "name": "colombia", "colour": "#7A75B4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706655298, "uuid": "9e873e6f-499e-46a0-8a41-fae7163d794d", "value": "T12B82E1080553A76801EFA9643C3788A875C7CBDDCA3F1F1315487BB98C67FDB60952A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706655298, "uuid": "105b267a-48c6-4617-a42e-aeb1a31a5677", "value": "384:+uM4JsPcRhh8r6XaDd/3sVKyZ3HwJKWEYcml339Miq:+hYQCvid/3sVfgJK6l9Jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706655298, "uuid": "1cd3c946-7559-408d-a9fe-c81ad18ed86a", "value": 19060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706655298, "uuid": "d23b1fdb-bc67-4c94-ab9c-989b14ab7ad1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706655298, "uuid": "2cb9927c-092d-417b-9a3c-6045cef3f99f", "value": "TRANSFERENCIA DAVIVIENDA EMPRESARIAL REALIZADA EN CUENTA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608fb984-bf9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706639314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639314, "uuid": "47ab0d6a-e65e-427e-ac63-647f9ded2ca5", "comment": "Malware payload", "value": "8148612efbc0524e5c045eaf7cbd3832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639314, "uuid": "e23f036b-1137-40fc-ae9a-d61bdc45b7ea", "comment": "Malware payload", "value": "3a87a5d090b10e7dc062b81226b9c61051c92b4464a0dae3831d556f59ef7215", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639314, "uuid": "654047c1-7ca2-489f-b6e6-404f0b63c38b", "comment": "Malware payload", "value": "621ab2b51477bc34df624de76278adee4bc50f7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639314, "uuid": "9e382bc1-0129-4746-a223-f207a682052a", "comment": "Malware payload", "value": "801025157d4905230a557a5eb88abf3276817cb412620ad65942f8b213bd93edf151f8904ffdba6f6cfa549f73fe77fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639314, "uuid": "08964b4a-2b58-4fc6-92b1-42e25c66af02", "value": "T1BFA5F17A4198CA6AD211307D52CCA4A338782ECDBBD196C19DF4B8AFD9FDF570221712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639314, "uuid": "9b10b782-489d-4c88-a7d7-3638d0485d4d", "value": "d879a65e465b1c412670e44fbe2d8e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639314, "uuid": "2636ba64-6d1a-4fba-9c72-5bbcabf79a22", "value": "49152:o5C0L+XG0BrmwciR/s+iuDG3ythzHPA9mymixJBlw6F:oZL+zmwbR/3pQghLcM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706639314, "uuid": "c8a019e1-c319-48a4-a822-132d0525e065", "value": 2082576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706639314, "uuid": "a2e68242-07fc-4356-971c-84173fa414c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639314, "uuid": "2739f33a-9cb8-487f-bd15-d7179c88eb0f", "value": "SecuriteInfo.com.Trojan.Siggen22.10132.25052.26293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be1e204-bf7f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1706626287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706626287, "uuid": "605b1810-cd5d-4bba-bcd4-b9c2d46bc5b2", "comment": "Malware payload (Socks5Systemz)", "value": "0fef7a02acf750925c99260e3b53755c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706626287, "uuid": "12b12852-722d-442c-8ff4-cc523f4dd0e5", "comment": "Malware payload (Socks5Systemz)", "value": "3b0ea10dc08e2bfa8f1355a3e6ab72f9d06aad7dbf4961a6220d72ef72acb0b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706626287, "uuid": "531b72c6-2798-48b9-b559-6fa7716de549", "comment": "Malware payload (Socks5Systemz)", "value": "e70159bc02ea0fee82c30b0c14edd0540c7320cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706626287, "uuid": "4ba08fde-1dcd-4cb3-bc1e-7b7da5dd819a", "comment": "Malware payload (Socks5Systemz)", "value": "bad0bb6f20482b57eb2c4fdc58a59e989add1eb00d1ca23ea33212b8d78564f140d089ee6ad97a9e05bb3e28dd94245c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706626287, "uuid": "a9e642a0-dc0a-4fb1-bec4-a95ecaefa66b", "value": "T1BC56336B11C019B8FFE2A374C2A73175947295941F3AD8DCD3BE8C5DAAB90B08D6D213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706626287, "uuid": "3344eccb-4b4e-4358-a5b6-513e747c6db7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706626287, "uuid": "8b5aa949-06fc-4ce7-ac29-e598a0d2fe03", "value": "196608:A2kh10mWK8vOkxQoj41Hf6MqfwjJ6Qziw:9k7NWdvOnxfTjJHziw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706626287, "uuid": "775420b9-389d-4eaf-8989-f6b72413f98c", "value": 6402073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706626287, "uuid": "3b8adb0a-5bb5-4a6b-bd21-8cbfaf01cdfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706626287, "uuid": "2944cb71-ae7a-49fc-b61c-fdc31ce2920d", "value": "0fef7a02acf750925c99260e3b53755c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c4febe-bfb6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706650201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706650201, "uuid": "32282ba4-9fb0-4179-a662-0a98708d6358", "comment": "Malware payload", "value": "2cf0c4ef9ef7dfc25bb2e53efbaf08f4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706650201, "uuid": "a6a28814-e377-4c04-b315-e96ab69d9b17", "comment": "Malware payload", "value": "3b512d7b673cc6020140697f557a995a0fedd0691c595ba8f65ab0e7eaa9f374", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706650201, "uuid": "d878d1cf-dcd9-46ca-80c6-0d7139dd153f", "comment": "Malware payload", "value": "5c552fabe7616c9872556a4933857f3047372193", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706650201, "uuid": "b9bec220-5843-4ec9-81bd-dc16bdf5761f", "comment": "Malware payload", "value": "a240d5396af2c7070376d4a45dd8e011a4e1b886cdaede59bb5ccb1049a649f5cc8ae8f7a0c2c806aaf9d5bee5966943", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706650201, "uuid": "a4c9933a-1586-4785-b5a5-e9e3728813bf", "value": "T18F767C27B388713ED19A0B3A4877A754983F7B713A178C9A6BF4088C4F356412E3E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706650201, "uuid": "416bd4f3-952c-452d-800f-1ec0d871fad9", "value": "3c6964022661ee0963cbc676d8976c16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706650201, "uuid": "7efe8352-e617-44b0-9b25-ab0ca3fe57a1", "value": "98304:63Ze9/GQjxmxHX8HKnWw09khBQ/WSg3f2h7:Ke9OrNxEo6BW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706650201, "uuid": "63619e69-24a2-422a-9f47-b8a318f2db46", "value": 7439360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706650201, "uuid": "dd82e53d-a9b2-4bba-86f1-b0bc4a42735a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706650201, "uuid": "0502a739-c403-4d0a-aa2c-5870eebc1173", "value": "SecuriteInfo.com.Variant.Jaik.194576.15249.1002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2f6352-bfc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706657374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657374, "uuid": "0a53335f-15bc-41ba-bcbc-923072830c97", "comment": "Malware payload", "value": "d438ad60a9f5bf702be1f458ac3eada6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657374, "uuid": "a110704a-5bcf-4057-a9e2-986e8717020e", "comment": "Malware payload", "value": "3bf926f45c98dd511ebe8783d6079452fa81dd55bcb182fb402cd800b365caff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657374, "uuid": "4f810321-4653-4b22-953c-1c5f8973eab5", "comment": "Malware payload", "value": "157710db34e55c6ee2ef6caa43059a32eea42be8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657374, "uuid": "75cf4b61-60d7-44ab-b6fc-3ee34b24117a", "comment": "Malware payload", "value": "4a06d7f46023914fddc2b53a50c5307c4c4f2a9f2c9101693b64202760717291bb4dfa1dd57b5e81ff731e0bda5e9aee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657374, "uuid": "9676f67b-cdd6-4780-a624-17a42097442a", "value": "T10C85365255A300ACF176A03783968AB3B2EEB03687285FC7C1544D501BDF2F55BAE7B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657374, "uuid": "4d8ee8c4-5e55-4ad2-ab0b-562aa363465e", "value": "46a6b12e8219294cfdeaa7503ced8efe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657374, "uuid": "904f2e0e-de97-4511-9f0a-0d3efa26f489", "value": "24576:yvnHjN+VcuSsPoratwwNK1RUaE2xHPu1+39czOsQSEgbT+tyL4Q7O1FcOh9o7WXI:UxyDPTh6UKFPpOySE4aetJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706657374, "uuid": "6f0bf019-33da-486d-8ba3-dd93763c5d63", "value": 1773568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706657374, "uuid": "ea9ec148-7682-41b9-9422-46c09481aefe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657374, "uuid": "3fdeb3cb-284a-4f43-b831-2b6af0d8f7d0", "value": "Loader.kZAqy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930d36b4-bf73-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706621360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621360, "uuid": "2677c3ed-a8f8-4bd9-9e52-770e839eb973", "comment": "Malware payload (AgentTesla)", "value": "740bdef42f41386b3426df3f59987d3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621360, "uuid": "ed0f3999-2559-48d4-b12f-271ae04e5759", "comment": "Malware payload (AgentTesla)", "value": "3ddb083ec344f66d68a2cd9df76f9675d4906689c235cd8456b9ad5db4cfee66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621360, "uuid": "febc0e65-23d5-49a4-95c6-092fcec69dbe", "comment": "Malware payload (AgentTesla)", "value": "6a31aa24062ee0b0b03201b308d02868a8dd5084", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621360, "uuid": "1d8f8574-2d99-482c-b5c7-0f6cfa928383", "comment": "Malware payload (AgentTesla)", "value": "5b4b32550be4ee60715de60d5d56b25bf5ea9a0c16e74910158824bd91e8147c0ecd7ec99bf9a1678a315a5de0844d30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621360, "uuid": "93a6e461-216c-471d-9160-1a8af239e42a", "value": "T19E4140FA881BEAC3000EC65AE7846D354F57B18721953DE4BC0BD984A6D2711B23F098", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621360, "uuid": "510c830f-a713-4135-a798-f127e3f3b6c5", "value": "48:kWA5dIaO6iPUDJBDaFNbnE37GK3LVq2olGcHYznodUm9lr:o5z6UDbO/ne7Gm7Jc4pm9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706621360, "uuid": "194de0a3-9eb1-434e-b304-d4f7ad8eeb7d", "value": 2080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706621360, "uuid": "de61a567-66c0-4087-b10e-038c6f7aa7bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621360, "uuid": "00cded82-ee87-4831-835c-53a88cd3919d", "value": "rfacturaEX46240192.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abb4c04-bfc2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706655249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706655249, "uuid": "aa87fd35-6901-4ad2-bb52-8adf35ba80a3", "comment": "Malware payload", "value": "8be5982f6faa8d568b476bfe3ea75365", "object_relation": "md5", "Tag": [ { "name": "colombia", "colour": "#7A75B4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706655249, "uuid": "7c18a9c8-3501-4145-88c8-43abbf198cd8", "comment": "Malware payload", "value": "3e2fe0df76c5733e6b93eaa3ddfeae851729a0665ed298f9f173a2544ee5057e", "object_relation": "sha256", "Tag": [ { "name": "colombia", "colour": "#7A75B4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706655249, "uuid": "31b08566-8dbd-425d-bac4-ea1f13732ab7", "comment": "Malware payload", "value": "3e07dfdbb172b0140942074259460e06c0da64fd", "object_relation": "sha1", "Tag": [ { "name": "colombia", "colour": "#7A75B4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706655249, "uuid": "7cb5c1f3-3a23-4b12-9bcc-4b3a8cb61dca", "comment": "Malware payload", "value": "804a8d5fb3a19b9d35b9a027daa564d1ba1e9f1c97921c7d894c114dbce2fc208a1d8be4d8b1d55291821e7b9fb08a37", "object_relation": "sha3-384", "Tag": [ { "name": "colombia", "colour": "#7A75B4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706655249, "uuid": "87de8009-6857-4128-afd5-8f0a3b460517", "value": "T1C782E067C8E02291D55C01E6FEC53C1AF267F278E0056692C1C74E5E12E6AF34819DEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706655249, "uuid": "8742dc6c-1a3f-413f-9529-0e47d8169b36", "value": "384:bIoNclu3eyBPaBVGl/PqrvDn8SxbCEsGzqL1DFBBqvUhscEMbvYKLG3U06gb14FN:a6BPkK/aT8SwEsWqxpTZEALGk9+GF/v9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706655249, "uuid": "43e51ed0-5ed2-435d-88a1-9cd4e0d16ca2", "value": 19060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706655249, "uuid": "33b1759d-aefb-4ed5-afed-e78c0cdc6217", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706655249, "uuid": "19c21b7a-1d6a-4764-b61f-50476dabb64e", "value": "LLAMADO PRIMERA INSTANCIA NOTIFICACION JUDICIAL FISCALIA NACIONAL DEL ESTADO.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac8f85f-bf66-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706615575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615575, "uuid": "0b67fde6-701e-415c-8a2e-a281d93c1806", "comment": "Malware payload", "value": "286f697f275f24efd0df1c052d4578f9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615575, "uuid": "35e54064-ae0e-4964-8591-02c563d2ab30", "comment": "Malware payload", "value": "4078ea0d92cebb80d42608e130fc625ccc32306a49ff772fed909be6afe12ff9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615575, "uuid": "2191f3be-3546-4ac7-9d74-469e702c45e8", "comment": "Malware payload", "value": "9c59ec6e5beebf66e28a7273a5e8ede82630f8da", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615575, "uuid": "8cf34f36-7ba6-4340-8271-8241b73069e5", "comment": "Malware payload", "value": "b488d1a72b4224e980e8a118360363a48531aab4c396990559307ce4ae6bbfab0c5e415c3245f03d3e2ff02cac1bd256", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615575, "uuid": "d4e6bf3a-74c4-4ac4-a6cd-8eed257cf40e", "value": "T12A04576DD34B02598F6252379B1B1E9441BDBA7EF38552B1306C833933EEC39A12927D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615575, "uuid": "41f5b466-c1ad-4eaa-aa6d-1eb822d7728b", "value": "768:3wAbZSibMX9gRWjtwAbZSibMX9gRWjpcaebCMX++5raTNpB1qgN1a9:3wAlRkwAlRCGVX++dIBcK1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706615575, "uuid": "af6972d8-1712-4984-9c50-2a192c634e8c", "value": 176742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706615575, "uuid": "94b91acc-6706-425e-8e79-ec95a64f8354", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615575, "uuid": "8aa7a0b0-6763-4936-a820-7a7310eb66fa", "value": "\u0391\u03bd\u03c4\u03af\u03b3\u03c1\u03b1\u03c6\u03bf \u03c4\u03b9\u03bc\u03bf\u03bb\u03bf\u03b3\u03af\u03bf\u03c5.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adacdd67-bfa4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706642450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706642450, "uuid": "907b8671-db5b-45c0-a3be-0d9a9db77e9d", "comment": "Malware payload", "value": "553ac66062429d5a0423d4b286e53c31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706642450, "uuid": "1e9eddb2-5b90-4456-a72b-9bb53aef3bea", "comment": "Malware payload", "value": "428d51259ad927c58ea5abb9eca6e0dce4fee5d97e20f78abba194c8c4faadfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706642450, "uuid": "477c20f1-c758-4930-bce0-5220cc3232a0", "comment": "Malware payload", "value": "0acea7bcaea5c8a9a4e19232e3ca114863aa6968", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706642450, "uuid": "2edf827b-9e0d-40e4-aaa4-d5cc80ac29a4", "comment": "Malware payload", "value": "9b48ee38dcbf59cadf3db499c31c1f34fc79407b56fcef07813caa17969b2bcfce2674b5ca84baa4ed739fcc33350847", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706642450, "uuid": "0030b529-cfdc-4f3d-b45c-deb9a5d5a2d4", "value": "T16ED46977344415E2F93D6BF16BC6AAB659EE6E7F1CC1499422DC31F8A0B6220819C13F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706642450, "uuid": "d1306257-bd9c-4e15-84d0-9c2b009e9ca2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706642450, "uuid": "3de911b0-c3e8-4dc3-a95e-f42c3182c239", "value": "12288:nL6hD2x/HAWbR2zS4sisO1A83u2BSDoCqKcuz:L6uHAW92zt/sWu2BSMCqDuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706642450, "uuid": "e01905bb-574a-4936-a6e9-73952b7d5fa3", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706642450, "uuid": "87ddfdfe-53c0-4db0-a638-5c4166553b2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706642450, "uuid": "8005680f-d023-46ed-8357-df0035c6b73f", "value": "Market_Time_New_Conditions.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c3336a-bf3e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706598443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598443, "uuid": "e241ceba-9e00-4538-b268-7aff7702f3b7", "comment": "Malware payload (LummaStealer)", "value": "e4634aa2aa53d8df858ad5149bc55559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598443, "uuid": "940415ac-273a-4712-9746-e9563d3cbe41", "comment": "Malware payload (LummaStealer)", "value": "42a144de24314ded37c550a3d5908e305691d0e3db75e48d11500340dbd450c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598443, "uuid": "e7640cc0-30c0-45f4-b05c-a6f13654b112", "comment": "Malware payload (LummaStealer)", "value": "fc9683c187bcae3cc7c641f145f00f8f2c2aa71a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598443, "uuid": "04d15178-d7ef-49f4-a3a4-3910105f9500", "comment": "Malware payload (LummaStealer)", "value": "7b1f656ca1cd4f89a8d9dd5ab441061bde9976d6fd61ff116c021a831bec56b5844be15bbd3749363e03b20aef056b3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598443, "uuid": "939c6107-e9f5-4985-bba6-954a9829e22d", "value": "T104650640D6DD8160EF6E7130B72D39D9E833ECE80D984A262FF0D6AD07EB66217C554A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598443, "uuid": "648ca1e1-cb79-4078-be6a-0d3da7d9d457", "value": "80b270b428e64dbb2651f8bbe55b6424", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598443, "uuid": "1e37c743-d32d-4b3c-846b-b4d5f84d430d", "value": "24576:Yrzf+sKsqlpta7G4QRLAJJ4aMOIK+zZ/FHmqytRt4UV9r5Ez:YXpGnpOkbHNytZf5Ez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706598443, "uuid": "745a198d-1661-41cb-988c-8d11126db192", "value": 1538688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706598443, "uuid": "fdb87077-66db-4219-a3f3-ef22a263c42f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598443, "uuid": "d1251511-9d84-49cd-a720-7ea4754a7fc2", "value": "e4634aa2aa53d8df858ad5149bc55559.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93795e2-bf52-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706607304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706607304, "uuid": "aec07282-26be-4475-a5fe-6a1c0d166f34", "comment": "Malware payload", "value": "3cd444b96eccaa1aaf680db225842755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706607304, "uuid": "b13c4b1a-ba4c-45fc-a02d-3ea251d1abe6", "comment": "Malware payload", "value": "42b6937e2787e6fd7111939069305d21d97cced99a9a3942c0fc785c0dfc6171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706607304, "uuid": "b1aa4176-b221-4c44-96c2-cc3dce431687", "comment": "Malware payload", "value": "717c52d12033bbaf6b3ce2802c5240f07800eb1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706607304, "uuid": "26184013-c6ba-4ece-83be-b835a182c7fc", "comment": "Malware payload", "value": "3f49a5c8112013b9859ea3e3c5c7c9571b52e3866af2f1b6b00a971d17fc876ba38af0e7ead9593b2cda762e93b91099", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706607304, "uuid": "4c3ce81b-bd61-48fc-b45b-82c4cc3893eb", "value": "T1E5F733BFFD741E29E85F1A33C6E2EA0049BF3E63563E495737F02C29BB858201A25545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706607304, "uuid": "02370e7b-f2b6-4528-b177-02abb5bd1d00", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706607304, "uuid": "a56f7d4f-598e-49df-b605-f3f0b1b025dd", "value": "1572864:rhK24WKvxtfFGO/zU1o2kSoRrIRspbex8SnpmpAujbdsx1:mWmxtfcO/4o2k5RruGbexRp3QOx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706607304, "uuid": "0542c871-232f-44ec-9758-0f86fa4426f9", "value": 71822496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706607304, "uuid": "b2f4d61e-f89b-4a31-8bad-611eb01cb23c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706607304, "uuid": "31ced782-efc4-4158-9dfa-2e19f7897361", "value": "SecuriteInfo.com.Program.Freemake.312.24129.1991", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff09b80-bfa2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (MarsStealer)", "timestamp": 1706641434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641434, "uuid": "56cbf5d0-54fe-44d4-8714-b594bc340483", "comment": "Malware payload (MarsStealer)", "value": "963d5aa16a4fe05fb14d2abe93cbe73b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641434, "uuid": "2348e524-7f12-4278-9a65-ccded5728e5d", "comment": "Malware payload (MarsStealer)", "value": "42e78e03663f03bc3444e805d9fdf2fd085c6d4556450e7c16f4432d12bf73f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641434, "uuid": "078429c2-a3c9-44e0-a837-ce86a8fd0185", "comment": "Malware payload (MarsStealer)", "value": "aec1ded71b1b9112faeb8cfe44003cdba2b3436f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641434, "uuid": "a16c453f-81ba-4019-b6c9-cfbf7c3dcea6", "comment": "Malware payload (MarsStealer)", "value": "d9f5d2fa7937f84651cc710050ddc28a185eda9212381bde62229c56e4eff8d7f8f34e3e9a42de8abda527091c360b98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641434, "uuid": "12af199b-9134-499e-b530-9f4086ecb844", "value": "T13BB63327736051F6EE6D47F6A403006122FC7C3D6563A889B3E9F3DBC86F6615A0858B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641434, "uuid": "4bafdfeb-0fd7-4982-bd77-384eac153ca7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641434, "uuid": "971b28db-40b8-41b2-906f-24314331a8a5", "value": "196608:vV18X/ZLboxpZhEk2fnbSJ6476gULdGSm14EE6nZwrRFdpg/Z1epninv54991i:vs/honK9r3LdNm1LEVRFdphonvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706641434, "uuid": "517acb2f-2acb-4bfe-ab3e-d62a9a3d39dd", "value": 10887680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706641434, "uuid": "d27e9c42-7400-4189-b1b3-eb7df417fd1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641434, "uuid": "6fad9620-8ac3-4a73-85db-175be23b8696", "value": "Kan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6316ed9-bf0f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706578469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706578469, "uuid": "4acc741c-a874-488d-850d-3e680008bd86", "comment": "Malware payload (Formbook)", "value": "3ed5075e8e00e18ea203b86195f94d4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706578469, "uuid": "9f46715b-7484-4d30-be61-129457ef9763", "comment": "Malware payload (Formbook)", "value": "438b026b52bd8b11d0b752f5734bf8a20275a6746a522c4a8179f2f9030c5fb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706578469, "uuid": "f65c68ea-eb41-47c2-9b87-1eac74260e3d", "comment": "Malware payload (Formbook)", "value": "1e2eab9663da32f9e2a04a3d30405c43a65caf8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706578469, "uuid": "74c26711-7ea9-40d3-bfff-9bfa7f5db3da", "comment": "Malware payload (Formbook)", "value": "8ebb1349541d063c51826a0a20c976794374dd7528b223adcf3238f19c0808de2a8f7014012e33e4900ad3059d9e1c52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706578469, "uuid": "9127dce5-6c08-4c74-8351-9d2a1a3b27be", "value": "T12CD4120473FC171BF8B667F67229064817B6B90A60E0D7ED0DD8A1DE0A75B428D28F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706578469, "uuid": "2d81953d-5517-424a-9fb0-ae17a9e69b55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706578469, "uuid": "d800221e-7541-432b-9cb7-b9652cde3a5f", "value": "12288:xwEoIFFHgeg/cs/t1clJ6SsN8KmBcKRvUUooEk5vb3aMXlTKy0fxor:SEXFxs/tgg/hPaaMVKy0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706578469, "uuid": "dbded60b-f677-48c0-9ec3-0905ca2994a9", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706578469, "uuid": "beb23d6f-0fe9-46e2-be31-648acb0603ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706578469, "uuid": "244fe401-fe91-4c42-80c1-3c183a1ecaa8", "value": "SecuriteInfo.com.Trojan.Packed2.46190.15325.19908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59af4e3e-bf3e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706598500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598500, "uuid": "a4696445-c550-42e9-9257-0f683914675e", "comment": "Malware payload (RemcosRAT)", "value": "1054af75495448aff0b28888fbfd2e25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598500, "uuid": "fb22d787-32d1-4c90-8cdc-39189bce7afb", "comment": "Malware payload (RemcosRAT)", "value": "43e06682b919ac1e1ed1a3093df3a0f7d261e424ba2839243fa03f4ae2cedb75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598500, "uuid": "247596be-e9da-45c4-9154-35c3fcbf4caa", "comment": "Malware payload (RemcosRAT)", "value": "807a8f994eccd974baa9aadd1809b8b37ddea9eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598500, "uuid": "688c6b79-4f5c-4bb5-9c66-234c42f6cfb4", "comment": "Malware payload (RemcosRAT)", "value": "209904b19a1b063751c98be166597d6186b1b4d6bdd6ecf8a629e7c6a299a6d6be2dcc39012af203e3a9dcc1a8bb0050", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598500, "uuid": "ec02b0eb-7833-4a60-8846-7556b668d6bc", "value": "T1BF35F10E43196A53C7B25338C5B7E7150220EAF558B6E387CBEA783A74263E94FD1712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598500, "uuid": "2eac7e45-302c-4912-b87e-58d8481236de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598500, "uuid": "a6003bcc-5767-4fc6-888d-000749b81823", "value": "24576:bk4u02ahnCl3+ijHXadOUFeAxIsR9+6EpO:QuebXadOUvII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706598500, "uuid": "3b186955-4a10-4d22-a112-1aace56ddb16", "value": 1116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706598500, "uuid": "76920074-7363-4982-8bb9-c2272830bcec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598500, "uuid": "7f71d505-512e-434b-bb37-c6a2c319386c", "value": "FP-Trading_PO240001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045e36ed-bf7f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1706626275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706626275, "uuid": "53a3bd08-e4b0-468f-a7e2-c6d0fdc23c70", "comment": "Malware payload (Socks5Systemz)", "value": "f920719f5ec1c123d64416cce7f092f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706626275, "uuid": "cf1b1130-cbf9-4b92-92d7-570d59e1f029", "comment": "Malware payload (Socks5Systemz)", "value": "4450a663eadc459059f90880f529d6af9ce1b4623d3c2de1643147f982848ce7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706626275, "uuid": "f6e51fb7-ea3e-4d94-ac83-2091dbb29896", "comment": "Malware payload (Socks5Systemz)", "value": "f7c227159adf6153ac64286c25bb0ede5444610b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706626275, "uuid": "32723f6c-7ece-4f86-a087-8f30232294bb", "comment": "Malware payload (Socks5Systemz)", "value": "128b43886bd71d424f6269fc4a628d62ad0f729acecdf0f026ea20166ff4f0ed6c63c5ef8f8c59c3e948782c3f212809", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706626275, "uuid": "3e385ea6-60ff-4363-bdd1-6d1a2c3c41fb", "value": "T1536633A276E0D5B9E241CF75896B1204C66BE9343E38C50CA69EC24FD77328587BE317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706626275, "uuid": "ec70e129-94ea-4d9c-b31d-72501f2ac1fe", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706626275, "uuid": "dd95653a-f24a-4474-901f-1f2bee05506d", "value": "196608:de/kp3pE8oMLcNGR3CgdcvVtnZ0yy6Hyw:de/Aq8rBdcvVt2yyoyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706626275, "uuid": "b917bece-91ca-4ec8-bef9-89a3b050d588", "value": 6581714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706626275, "uuid": "cd78ce07-4fad-443a-a806-d9cdc9304257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706626275, "uuid": "58b08526-b11d-4800-a621-9564fe46c03d", "value": "f920719f5ec1c123d64416cce7f092f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69d0001-bf5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706611622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611622, "uuid": "b19a6b93-d4f7-4def-b494-a6f8dc45c1a8", "comment": "Malware payload (AgentTesla)", "value": "36793f5e0c940a97a8a0d8697a5c3a3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611622, "uuid": "8f5499ff-dce8-461b-89ed-aebb37b1358a", "comment": "Malware payload (AgentTesla)", "value": "44d966ac7046e1860d9f18368b2c190299a7de106f212814543b3d373552ff73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611622, "uuid": "d3b75199-14ae-4f68-bda7-d220e5798a47", "comment": "Malware payload (AgentTesla)", "value": "0d861df22d18152d53842a61cbf5234588a58314", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611622, "uuid": "054be0c6-5cdb-474f-b31d-ba3f539e91a5", "comment": "Malware payload (AgentTesla)", "value": "0b74d97563184765354c1ee7589f239f38ad1341d3caf08204364d634166d63f6b395104e4a6e2495912c0e5c6b45a58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611622, "uuid": "8985838c-4eed-49fa-9fac-310379a515f8", "value": "T1C1C402289A349F12F93C0FF611B4BA51E3F12297251AD7B95CD920C52BB3F250B44EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611622, "uuid": "da74f25c-2e55-43ce-88db-272059ccc61d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611622, "uuid": "6f07576a-fe3c-47cf-8e31-aec33fad44fc", "value": "12288:+J+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8l:+0a6u/ZKCcmdqw6S2dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706611622, "uuid": "3e90abaf-e4f0-4f89-8796-fc42420439be", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706611622, "uuid": "ac58ad5c-b7aa-4b2f-88e1-b90994002cad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611622, "uuid": "87b9b359-23fc-4b4e-a2e5-3a2ee381917d", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fb9885-bfb2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706648269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648269, "uuid": "cab22a4e-db32-452d-a8dd-7e62629959ea", "comment": "Malware payload (Mirai)", "value": "018e9a5f6930dd33f44dff5a320456f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648269, "uuid": "bd7eb825-9de3-443e-9b3d-3bac8798487e", "comment": "Malware payload (Mirai)", "value": "465dcbb819930a79b1472ab040ae0684175247ddb8e31f83d5b5b5f677a50dff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648269, "uuid": "cc530f73-1b60-40d0-a3e5-931f6cad8068", "comment": "Malware payload (Mirai)", "value": "157b0927edc34a37829745c9478ccd97517adcbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648269, "uuid": "d1023938-942e-4be1-aa51-af670764a1e9", "comment": "Malware payload (Mirai)", "value": "28bf24e90ee897a4610b814607e7243e731eba250b7117bcb0beaa361ed10244d1eb926039f7c4a15f51ed7d8d0ebc22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706648269, "uuid": "5ac433a9-480a-4700-9b04-f02ac26caf98", "value": "T16A836DC5E5E3E8F5E80105792237FF329E32E53B6016EE93D7D95E226D21A01D6072AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706648269, "uuid": "1ee1e923-7ca2-4c64-9e0b-894aeef56fb0", "value": "1536:/Edv6bzcaO/zDFCqY+5zadwz2xi1JGNCD4lrfI9WbVZSCoXoEOeLwvETGs+1ngTx:/YibzcaO/zDFC+5zadwz2sJGNCD4lrfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706648269, "uuid": "9b407d12-e65f-4ea4-9d9a-4082efb72eac", "value": 83344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706648269, "uuid": "408d558e-bca6-48cf-91d5-c0790ab45e3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706648269, "uuid": "c714f948-0b31-4920-acbe-d7d6d394fd02", "value": "paraiso.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f11cdc9-bfaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706646962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646962, "uuid": "80efe4ca-d7f9-46f7-bf99-961f260289c2", "comment": "Malware payload", "value": "f5ff4bffc1a089536b007f938b880922", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646962, "uuid": "cff6c915-0578-4d74-a471-3cbfcad94221", "comment": "Malware payload", "value": "4700dbc35be95d163dfeb4b4fa7d507f01250530b24f0f53e62b64b7b15fdd6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646962, "uuid": "069095b0-ee23-4ef6-a941-ad7df303934e", "comment": "Malware payload", "value": "dddeb333e8f1fb79d03188b056e61b7582597bd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646962, "uuid": "6912a9c9-99a3-4f78-ad62-06ab2a2aaa3a", "comment": "Malware payload", "value": "cc0f06ed0124c2993adcce2638297fc99ed44ebbde7d3526f94710b851a1445a1cb0ced19ce19564dc1c971aa0ad6b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646962, "uuid": "8d04a852-a221-4b2c-9f7d-df3402830cc7", "value": "T163E57B42665083B1D952C93C4D94CADEEB3DB9F33B6076CB2F9856593F223D02E3521A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646962, "uuid": "aa6fd166-7f6e-4261-8a42-bd7118cdff2e", "value": "b294737f6472df922e71bd7c1b54ea60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646962, "uuid": "86d7f82e-a5d7-4132-8df4-bd47173931ea", "value": "49152:cHV8PaEwnjKNRAsjKN4KleMTd8JS/TnIcscTMEIyFTJ:c18PjwGKleeDbpsVE9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706646962, "uuid": "5911e193-8ab3-4e75-9609-19f9a1197986", "value": 3195440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706646962, "uuid": "ed2e2335-9807-4ace-9fc3-9160ea2fb09c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646962, "uuid": "e406628b-b520-4f04-be71-2e64ee42539f", "value": "SecuriteInfo.com.Trojan.TR.Dropper.Gen.16136.10101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9748059-bf79-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706624001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706624001, "uuid": "10c14382-88af-4fe2-8a53-4f11c3d5a2bc", "comment": "Malware payload (RemcosRAT)", "value": "900aa2be86a9a5b77ca096eb0ccb0b6a", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706624001, "uuid": "9e926162-5c6f-4dbc-92d0-3186aef2ba30", "comment": "Malware payload (RemcosRAT)", "value": "474f90e7d4fdc22c2565faaabf36f10527b9a5e599ff84a42d5035bc817e4e52", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706624001, "uuid": "66cbc866-2e14-4c50-b79a-e75395317bba", "comment": "Malware payload (RemcosRAT)", "value": "7ca990c73bfd3faf428f2393c0271d8e5dfde06a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706624001, "uuid": "1d26f3be-d175-417a-9cd1-e55a63b06cbe", "comment": "Malware payload (RemcosRAT)", "value": "d74394209f20034120eb6bec022e447ec7fe3c90b07bd4936f0feb32efda08bf872469e8b58b79490de73109b677f232", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706624001, "uuid": "8d562e88-de4e-468d-9b29-7d03f626377e", "value": "T18F233B493D4B1668DBA50C97EE88AF95D8E75CE14073AD837A3480E57AC210558FBFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706624001, "uuid": "53debffb-09d3-43a8-9509-85a4e68b2902", "value": "768:uLLLLLsXpcXNRbXfXZXILLLLLCLLLLLlLLLLLuAlLLLLLB:DAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706624001, "uuid": "b0d01493-b6ac-4a83-8c44-f1ed6f24913c", "value": 48819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706624001, "uuid": "18018d05-5d2a-4dc4-a588-492126cf3e7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706624001, "uuid": "d35b9e12-8025-4b6f-99ef-482436d9b208", "value": "Ladyisbeautiful.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6ffee1-bf99-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706637693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637693, "uuid": "f59c0ed4-1973-4903-838e-d9085ae964de", "comment": "Malware payload (Mirai)", "value": "5982f1818c6791ad882bdc18655ce785", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637693, "uuid": "7da8cab0-5ace-4ebf-8719-ec67f1bee972", "comment": "Malware payload (Mirai)", "value": "498f8f38c82729fa4031ed1101249dfab8dd263aaad95b90de8c70e3a068e130", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637693, "uuid": "177142b0-0594-4422-8c3d-c599a0815e53", "comment": "Malware payload (Mirai)", "value": "de09f46bef0506a2fe5c61fa9b1d49b32cd39f58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637693, "uuid": "71747ea5-958a-4c30-94e2-d4cbda75d82e", "comment": "Malware payload (Mirai)", "value": "1e44b2a00f6f4f0ee821eca6e9f1d3e931b3ffb717bcd3a4dc0b920d063c49e5e0864e6f2a5d2efb7c9d498f6b3f4966", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637693, "uuid": "57e8c01b-631f-4e6b-a1d3-c99aae767aeb", "value": "T1D9B34A77C8296FA8C259D5B4B0B09F792B63A58182471FBE54B2C3B64083DCDF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637693, "uuid": "9fb9e03f-c1fd-49f5-845e-50b1532ad8cb", "value": "1536:2aVTHW/qIAmPq9aHFGEWCRPKBKFnLblvCifzQVW9kXxeUwr/zC:2qWLS9alDWMSBOlvC2sWqXxQrbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706637693, "uuid": "36a50e8f-19b1-46ce-9b0f-b8f7584e5025", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706637693, "uuid": "142dccf9-2514-4f40-9b61-ee3f0755cbbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637693, "uuid": "66efb27e-4492-40ad-81f2-766668feb410", "value": "5982f1818c6791ad882bdc18655ce785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa028bb7-bf24-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706587468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587468, "uuid": "7375e877-603c-4601-bd8a-27dd92c97837", "comment": "Malware payload", "value": "ac6132e51eeb91f7d294c448fc2605a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587468, "uuid": "ae76f391-d686-4213-8575-6b00d4991e24", "comment": "Malware payload", "value": "49cfbb6f99f899fc4a5f5c18b985f71e54b51778a63f8fa015eb6ff887f401a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587468, "uuid": "372d70df-2f7b-4f66-883c-a2fe2cc7f871", "comment": "Malware payload", "value": "6fb9c6e9df6913b8c327235fc31821bc1fca0982", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587468, "uuid": "9f8e926a-2272-420b-99f1-3dff5f8e18af", "comment": "Malware payload", "value": "4033b5dd2f478acaa38ddc0fdbbaf4860f8c87f36895e28936f631464aef7a6ded24dd98c5d7ef0d476fd3738bedede6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587468, "uuid": "7d2e5315-2816-4b6d-8c78-92c7e11b0b01", "value": "T1F4734B43B9D2D871E9721D311860C6A19E3FB9210E659E6B2344167E0F30AD1ED39F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587468, "uuid": "0b36873e-d259-40c1-a633-abb01384fb09", "value": "67b092a69844bee71741beabb06b1afb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587468, "uuid": "31834450-6a5a-46f8-b70b-b62fecdcde58", "value": "1536:K1VAm1xLdXrKW2QbawQbulpjCDRGczgWSob+DHGZksW3cdPYCk8Y:u1Trn2QbawJCDRGczgWS1GRPYCk8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706587468, "uuid": "a675c38c-03fa-44fd-9c5a-f664f04b0bf7", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706587468, "uuid": "29d124fc-9c86-4190-bb45-1aca7771a29b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587468, "uuid": "637262e5-8ba3-47ea-8956-42670fc5f922", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636d959e-bf23-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706586920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586920, "uuid": "279ce50b-46a0-4bd0-a29b-16d7a5867c69", "comment": "Malware payload (RiseProStealer)", "value": "162040ba6633447aad561492228d34ec", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586920, "uuid": "057e2a0c-e59d-4c37-a7c0-f6b4a02bcc07", "comment": "Malware payload (RiseProStealer)", "value": "4a29b32e33509dac8f19e77b6a103509d6c9efe3ff80a8bfa1558e8efb9bcf0b", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586920, "uuid": "eb36a16b-d597-4e86-bf57-27da4a3f7a3c", "comment": "Malware payload (RiseProStealer)", "value": "b86a527b52ae73497d3db19acfd6e0c59aeef5f6", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586920, "uuid": "66225f51-acc8-4697-b8e3-32eaa103e26c", "comment": "Malware payload (RiseProStealer)", "value": "ee09e4e5602d89539472ccfc7d092f2cd386dce8410d170f2515c4f7dfe1145670e44a0f4759eacb5562502a6df201c6", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586920, "uuid": "75105ba7-231a-42b1-bd76-b5b8befd1be3", "value": "T12D15A99C765076DFC86BC972CEA81C68EB6074BB531F9207901315EDAA0D99BDF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586920, "uuid": "837d895f-32dc-4c96-9541-00d88e7d62ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586920, "uuid": "6bc44be2-1b8b-40b3-ab5b-a8f76468d827", "value": "12288:juRV4sgPodITfjGJ416+mAomZ/47xbl+ED+I5UrI+ONQchgdDcVV3CXdVh4pGTUD:jh9a0jg4Q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706586920, "uuid": "6f26d50d-0849-4008-8c1c-8ab857fde63f", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706586920, "uuid": "56ab39a4-3d88-4b8d-a37d-f6c9291d9a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586920, "uuid": "2a47098f-3879-41ae-aa8b-962cb9b86ba9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d3c4e8-bf8d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706632401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632401, "uuid": "31d32d66-d020-410b-901b-1aa72f360f4f", "comment": "Malware payload (AgentTesla)", "value": "10908f61e0d438a0f0643394397fe6fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632401, "uuid": "c6c08daa-7dc7-409e-8ddf-99816cd979e5", "comment": "Malware payload (AgentTesla)", "value": "4ab75585e2e992e947b3e5c55ad0981123a22ea85a42f6278fd788bc4aa6a43b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632401, "uuid": "e3a33447-4229-43d6-864c-1b5ab067f38c", "comment": "Malware payload (AgentTesla)", "value": "a233961e974db3d71e29f3038aa068003496fd02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632401, "uuid": "05c82ca3-9ada-42e4-8630-626f752675e0", "comment": "Malware payload (AgentTesla)", "value": "e7186989944c2665879938b5a5749c8ec4cb9c46079c324c07f76019770b2cbe42cbb98ab6f9eaccb22f68abd636b6c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632401, "uuid": "f1a4cf31-2858-4d77-a2b2-15b49c7103a6", "value": "T15BE4232123756BBBE1770BFA20A6461117F33A3F6626D76C4D8110CB9E7B3104BA271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632401, "uuid": "0863c41e-eb1d-4722-acd0-7669a1565a53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632401, "uuid": "15a82c23-659a-46a4-8879-f5bd8906bb2b", "value": "12288:Z+WAYQ4lvjTTqAPIo8wys+7sa4feHplN6F2FavNYd3:hAw3TpExL0Wx6F2Fug3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706632401, "uuid": "df21b962-0378-4b92-acae-875ce7a181d5", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706632401, "uuid": "8b31762a-e950-4315-93eb-d62a359aae78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632401, "uuid": "b4c7f6ef-10d7-44d0-bda3-7a9422139b78", "value": "RFQV160T LIBERTY SUPPLY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2aa490-bf24-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706587287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587287, "uuid": "98cd3fb2-dfed-44c1-9cee-cc2a389216b2", "comment": "Malware payload (RiseProStealer)", "value": "691ae247cd30ee3598fdff23a128da70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587287, "uuid": "8662fb2f-441c-43a7-acaf-b09e04e698f6", "comment": "Malware payload (RiseProStealer)", "value": "4cb4e4ea3f66b2199b83623e6d1e7f5ebd8608ce11b30c895d899ec434f4c81b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587287, "uuid": "e636c1b6-d396-4fce-9809-f709b3361033", "comment": "Malware payload (RiseProStealer)", "value": "83b91223f67f22046db742895e7d76b3f2fa179c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587287, "uuid": "224667a8-6835-4db1-8f32-519b759b063b", "comment": "Malware payload (RiseProStealer)", "value": "c5aced43f83facbe8288e9ceb18735a9af78268bcb1ca9e0b761f8d378c16cfdaa5b6e0e704466449b6fb56e7d73eb2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587287, "uuid": "92f3e009-dcc2-44bd-b27b-f3abd05f8991", "value": "T1B64533F80547ACF1E92911B9008C1991AF6DFD29D015A311AA6FBDD44EF889C6FE6F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587287, "uuid": "0c8eac69-a660-4d6d-8314-8e425f2cc814", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587287, "uuid": "479f5f79-660c-49fe-8ede-eff2b06a87b7", "value": "24576:MHKw2ICUUvPR7cmGXkMnvzn87wQrBaWnBCqblgPKX/ObmNrUJJXgxC5:gvoPRg5nvqlrBaWntWivOSgHMC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706587287, "uuid": "27b59da8-2957-4d6f-b52b-bc6dfcd237b1", "value": 1194496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706587287, "uuid": "41e0824b-c753-4fc5-984f-bae14d170f4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587287, "uuid": "f92ab8e2-163b-42f3-a33e-a829c3040861", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389e081d-bfc1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706654709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706654709, "uuid": "d2e4a81e-005c-4da5-8cbb-882776645788", "comment": "Malware payload (Mirai)", "value": "8c2395490494fcc8de85020b4bad4c43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706654709, "uuid": "e4c55b9c-7db6-4b20-88b9-51ffda80d137", "comment": "Malware payload (Mirai)", "value": "4d05c0973c7370e1e989c4f58bec54eef835e13b47e409df20c22627d73d8af9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706654709, "uuid": "0ac53518-e6a7-4aa1-87c8-b255576ee95b", "comment": "Malware payload (Mirai)", "value": "4c245865e6bda2dce5d26381e5764497685ecc38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706654709, "uuid": "48d24ff9-874f-431e-8a2b-f44b5804719e", "comment": "Malware payload (Mirai)", "value": "d99fc51b4f02781638c40ea6d95119bb6ebb58f10def717531e60d248900579fb374490f43f04026d3987d1d71e004ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706654709, "uuid": "3cb3fb61-397e-43d4-ace1-81eb8d7be407", "value": "T1E7432B31FA761E27C0D1A87661E74B25B2B143CE26E8C60B3D710E9EBF61A406513EF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706654709, "uuid": "b0b6908b-d2c9-4417-bec5-c0e841d3aa49", "value": "1536:EBNZ790epq6IWi5ZYiId2l6Qxvh753S8tNyVR:4LQSUTvhVCYyVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706654709, "uuid": "c654fb0d-bfd7-454f-8ef1-9edda07f9050", "value": 60048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706654709, "uuid": "4ed2de6e-e7e2-4420-ac4f-521b389784bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706654709, "uuid": "3f2c0c21-1f5f-45f8-9ba6-128a41d4255d", "value": "8c2395490494fcc8de85020b4bad4c43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2745ea-bf49-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706603415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603415, "uuid": "dbd22688-5493-45d7-aaf4-4ba1dd5a6e6a", "comment": "Malware payload (Formbook)", "value": "ce2b567f273193828f82efeb2e2aa2b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603415, "uuid": "43a856ef-44ef-4b1b-804b-fec3ea8d6f20", "comment": "Malware payload (Formbook)", "value": "4d113b9c60b2ec3b5fcf9be19607bd379534630ae6acbf9b64a5f48600f275f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603415, "uuid": "30f5660c-966e-4fef-9803-4ed3db5dd544", "comment": "Malware payload (Formbook)", "value": "0d32ebdc1b86ec05eb9c402e3287889664b85a0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603415, "uuid": "e50771b8-4185-4137-a6ec-41c4159caf16", "comment": "Malware payload (Formbook)", "value": "8d3b4bebd4969aa22e5aac9511105141dd336223a25c90188513169a9c9a85e349bd8ff081112bfbb644df68e1ffce02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603415, "uuid": "2a0c61da-2e9c-4404-aaa4-fa7f325e3c90", "value": "T129F412A233491997D67D09F9CC9912DD1776CF2A7E83C38B6CC870A666B27D4350A2C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603415, "uuid": "97e8af14-58ae-439c-9bd0-45dd41394720", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603415, "uuid": "08fe11d4-2565-4e95-817b-56dc96b30809", "value": "12288:CER9SCF1O8Zw932FAJ5YwaEm2DGTNvp3WM49zQop0HBmLoHxmzPkS+HpPb3N:/R9ZxY32F/wTy1p3WMwzwhg+xmzHCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706603415, "uuid": "ad3b86a3-71a8-4f6e-8312-9dcc46502d24", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706603415, "uuid": "b8cf6ec6-388a-441c-867f-f2110f17d518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603415, "uuid": "d30c8335-3131-42f6-b5ef-214d999f30f7", "value": "SecuriteInfo.com.Win32.PWSX-gen.26901.183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3397ff60-bf92-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706634514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634514, "uuid": "b0181e76-4d4d-4dc3-bd59-6c5a3028d5f7", "comment": "Malware payload (Mirai)", "value": "f47cc607050979da4a6fbdfc71c923a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634514, "uuid": "eda3decb-4ce3-461f-a79a-b6696ece5c53", "comment": "Malware payload (Mirai)", "value": "4d7e4a5698751aa2c1495a5e6241885ccb9b5d52b3c27444b3676db27d3bd809", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634514, "uuid": "679a2b7d-c2f0-4a3e-b6a1-e62fc28426cf", "comment": "Malware payload (Mirai)", "value": "37e1dabab269e38cc3b696768b53b6b2d3f2abc3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634514, "uuid": "2056cb03-f7f4-44ec-983c-85e836e41737", "comment": "Malware payload (Mirai)", "value": "924eefcedaf7daebcef616a650ba4d6cc70a100566c55ea7013fcba4b5f910312db63e576f0a495e9405a771ff5a21c6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634514, "uuid": "2c7fe9fc-a0d2-4b11-9db1-55bab35ad41d", "value": "T154042A46EA404B13C0D627B5F6DF42453333ABA497EB73069628ABF43F8679E4F22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634514, "uuid": "cc73f5b7-a599-4f04-93af-34a8805cd6a5", "value": "3072:uk/ucwNbBLbcBCkoajwdyqkk4/T/6EBpxu/hJjogM/RkWT+M:uk/MBLbEloajwdybkwRBHu/XMgM/RkWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706634514, "uuid": "9c80fd3a-389a-4e77-8936-0aa2886ad870", "value": 179821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706634514, "uuid": "b5aa08ae-482f-460d-93b9-79e5cc2cf9f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634514, "uuid": "a9e67df0-3e61-4e24-838f-bad9d7334a41", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edcafc9-bf78-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706623312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623312, "uuid": "441d8131-109a-4a7b-b505-30a2a9f80fa7", "comment": "Malware payload (Mirai)", "value": "518f6c7baaa380dd17bcc368e06e82e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623312, "uuid": "a6c47b8d-ce08-49e7-b03d-c9dd3723ba97", "comment": "Malware payload (Mirai)", "value": "4de2f520d7876eb2abc0677683e2d99352cfa964bf9de5635ffcd0373a38c147", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623312, "uuid": "ffc79f6d-92ae-426b-a202-ab3979bb09a9", "comment": "Malware payload (Mirai)", "value": "d6c4651425aec20e295eedb5b3e3e9cbfae68dd4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623312, "uuid": "926397a6-0551-46f0-8406-0cad35b054bf", "comment": "Malware payload (Mirai)", "value": "4f40a5d9ca6f176281cc363714ddf26ee6eff998c8fdde608bd7f47dfd45054ced0127fa75859234d4b610408e251ccd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623312, "uuid": "4bbd7384-388e-465c-a4b8-a9d015847d8c", "value": "T1FE632AD6F801DD7DF80AE77F44234809B570B39651830F3667A7F9A3BC721A80962E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623312, "uuid": "28c9c83c-274e-454f-b52e-388f4b7361af", "value": "1536:04bmlitZJxKb82Gyn9RQMNwmjj55AD7Y7WvKbxy:l+ebKQyn9Rrjl5G4Vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706623312, "uuid": "f93e3960-d470-43b3-86fc-d847a1866234", "value": 70040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706623312, "uuid": "44ad1925-6b9d-4e3c-855c-2a016af0b0c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623312, "uuid": "10a883b6-3dbf-4757-a591-c1b6bb0f1d5f", "value": "518f6c7baaa380dd17bcc368e06e82e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d21377-bf3e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706598387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598387, "uuid": "743e5934-439c-4bd5-b158-e4d3b8433d7f", "comment": "Malware payload (LummaStealer)", "value": "415294ce33ca3e01023134503f26f9ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598387, "uuid": "4432a6cc-c224-4263-b1c6-f69d5002cd26", "comment": "Malware payload (LummaStealer)", "value": "4f060209fa2212a75fdd0f6b12fbe23eb29ac1fdecc95ff6ba65db63300d7d4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598387, "uuid": "021ee9d1-d532-4678-a959-340072e8bd43", "comment": "Malware payload (LummaStealer)", "value": "6bed7130d4771f39532cf716b481d41c25c8701a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598387, "uuid": "4789fa35-030d-4aac-8da7-9aefdb7f5d7a", "comment": "Malware payload (LummaStealer)", "value": "ac8e93ea0a11597c3a588edbe725000520db4d6559ecc0b7332bdfdb36d0fd28c4e893cb269da3c884a1582353f30b55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598387, "uuid": "96355d05-fe4b-4c99-8597-e69856ea566b", "value": "T1A9463360AECB3AADC4AD86795353FD6C30F82FA889355439851CBBE79C5349852F4B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598387, "uuid": "5cb5f7fb-4396-4ecc-ad0b-5cf4d377bfae", "value": "92e05c894e0e4c4ea34a22621a9789dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598387, "uuid": "211c5712-c6f4-482c-9740-b46f9bc50414", "value": "98304:gwP/nZf+Yob5s3HsvbbHkaIgpIPR6lk2LSEai5ukefgnC1BZEeRMGXh901s+2IUr:gw3xwls3H8fHkjcIQlk2JB5sYnIBZEe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706598387, "uuid": "cd7a226d-4026-4b27-bb3e-8047668cdc26", "value": 5852672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706598387, "uuid": "71b574e9-3189-4177-bc56-8c16d8e8a794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598387, "uuid": "216da17e-17d8-43ec-997c-bae3cce8774a", "value": "415294ce33ca3e01023134503f26f9ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d9ccc8-bfb3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1706648951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648951, "uuid": "d18cbc6e-5918-4cb0-b15b-64a217fa3e8c", "comment": "Malware payload (Stealc)", "value": "0315254a52bc012cd27310f9e8cc0a0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648951, "uuid": "fe87367f-b764-4de2-bf04-4eaeb46296d4", "comment": "Malware payload (Stealc)", "value": "4f883a42e2baa671520a7471c0fefe56fd75be8fd5abedde10e2873fed11662d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648951, "uuid": "0559c304-db73-4a10-b4c0-3fd43ba80179", "comment": "Malware payload (Stealc)", "value": "81f33ba791c05da97c0406a90d827c44bd26d630", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648951, "uuid": "34309c55-05a1-4f88-9030-791b0196eb0b", "comment": "Malware payload (Stealc)", "value": "4b7d57ca293fddaa6c5b56dff505cd5d2ca5fd5388c9cb30d3bff752d81d7126eb80df53b12d2bdd10f665e64e04b9e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706648951, "uuid": "1cfd3a1c-8d13-4876-bc14-872b8d32fa3b", "value": "T1FBA5334DB5538E32E8B94972A5312BF767BE8E7845D439187734B7C8387002B229FB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706648951, "uuid": "45e2caa3-4c24-4c7e-83e9-8a38e65237b3", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706648951, "uuid": "cf98fa43-bca7-45e8-b3d1-bf0ba525d7de", "value": "49152:ChzF2z0X1W34qvuyXPHcqaGqW9gwLgMyu5noEiyIJAuB:ClFdFWINS/NF9gpMR5oEfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706648951, "uuid": "01ef3a65-679e-4517-bfd4-ad239efe2569", "value": 2123211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706648951, "uuid": "fd68ba4d-1ea4-488e-a44c-6868f6148a04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706648951, "uuid": "64170526-62c5-4347-a0cc-533b1400b9ab", "value": "0315254a52bc012cd27310f9e8cc0a0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f17fc91-bf5d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706611824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611824, "uuid": "38b330a4-3324-4035-8d72-7e83a8133a1b", "comment": "Malware payload (DCRat)", "value": "a19d22a2f5989d2e2dc98bb62bfcf9fb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611824, "uuid": "cdb8702e-2665-48ce-a53a-f09af9ce52be", "comment": "Malware payload (DCRat)", "value": "4faac7b368c5b46e3a5cc10300e9be5ad85463c29a8d38025c8ec386ed06a9de", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611824, "uuid": "12a6fc40-892a-42fd-8eb6-d886cd9dd0de", "comment": "Malware payload (DCRat)", "value": "b8f39041eb1e294b4952197a06d33e8bf885714f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611824, "uuid": "c50a25da-1703-4ba9-a51a-355d99ae3da4", "comment": "Malware payload (DCRat)", "value": "f3dcee30c0367f89d76844da7289bb8d36d0d30206e9eb89e567e7f771395562c982ad93e10afcdcd8297fb8e7bb677b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611824, "uuid": "075c3c83-d4e6-48aa-bcf0-e1eafe589085", "value": "T13AA733ECF230AD4BD6429CBDD78632D2B763C52F45C6BA56F14998358C500B863A2F1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611824, "uuid": "f75baa4d-08e2-4fdd-9ec3-b51ca92d466c", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611824, "uuid": "77fb5e78-445f-403f-964d-011d9d72e44c", "value": "786432:yLEB9kPgvPAK9UGJ7dcsfh3n9dCmBSIARXSK6dZPpj4HabgRVUv+oIr7IPaDm0zY:EE/ko19UeWsfh3n9lGRCK0h8HygAvjIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706611824, "uuid": "68d21bdb-3805-4b2f-9929-9a87620cb092", "value": 45981696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706611824, "uuid": "d6cf83c1-663c-4c6a-bc04-651fac4997c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611824, "uuid": "71f61fa8-440a-488a-83a4-5c3546aae397", "value": "a19d22a2f5989d2e2dc98bb62bfcf9fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b7c239-bf5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1706611649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611649, "uuid": "4e88d367-28ad-491f-9127-ac07683f3e23", "comment": "Malware payload (DBatLoader)", "value": "f3978247520bfb1ffffbb57dadb1b87d", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611649, "uuid": "8b8a4f1f-d719-4b2c-823e-4c49aa12d405", "comment": "Malware payload (DBatLoader)", "value": "503c47d263e7f72b764a3d5624dfcce5626e2fa3779275a125c1e7f6821ae30d", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611649, "uuid": "a7d60bc4-b82a-4271-8be4-329b79ce7f9d", "comment": "Malware payload (DBatLoader)", "value": "32cfbb0e7f78f0e92b933e2c6c6574fc57c798e5", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611649, "uuid": "a78fd756-d6be-4d3c-b544-fee83e889d29", "comment": "Malware payload (DBatLoader)", "value": "5f1d34ec561a5a5ba498982c270fc706138b9c1fa68c6339d6e7a185665129b6a33aa205edcc115fe99256cd17d19abd", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611649, "uuid": "5d271642-d069-47c3-bc6b-576ae7e2e83e", "value": "T11365339E64DAE433BD2108AC7467FDB13C20E92394507CAC832B09B5DB075EBAA7D571", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611649, "uuid": "bfca61a6-bf05-4acc-84be-d0c8af621cc0", "value": "24576:iqWHfAG+E6oxPe+I/cGcaK/jPqIw/gXuaAPHvg7GYSvuKjyJ7UmlVpfJDfPhf1R0:i38EjNw/NKqIw8BwyGYS6JDf59RikYXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706611649, "uuid": "ad97c7b1-2fe8-4e60-8847-007ce8939c56", "value": 1412302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706611649, "uuid": "d222237d-95d4-4167-af9c-c4d7e0eab5ae", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611649, "uuid": "44a0d6ab-452f-4d8f-8ba4-ebdde6e0892b", "value": "Wire_Transfer_Confirmation_P729200FBQ12.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c075054d-bfc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706657514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657514, "uuid": "414c803f-6d28-47d7-b259-534df8ae704f", "comment": "Malware payload (Mirai)", "value": "486decc38ff2d9ec0ca91e2ef81cb52a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657514, "uuid": "c732b576-6ac7-4d47-9385-1d0b29ff007e", "comment": "Malware payload (Mirai)", "value": "53a984f2c9affdd19bc5ce343dbf6441407f1786f01553e929e30624cece9adf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657514, "uuid": "cf8ddc2f-1a2a-4f6f-adb0-38980337c06a", "comment": "Malware payload (Mirai)", "value": "6d324f12368e378c0f55190d104bbb26b0a2627f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657514, "uuid": "6006cfbf-a2d1-4183-aa79-9d7349be9c86", "comment": "Malware payload (Mirai)", "value": "d0af3eb06efffc5402fd5cbf255aad3f4d572fc51e7dae5ae3f831a5d4b48a4f8f66c88fad59c51f6c970f4f618f2d51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657514, "uuid": "b47d1bde-54bd-44f8-9af9-5bcc59ee7b57", "value": "T151A2D0D66D4B6556C1740FF1E838E991436E0670E6AB30732108CF6B3A99C9A73F891A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657514, "uuid": "1c19b24e-4dde-454f-a571-0d5a58195490", "value": "384:kzOxPVM3OF8/Wd+9yFfJNmOkpNbLIfGBpoz8vE2qMIcbRjyRmdGU5eT6Nu4O:kCtVM+F8/A+kxzmOkTvyMHY3UQee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706657514, "uuid": "ca81a652-5c80-40ed-a51c-2fa50657baaa", "value": 21792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706657514, "uuid": "628f82e6-131a-4d60-9819-7a6a8f1b3283", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657514, "uuid": "eaa59082-26f4-4f09-863f-f9cdb60e3a4e", "value": "486decc38ff2d9ec0ca91e2ef81cb52a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2be37b-bf59-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1706610292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706610292, "uuid": "26988546-a8c9-41f0-bd28-fb8121f26da9", "comment": "Malware payload (Cobalt Strike)", "value": "40dda1b39b42825b0877cefc8e849bf4", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706610292, "uuid": "db1d044e-34c9-481b-a8f1-708c9d4c253b", "comment": "Malware payload (Cobalt Strike)", "value": "5509ec26758c3c0dcf2bf1b0d7d8600da08cdcfb73cd6b90d46f84ea61c71094", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706610292, "uuid": "dda3fa1e-9766-4838-8b9d-a076accfb8ec", "comment": "Malware payload (Cobalt Strike)", "value": "527453a0f60ba6bd027bdd2d57a0a903270956e9", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706610292, "uuid": "f2c030b5-6aa6-4e8b-888f-3109e808cb7a", "comment": "Malware payload (Cobalt Strike)", "value": "9cf1e2b92541f956c9500aae4877dba685b35e1f67e0413f99780c26b4d70421c23081a1d3279f9b58a55b3680d278f9", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706610292, "uuid": "d073cbaa-c5dc-439d-9c7c-6b605b856426", "value": "T137445B327264AF13E41E4D3194EDD5A47F66FC1389A88A8F79C93F1E7C7A9106E03660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706610292, "uuid": "f7d89aa8-150e-4611-b8cb-66331f87a8e3", "value": "6144:zmJqf7Qsa9L/tO8rqSA81Pr4Y0Oz7DtL1Z:VQjL/KSA4Eoz7PZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706610292, "uuid": "fde6d0da-8da8-4aaa-abaf-378338c58071", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706610292, "uuid": "c6fe16cb-bd39-49a5-a882-8ae7c1a5509e", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706610292, "uuid": "2b03b798-f2c3-4ded-890b-166b783ee21e", "value": "prozorro3.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc09012c-bfc4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706656325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706656325, "uuid": "8e2f7d51-c4ec-4764-8504-6d0d63d09f29", "comment": "Malware payload", "value": "1c36177ac4423129e301c5a40247f180", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706656325, "uuid": "98a90bf3-a6db-429e-bc18-df6994b733fd", "comment": "Malware payload", "value": "55a0bbde3e32c559715cdc9c7d30d003b9e14725a6369d30edef20c1ed6dd994", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706656325, "uuid": "ef56d4fd-d517-42a7-8855-7b0060762efc", "comment": "Malware payload", "value": "b3453e58af7d90949ef6843f380f5ccfa9b4943d", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706656325, "uuid": "e736ac50-f4f7-4b8a-8ccf-6defab9b7571", "comment": "Malware payload", "value": "36df423b247720850f92ec751e5b4e332ce07fac0659da05f850bc38db9938c2c6cf404bc612683f8689bfcf9b876cb6", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706656325, "uuid": "abdd7a3c-0250-41fc-98ea-76889b105395", "value": "T1467423B8AC7A613BDE0CF6A66C9EB795C03C289994B97E371EC14070F0E73C5E909165", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706656325, "uuid": "be2e4649-d888-48b8-9a9f-8d9960475d15", "value": "6144:i4EGSIITjgtYLpzNDmjpVs6NSgPZK1mLY8djo/GAUcTkBj2Pn10R0TbMcrF:ijG0ot4HYpVs6NSgPZK10djK+csj2P1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706656325, "uuid": "31723496-4318-4f55-95e7-b89c14488330", "value": 363820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706656325, "uuid": "570aeb01-b2e3-4644-ae74-349aec41e6ec", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706656325, "uuid": "7986daae-94ec-42fc-9166-acbefd8a9e71", "value": "2.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b302f62-bfa2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706641533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641533, "uuid": "2169e61f-4eb3-4bfa-9dcc-0e3a9c8c72a8", "comment": "Malware payload (LummaStealer)", "value": "5e58319a867cfde2f61a5282427c077c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641533, "uuid": "c7738f53-4374-4b22-a493-54eda83fec42", "comment": "Malware payload (LummaStealer)", "value": "59311e8e9a0a8fa14bc043613a4d38f8febdeb4f633fb3f36d812e9bfa236181", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641533, "uuid": "2d5632d8-b366-4a67-ad43-56d03962ad3a", "comment": "Malware payload (LummaStealer)", "value": "c42a13d6b3096ea9032f26dd40bf36744b078cce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641533, "uuid": "b5508ea8-d8e4-432c-bde8-a60ab706ccd1", "comment": "Malware payload (LummaStealer)", "value": "024afd56fc161e692e44d7c4d94ed365efa0e384e990ba564ce37758d175e21f11572d2c23319ced9d2bfc38e65937be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641533, "uuid": "fffadfc4-3b9b-4d8a-95e9-62f5a1caf557", "value": "T16AF633C6F1F40A5ADA2FF972D0B416B6AC22717659418C0FA36824E4F1E79FA4F73421", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641533, "uuid": "c15bd0c4-0a7a-42fd-8081-26c9d283fd84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641533, "uuid": "361a2cca-1017-47f5-869d-7a1c97ad6702", "value": "393216:VDw9QvyBAsNAfDCMUP/UwlADdFfXP1y1jRPcMjeqwUX:5yisJjP8nDdFVyTcMyqDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706641533, "uuid": "d75813fb-4e07-4353-bac0-e4e666bd7fbf", "value": 16571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706641533, "uuid": "d5874c91-fa30-42be-86d0-ffb5485a508f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641533, "uuid": "42e1b55e-4251-4538-83b7-711b0a5c3a8d", "value": "app.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a17273d-bf3e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706598447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598447, "uuid": "5a4ecc17-77d4-43f1-8451-8eb43bb2895b", "comment": "Malware payload", "value": "21c64a0821735d6be26e4475d3a9c6d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598447, "uuid": "0b8a4f72-9ae4-42ed-92a7-e5b0cb804e4d", "comment": "Malware payload", "value": "59ca8b5d8711a3aa4009d181b0a38e3a909088b0d35ffde7bd7fab27492c5ddc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598447, "uuid": "55c96170-45fe-4b2d-a18a-f9b04924f55a", "comment": "Malware payload", "value": "cf691a5f8fa574379f8d210780e0badf217bdc02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598447, "uuid": "0d677840-946f-417b-bdd4-e4ef32727fb2", "comment": "Malware payload", "value": "09a5e6f0c084f2f6d6432838ddc5dfe292b5a861ff1ac9a6cdbda25f6edad593e812bdb3c7dcbf6e7b3f6e1aa290e654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598447, "uuid": "8d15d8ed-10f8-4770-b09e-eb5e3b0bfcc0", "value": "T17105F12032E5F032E2B375315934D7B1473BB8222A32799FAF95167A5EB56C18E7130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598447, "uuid": "f5cc3ca6-6ead-401a-b749-878258cf588e", "value": "056357a8f98a77fe6386c868cc8d22fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598447, "uuid": "f7c2969d-0807-4579-ad1a-15e4a507cf4c", "value": "12288:VAubpblZljkgs7FmNNTj7VQV+VVoNtVE53rKfyBpJsEyF4spqHaFoeYxYmE:V9V3lpJ7W+gDE5rEyBpJszycq6OxYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706598447, "uuid": "7ab4b512-6bd3-4e65-ab63-1afd0f8218f7", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706598447, "uuid": "f34ecb1f-e979-48e5-b461-d30688be4b93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598447, "uuid": "9f3a8f60-454f-4dd8-9591-52d53d704128", "value": "21c64a0821735d6be26e4475d3a9c6d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f968840b-bf21-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1706586313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586313, "uuid": "d5f71851-2a04-43be-9bb2-24545249c4d8", "comment": "Malware payload (PureLogStealer)", "value": "8f505e8ec6a2129264b6609d96e68962", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586313, "uuid": "f094c85c-a90e-48f0-8972-d9e8eb1d0cca", "comment": "Malware payload (PureLogStealer)", "value": "59e7180a2a869453fb54d13f04b4eda1a5153659378501fa31b18f862576f800", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586313, "uuid": "d98a4707-e799-4500-bac7-0703350126fe", "comment": "Malware payload (PureLogStealer)", "value": "a4f8e2102645ad87b37c4de7fa45779d3bb70f18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586313, "uuid": "7affef66-2391-4c28-863b-10088d37f510", "comment": "Malware payload (PureLogStealer)", "value": "b353fd45979b035ce677eb0c516e399574e47446a6d2d6e86e78f7a73c602c64ac1e3d876ee959c91bb9c6d2014f40bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586313, "uuid": "014aba5d-095e-4c4a-bbcd-0d6b9d058be4", "value": "T1BF46C0261B670A730E5CA78C3476D48A144DC9FB2AE85722BFD57E3007CED382DDA5A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586313, "uuid": "5456a14a-c90d-4edd-8d1d-a0418a1902c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586313, "uuid": "e8529785-d580-46bd-af7d-2863cfa5e120", "value": "49152:tl+wZnx28ufF6eE39oRGIOVgdDll+wZnx28uf36eE39oRGIOVgdDp:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706586313, "uuid": "40baa9eb-e92f-4cbd-8a19-82b76a33afbd", "value": 5687296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706586313, "uuid": "b7059bf3-dda0-4dca-a19e-8d75848cef13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586313, "uuid": "2f9cb052-4f27-49c8-afcf-c923cd3bd901", "value": "8f505e8ec6a2129264b6609d96e68962", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c451572-bfb9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706651440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706651440, "uuid": "cf10c491-d4d1-411e-886b-a1dd7f838d51", "comment": "Malware payload (GuLoader)", "value": "ba0d243a5e2a679ffacae0574a40b36d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706651440, "uuid": "5b233e84-bfc3-4a93-89e0-840a2519ef0b", "comment": "Malware payload (GuLoader)", "value": "5a09bf672418604d897543db6a61ddd4ea6b63eb9594fc2c82d1bf758817eb08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706651440, "uuid": "ba6b3f85-2a0f-4c30-88b3-338e4727a3c2", "comment": "Malware payload (GuLoader)", "value": "71f7e787d6e40752937531622dc9257061d38146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706651440, "uuid": "6aecea9b-82e1-433b-9c7a-b0ee0e41e00c", "comment": "Malware payload (GuLoader)", "value": "f100594a405d8cafa311a958b8f690a948a113af6124fa700a48bf528231de47063e76ecc5ce8e9f71978717e34bf5f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706651440, "uuid": "33ec6dfd-3767-4376-b2ac-028f91c9d9e7", "value": "T1ED4512D3B6C8CBCED1041A31D97ACAF30665AD3CE911160B77A1FF4EB471292E827199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706651440, "uuid": "cd4c13ed-c4be-46ae-8959-64904bf5e7d5", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706651440, "uuid": "3dabd9fa-7753-4ac2-bce7-ef457eef1cc6", "value": "24576:XUZqqixyuvusFIZdz+hDkiUgEnTZUQplhDx3nxEWfi80HcUiAEV:XhqidGsFIvz+JVlEnTrpfJ9f0Hd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706651440, "uuid": "dca1f32a-0d5b-4f23-b137-1281d9122623", "value": 1269912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706651440, "uuid": "22590c16-d62f-4535-9fe0-e4ced4d8eaba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706651440, "uuid": "6dfb100f-c4ae-4744-a19a-4765d49567ed", "value": "copesetic glasrr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08577cce-bf93-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1706634871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634871, "uuid": "f7c21943-a718-4085-85dc-4671dd7b2d2f", "comment": "Malware payload (Socks5Systemz)", "value": "341edb9d58cd37043107d39849e09aba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634871, "uuid": "7e5e71c6-ebee-4173-9e7b-d5bce5563229", "comment": "Malware payload (Socks5Systemz)", "value": "5e2bfc430cd10ac7ba31f6d5e2051abaeabe9b5912c3ed8e4d3b87bf48a8154e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634871, "uuid": "72fefae9-c598-4659-9ea2-3bc7411d8cb4", "comment": "Malware payload (Socks5Systemz)", "value": "f3511211495f2225a53fe946e569f317228721de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634871, "uuid": "865241a1-5bcd-4575-ac6e-1e3707b2183c", "comment": "Malware payload (Socks5Systemz)", "value": "34914ef30e906b8a6e08dcb0e412a920f1cff190bbfd132692fbb00c2c8aee777f66b7e90af65f75ab4319c9480f9755", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634871, "uuid": "aafcd52f-5e6e-4f90-9ede-c8b0095a72fc", "value": "T13866339140F8A7B1D29DEE366D4CD0E6E6397EB13C307A24546F32AB2F410A12E4D797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634871, "uuid": "5318292a-8423-4b92-b3b6-aacd6eb51b21", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634871, "uuid": "3f0e4467-c12b-4fd4-9531-57105edc23c2", "value": "196608:rOXdRQGP6EbF1xlhU+71qGSAfrao0Av43ZKqEASnL6w:idRR6E3xlhqX6z6Z/Vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706634871, "uuid": "70af847d-16a0-426d-bef7-c87aaa19e4cf", "value": 6556752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706634871, "uuid": "d21f89a8-61b5-4960-a02c-5fbf2bb73eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634871, "uuid": "38b3feae-3256-4ba8-b2df-77c8be6db85e", "value": "341edb9d58cd37043107d39849e09aba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3116d7c-bfbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706653680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653680, "uuid": "b7f470ee-4141-467e-b601-8ad6824a3b4a", "comment": "Malware payload", "value": "997ba7d19077760d7ad2ad89d0ee7616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653680, "uuid": "dc7c8665-35f6-4eae-a592-338db46c9fe3", "comment": "Malware payload", "value": "5f0dae6e7bc8176da27b80e0e917544ad5f69fca0b7044889a0f14ba71721aba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653680, "uuid": "ede5f7d7-af6a-4465-accf-f5e6616d5aec", "comment": "Malware payload", "value": "cff3df44b11089c97b2e65b4803dc5566ffced8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653680, "uuid": "5c113fbc-3572-4c96-bc96-8749ec5ef85b", "comment": "Malware payload", "value": "9928be97f79133256dd543b3ab32fc6e3e4bb48294fbfa52251aac69f378f5b1756781ada7f0c03bd76d42e21e380b96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653680, "uuid": "7828b357-a71c-46bc-a12b-375fb1c25b49", "value": "T1712623A138880071ED7B6331BC21E32B91E5B91A2ECDFD7759C4C46E16A9DE11349BF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653680, "uuid": "13f805f7-5849-43a4-950c-8eb0a4f87223", "value": "3274eb31a09f62e60543d12bd4fbf1e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653680, "uuid": "c5761b24-8dd3-439c-a53e-628b0e66f603", "value": "98304:tXST2XW0d54zvQniT1WEAqEpnrBxwyZ4DESLnx:Zrh5iT0EA1pnrPTmLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706653680, "uuid": "2bc23575-13fc-47a2-bc97-9142097fbff7", "value": 4744255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706653680, "uuid": "aa98ec18-a403-474d-9d2f-df5b920f5bff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653680, "uuid": "874f359a-f7eb-4d73-9619-c1ef082b81eb", "value": "SecuriteInfo.com.W32.Llac.Q.gen.Eldorado.17726.30458", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7607aef2-bfa6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706643216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706643216, "uuid": "edfdedc6-7ad3-47e4-8157-74253f1cf638", "comment": "Malware payload", "value": "7a2fee41157ed80055f16c07c2890aa1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706643216, "uuid": "81457238-35d2-48e5-9188-6678c3f11e13", "comment": "Malware payload", "value": "60888bbba92173b3200ccd9ca388f13b38a364678f5574f7a9fed74653f2ea7a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706643216, "uuid": "dc7327bd-9505-4fe9-9167-a53ca61fc6fa", "comment": "Malware payload", "value": "814c86e1b24da67c15bf1ebec33759e3beea9770", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706643216, "uuid": "01001239-f3ac-4561-9853-4ac441d93af2", "comment": "Malware payload", "value": "7cd41b9a56b17ce672890caeafc6036d7cd702a4347bf9c456fdf3a83187929525e4bcc62df3aaa1ae19add7909153ad", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706643216, "uuid": "c14addbb-8fec-4ca7-af46-2cbef0219783", "value": "T13F36333539814E61B60FD0FCB4983A677696730494BD66CF92BAB9D84842C09FE07F2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706643216, "uuid": "30014f87-7fb4-4c88-ae6c-0b7a44440c17", "value": "98304:GVknhwLdJ+NUuu5qJgoOWnw2ij1gDbYDjqIM8NbYZ4/GTtzcx9pW:l6dJ+Reqyb72G1pylThcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706643216, "uuid": "5c44e1db-5dd2-469f-9548-e93f8d92a952", "value": 5332241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706643216, "uuid": "d3dcf571-30cb-4628-964f-dbba505d6338", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706643216, "uuid": "6caf6804-f22b-43b4-a569-776b65f3409c", "value": "X.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a328363b-bf30-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GootLoader)", "timestamp": 1706592611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706592611, "uuid": "161f3722-1ffc-4563-9e25-40042e22e04a", "comment": "Malware payload (GootLoader)", "value": "f48bef9e5bb14466f5fdefa019f1ca72", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706592611, "uuid": "42ed505d-4d9a-4eb8-b1b3-90e750178a14", "comment": "Malware payload (GootLoader)", "value": "61b0b9be83f47f7691800f81208dbacdbabe49734d22ab889defccb87e2bd9b9", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706592611, "uuid": "45895761-636b-4985-aec2-4697537a7d62", "comment": "Malware payload (GootLoader)", "value": "d67335910dcbd1477d224f37464959e17c4c8e7a", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706592611, "uuid": "44f01931-1017-487f-a9ed-8ff85b21c3ff", "comment": "Malware payload (GootLoader)", "value": "20ed5ec77a2a4b3bfbaae5fc88128a7f3f0aa09f67c4a8ed4be1c632157d286a16f065410d1089e4759d0c880389eb9e", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706592611, "uuid": "98971851-3b62-4259-9206-da25e0153bec", "value": "T1AB05E858E7DC200642737078989F94C9AC3CE41A819DAC92FD0CC194AB94AFD997FEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706592611, "uuid": "c332e0e4-86e7-461a-8e41-84f271d5a352", "value": "24576:wKCgo+ogQc5WfNnZmD/nNZYqErPea8ToxxkWpyQTaSFNE3NEr:wKCgo+ogQc5WfNnZmD/nXYqEiP+kWpyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706592611, "uuid": "771cb075-5798-43df-9c04-f4c4d0950998", "value": 860772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706592611, "uuid": "c62edb2e-9792-4c14-a423-b80224e07feb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706592611, "uuid": "04007664-4dcb-41b0-af5b-75e0cd16df39", "value": "is it legal to own a fennec fox in virginia 565.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31fb280-bfba-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706652015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652015, "uuid": "1345368b-9c60-461f-964f-956307555e10", "comment": "Malware payload", "value": "6130f294d48ba8ab5d27dca0940ce3ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652015, "uuid": "b83b5fc4-d815-42ac-8c4b-030d1bca15c0", "comment": "Malware payload", "value": "61ff6927aabbe693a6eefce8fc39a89e23add0bdb3e7526f5c6878d9a0e3ffc2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652015, "uuid": "699ceaba-4975-4b17-8122-e078ac21da20", "comment": "Malware payload", "value": "a8a2fed9feedcd9540882e3a1667dfb5496f9a7f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652015, "uuid": "476cb60d-9642-4985-a104-9624e3df2640", "comment": "Malware payload", "value": "53be714c43babf611d3c74bf1e520127d4df1300cc1f6728e773c15955307155b0b5b0bc39ed4bee1483b6582c874e0d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652015, "uuid": "9d2bcff9-824e-4fdc-a9fc-1fb915a42094", "value": "T13FD32B56EB408B13C0D61779B6EF424533239BA493D773069928AFF43F8679B0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652015, "uuid": "9cfde74e-abf3-4ff9-ab6e-1b372f7fc9cc", "value": "3072:yzGtlgX5taOgQ5pDYY06MATSivRo/u+EkfM/9/M6H:yzGtytaOgQ5pcMMGJo/u+EkM/9PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706652015, "uuid": "e54f4d63-39c2-422f-a458-32a42ce54d69", "value": 140758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706652015, "uuid": "2bbf1ac9-f025-42f3-9b08-d5a6b8374387", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652015, "uuid": "f51c6283-1e20-4018-a1a5-96f78e6cf170", "value": "a7.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0256c79f-bf82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1706627560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706627560, "uuid": "2e50f66d-da09-477a-9719-2609fe89a612", "comment": "Malware payload (QuasarRAT)", "value": "83f996a5252a30e0e199225fc6eb4b33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706627560, "uuid": "fbe99312-1577-4bd5-b61c-f010f89ab014", "comment": "Malware payload (QuasarRAT)", "value": "6285137b6f585e1829051ffa8355e9a11bb81ec51c4b576a63a1709cb4846675", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706627560, "uuid": "750f57f2-64d5-4e7d-8220-813492dc3338", "comment": "Malware payload (QuasarRAT)", "value": "f2f9260df531dda677aed101bcaa45f8bcb194bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706627560, "uuid": "33cf029a-6753-4866-b854-1255699cd9da", "comment": "Malware payload (QuasarRAT)", "value": "6b8ff5d22d0cc5bde49e59195095c9ba42253237d5acb2d8e4041c7c6fcda9146273b4d12ddd728f6d86c25da011b12d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706627560, "uuid": "1f21b930-9c69-454a-9e3d-e93eaddb43ca", "value": "T19DE56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706627560, "uuid": "3ab465a4-aed2-4417-9c5e-613f12db0c57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706627560, "uuid": "27edb36a-32bc-41cd-8e00-266b5a38c712", "value": "49152:ZvyI22SsaNYfdPBldt698dBcjHHQRJ6ObR3LoGdMdTHHB72eh2NT:Zvf22SsaNYfdPBldt6+dBcjHHQRJ6Ic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706627560, "uuid": "04130452-2dee-4857-9b69-08633f2aba93", "value": 3268608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706627560, "uuid": "35962e4b-3018-4e1d-b826-046be2c8d53d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706627560, "uuid": "6b8b76b0-30ae-4658-88d7-f2dccbab1c7d", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a010a050-bf59-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Fabookie)", "timestamp": 1706610215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706610215, "uuid": "bde36efc-473e-486c-99d3-b27d16a85a9a", "comment": "Malware payload (Fabookie)", "value": "b799142f0247275b950d573fd171fb92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706610215, "uuid": "362661c0-9e41-417c-b5a2-bb5d7d288702", "comment": "Malware payload (Fabookie)", "value": "62af2f24a8e53b72b09ff55f94eb0723f491e1bee22fa15b3d938592d391740f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706610215, "uuid": "1d600028-c8c1-4715-a59c-04e78adb68ae", "comment": "Malware payload (Fabookie)", "value": "7be9070536ab6e85b973590398e7dfff5d4357d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706610215, "uuid": "95c590b3-6cde-4728-90bd-ca27aefc39a7", "comment": "Malware payload (Fabookie)", "value": "74609ba82737a7cfe4ed8c752914099324e8f7b528df97348e723fbd965d09b11cb0146782b4511cdc7077bd9c6866c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706610215, "uuid": "d4cddce3-eaf2-422c-a666-157d7855ed3c", "value": "T14F941849FB7408B6D096C531CDBE8376E272BC831B25930B8641FF5E2FF36216969681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706610215, "uuid": "0cca2c47-0147-488b-b1d3-c49ae18f513c", "value": "ff082fef3d15cdd142534440e54d6a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706610215, "uuid": "c3eb26c5-5d23-4569-9577-c0b21884a87d", "value": "6144:vyoFqDQLwcoEHMBoiT4MKBz3I8J/GxerEhgVIXFM:vHpUcoaCVrKi66erLIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706610215, "uuid": "6faf6530-f4b4-4deb-82e9-983b1c4c1309", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706610215, "uuid": "68a94a0e-570e-4e7e-b627-66f70551ebb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706610215, "uuid": "74ac682a-e9e4-4c62-ba31-3dda860c8147", "value": "SecuriteInfo.com.Trojan.DownLoader45.62336.4021.7794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e371946a-bf85-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706629226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706629226, "uuid": "602e19ef-40e0-4b46-9b4c-856670810c64", "comment": "Malware payload", "value": "2f4985d9de86ca2f6f2a15dc78b7ea87", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706629226, "uuid": "465010b1-5b87-4105-8a7b-7bd8d9e529d4", "comment": "Malware payload", "value": "6638d55eb3da7608b1d118457aff0c8353c801e6bce7e6f08ed9ceb28c845e75", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706629226, "uuid": "14d4a02d-8863-4f4e-9466-d0db6d77277d", "comment": "Malware payload", "value": "235964df75e0db6e29d55b1b48026dc5a570b66c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706629226, "uuid": "8c7c2c65-cb77-494c-87f7-475ad72eed9a", "comment": "Malware payload", "value": "789043a2bdee101264774d6cdc2dcaf49a5527efc30970a53a42f1900702b6c4a6436539c9467d7778b77aafac894d61", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706629226, "uuid": "64f82547-b091-4bbd-9421-b3055138c650", "value": "T15E14A743E64710B598B643B3ED0B412EEE6000B750659840FB5D884DEFF6A9ED3B668F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706629226, "uuid": "edd11109-92c7-48db-aeaf-cb2476e30a17", "value": "1536:CY4NyWniU8V24qf4t0OeJ9IScaUvgX0sXMyX5XAXSXIXSXQXAXcXAX/XmX6XXXFC:CY4Bd8Alf4uI9vCOjX1cD91Mry44iRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706629226, "uuid": "f5930462-98a6-4776-b95d-c8e896e62acc", "value": 204026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706629226, "uuid": "3d594a03-7bab-4118-a435-15c90eda884b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706629226, "uuid": "0ea522f6-7245-4e68-b3dc-d2b130e632b1", "value": "K7wVV", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f90d31-bf24-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1706587468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587468, "uuid": "f068eca0-dfc8-4868-acac-dc9543bff665", "comment": "Malware payload (GCleaner)", "value": "5c9e678199c6054597416c49a86e0fa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587468, "uuid": "a1669b5c-0cde-4156-956a-fee1dd34afac", "comment": "Malware payload (GCleaner)", "value": "66fc98dc502d38d9116a0f01c547b42b90c0999ecd31a4f524eca5b4a7909d69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587468, "uuid": "fd489519-772a-43d5-93dc-854f7250be2f", "comment": "Malware payload (GCleaner)", "value": "7d316803b6bdaeff63fd5d3c6b3d0cac32640b4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587468, "uuid": "ab6a76a1-fc74-4094-942b-6cbad4908761", "comment": "Malware payload (GCleaner)", "value": "c3ffee865ec3f9ba50f635fd428665808a6f7a2710e1cd132d7e572bf993fcf2ab36ee390950866cc349f3993232dfad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587468, "uuid": "e53dbe25-c5bd-46a4-8711-193ba2a6ef66", "value": "T1B474AE1066E1C031E2B35A304A70F7B54A3FB8A2F639D58F2BD5263E0E75AC18635797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587468, "uuid": "135e89c6-6000-463c-a464-20afb91e24f2", "value": "0f86209308d034305701c953de1bb53c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587468, "uuid": "5e8f2d4c-a2be-4452-aaca-512e52e06e67", "value": "6144:A7lvMVpuKh1QVI/QVXUH63ytAL0RVuuTfiiySKv/mXGGpYj3:elEVpuAeu/gUH6igifiixXG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706587468, "uuid": "93995810-6983-4c78-a194-eefb539e206c", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706587468, "uuid": "8abe9f2c-6fef-47b1-b5d6-7a346bd1b85e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587468, "uuid": "936d1be3-f6a6-41a2-9708-fa494b5cea9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f042a2-bf9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706639221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639221, "uuid": "50eb4a8e-900b-40a5-8cf1-aa5468a3a569", "comment": "Malware payload (AgentTesla)", "value": "ae0998473231342a0b14b4c2b742d49a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639221, "uuid": "18d80fb1-af82-489f-abae-5a0f07f51131", "comment": "Malware payload (AgentTesla)", "value": "677040e2f1dc15c48b7fbafeeeb24ae465a2897c2c3963f8db00873eaf1d9d69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639221, "uuid": "8cc79178-8063-4f7f-9819-caf7c94ea3d5", "comment": "Malware payload (AgentTesla)", "value": "f5c4cc051e8676959b79fdff7cc937e2593e086a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639221, "uuid": "43273a3d-79b5-410f-829d-a3eb97d3e235", "comment": "Malware payload (AgentTesla)", "value": "47f0d2e8a04da58fd23869c5b44a30538e9d14a6b9033cdaa844e76930dcdf87e355734f3d29e46380a5da8e9f8d87dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639221, "uuid": "c193c4df-37ed-4e15-98c6-acb8a67eabf2", "value": "T118A423C8EFDD1E01309D3E592B35AB0B06D16E6A326C28D505F3B73A8117D8B5395A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639221, "uuid": "4244bd28-e3ae-42d7-9da8-07b6865c8bed", "value": "12288:fckstFJjqO26XykrCUkxq4uhPC2k0oXmjQsn:fy5326XykrNkLWaN0om7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706639221, "uuid": "cfd1aa5f-94ac-4053-a95c-f5bd6f11969e", "value": 484528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706639221, "uuid": "f4acf870-59b7-4913-8d4c-0b90011bdb72", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639221, "uuid": "2c96e924-63e6-46e4-b660-029c02768ce6", "value": "708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938ff6e9-bf50-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706606328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606328, "uuid": "392e7226-fee6-43ab-87a9-14f787a36a4b", "comment": "Malware payload (GuLoader)", "value": "366d41af59eaf70303ebec243da976a6", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606328, "uuid": "ca40106a-761c-4416-b0a4-077c24315084", "comment": "Malware payload (GuLoader)", "value": "67ea5c631a56b18c38c06f3dd4568f7bc336dc0897a912798f07fdb50b655c53", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606328, "uuid": "22346542-70ec-4c68-a397-38904156025e", "comment": "Malware payload (GuLoader)", "value": "3f879b380fb4c0b3761c18ae1a62c7ca865e880c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606328, "uuid": "d0338404-9178-4a04-990e-649861c0b0a8", "comment": "Malware payload (GuLoader)", "value": "57e55a792e690f8c6ad228ea0837e8aab34771f93dcfddcf118cd03cb43dae864cb96c22b1523b177b205e5f1057b26c", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706606328, "uuid": "77d262a3-e5c5-4f85-9656-5f5a27f499d8", "value": "T1F422C0D6C6F4023466C010D6CEDAE051D7E299E884360B89D4C2B872BA7636E9C97F0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706606328, "uuid": "7f67fa47-8604-4442-bb0b-a1e528c390c6", "value": "192:rTCUmRo4spPI6uVHqQfAHlK+s3cjS7MZrc1ePQEaaDU1smtHaOvtUt99DlDsnhiR:0RWlaKwqk/3oS7MZrG6bmLUt99DlIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706606328, "uuid": "113d0ce7-4bce-4666-b872-2756340360f3", "value": 10830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706606328, "uuid": "b753a5a0-5ebd-45cf-9baa-7024e48f9072", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706606328, "uuid": "7350472b-c347-4758-a3a4-47310e75b05c", "value": "CamScanner0091.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0897323f-bf0d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706577319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706577319, "uuid": "007d9d2e-717d-4130-a1b7-750e1b6aaac0", "comment": "Malware payload (DCRat)", "value": "0d64a9960eae9d028325b119a13f7258", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706577319, "uuid": "fc5cccf1-9e49-468e-b3b9-bb1159214e21", "comment": "Malware payload (DCRat)", "value": "69f2383556669975073a487dd45f4c273ebac2d2c2130e5f03b6a96b301a8cda", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706577319, "uuid": "e3fd44e4-20f4-4dd7-9a7d-bcf9c9f56d32", "comment": "Malware payload (DCRat)", "value": "0691edc5c57a873e828ec7ef60aa751eea50c441", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706577319, "uuid": "22dd1017-46ef-4f6a-9342-cad4055b1d94", "comment": "Malware payload (DCRat)", "value": "e633a7c1d5ad89e92330317cca5a12cd4b9cdadf1d51b073572937d2f63c036cb426e4961f732ea8a9b43617bdf0461e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706577319, "uuid": "72f4d059-635f-4599-ba97-39150aa288fd", "value": "T103B5DF027E44CE01F42A1233D2FF495887B49C9166A6E32B7DBA376E55123A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706577319, "uuid": "2a15e157-a3e7-422a-808e-47805a6a9c68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706577319, "uuid": "3afbd0f4-c038-4892-a50c-613275197f0d", "value": "49152:6woi3JNPK63xvSAcboTH29sB7uTmYYn6/sL0VqmYo:6woqoypccTH2+U9Yn6/e0VqmYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706577319, "uuid": "31ab448c-c9fa-4723-ab7f-9fca84f8bdf7", "value": 2403840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706577319, "uuid": "cc65480a-90fc-4a0f-919d-ad706172fbd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706577319, "uuid": "4a6bd9a7-8af4-4723-9e71-ba596d52fdb8", "value": "0d64a9960eae9d028325b119a13f7258.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f64b903-bf92-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706634534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634534, "uuid": "2fc1e025-0cf2-4503-97e6-cc3a40d82752", "comment": "Malware payload (Mirai)", "value": "262a5e5beb1bedb8482758e6d71890e4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634534, "uuid": "e2324c66-58ec-4827-8fdf-a7a960eb49a9", "comment": "Malware payload (Mirai)", "value": "6a720f90b1ebc49b126a20504b4da21f41236af2693f9744db7a2bfdf7192b77", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634534, "uuid": "81d761c8-50c1-4010-b393-7ea4ba053311", "comment": "Malware payload (Mirai)", "value": "46b026217e15a5bf620e1fa379ee4db4cbd462bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634534, "uuid": "c6fe6320-c4a4-49d9-a4c5-796d5080abd8", "comment": "Malware payload (Mirai)", "value": "a4971057c05e89f1247581f3e28d52fce2719bce8762a4d060c159c134da8f9dfe1135c6611ef9edd8cfe000c88c8a3d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634534, "uuid": "2b2c8242-15ff-4523-8640-6969aca94055", "value": "T168D33A17B5C180FDC4DAC1B44F9EF53ADD32B1AC1238B16B2BD4AA221E5AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634534, "uuid": "dd91c605-c299-43e6-be92-152e1c554fab", "value": "3072:tGtwnNiaOnUTtFKPT9OSQ7AOaogjV2iZlBWCgGiA8QPdL:tGtwnNiaOnUTbuLyW8QPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706634534, "uuid": "aad2a500-74c7-4948-9ce9-9bf96ae8a522", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706634534, "uuid": "a8a7e042-bc07-40f4-b053-5a720e58357f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634534, "uuid": "0bcbe152-4b89-4d1d-b004-ac469d9417f4", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2b8c0f-bf23-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1706586878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586878, "uuid": "4e4deeba-f91b-4838-adfe-d7906f5db221", "comment": "Malware payload (PureLogStealer)", "value": "01a908923cbc76874658c47d432424a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586878, "uuid": "f8321560-d86f-4dbe-b570-2acc61265197", "comment": "Malware payload (PureLogStealer)", "value": "6ba75d8e032bf1a23d50f4426c9f00444bec1b5396f29042a72b652a515b4247", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586878, "uuid": "ee3042ad-ff6b-48b4-8e65-80ceead61616", "comment": "Malware payload (PureLogStealer)", "value": "5397fdeeb8e9365b3d9a6b8f599e658e050de1d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586878, "uuid": "090d3d3d-9eef-4f53-aa92-238e1d65b0a5", "comment": "Malware payload (PureLogStealer)", "value": "bd34bb527e9ecad777436d2a40d0e35bac10c1d51e4cef502b1935131b8c3b67096cd29e077cd8e5f75d0a49b903ed55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586878, "uuid": "35ac1d86-8779-4584-aeab-18628d82f8ae", "value": "T14B83E71BBA1B89F3C688573AC6BB54040364D681F663EFCE798ED35649037EE8C0564B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586878, "uuid": "8074b340-92cb-4f92-9f2f-dc024da8a66c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586878, "uuid": "c8865b40-48ab-4396-9002-dc2be36bf13a", "value": "1536:Em65rG4SzbXVzjvf1nRmyr20DmjyleT0FfWU4f23F0Wbub7B4B/:E6HXVzhvI0FfWU4O10kuPKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706586878, "uuid": "4868843a-46ac-4d28-b632-a9ed405cf6a6", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706586878, "uuid": "cfb5ef75-0c60-49a5-a014-5182b6e69e4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586878, "uuid": "c05504c2-857a-48c4-8c0c-11932fd8efc2", "value": "01a908923cbc76874658c47d432424a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9795a5cb-bf73-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706621368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621368, "uuid": "853c8bbf-a76c-44df-844a-ee2cacee6242", "comment": "Malware payload (Formbook)", "value": "bbb24fbe1537b1dca329bf06a538c70e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621368, "uuid": "b433be72-e9e7-4e25-9b33-c02c88b9c984", "comment": "Malware payload (Formbook)", "value": "6c1ef5c49bd50a87b78c6836da99912d61bddbe94f5f604bb6153ef2fd9b0510", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621368, "uuid": "6450b5cf-d156-4144-82c9-a3d1207dffca", "comment": "Malware payload (Formbook)", "value": "fbc29a0d837d9119a4dcc936a5493993d7bce256", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621368, "uuid": "d16b5365-0d47-405d-9615-55ad8e83576f", "comment": "Malware payload (Formbook)", "value": "53fad704e76bc25be0a6235d5bb90f47bca200bc1d71b7b49f62c73254ceb970c4ff83e928fbf0ef3afdf4124bdd23a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621368, "uuid": "0988d591-8c86-4605-b8bc-fbdceca64403", "value": "T164D412052BE8837AD9BE43BD6D718090973A36137162E75CC9D9E4EE1C37BC18A16363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621368, "uuid": "28dc6dd6-1775-4bcb-9964-9f0b807bfc7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621368, "uuid": "46856c81-68a1-4160-9b83-747ce8b31c77", "value": "12288:JMvhIeeAfU3Y+ZZrVmz00P3/dGfcP620vHUULat+GVPtMFCW8ENsXw:JMvhG8JCrr0HS20/nOt+GVyFCWtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706621368, "uuid": "e1d06b5b-fc4d-4166-bb4b-44e58c440485", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706621368, "uuid": "3722a461-2224-40f3-946d-1639c0a70615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621368, "uuid": "414e6bdd-3356-43ed-84b8-5ef563e72e15", "value": "rSKMBT_2092024PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeea2432-bf26-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706588443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706588443, "uuid": "964c5ce0-07dd-4f41-8b51-ad661bf267f6", "comment": "Malware payload (RemcosRAT)", "value": "f94c1293324f4cbad927f399dbed2d15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706588443, "uuid": "93b844d1-5211-43b0-ba4f-ae97dbebb9e3", "comment": "Malware payload (RemcosRAT)", "value": "6c31c906b79f6b7e04ebbf079735b5a1052f4df211a161fe887b6df8bd0c9eee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706588443, "uuid": "205e4ff0-54ce-4e34-88e5-0ea0a18b540c", "comment": "Malware payload (RemcosRAT)", "value": "4d9c087e721b0dee21a3559bae437c45a24c22d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706588443, "uuid": "41f3299d-9069-4c55-9812-94a4029d2faa", "comment": "Malware payload (RemcosRAT)", "value": "8f71af2de59be0629cf4c5baa04eb184b4c8e21fda9e2fff104d1cc4ea2d138ac6b754c37f47058a213d86bc168c9ef9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706588443, "uuid": "27d202c6-996f-40f5-a128-8bda959c09c2", "value": "T13425232273905917C11A47B9DE204AEE47B6AE523F86E7CF5CC074AE11B3B9B538131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706588443, "uuid": "0415ebe9-c7f8-423d-ae78-dce426d0a6c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706588443, "uuid": "2ef4eccf-2b1d-4f27-907a-f9c9cb151f5d", "value": "24576:kF29Zd/91EA98GDCUtSS6nNvLs8BgNjTcwIIOhHDb0dyoM:kFgZcdGDZijs7jT9OHDb0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706588443, "uuid": "ce0ea547-60de-4b28-9e69-2b264797abd9", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706588443, "uuid": "7fe0463f-80bc-42f5-ab03-9af51bab7b95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706588443, "uuid": "29b31608-439b-4a17-925f-eb0fd6355662", "value": "SecuriteInfo.com.Win32.CrypterX-gen.241.13129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f10c724-bf7c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706625219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706625219, "uuid": "8cb030fb-6948-440f-a1bf-b6f1d445f168", "comment": "Malware payload", "value": "e4f395ddd1c19c0d48fbd9ca6e5d00ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706625219, "uuid": "3f741460-99be-4f00-9c92-e4796513f11c", "comment": "Malware payload", "value": "6d04cf766a620dedb1c6dc9354ed93523a00a66383a25a60a56c7448238a1f22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706625219, "uuid": "03198a4f-1344-4d02-a324-5276217f353c", "comment": "Malware payload", "value": "2e75c5eac2898084feb12558f0586861dd2a4f10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706625219, "uuid": "bd8e95fe-d9fd-4088-a6ad-bff83b4d510a", "comment": "Malware payload", "value": "5e6cad120a105b0c6a88fccb70f7f62cc64b9bdad3495f3f07a0c0f40576080b0511829943d9986fb4e2b3be0744d89a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706625219, "uuid": "0143df6f-77ce-45ad-ac81-8a5f6cb7e60e", "value": "T16136F1B4DC2CC6CEF776257A5604C2880AF05C016105BAA77660B4B6D5F93C189BEFAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706625219, "uuid": "5f55705e-7cf2-4e61-9780-cf78d06c07ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706625219, "uuid": "a4bcea31-b1fb-494e-9cb6-93acbe6462f7", "value": "98304:PqKn6aOy4wY6OtiYBzq5hBllACASe6YiSziuLOCeAHT2:P9n6VyXOtZIllArSjSzfLxeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706625219, "uuid": "456cf216-e194-4b3d-b218-f2bb91ca0991", "value": 4938512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706625219, "uuid": "8c416ceb-3dbf-4934-8681-8f87c0c1d582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706625219, "uuid": "49182760-57e9-439a-b338-88c6cb6954e7", "value": "SecuriteInfo.com.PUA.MSIL.Exceldna.2131.3701", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db97d0ac-bf8c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706632219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632219, "uuid": "778ba40d-c7b9-4a56-8bcb-3205cd35234d", "comment": "Malware payload (njrat)", "value": "871722db5b9b702357b675e48e491193", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632219, "uuid": "c240cbe0-c645-439e-a91d-e277524edfd0", "comment": "Malware payload (njrat)", "value": "6f3d6bf9ee09bd4cd6af117cca33965c33b99a7380d8de14450b7d4a3cd499b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632219, "uuid": "55df44cb-a239-47ba-9748-3c08a85003a6", "comment": "Malware payload (njrat)", "value": "ec5cf5b57414fa8253a842bb06fc6822b85e399d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632219, "uuid": "cfcd06f1-3c00-4770-bcd2-f8ea8ab8e54b", "comment": "Malware payload (njrat)", "value": "3dd4bf3a5ea4cc1e1ffc7761e698530521b064753f6a0d99b3c99eb31c3018c5f822141a986462cf81d0dcf645107044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632219, "uuid": "6d1d40ed-5cbb-46b3-8a6b-495ad09de04a", "value": "T1C2032A4D7FE18168C5FD467B05B2D41207BBE04B6E23D90E8EF564AA37636C18B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632219, "uuid": "2f1b9bbb-1d46-4cdf-9598-2bc4fde3691e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632219, "uuid": "b84361f2-288d-4138-90b6-37b3200da877", "value": "384:GstKUiDtblmJEpRGyEf7JfJuQCY6iXQrAF+rMRTyN/0L+EcoinblneHQM3epzXIf:5tiHpR9Ef7JsQCFiArM+rMRa8NuCFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706632219, "uuid": "ce0570ec-ab9b-4cf5-8300-870363c2b18d", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706632219, "uuid": "791ff380-beaf-4ded-ae57-f240f95b2832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632219, "uuid": "ef5e72a9-3c1e-46ef-8ea4-c8d83d32c61a", "value": "871722DB5B9B702357B675E48E491193.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba61753c-bfa2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (MarsStealer)", "timestamp": 1706641612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641612, "uuid": "d4ddfe8f-8aa2-47a3-ba79-80b1e6aaaef9", "comment": "Malware payload (MarsStealer)", "value": "6e62e68e7f2fa96e2cf9e973baa21505", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641612, "uuid": "4694adb8-72b4-425f-8666-f527f754f5e3", "comment": "Malware payload (MarsStealer)", "value": "70df64d620fadd65a765aa364a9717436638a7b343f5ac42a90ae4ea8503c9ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641612, "uuid": "a30dffd6-e476-4812-8e97-fe13efe62624", "comment": "Malware payload (MarsStealer)", "value": "94a4e181ed4f49daa1edcf6bfde8a24e6e73d7fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641612, "uuid": "5b3a0bfc-6328-4ba0-bbcf-127faf4c369f", "comment": "Malware payload (MarsStealer)", "value": "584c375360d3ec1552a17033baf13d60836d11c60492812f294e82e22bd596a623fd873e51a34c5ae605a22c2ebcb2a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641612, "uuid": "6b1c89a3-8a58-48b2-ac34-af5265e92a69", "value": "T168B6336A3B04760BD2474DFAD5AB3530CB1269F185E7A36F094F27E98C1D7E1A031E92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641612, "uuid": "f4595c47-ed75-41d7-980b-904f42ba60a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641612, "uuid": "2c8d05d2-7478-40d2-8f95-880c49b5a0ce", "value": "196608:I7gNuvWzH44bw5cD0o/fSrm0h/caLPD9tfKHCeOYllgF:kzvWLbesAxBcYnfQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706641612, "uuid": "d62b8c6b-f722-48f6-a327-826fea349ebc", "value": 11392000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706641612, "uuid": "bf120add-f7c9-453d-b750-b8815240c546", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641612, "uuid": "461795bc-deb8-40b4-b82f-b09eb7d18fa9", "value": "document_chappo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2a1697-bfc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706657507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657507, "uuid": "ddfa7483-e8c1-47e1-9e83-d58f2fc56e79", "comment": "Malware payload (Mirai)", "value": "89e1a38098468f9a4c9f057d3e307305", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657507, "uuid": "da181bb0-da29-4d07-a6af-582a04dd42bd", "comment": "Malware payload (Mirai)", "value": "72998a3bb3d1c330666c22948764a7e827cbbec564e8f1c787c1c396f201442d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657507, "uuid": "48333235-efe6-4057-a67d-042ab649a7fc", "comment": "Malware payload (Mirai)", "value": "db38bc955b16f9045b133e45a7c62e087a890680", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706657507, "uuid": "455ca3cd-dbfd-44e3-bab6-1ff7b6843933", "comment": "Malware payload (Mirai)", "value": "7055b0c4dddd95390d58fdd5659bcac76ad6a37531d64422d6dc4437e9d14babf74dbbac29d92c6f70a4857844910591", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657507, "uuid": "4de141f9-bca4-4416-a9c6-ee0522491bd0", "value": "T17D83AE63D8156E98C51A8274F1F08E7A0B23F41091B36EF9699BC3A94093DECF5163F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657507, "uuid": "a8105870-86de-4c63-9eb6-975e80d13da0", "value": "1536:Mu/jLszHkj3izOnaRpuxG+dVs3Kj2d5sslhoLCrrgChjg:Mu7LQOyzMQuxG+dVLjZslhoLYjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706657507, "uuid": "f2ce1db1-156d-4674-95b0-afa0c44fbe96", "value": 87392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706657507, "uuid": "df17431d-772a-45f6-bf3c-006f7cf893f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706657507, "uuid": "64a40684-9dfa-4eb9-af3d-d7ac80232c3e", "value": "89e1a38098468f9a4c9f057d3e307305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64d9dd1-bfbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706653685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653685, "uuid": "6005e1df-76ac-41f0-98ad-dafee84670ef", "comment": "Malware payload (AgentTesla)", "value": "bbf09cc0efd5c3999216412cf07ff1eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653685, "uuid": "e75f32dc-921b-4d2c-81e3-bdd4481541d6", "comment": "Malware payload (AgentTesla)", "value": "73e7ac612fab26068e3ae2289434f23f58e0758a4627fa1e71b54b0c50db67e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653685, "uuid": "86f73068-af49-4991-838a-30a4edb7ce20", "comment": "Malware payload (AgentTesla)", "value": "64b9dd71007173ca44fa371ef416bd95871553f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706653685, "uuid": "ee0d6038-2eeb-4855-8c02-17f5caf63ba4", "comment": "Malware payload (AgentTesla)", "value": "73422791a454ae4ddeb5294532b0306d5134a220c8e9eba4e38ac63abb5051c5ad7f7c4cdfe106131bff320ff4cfa45a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653685, "uuid": "b2316739-2acb-45fc-8c43-58bc6f673511", "value": "T12B74120467DDEE37D15452FE826321864EB2962E5852F3DE6D85AACF09EFF010853C3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653685, "uuid": "45f1d526-d97b-427b-aefa-79808a0fb0f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653685, "uuid": "33a96cbc-e27b-444c-a585-feea63c41576", "value": "6144:PpmqopV1/dORH/vocF8zsxBckRmW5mDbJtFDv:htI110HocF8Axmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706653685, "uuid": "045faead-266f-41df-a685-c9f03a65b77f", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706653685, "uuid": "2be4191c-a848-4924-8ee1-9889ba1ea78c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706653685, "uuid": "93572df1-02c1-4d36-92bd-338aeae9c320", "value": "SecuriteInfo.com.Variant.Lazy.469857.14315.16071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8060b03-bfba-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706652024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652024, "uuid": "c1f5dda9-2861-486c-9068-dcb6e397aa5a", "comment": "Malware payload", "value": "83fb3e964243a45402386f1c64a4d8e9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652024, "uuid": "1dcc644b-8f42-457c-9642-78750b4e7beb", "comment": "Malware payload", "value": "751ba61f76a2ea3288ae6c10d7712e3bca9137849b2001aa9868e6aaf8b7e82a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652024, "uuid": "9e29b493-70a3-4ba0-99b3-bfe508b7ac58", "comment": "Malware payload", "value": "ea39a9443f24cf204dd9aa3b3426ccbdb17d243e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652024, "uuid": "45d67abb-6b9f-4551-b7c3-1434dce8131e", "comment": "Malware payload", "value": "42a27d7af3937201bd26bc27ee3608efc6d5ab19268b44104ca62987c289b18872e89c82553b04ac0363eec979051bd2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652024, "uuid": "6a795968-e2d3-4135-8bc1-9a4db5d3d11b", "value": "T13473E516FB610FB7DCABCD3305A91B0139CC654A22E97B363534D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652024, "uuid": "9dde6da8-5251-4b16-add4-1e660696b6a8", "value": "768:+3AJ4ozidM3Ep2rlyGnteJte/cejiWFROwru/yiZfs3XizI5Qkc0XcJtwo7IQ:+3AJ4ort0tmcEiQGDZfsrQkc0fo7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706652024, "uuid": "01014667-6d91-4f7c-bdc8-284f4a9193d5", "value": 76392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706652024, "uuid": "6e0c7053-a503-47e6-85d4-2358d3e5e570", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652024, "uuid": "0b029442-c05c-4ed9-a3a1-22cdbef57739", "value": "mpl.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5cbc1d-bfb0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706647627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706647627, "uuid": "d8fec67f-8fd4-457a-bf56-258084252ef0", "comment": "Malware payload", "value": "a22c4b461dbf55f6ee157914cba76a40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706647627, "uuid": "954f027b-ae2f-4d12-a22b-9e9db3775d28", "comment": "Malware payload", "value": "752abf71410846d1c5b669198eecebc71047c3ab87296ba8607faa1e1397df97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706647627, "uuid": "9ed3de08-c1a2-4c16-bb31-dd5339ed7ca2", "comment": "Malware payload", "value": "4e955e7cf6e532d05d97d5ebfe24fcdba07f8994", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706647627, "uuid": "30df4945-8359-4e0d-a3c8-f255c70c96b2", "comment": "Malware payload", "value": "c632329f5c3519f0bbac4aa643600855edc047edd3ef139f505f861f3d8adf176afa5117763d92fed7847278fd16a7b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706647627, "uuid": "a8b674b7-c1fa-4af8-aee9-47b6d8083645", "value": "T124C5F27647295E06C15D067BA03C4F0F7AF8C84FA6C6B76F7828A2BEA8D57104D850E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706647627, "uuid": "3a58e4a5-4932-4454-abda-4ed3d2503cc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706647627, "uuid": "725f18ae-93bf-4a91-b661-e1d739645538", "value": "24576:XbWJwmGQ/0vovXvMD82Gbp/GYMeCbR+PAOh//0vovXvMD82Gbp/GYMeCbR+PAOhJ:MT7pqZsT7pqZYDDoRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706647627, "uuid": "ee635fad-7592-443e-8692-f72f09cb9670", "value": 2715584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706647627, "uuid": "b8f9ee5c-5641-40e7-88cb-f769279bfcdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706647627, "uuid": "214a2108-0246-4244-aeac-5dee49264327", "value": "edge_x86_KB91412024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0405d80e-bf81-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706627133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706627133, "uuid": "9aa7ca1b-fd2a-450a-a0f5-3c20c42e2885", "comment": "Malware payload (RedLineStealer)", "value": "477665e7102ea8e7f3f304cf0ac659ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706627133, "uuid": "47eb7212-220c-4431-9189-21d499e3f790", "comment": "Malware payload (RedLineStealer)", "value": "75cee82ef5404e1ad851a1b60625717ae8666082ca2d4e3091b11de4a90851a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706627133, "uuid": "a02ecec7-343f-4bda-8f36-edfd9aebd2f4", "comment": "Malware payload (RedLineStealer)", "value": "7ef19ad6ed5bafe390d3f991d6f416bbf151ba31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706627133, "uuid": "dee064b2-7bab-4d53-a571-e674b64c68a3", "comment": "Malware payload (RedLineStealer)", "value": "67de45a5d61117bcaaad8b26998a1a027733769604338ab586077febc24fe94a640729204cefb6821b26b56bf8ce3447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706627133, "uuid": "fa3402d7-bbb8-46ce-8eee-bebd019022a4", "value": "T1FB84125077DB83B1C55816BA80E3557103F76B8A0F73E28C798951B49E96FE0CB8DB88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706627133, "uuid": "2ad555a9-b772-428c-bc9a-415479dcf003", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706627133, "uuid": "0bc77a39-d6d0-40c6-9d2b-33cbe9669b2f", "value": "6144:3dRaQrp1ElQ2PNTYiQjNFgzkcpIMkA9Z7+nnDyJhk:NtilQ2PNTYiQ50vn7cnDyTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706627133, "uuid": "c299d44a-f5c2-4cac-b8d1-7ff304aecc94", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706627133, "uuid": "8327d693-5ec1-472e-b328-83578399e52f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706627133, "uuid": "ce79b302-5aec-4a9c-9d77-1f7a20a6c83c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e303b9-bf30-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GootLoader)", "timestamp": 1706592481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706592481, "uuid": "d733907f-6fae-4a0b-9c35-abb51e698cf0", "comment": "Malware payload (GootLoader)", "value": "c8c1815a39f697d262d863f235f3a9f0", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706592481, "uuid": "bd5f9d81-f3bd-4ce9-8727-27198e04f08c", "comment": "Malware payload (GootLoader)", "value": "75d7cc9bef14876bd6d42ac33c3b26b218d873e029834d82e21e1f9b97d66f4e", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706592481, "uuid": "89d2a5f6-51a7-45ba-98f7-6a2dc5b7be6b", "comment": "Malware payload (GootLoader)", "value": "7c227e51e4ea2a25ed2205913497c5985d6e4463", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706592481, "uuid": "fa2336e0-c922-4320-8e15-fa95248ae02e", "comment": "Malware payload (GootLoader)", "value": "9acdfbe9c365755d41d84440aab5ba44f910a77a7784a47470aa289531d383eb14c78e904153a837511891b880804d2c", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706592481, "uuid": "14de3889-5082-4595-ab75-069cd37cb634", "value": "T13234229F5046BDB4C7AFC7610AF44BF9CFC991D9F871E1A8E814222D0196DB2D14F8A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706592481, "uuid": "5fdf1762-7ab2-430e-ba52-e5a53f7334c6", "value": "6144:fy2FqFyRQgw5juo4vce4qw1czyAI0p+ZJGy:ahFmpw5+vI92Wh00ZJGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706592481, "uuid": "aabdfda8-8095-4ae7-98bc-8e78bccae6ae", "value": 233173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706592481, "uuid": "65d2576c-8d30-4c6a-a12b-c70acfe23e26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706592481, "uuid": "e0e1a923-70ef-477a-8b18-0339fbb0b79d", "value": "Is_it_legal_to_own_a_fennec_fox_in_virginia_2805.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f95072-bf70-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706620100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706620100, "uuid": "b1de4fff-9005-4483-9c84-0b36cd6fb1cf", "comment": "Malware payload", "value": "a560bad9e373ea5223792d60bede2b13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706620100, "uuid": "a94c4085-9c43-41b7-84e0-da8465b16a02", "comment": "Malware payload", "value": "76359cd4b0349a83337b941332ad042c90351c2bb0a4628307740324c97984cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706620100, "uuid": "0230a59e-f033-422b-8a4a-a3f3d00fb691", "comment": "Malware payload", "value": "82a0da9b52741d8994f28ad9ed6cbd3e6d3538fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706620100, "uuid": "b7ead9a2-648b-44bf-9b6b-2549832e46f9", "comment": "Malware payload", "value": "bc39e5126b08207e2cb4d0aca6e30b3dd7075b184464e88c3b5677ae3dff6c6fba80c08cd3aeafaab2e1ac0498d7bfcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706620100, "uuid": "1f64717e-be90-4b9b-9315-94f52b2be26c", "value": "T15A956C01E7E89F2BE56F6B76E030055813F3E9867376F78B2A4871792A937504E053A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706620100, "uuid": "adea21cd-42f4-4499-ba17-090c59790ae6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706620100, "uuid": "9606fcc3-9a1e-4d74-abcc-c5788ed56142", "value": "24576:pWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2:0t3UCiag6CKM2zCyZuOjJaxSS5qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706620100, "uuid": "238a5eae-1d04-4dc3-8b3f-99fb3b7d0c9b", "value": 1899520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706620100, "uuid": "dcfa996d-3aee-49c9-bebd-c47e3c43382f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706620100, "uuid": "913e8eef-e9cd-4b92-8541-1a850ddcebb9", "value": "Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e657872-bf5d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706611715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611715, "uuid": "f8cec9c5-4bc7-4225-b939-e9a4e37c4f41", "comment": "Malware payload", "value": "de8858d20b13e6ed168d41cf4898685b", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611715, "uuid": "5fbbf6e1-36e8-475b-a7af-47533eb776ac", "comment": "Malware payload", "value": "7696f45cc84723b614814ad6fddf7c56482acda186756dac7c5acf3faf502d3a", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611715, "uuid": "8c763f07-85e0-4ec5-a9ce-4804571486b7", "comment": "Malware payload", "value": "c6083a802b0392993ff87e006e6c6d6c1ffba16f", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611715, "uuid": "8bd1cacc-1545-463d-a4b6-6ee00a8a9b01", "comment": "Malware payload", "value": "c0ce1a7025289dceaac5e47ff17dba4e9a35fca7a2134250c9ee0b29a7796730aa17bed58b020a726473bec121a06205", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611715, "uuid": "401db39c-2d6b-484a-b8ec-e8f8c1dce1ab", "value": "T1CC752338238C8B73CADDB1F9D8B4619C0772957AA825E7427A4C36B90F47FC5198136B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611715, "uuid": "89c96fb1-461e-49c6-b4cd-ee5b94331b13", "value": "24576:I+9cqLksByMQYBt1wJ1PnvVJynB7f0oCNhlgsIhruUCJQWPcL6T3AAOJLQg7X04Q:W/CQY7SJtmnB7f0FAsIyDJWi3AARcXjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706611715, "uuid": "9a1aa5ec-fd2d-4b30-95a7-65e64d4a07b7", "value": 1564672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706611715, "uuid": "76d0e290-ed86-4183-ab83-3a03cedf85cc", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611715, "uuid": "1a700050-3830-4c72-b57d-2a8cbb920d90", "value": "Enquiry list RFQ 02024030013042117374823 PDF.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4504508-bfba-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706652017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652017, "uuid": "a4c79b06-fccc-4f18-ac96-3704cee34aa9", "comment": "Malware payload", "value": "0927ee9539ed95712454326f7a28ced5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652017, "uuid": "eff6af05-0ef8-4ac5-a126-d624fe272b15", "comment": "Malware payload", "value": "76c0083c50d8457519cd2f2f2e4a8b57dd9f65aa46c3b8d79b3d0348c7f5b340", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652017, "uuid": "e0211694-8f16-4328-b08b-d3850128b09b", "comment": "Malware payload", "value": "1b36ed1f6890c7e3125f862d721fc8c2f7b64911", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652017, "uuid": "fb75e0ef-b493-4fad-b53e-f9ba07bd03a3", "comment": "Malware payload", "value": "523fdab941b04a471fbbbc047c08b62de13e6889a14d5e1badcc2fa452a7e490f9c2981b646d9b03c60e6a53369d11f1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652017, "uuid": "ef201eb9-7544-403d-985c-1b99b9293855", "value": "T16FF2E891B8854637C2E413BAB6AE4A8E373077ECD2CFB21BD9214B247A8151F0D63F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652017, "uuid": "aa8d29be-2fa6-4b18-892c-636c2691ad5f", "value": "768:wfF9lqm9G5sFIbB5tsKSp3iOpUVfaS9uku9I3Pj4bWVvoeawo:0qQG5sAvtshQRX8VCV1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706652017, "uuid": "8f31fbe0-53a0-484d-8bcf-be426a0b6588", "value": 35060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706652017, "uuid": "4ba531e4-e917-4467-9f67-5d2f2cc15b47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652017, "uuid": "9e1c89e0-fe38-4a47-ac33-66e9ec254de7", "value": "a5.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b863b326-bf62-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706614121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706614121, "uuid": "e775b97b-428f-42f8-b290-9014b795b9cf", "comment": "Malware payload (Formbook)", "value": "c40eb6d55a7a8a7f760fd9a33cee75e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706614121, "uuid": "b1536b98-7c8d-45b9-b5b1-4aea261d47cd", "comment": "Malware payload (Formbook)", "value": "79a5917c86307ed937fe888d4465ab6453ebb83a5045eda4256790a1de71c5e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706614121, "uuid": "daf5878f-42aa-4f38-9206-e9a4c5d7ade8", "comment": "Malware payload (Formbook)", "value": "4c05e2478011c2ea204228ea05cfdcf89f2a337e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706614121, "uuid": "3649b25a-508d-4785-8710-ca0bf7eec7c9", "comment": "Malware payload (Formbook)", "value": "89313dc7c270b134a17fd798117d49c64f76c8f47700d8992aaabdea21da81e796d16d8c9224972071c5840a96784d19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706614121, "uuid": "16173f53-6c87-4ca5-b25b-a2ec958fe21c", "value": "T167E41246AAFC072AEAFEAFF455A901050FF174275523F34A8DC125CA28A7F414B60E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706614121, "uuid": "bc46761b-bcf8-42d8-be9d-cddb54dd62a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706614121, "uuid": "a6a1662d-5654-4d54-85f2-89708782e6cf", "value": "12288:SJpVIAYQ4y7cJJjmCfay3bd10HlIpyalVEGgisOvvG4a+Nkba+l0wu433:Q7IA0j7Rd1Oj+2MsOXGYkW0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706614121, "uuid": "f32b245e-add2-48e8-9415-88a686b7e56e", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706614121, "uuid": "15c9d197-c489-4537-a07c-44e003386057", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706614121, "uuid": "d84d0db7-3974-44b2-a965-4ccbd0b5fcb2", "value": "Angene Remit - 6300547 28.01.24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f6312d-bf78-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706623276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623276, "uuid": "fc7932e8-1fb9-4c0b-9695-98442d2e9df2", "comment": "Malware payload (Mirai)", "value": "f713afb871ac0a9ea550125d4e16f382", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623276, "uuid": "704274e9-2209-49b0-a4ab-2650655b0c9d", "comment": "Malware payload (Mirai)", "value": "7ade3b46a33113d8046c4895c74f0e2e15675e630fba22e2ddfad485b50b101c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623276, "uuid": "4e25ff32-dc4e-4a5e-94cf-37ae103619e4", "comment": "Malware payload (Mirai)", "value": "480afc10cc5ffc334d348459c23089e7277a5458", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623276, "uuid": "5d1dfe6d-8ccd-4fa2-99b2-5e4dd80e58ee", "comment": "Malware payload (Mirai)", "value": "20576f1589e51fff0f6c334179385b7ffd375d6f8c32085b0215c162669180b225661e3f528ece933bc2aed591332700", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623276, "uuid": "dec8dbf8-3153-4afd-a4c5-fee5a914b351", "value": "T1CE634A227A721A17C4D4A87A62F74764F2F1474A29BCCA1A3C720E4EFF3464076576F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623276, "uuid": "4dcb3f0a-4542-4788-97fd-ae7323aedff3", "value": "768:TdM1wF6OxihTuyTam883AhjRpO+l95Vbu3xnGHTT4n1tJeIa:TdM1wF695u2883yPl95DzIt8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706623276, "uuid": "cb2299a8-d190-4175-a24e-d76f7d45708e", "value": 69480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706623276, "uuid": "014af411-ae21-48a5-b6a9-249552449bc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623276, "uuid": "ca4cca71-9788-4cd6-8357-ad52ff05b2d3", "value": "f713afb871ac0a9ea550125d4e16f382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0541c2a3-bfa3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706641738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641738, "uuid": "c54c9876-29af-4a9e-b4a3-515f315ffb78", "comment": "Malware payload (LummaStealer)", "value": "e5f7fb91f7fbe9bf3e56486dd4319654", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641738, "uuid": "baa95436-6349-4f11-a583-4cf9189352e6", "comment": "Malware payload (LummaStealer)", "value": "7c8cba80f25133b472a18ef8e8661d9d31340e491d02fb1d33823651204c9831", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641738, "uuid": "2d8ecefd-3cd9-4ded-892e-315f8a01e67e", "comment": "Malware payload (LummaStealer)", "value": "3265d5d16aa4efe9f9322c73d9efa5dbcfddb0aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641738, "uuid": "d0871b66-2942-4f0c-ba92-20a3e87926c9", "comment": "Malware payload (LummaStealer)", "value": "37b869f5bfc404eecb1a9baab0676884b7fd79ee6954407d39f3da7fe194842be9edc8cddf20141fa93a9881b625e0f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641738, "uuid": "8d07c9d5-e6ad-4295-ab77-8df32a28c8b1", "value": "T17FD4220252971338C96E01796C6365A603F6A7EBDDB7CB2C6D4413D12E42F96A783BCC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641738, "uuid": "2118fd0e-b347-4af9-8bdc-83bc81d1912e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641738, "uuid": "35a36535-2c04-433f-bb2a-9b08a8c965e6", "value": "12288:+8ob6nHFiUPlmh9thrW9mivK3+o/k0omIagwmS0wgwPDHRLeIMh1XJ3RhV:+8vFn9mh9tViyYhmIa7Vg4HN2DRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706641738, "uuid": "91afd911-17c2-4f68-982d-7e3a1337ae9a", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706641738, "uuid": "b2ac924f-5d10-47cc-a61d-08fc6c5ba441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641738, "uuid": "202587e6-279f-4278-89c5-efe963e9b286", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdce8cc-bf76-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Fabookie)", "timestamp": 1706622692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706622692, "uuid": "4e1e71b7-c794-409b-beda-945d5c5bd1d5", "comment": "Malware payload (Fabookie)", "value": "0b941f1bb25e443be09efec27f807341", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706622692, "uuid": "597be3f3-134f-498a-ab9e-24ae3769a34e", "comment": "Malware payload (Fabookie)", "value": "7cd7e631e7729dca4ffb4099dc22e95f625ae1ed79ba61a1330bba6072c8ce34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706622692, "uuid": "9d26059c-98b9-463e-8328-2878f77910db", "comment": "Malware payload (Fabookie)", "value": "2b30cebcfaa3f71d37755a7ffa5afb9184fc5a26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706622692, "uuid": "671fb6ad-390e-40ef-abb5-daefe5d1cf14", "comment": "Malware payload (Fabookie)", "value": "55c60b9eaa2d6a2db67e516279d5c64cf458d15a27b6ad9aa18a09581300fe059f784a2b603e8b3f06375141468c9a01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706622692, "uuid": "61808cfb-32fd-479e-bba5-e91af1871149", "value": "T1E8544912AB25DFB8F0C7C8B6BD30410218E8B4097758B57E96CDCC751A3BC51ADB5AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706622692, "uuid": "6ae9395d-8ae9-4bb1-b474-07b95a030e3c", "value": "5f7cc0f5167c2e87d5d2573013f2660f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706622692, "uuid": "07965d69-0e52-4ccf-8385-bfdbc3b59296", "value": "6144:k7F5GxMr+PtCE2kWCZ3j9Z0CINiNZpxyN90vE:4FYxMqAEVBkCIWBy90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706622692, "uuid": "92f68428-7b75-41dc-a871-e949450d0ca7", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706622692, "uuid": "430df7cc-aae0-4868-9078-af819e03fd8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706622692, "uuid": "edeedc0e-c081-45bb-82eb-eae23843cebc", "value": "SecuriteInfo.com.Trojan.DownLoader45.60905.17111.7293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660f3f13-bf3e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1706598521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598521, "uuid": "7606fd61-1c12-4fed-864c-dcd3f0c22eed", "comment": "Malware payload (Stealc)", "value": "f810897c2cef3c0ac0f34ac3586893c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598521, "uuid": "be7b0270-3ceb-4ef2-9bbe-3887655dd6fe", "comment": "Malware payload (Stealc)", "value": "7d22a51be8913735586f0fb030468923a0cce7938f2052cb17579b67156732ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598521, "uuid": "dd06c053-b45a-44f4-9a71-8d51572737ad", "comment": "Malware payload (Stealc)", "value": "9c1d27f2b4a4537a190ae5d7c01c282162ca307f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598521, "uuid": "8d957a35-a17f-493c-aa5e-737535a52689", "comment": "Malware payload (Stealc)", "value": "7899f620277cff21660622494c9968276d66f730ee1fb6a452f2e35e78c1f7a5c0e3c185adb0b50a1ff663a6fdca04d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598521, "uuid": "b4ca263d-6c5f-4ff5-8f57-e88b93da8643", "value": "T1D0748D507AECC0B0E2B71A358935C7A50B7BB8326E31A58F3FA5563E5E347D1862131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598521, "uuid": "894fd521-87fc-489e-8d6c-6de2c3102898", "value": "cd132b2f89f79b212f0c4061c0a4f036", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598521, "uuid": "6e18c1f0-adbd-4eab-9847-d5b61d435342", "value": "6144:aAbB8lt2+0XjhZQq8xhUoQcyBKmKBNLW9Y3fXkA:t+lt2lXjXGwtBKm6NDfUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706598521, "uuid": "477c5488-87f6-44f2-9d50-bb43fc3460ad", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706598521, "uuid": "4af52905-cf93-4981-afff-2d185bfa14f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598521, "uuid": "07f4f739-5399-4ee3-b567-e8b6cacecd92", "value": "f810897c2cef3c0ac0f34ac3586893c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44efaf96-bfa2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (MarsStealer)", "timestamp": 1706641415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641415, "uuid": "8b834f0b-5113-4186-b319-66439085c9d1", "comment": "Malware payload (MarsStealer)", "value": "afc4c3b10fcace7719330384a3be79a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641415, "uuid": "8c5ecc32-ccd4-48e7-b718-56ace5ca5811", "comment": "Malware payload (MarsStealer)", "value": "800cd06e420db368d76de6067d887fb0a801ed31b787efbfde248ff28168eb54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641415, "uuid": "68021f69-1875-4644-bead-03b8d475a810", "comment": "Malware payload (MarsStealer)", "value": "2f3f30da30146eea5adc2ab74e7ce496c5d2d0d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641415, "uuid": "b309a483-86b1-4b12-852d-f958530f51a5", "comment": "Malware payload (MarsStealer)", "value": "205e9f747cf62213ad908fe07fee26f0c794a3328dbc1c1be76aee603fa7d63030fe4b6671ad1ca1e3f77b8816c9284e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641415, "uuid": "cbd77d28-68c9-40d8-bc30-ca45ba95e162", "value": "T119B6338443DD83C1DA9DCDF3197FA9AF4E2D78A7548BD7F62540A7A0089337AAB31106", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641415, "uuid": "26d860b1-dde7-481b-bcbf-34b391d86fb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641415, "uuid": "1d078196-e26c-405f-89e9-88879519460c", "value": "196608:JzewqESOCpxGHCJXEbbK6vJnjSPo6d0ZTzr0HWjJ0b5c6zbLkrQx:J5qEevJXEa6vJjSwEu/rYWZ2bArQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706641415, "uuid": "dd6016f1-ea32-42ef-b8fc-836d93c037f9", "value": 10533376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706641415, "uuid": "109a6e60-67eb-4b98-9422-69dd57546c06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641415, "uuid": "bc870661-2ba7-4fb5-9e02-af02d90aa198", "value": "Kanagawa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d69ed22-bfaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706646932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646932, "uuid": "433999d6-89c0-4254-a98e-5587080e4c50", "comment": "Malware payload", "value": "2a505aca1b907ea51c99e9d3ccada87c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646932, "uuid": "1ffbe7c2-7bb4-4c30-9876-d2610ae16bee", "comment": "Malware payload", "value": "81088414af30d63ef3abe12926a308e5ef20a0b75c3ccbc9a5f886cb4b78f39a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646932, "uuid": "20bc8355-0360-418d-889e-b8ccfe9015b3", "comment": "Malware payload", "value": "b8f9c2aabd55fae74a2ed016e87336b844dbfb9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646932, "uuid": "682d90fa-278b-45bf-93bd-f6bcabfa62db", "comment": "Malware payload", "value": "8928a03188206230b45b09460def699f5e1949d9dd02354d63e5d7d93b3725c57cb8ceb3c1d97ca9dd79377c9653ea84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646932, "uuid": "dcbfc654-d4d1-4a88-be5b-72d8152dcfa1", "value": "T1A3C402289A749F12F93C0FF621B4B911E3F122972516D7B91CD920C92BB3F250B45EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646932, "uuid": "89d194e0-c5c6-4b86-b67e-52ed6eb5d37e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646932, "uuid": "e4395ca5-8820-418c-b74e-16a306cfb8fa", "value": "12288:pv+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8l:pma6u/ZKCcmdqw6S2dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706646932, "uuid": "64ab226b-6f5a-4834-9ada-9c840ee15914", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706646932, "uuid": "9386dd29-2f8f-4b76-839e-009bc3138ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646932, "uuid": "0a32d896-f717-4015-9bf7-c0f9252dd45b", "value": "SecuriteInfo.com.Win32.CrypterX-gen.17788.27826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd8a613-bf43-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1706600574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706600574, "uuid": "992ccc2e-8c7e-4ec0-a259-cfe987f59d4d", "comment": "Malware payload (AveMariaRAT)", "value": "d1ebfffb918cb931ae8e6ef5546b9efa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706600574, "uuid": "a1e934a7-072e-478d-ac68-4bbb70e8ed5c", "comment": "Malware payload (AveMariaRAT)", "value": "82024edb19dae637e9af2940bbbf5e10fc8ad04deece28d610474e993ee3450e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706600574, "uuid": "a697f586-75c7-469a-8465-c80a9eebeaf3", "comment": "Malware payload (AveMariaRAT)", "value": "325c8470cce00044d8a2ff9281c2ecc4223ab011", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706600574, "uuid": "67346eb3-a885-4ecf-8a38-b1eb1ba99988", "comment": "Malware payload (AveMariaRAT)", "value": "af861b0fbb5bba37b8ddb6cc6444ec4356dcda2c318ebd9e764581b20518296e1da371dfa62cdbc48401612b9b4fc008", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706600574, "uuid": "56cce488-33ff-4101-b289-bd3242b66639", "value": "T139D4122533D04DA3CC9D56B8DD6096ED4376AE227E90F3DF2D8870A558F3B824A92713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706600574, "uuid": "66c671ba-73a3-4994-8496-1663d0b74261", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706600574, "uuid": "128080f5-8a1e-4835-a1ba-b57c38335633", "value": "12288:LZV+d9SCF1ORqY9KWXhrgT4/ZneqcMkgw45GT5bBjjtwA8mon:LZV+d9Z0wWXh0T4/AqcMki5oBO1fn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706600574, "uuid": "93e0c441-0425-4861-a39f-86755cccfb70", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706600574, "uuid": "bc02e954-a630-401f-a8ff-274d120db9f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706600574, "uuid": "69ccf765-8c5f-480d-b524-64b7f6d68940", "value": "d1ebfffb918cb931ae8e6ef5546b9efa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d1751f-bfb2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706648260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648260, "uuid": "a5b0cca0-af2a-41a0-ba0a-334c2adef943", "comment": "Malware payload (Mirai)", "value": "09024de7dc3f9ef9832ba764046c5670", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648260, "uuid": "90198813-06f9-4058-9314-c7eda6c57005", "comment": "Malware payload (Mirai)", "value": "83f8f24e32689f0fabb6f2937488d2a39a69a1df565951c26e72e856858ba1ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648260, "uuid": "28386a37-8081-4e8a-b5c4-864f970ea804", "comment": "Malware payload (Mirai)", "value": "52ddf7b2f5b5cc5cdd22349aa9ae1318fcf0f0ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648260, "uuid": "ed577317-7c7f-46a0-a29c-ac131400b9c9", "comment": "Malware payload (Mirai)", "value": "51ad431a480bd60330235900521a0244571cd9a8b17f1e4f45d93a36ca700b2efd1f0123bfaef3001dc07896502696a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706648260, "uuid": "63708838-59d0-4a9b-9a12-b76a01596c3a", "value": "T19B03F293929E070BF03EE2F52549FFC64814E66A158C4B77BE5026689F9731C2E7A1C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706648260, "uuid": "82ca48a4-accf-4d4d-9105-c99046847e51", "value": "768:0Bnl6oqnQyBi6DC5QvF9CtA2wsZ3Zy2G330DBey2tnbcuyD7U1gURQ:ilJiiusBzZJy2Gn01ktnouy81i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706648260, "uuid": "cd6c4a29-3b84-46d4-9c10-d38e8e34ee9a", "value": 39004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706648260, "uuid": "527fd769-1633-4763-9d3c-128db0853315", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706648260, "uuid": "037ad19c-188b-469d-8a8e-868d9e391f55", "value": "paraiso.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7c9d26-bf08-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706575525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706575525, "uuid": "3984ea88-3373-45c1-be7e-2b2dcc3608f0", "comment": "Malware payload (AgentTesla)", "value": "afca8f7a63a18a7c982b4fece0f8840c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706575525, "uuid": "18931593-c5b4-4c95-9dc6-e548c5679458", "comment": "Malware payload (AgentTesla)", "value": "84751bcf03258a672747728fe92c31c4a97bb7cc409960e94557a909ae60ba04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706575525, "uuid": "aca1750c-99e5-4004-bd85-3740a7afd34a", "comment": "Malware payload (AgentTesla)", "value": "0359612c1b3f96dd0540b3b380f776c78d6157fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706575525, "uuid": "1ee2db87-c68f-49c2-a792-40bacd3ae83e", "comment": "Malware payload (AgentTesla)", "value": "18217b741d0dc2e015b4d0c949d0922a9c0a0ada8563341be53b81cc236bfa3e4ac7375887876cc64da0b9824e7b7a51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706575525, "uuid": "98c6be47-18a4-43f7-b01b-e54c8c64a5c1", "value": "T11E741221B7B4BD67C67DA3F45C77A98847F38C412450E1DADEC808D744E9F0A898AE4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706575525, "uuid": "69f27b11-c38f-42b6-baa4-fa59a0ea5b6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706575525, "uuid": "12e28575-831c-49a9-9b8d-e3623040a536", "value": "6144:cy93AVSYFZwaWFcR8oKy42nMNl1n0HWmv2DSOLpgMlaVhgP+cuXeCE27ITpb:bgZfWFcB4B0+S+pgMZYREtTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706575525, "uuid": "24e9a990-e367-4d76-9b1a-fd578e270d30", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706575525, "uuid": "72c56194-d18f-4889-b193-7f11966cd7c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706575525, "uuid": "c440b473-8099-415f-a5ef-f0521a6f730b", "value": "SecuriteInfo.com.Variant.Lazy.469857.25240.19205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7df57b5-bf56-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706608966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706608966, "uuid": "48a8ad5e-91f4-4f8b-a666-9edfdc74e619", "comment": "Malware payload", "value": "b4d52f7206479267b9ffdb608737f6e9", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706608966, "uuid": "5cf4494e-097a-4f3e-8fa2-eb8f0d242434", "comment": "Malware payload", "value": "85c27174478a82891571ee21f1d301140cdc00c0a7f2837cca7b38063773ccd7", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706608966, "uuid": "97e580d1-420e-4300-b141-8934153d20b6", "comment": "Malware payload", "value": "edcca305071d8ebb7434a6c02f4a634bdcb29006", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706608966, "uuid": "91e58953-5ca0-4c37-8a19-592b594953ec", "comment": "Malware payload", "value": "77322295544fbf9a128ec59c8f278f4b9d88b1079b8e07267f4d331bea49ed9b7c4547b67b3b96282286a85664a609d5", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706608966, "uuid": "fd07d900-d04b-49c6-bb37-6cb5b03980e9", "value": "T1C1530138959D6D0AD5E848BC188D00F3F2290D52E79DA57B9E2AD7FCDE118C7163C6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706608966, "uuid": "2b49a2ed-8b6e-4b94-afd3-280a20b674c8", "value": "1536:G52ey80J/VmLqYHnw7YF7wIe/1mRoaBOtPyzQsYANfaP:GadalS9mqaEU0sYANfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706608966, "uuid": "b3661653-2b11-459f-8e1b-d24b36cd75ae", "value": 65718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706608966, "uuid": "bab70fb6-00b3-4188-bf83-532c50409fd0", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706608966, "uuid": "d59e6cd0-feed-49e4-b60b-32ae8325cd8e", "value": "b4d52f7206479267b9ffdb608737f6e9.dotm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a5ba1e-bf65-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706615398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615398, "uuid": "25741229-c6f7-43fc-a1c4-79976e68e740", "comment": "Malware payload", "value": "bbc4414d76d1a765f3d525556f616ef9", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615398, "uuid": "affc90de-0885-4d46-bce9-2beb033bdf7b", "comment": "Malware payload", "value": "86f504dea07fd952253904c468d83d9014a290e1ff5f2d103059638e07d14b09", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615398, "uuid": "7c31e9f7-883f-4fee-a753-d4a9d0ee5553", "comment": "Malware payload", "value": "c73e28d87fbbc8be79ed1d421e78a41c29111a86", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615398, "uuid": "03381a1e-d74d-4f0e-b9e0-4034d682a58f", "comment": "Malware payload", "value": "74067cf1da1903482e3b10a0f0431c1241ee266083677d04dd16e50ac07a597240e1357bb19f2088162311b0674ab710", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615398, "uuid": "4b7fd672-e709-4579-8f4d-6551e9d51ea8", "value": "T1C543C032CE6E1F41E3D1613440EF19E52A6CA38F2A95CE9FAE0F3A4DAC50115E1D46ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615398, "uuid": "e09e4de8-4598-4f7f-ae7d-e5ee90f54e86", "value": "768:NLoFJQeDHeGYyhA5Z7JsCVResXebqwVCYm7/k/m7RU6d/dwiuGIjsZL2RxcNRyxc:NLBWYX5Z7JsCVCbqECB7cOm0OoxUURV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706615398, "uuid": "13995f54-11f4-4c4d-a4e6-5c392d1723e1", "value": 57257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706615398, "uuid": "9de16c9f-db03-423b-bcbe-f4ab57d65beb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615398, "uuid": "6959143e-0bd1-4a71-9d68-1840de747f57", "value": "2023_Annual_Report.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656fc803-bf0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706576186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706576186, "uuid": "529e2c2f-c734-47cd-94dc-b80b3afac066", "comment": "Malware payload (LummaStealer)", "value": "f0878b4716bbd827850ee35c5d645225", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706576186, "uuid": "2de81b18-1bb5-4852-8022-7e1614eb6582", "comment": "Malware payload (LummaStealer)", "value": "87b95aafd1a985f19856797ec0407fdc5c9cdf4b695050d2c56b879fa7553c64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706576186, "uuid": "8e43b6e5-82c3-4bb1-bd85-ca70ecacab7c", "comment": "Malware payload (LummaStealer)", "value": "7a675f934da6c986cf1195883dd9e3ee492e2815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706576186, "uuid": "ba71a37c-6f16-4419-8582-89336001b1dc", "comment": "Malware payload (LummaStealer)", "value": "a263b93b45cd2fbc700e5753ec574d3fac5e06d13643a3aa16f2bf027883a56c51189b2fd90eb2ddbb79484f185eb9d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706576186, "uuid": "5820cb2e-a6b9-4376-843c-5c8d84f242db", "value": "T1E6C49D16F0A3D068C93B34BA6218B369EF3E5CC7135188F6A2908BE539329B55D35D37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706576186, "uuid": "51338fce-e046-4199-a1bc-3c4191520450", "value": "31caab6c07bdd9ba8a35c1b9e5e79f14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706576186, "uuid": "5cae4a47-f96d-4297-a344-9e614beeb04c", "value": "12288:4s6Eu8eCt8G4ZhClzwhm2hoMxYzlSjrt4:i8bD4zQyWUSSjrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706576186, "uuid": "215455d7-4f90-4254-9891-9b975eb4c953", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706576186, "uuid": "af9f2f2f-1894-4913-a495-180a69c8af0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706576186, "uuid": "bd11fb45-8354-47dc-a69b-43b580e83340", "value": "027c99520dacf084ad96858e3c7c46bccd59f4a978c2c879e48e319381248bc2_payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0404f3f0-bf93-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1706634864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634864, "uuid": "6fd7072f-55eb-4cfc-b6b8-16d2198f4412", "comment": "Malware payload (Socks5Systemz)", "value": "858b9df958a4e750fb3908b97352acab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634864, "uuid": "5f3a4a43-5c43-4ea6-9f4b-a45fc004686d", "comment": "Malware payload (Socks5Systemz)", "value": "8a25a216c9277f5ecc0f04e27dc57a7ef01cc4ec58f293367066ec05fc20c38c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634864, "uuid": "00b74861-d577-4bfb-9451-e195c70b71b0", "comment": "Malware payload (Socks5Systemz)", "value": "828acd0ddc734e97e91a044b49e8d91446d52a17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634864, "uuid": "9772c0ac-8c1a-4b09-9cf6-c54f7fda9970", "comment": "Malware payload (Socks5Systemz)", "value": "7fc83c5eaee5b2173442739d926c92d88dd865302da252c98d4fff83a2abe54dd104428dfa5f2aca278deb7f7d6169e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634864, "uuid": "843a4409-83d8-497a-8bcd-1e59bcbe493d", "value": "T19E5633498576CE7AEA908ABD5964B383B9313FFC0E3C2359754C160F6F618F8990C399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634864, "uuid": "4f45308b-50a3-4b83-b6ab-cf4283532dc4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634864, "uuid": "6ab9fd88-39b7-4cb0-b982-3572fc46a2fc", "value": "196608:KLYy0JNrwPkHpDhMiy7Gra3MjkTRqTLSS961xpw:eYyqNC4i7oa3MjkTRqD9+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706634864, "uuid": "13157209-ee7d-40c2-99eb-3b8d244e5a86", "value": 6418769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706634864, "uuid": "a0ede7e0-4f91-442c-b694-daee70bf0c36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634864, "uuid": "22e6b922-ccb1-4096-b23e-ce5f90de305c", "value": "858b9df958a4e750fb3908b97352acab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f347e0-bf78-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1706623588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623588, "uuid": "fdc4e865-53ae-4956-8e84-89b468f5c867", "comment": "Malware payload (IRATA)", "value": "18ac895a5f348d2a05d6a07a213d84a6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623588, "uuid": "77081a6f-cfde-439e-ac16-797503130538", "comment": "Malware payload (IRATA)", "value": "8a2f6ff8aa1a6b416cb0aaa1530a8178c53760a69ce5c14d1d16ee880c335a4f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623588, "uuid": "83e20058-5d68-44dc-88d0-f90446d837ee", "comment": "Malware payload (IRATA)", "value": "1d7f85d3b91fad635193349d5903f6b1a4f310b2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623588, "uuid": "2e357e68-2f9e-46dd-9378-4a1894f648b8", "comment": "Malware payload (IRATA)", "value": "97d2c10bbdc2629acc89d674b30d9d4951c8f8abc58a858ba90a99c9ac5cb080b4e0b91b9db2fde20f3256d2fc0843ff", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623588, "uuid": "538bae92-ab05-4bca-8f53-3c989a64160a", "value": "T1452633E6F1B781D2E66B5073E4230319DB3A088BBE601C5678F7276051E79DEA3198DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623588, "uuid": "de78a1a0-28d6-4357-9795-dc42612db8f2", "value": "98304:H9hinlhin6Vhinahinx1hin6hinshinUhinGkcr13+TkjroxpUKth:HbCzC6DC8CxjCcCyCKCGL4TPD7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706623588, "uuid": "84d9b6fb-2841-4954-a378-a546fa34fc1d", "value": 4747446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706623588, "uuid": "c1679b9b-c843-4cb5-be2f-217e59ad94ca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623588, "uuid": "272b093a-23f4-41e5-b467-30beed880c2c", "value": "18ac895a5f348d2a05d6a07a213d84a6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bcf52e8-bfc1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706654714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706654714, "uuid": "351f32a3-bbaf-47f3-b380-f7ac57eee650", "comment": "Malware payload", "value": "8d923ac649477049a637c3d6d416c98d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706654714, "uuid": "96975697-2c66-4dc7-9b0d-02bee3347daf", "comment": "Malware payload", "value": "8aeedaa4668f311cde555a4420945a80e174721a5dbab133033e4568feb9d5ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706654714, "uuid": "6e4d85ff-81c0-423f-82f7-b2a9a404d50d", "comment": "Malware payload", "value": "f58fab792be333d1662fe7cae09198066304b414", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706654714, "uuid": "bf887105-afdc-4050-b398-2c5e837489df", "comment": "Malware payload", "value": "5b047c32bfc2a33e16793e053deb10469d9996e9ee4ab6d488869617a1c56a283d3e1201ae5609807bec00225a31f8bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706654714, "uuid": "3708bb7e-cd5c-409b-8687-1e124dbb15f2", "value": "T1A4339D37E82A5E54C09A817075788F751F23F4C493432EBB1AAAC2795497EACF501FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706654714, "uuid": "9f80308d-a171-4276-9b58-e9f0ab9aac7a", "value": "1536:2ao/3/UuiViCp1AKmv3GRpV3CVn5UPVYob:2n/3suiUC3Hm+pV3dYob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706654714, "uuid": "7c4125f0-7700-4120-906a-9d48c0bad2f1", "value": 50816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706654714, "uuid": "3cff0b86-7c93-4720-bdc8-06233efa1b6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706654714, "uuid": "16b8a745-4f5c-4551-978e-aa72d74e497a", "value": "8d923ac649477049a637c3d6d416c98d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c3234c-bfba-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706652021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652021, "uuid": "47b48744-ba8a-4b05-b21f-65b72bdf1d84", "comment": "Malware payload", "value": "8ebdaaacfe388b185ff7b1260f3d84e4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652021, "uuid": "fe5fb671-d524-4c9f-b329-8726ed8c3efc", "comment": "Malware payload", "value": "8b3159bca34b441a017d425015343a2f1e84d8eef60ea186f678ebdb0b6c5e99", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652021, "uuid": "a7123a57-7595-4bc9-b438-959c5de59b71", "comment": "Malware payload", "value": "5b582bcef19b4f23801e9efebf80728cc6b96fd2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652021, "uuid": "d3435ad3-812d-4732-aa80-fc46713d6bcc", "comment": "Malware payload", "value": "ebc9dfae19359623ac0016ced818534baa791e4aec9ab6a18c98aeaa0e275b441c5d8ad1be6b70ef4aa75c96b2e09932", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652021, "uuid": "d08c9394-9d44-4418-8846-02d503e48ae3", "value": "T16263B61ABE228FBDF759823507B78E11A79923C637D1D641E26CD6002F6134E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652021, "uuid": "837db301-8385-49af-bd7c-8ee2c92cce46", "value": "768:TLGl3o5UaqLQqeuuBLvDn9N1FdVtlb/T3edCj/zGxcLso+kw+l2CC76t16v219/s:TD5bRw+k77yd5Lehk0oTAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706652021, "uuid": "96409144-185d-4dec-a337-3c3ab932af8f", "value": 72808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706652021, "uuid": "93e0b58d-7c7f-4a81-bcf5-ae84bf2a3bb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652021, "uuid": "f770a4f9-c2b3-4895-8975-39cc30366ebb", "value": "ms.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed0b40d-bf73-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706621407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621407, "uuid": "f41b4275-90f6-473d-ba02-f575612a39be", "comment": "Malware payload", "value": "6df222c6fdd6d1c699f06bc7fd1500e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621407, "uuid": "b47fe5ef-9d85-453d-a5ee-989add090287", "comment": "Malware payload", "value": "8c1c5ba560bf8b15b12a18822f4cef0e51ed8ffb2777ddf9248825774549564c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621407, "uuid": "39d3dff4-200b-4e45-aeff-9a9089e7819b", "comment": "Malware payload", "value": "befad8eb8c42be8dfab04edd67c3ecf45d7df417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621407, "uuid": "836a353c-fd77-46c0-8c36-137e584fd9e7", "comment": "Malware payload", "value": "2a4f1fdee7c1780c44866a68e31264aed949d57c448c0c577227eae054c882f9fad9ce10ad12e8ed4dfdd07cf3169bf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621407, "uuid": "a2ccca8f-4f0b-470f-b1f8-d92cd1613871", "value": "T1DB24CF52D05B35E4F39605F1404B2EFA0DD7FC33ADA526F60BF932586A36235125CAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621407, "uuid": "1a0f5d81-5db8-4e39-9e74-820d7462c29b", "value": "43be4169b7858b613c6ec366d24e906d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621407, "uuid": "30ba5ab4-2ba7-4e12-b6aa-da8fe5b3b82b", "value": "3072:uNlC4SD6bJK8quJe3lSnUshy8Hm8E3N+82nYCqISU5ysGp:cU4SDSNU/sjY3aYClm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706621407, "uuid": "ba6a5971-dcac-4aff-a201-c06ff66bb65b", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706621407, "uuid": "7315da21-4354-4103-85d3-5e48991a9063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621407, "uuid": "58a776a3-754c-447d-a8d9-4f24ee0347af", "value": "CryptFlr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2127aee-bf99-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706637706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637706, "uuid": "20bf38d6-f9c3-48cc-b9a3-b1b0c9276220", "comment": "Malware payload (Mirai)", "value": "0f834a4827540e2a0152a8346a6a53f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637706, "uuid": "6669badb-1b51-478b-857e-1918ab217863", "comment": "Malware payload (Mirai)", "value": "8c75808f1976f54832a16321b7a8e900e9d29495ddb6a2b65b9aac0931eccd2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637706, "uuid": "a4c0e304-cdc0-46a4-aaa3-66072e5c1b34", "comment": "Malware payload (Mirai)", "value": "57b93343726f5b2b46f4dc32848225039125e706", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637706, "uuid": "29efa38c-c4d9-4e6f-ba96-47593375bc0f", "comment": "Malware payload (Mirai)", "value": "ec97d71335b2a5df59f79a37f8decd54220c664bbb610810a72901deba9cd777c44cbff0f090bae6f455aa97a23b9779", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637706, "uuid": "d1779c73-c8a1-4fb0-a554-879203d94240", "value": "T19CE32ADBF800DEFAF80AE33748530906B530B7E145925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637706, "uuid": "498f54fa-e363-43a3-8b88-d776c4200a04", "value": "3072:RhRsZeyhrvKj/mCn9DA1wMlmvVrjbi1Lv16Ksy+O5sO:RvsGbnxAllmQLv1Qy+UsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706637706, "uuid": "81a260b5-ecf7-436b-b609-ec311753aa2c", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706637706, "uuid": "b86d2395-b59d-429e-9875-6c3cf3d1253c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637706, "uuid": "2c5f82d4-afb3-443d-b287-2f34fa57c920", "value": "0f834a4827540e2a0152a8346a6a53f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee39d6b9-bf21-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1706586294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586294, "uuid": "df6a4168-d889-4a1e-a8a5-380f1272a922", "comment": "Malware payload (Arechclient2)", "value": "eca96e3eb1fe44265acc31373a1dadb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586294, "uuid": "c2b3d918-6f82-443e-a9ac-2b6e817e1698", "comment": "Malware payload (Arechclient2)", "value": "906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586294, "uuid": "aa5fcc91-274d-453f-8972-bd620668d1f0", "comment": "Malware payload (Arechclient2)", "value": "3221c9a9d13cc4b0ae24b7d2cc807f18feb3ea4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586294, "uuid": "229b41da-7cde-4d51-895e-56e14c67a0d5", "comment": "Malware payload (Arechclient2)", "value": "fb099af1271fcb454ddb73b08b6dbb580eac2b3af3dfa8e390533082d199c5a96735c1f5024b1f952472488148f5a97f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586294, "uuid": "68c71d53-00d1-47e5-ac26-e1d2b34cd793", "value": "T12606D04279099781D6562339D4A39510C6F8BCF20BB2FDBA9B4D751C0A73B07EC0E9AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586294, "uuid": "f03cf6d9-17b0-4e26-9471-c7712fccd6c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586294, "uuid": "3c22d896-60f9-4910-b1e3-f6aecf9ea3ac", "value": "98304:lbPH543INzdx/9yiXGBwmcFBcBL+PRao/Szic:lb/5cUxllGBgFamYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706586294, "uuid": "a182c327-b7b0-44c3-9ffc-a3768527424f", "value": 3922944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706586294, "uuid": "6047f1d2-4803-4f0b-8344-ccbd2c946ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586294, "uuid": "eb9b5894-b739-44dc-9a3e-80b859571cdc", "value": "eca96e3eb1fe44265acc31373a1dadb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3311421-bfb3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706648875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648875, "uuid": "98744c4f-99a4-4451-9ea2-bbeb61e77f85", "comment": "Malware payload", "value": "d97886f33e4198fa5d3d5e3f0b58f998", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648875, "uuid": "f533c8b7-b07c-41d9-a777-377a1a8ba521", "comment": "Malware payload", "value": "91a2438e2f0b0572836b4e501bb22141c6908746b3891a41401a7276a03c1030", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648875, "uuid": "26573e60-44c5-4125-9ede-5c3fb4b7c248", "comment": "Malware payload", "value": "a536bb8003e30d8822c3fdae1a5d95f3673710ae", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648875, "uuid": "a7c121d0-5b7f-4ccb-bed2-29bf1d76b517", "comment": "Malware payload", "value": "df4e87f0a2a1160a1413460e78444a283d095986638a00094eefcf2ae06d5cb801ff84f3b5c28e12d791a34b93f45c0d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706648875, "uuid": "dbf68f48-eb84-466f-809e-ea89b7ad2519", "value": "T1E507334EFA9B1AD1D9D766A78D501DFAB3AB3F024382461D0703B74429935D2227E3CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706648875, "uuid": "15bf799e-f920-4d7b-8049-428616e49c7a", "value": "393216:+3IE3UbhLj5zGiRQVvnMwh2tfn3J8bVMF0hDXdAD8OQtTKOULTu9VzbjfyNww9mg:PE3Ur4vFh29J82OXdAD8OQtT+eNfyNHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706648875, "uuid": "5b660be3-d3b5-4c54-bc94-57a671fa54ec", "value": 17807566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706648875, "uuid": "d5cc4095-965c-45d1-83d9-f4f92503ae94", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706648875, "uuid": "31ae6b50-98f3-44fb-918d-8ede4e0e7505", "value": "ClipPlusCommunitySetup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376ed596-bf8b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706631514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706631514, "uuid": "d385c4b4-cca5-497a-ae1e-40a0b3df6e43", "comment": "Malware payload (RemcosRAT)", "value": "7b95bd97c6282f65eee7eab6097957f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706631514, "uuid": "8530f77c-5823-486d-be9b-cfae303103b0", "comment": "Malware payload (RemcosRAT)", "value": "930de6b7369a7c5b68405b1873f531a0df45101717631afe651dd8ab3bbee8ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706631514, "uuid": "f2e1dc70-c1d0-46a0-b4f3-ab1d2ade6beb", "comment": "Malware payload (RemcosRAT)", "value": "08d5e9b10101f376e7e2265b7cdb4a8b2072b791", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706631514, "uuid": "565fca9a-e524-4e5d-bbab-05596b9d428b", "comment": "Malware payload (RemcosRAT)", "value": "05ad18647e1656ee17a187c3cf13ebbf3f6d3780d41e552f589e528ba406088afb939639b117237db073ee0978cec996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706631514, "uuid": "84c3ad30-c9b0-41ad-9f4c-46c74446a25e", "value": "T14B1512A311538957C08059BD9275F7EC833C9FB28B2B32C9602A7221D6B1D9B5F9CCE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706631514, "uuid": "2faef667-27df-4c3b-8816-b450eb3a012a", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706631514, "uuid": "24efdfac-c58f-4b16-b195-fb7a0b8da247", "value": "12288:0YV6MorX7qzuC3QHO9FQVHPF51jgcEMiIrr88EXSgFmKsa3gnpp1cTF2bsjs0XpS:zBXu9HGaVHRHmS+mY3gnqRI0XMHNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706631514, "uuid": "ac892cd6-6512-489f-95c5-56e495ff8ba8", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706631514, "uuid": "bb9705ab-d24d-487f-bd75-db8dc1b0dc4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706631514, "uuid": "f77dbf14-4fe6-4f12-b964-60da2848a3e5", "value": "RFQ_NEW ORDER INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44ee940-bf0f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706578520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706578520, "uuid": "8fb778e6-a05e-4320-8bd0-7baa31b2fde8", "comment": "Malware payload (DCRat)", "value": "0420330e4153753d962df54caad0ae4c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706578520, "uuid": "603a9b73-5105-46c3-9196-7077227db718", "comment": "Malware payload (DCRat)", "value": "93120717524f0cac94e27fdb013982d760143dd05cca8a547258cbf21ecce2a7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706578520, "uuid": "5cba728c-529c-4aa5-9904-44e80af941c9", "comment": "Malware payload (DCRat)", "value": "1702c6cd8cf136c50b17ccaa18fa32f406558c0f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706578520, "uuid": "74c46b38-8728-4cdf-b90d-55d562a65297", "comment": "Malware payload (DCRat)", "value": "c4845686c19031329c4212662b263c59ec2a27acab779a5b17816f8fbb37c87707d52c0aeaf1d35c50a9cccd8423879e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706578520, "uuid": "5cf0f08f-b78d-48a0-9c30-ef27389e9a1a", "value": "T152F533CB3BB01EB0FABCC4B9DB9E56AC9D555185DCD26E3954206C81C37D2C18C1A3AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706578520, "uuid": "0041e54a-81d7-4272-8f06-85d9d3a959ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706578520, "uuid": "fcbba729-06bf-43cb-bc10-7de29130b119", "value": "98304:mxXgzSR1VsjN5tlgeSon2Lo708p0C2+4hN:mxXgzSYN5B3+e954D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706578520, "uuid": "6a956835-a5f8-402d-ab8d-6488ea39000b", "value": 3326001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706578520, "uuid": "95410513-3cd8-4a66-85f8-2ac4f4cedad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706578520, "uuid": "f2ac03b2-28dc-4830-a876-2380e827a3f9", "value": "0420330e4153753d962df54caad0ae4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd5973e-bf23-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706586914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586914, "uuid": "b25fef62-dc04-4014-b63f-28bae9169e6b", "comment": "Malware payload (RiseProStealer)", "value": "32b2415655787c5b3327b640b4807dc7", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586914, "uuid": "f6bbae4b-ddc0-4d0d-9bb7-2e823b7c50b5", "comment": "Malware payload (RiseProStealer)", "value": "943944b55c46fff5478b2f6bb7327cda0909c42f9d15411c2c767c7a8593d82f", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586914, "uuid": "30af0ce8-0991-4ba6-b818-ecc387a310fa", "comment": "Malware payload (RiseProStealer)", "value": "1da362ff7749ac9cd0087eab7c3a4a0bacf373fc", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586914, "uuid": "37b9fd46-85f0-4c60-a641-39871ee8f59c", "comment": "Malware payload (RiseProStealer)", "value": "9e226b1ca46e9a24ebd70d7cb68b9675ab31b933f366c7d4cf4f815162ce967ce5a11bf81865b13dbce9be4b5a4e0714", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586914, "uuid": "0dc022bc-28c0-4edb-b166-6bbce1b5e540", "value": "T11B159A9D765072DFC86BC972CEA81C64FA6074BB531F9207902315EDAA0D99BDF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586914, "uuid": "36f72d97-68a9-412c-b3c5-cd9487cb82f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586914, "uuid": "2288d5e0-6a08-4bed-8d10-b0cc6ca0d124", "value": "12288:eIR98s6RdDGTS/zac/rIFNmrO++h5X+V3nFzTfwPwFrbdxOTsegf/bd+Jo8SVNGa:TvehB/rIGOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706586914, "uuid": "7fe12d3e-badf-483c-b1e8-e3cc292e37dd", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706586914, "uuid": "0823b4de-6f66-43e0-a216-11cdccd1c0ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586914, "uuid": "f8938e41-124f-4b70-bac7-331ef8b15d04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131ccfac-bf78-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706623293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623293, "uuid": "c6003723-7a6d-4fd7-ba6a-93edc9e8fd0b", "comment": "Malware payload (Mirai)", "value": "500e6489797e28c2ef7da6d3149c1ca0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623293, "uuid": "d6b1d8de-77d2-4704-9071-5cf9c6eb081c", "comment": "Malware payload (Mirai)", "value": "9498d4e4701ee47876f810ddac4255cc4c5f41613b30970da2e03a6496fff141", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623293, "uuid": "233dde28-09cb-4ed8-9478-2c65b9ee07f8", "comment": "Malware payload (Mirai)", "value": "eee59c2b636f2fbb603442130557d4f216dc8bbe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623293, "uuid": "4850a68a-69e7-4522-9196-cda5649a64b3", "comment": "Malware payload (Mirai)", "value": "10b20edab542336c6d52c3a9a361711d52b6e88b628bcbbbc4688bc52efb3ac0cd08eac5451e4bc194c4385ad9eafc82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623293, "uuid": "40d47d83-415e-4a6f-a798-926a6a2a43ee", "value": "T1EB83E506BF654FFBDC6BCC3706A9271135CDA50A22B47B367934C82CB44B25B1AD39A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623293, "uuid": "66812d62-48c5-4fbe-bbed-105f79606c4a", "value": "1536:NP7Z0TBewamd6UVmByy6Yk4SPZ3pPvZCtZFf1/:l7Z0VewCyypcPgjFt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706623293, "uuid": "109f0a49-80cb-46e7-99b1-bf0e0cf73d48", "value": 85176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706623293, "uuid": "870ca61e-cd08-4510-9b7a-0c5d8483668e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623293, "uuid": "b45bfd87-9e89-45c6-8ba2-1c68c9a83e90", "value": "500e6489797e28c2ef7da6d3149c1ca0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82a41b5-bfb6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706650198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706650198, "uuid": "94627295-4c92-45aa-b2e9-180f6fdafea0", "comment": "Malware payload", "value": "5316dacbc00896c10f5b7c07cfd1341f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706650198, "uuid": "50e252ed-d8f3-4d3c-a03b-3d72628d323e", "comment": "Malware payload", "value": "94a8c95cac41dff829d2291e6744de03776f00f548883bd092b58c2f1cb45519", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706650198, "uuid": "4910e320-e342-44e2-b8c0-d4afced7fdc3", "comment": "Malware payload", "value": "4882dfc474093ba9bf25b2d7a21c54a85396fe58", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706650198, "uuid": "59bf75e0-d800-47bc-91b6-7d3b3f00f6a3", "comment": "Malware payload", "value": "358e5e4042625a792be3331d7dabf4f0950b4e2002b5031cf42c6519c48c989da9543dafd0e7712c6c5b7123cdc9ffa6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706650198, "uuid": "6dbfb5ae-7496-49b8-aea1-84b6ce9ce51a", "value": "T183867C27B388713AC15A0B3A5867E754983F7E713A178C976BF4288C4F356812E3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706650198, "uuid": "c7532ea5-d00f-4c65-8c74-b4546ef2b72d", "value": "3c6964022661ee0963cbc676d8976c16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706650198, "uuid": "8962232a-f6d8-4c49-beae-16f8464d5233", "value": "98304:63Ze9/GQjxmxHX8HKnWw09khBQ/WSg3f2h7Ko6i:Ke9OrNxEo6BWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706650198, "uuid": "5e992dc7-47e2-4ec3-9dec-1574e6ec7a51", "value": 8445952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706650198, "uuid": "3d5c1dfe-63af-450d-9820-299fefa5b6cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706650198, "uuid": "58aeeb68-5665-4ed0-82a8-152ccc636d3e", "value": "SecuriteInfo.com.Variant.Jaik.194576.26996.10779", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f8585f-bfa1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706640909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706640909, "uuid": "5440953d-0e3c-4ceb-b3a9-53cee4003bc0", "comment": "Malware payload", "value": "e7a3928badee5f2ec085fd773944b75d", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FalseFont", "colour": "#FAA745", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706640909, "uuid": "73cddfe2-644a-45ad-a218-300e2f48af44", "comment": "Malware payload", "value": "96a60e9e25f4cf99f2f71d4c4b783ff22d2db1d18673b1f0f47f1452087e2565", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FalseFont", "colour": "#FAA745", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706640909, "uuid": "adcde234-bd57-4d1b-a3ad-9810431bf29c", "comment": "Malware payload", "value": "7e67106c4a694050dbd1b413856a21537380a841", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FalseFont", "colour": "#FAA745", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706640909, "uuid": "1fc76257-599f-4f97-b167-ba22419e5524", "comment": "Malware payload", "value": "ace7c29da81155e2b2203ef4940c6ff797a19e01469291a5fb2e6bc055d77b5950b076e9dd1f752560bc1583c427f922", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FalseFont", "colour": "#FAA745", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706640909, "uuid": "b2ff439f-e99b-409f-b6f2-c5e3972e46e0", "value": "T12DF733F09252CE4EA58B837737B00A51221C1D6C7DEDBDD4929739280AF3AF62B6153D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706640909, "uuid": "60b25d2b-3caa-4ee2-8637-f32c4fa07e0f", "value": "1572864:uIWf6IndlawmGibTDmvhlFnOyHXkJGAkjl4JhTJ67RzW57:G9n/Rh73kEKDJ67lY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706640909, "uuid": "a4f365cd-c127-401a-a43a-3faaea99d5b3", "value": 75313243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706640909, "uuid": "f801e54a-853c-4484-8c8d-7043fa748580", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706640909, "uuid": "c213a18b-d018-4663-9352-249725f9983a", "value": "Maxar.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa29ccb7-bf24-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1706587468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587468, "uuid": "df72a92f-fa0d-488c-8f3e-5264bcd138a3", "comment": "Malware payload (Smoke Loader)", "value": "582200a724af12a4a525bf2ae4d8b75b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587468, "uuid": "08e6190a-9ac3-46e4-a242-2fcc3c7e897c", "comment": "Malware payload (Smoke Loader)", "value": "96ef0fa612962e229cabe7c23fcd099a34fc49e3dc760aafbddc6c44358db341", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587468, "uuid": "c83b6d2c-9af3-4ca3-aa03-37f2eec4d58d", "comment": "Malware payload (Smoke Loader)", "value": "a7dba48a45fa92a8649e7eb26d9b571ee1080644", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587468, "uuid": "5246b45f-5012-4b77-ba42-0131e7673c5a", "comment": "Malware payload (Smoke Loader)", "value": "bf741c89cf86e7d885d6c5ba5d757b05c29cd2061b824d05df43cee2e48d4fa8a66546e005b197b43d6960e81754683f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587468, "uuid": "dc6d7cc7-05f6-48d5-877b-a58ccb92d65e", "value": "T10D648D1176F0C031E2F369354930F7A50A7BB8A2EA39D98F2BD1173D5E25AD0C6207A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587468, "uuid": "81d87995-46c4-454c-bb31-b48c79b27846", "value": "0f86209308d034305701c953de1bb53c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587468, "uuid": "18ce93fb-9f68-4c31-8f03-7f5a4bdcb23e", "value": "6144:bt5/EuhHWN6cANbJr0T/gkfGCUKv/mXGGpYj3:p5suhHWN6cobZY/gkf0XG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706587468, "uuid": "c7085d91-5cc1-4ec8-b341-d4c15ecc8e9f", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706587468, "uuid": "f21cdab1-44ee-43a7-93fe-5b9714c9e0fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587468, "uuid": "963c364d-b5c6-409a-9581-b1910139b286", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8590334-bf66-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706615946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615946, "uuid": "a4560aa2-3e22-486b-a710-5347a67d9857", "comment": "Malware payload", "value": "eaec51e070790ef819e7837b880acf0a", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615946, "uuid": "12fc50bc-9e3f-4116-9ef3-db75c1d93e51", "comment": "Malware payload", "value": "975c708b22b084d4b0d503b4c8129d1ffee057a0636b1beed59c448dd76bbad1", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615946, "uuid": "d4a6065c-e192-4041-a17a-4133e92dbe6d", "comment": "Malware payload", "value": "5f07a5c2008b487c35ae1123691f1ad51fdd22bd", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615946, "uuid": "5ede68e9-11ea-44dc-a529-5b07f2668c6e", "comment": "Malware payload", "value": "27ebc79e3f4122d1c69301251c940955cac588a9f0737b7ce16a55f969378fc941f068f09dac4b3335371918907dbd15", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615946, "uuid": "ede497e4-e027-4b05-b2c9-acae02616891", "value": "T10BB4D003EE130D5287944B7F47AFE6DAB82F5F6A0C4A5EFB66225213D47C35380C85A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615946, "uuid": "48d25c22-1b3a-4bd5-8217-60aec2ec68d3", "value": "12288:mELH143D9sDYyyepzHIfiE1TS5fNyEzy0b:myMuKepzHaVS5BzyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706615946, "uuid": "c5e0c484-b286-4c68-a16a-1fe759a3cb69", "value": 515902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706615946, "uuid": "ea2580ee-e6b8-43a5-9665-e38a50790539", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615946, "uuid": "bdfccc7c-917a-4c75-a6ba-d58ffd9f6296", "value": "fabrika-nakrutok-kak-vk-prevrashchaet-runet.pdfx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b10103d-bf24-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SystemBC)", "timestamp": 1706587282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587282, "uuid": "4c80a4dd-f060-44a3-ae39-6fe80938fbed", "comment": "Malware payload (SystemBC)", "value": "250ed5825f166ce3037408aad1279687", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587282, "uuid": "5a0974fb-aeaa-42f4-973e-087c294e792e", "comment": "Malware payload (SystemBC)", "value": "9b61ab1b854861a9e98bc354da2b104c277c97fd758e39a24c382a9b06e29bc9", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587282, "uuid": "b38785a4-fbc4-4358-abfb-9041dd57dacf", "comment": "Malware payload (SystemBC)", "value": "793029f350ebf293cd693ac271cfec186a8c78d3", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587282, "uuid": "2ec4f126-b093-4fdf-b289-20e75aa16c55", "comment": "Malware payload (SystemBC)", "value": "06f236010af79a24098dbe85edb442def0913f160689a8b94793156e3f8840d4f4021e53162b49b172f69dadc8f9ecf1", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587282, "uuid": "be3c320f-4a1c-4947-9b02-0972d4d409a2", "value": "T1EBE4123927CC9F37D7ACEB7992F110E80B7EC2637022D7525904A8F72AE2399450759B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587282, "uuid": "79a06a77-3089-474a-b503-57aa663a1ff9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587282, "uuid": "2956fad8-52db-4ee9-a70f-e049256a8d4d", "value": "12288:J/Zk1CgV+UToXzeXuXlMgtkLvqt0RzhElivS5eqxQ6MgoxhkB:J/ZQCtUToXzQolMg70RziYvBjHDxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706587282, "uuid": "2a22f742-c7de-4a1e-a284-13986ff721ce", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706587282, "uuid": "f267b299-be04-4ebd-a966-c7236b3bbbf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587282, "uuid": "5f91f465-9e32-43e9-9fc5-4cc15ff393e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05e826b-bf78-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1706623610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623610, "uuid": "2ab19249-2563-4134-804d-d5c8d7bf4dfb", "comment": "Malware payload (IRATA)", "value": "71896aa37e39028680b628cb05080028", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623610, "uuid": "f03009a2-480b-49a0-8024-d2a9d0d36700", "comment": "Malware payload (IRATA)", "value": "9c136701362e2d661805257c02e23c9aa01b9081e1a559571f947390522fc51b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623610, "uuid": "f6055cfb-cc62-4f7b-8c2e-61458c0fa09a", "comment": "Malware payload (IRATA)", "value": "57b3a92819027caf9872d1e4ea854686510dc89b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623610, "uuid": "13865a56-ea47-40c4-bdd0-e47fb3d0cbbc", "comment": "Malware payload (IRATA)", "value": "e907b8d27b329a4936be4f10df65c58437ce2a1a244d2b05c420455892878047fc2dd332b32c64254b14086fcea7b7e6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623610, "uuid": "a875038b-eea5-4b00-94ba-a8f9d8e064b0", "value": "T1B31633D1F1B78187F66B84339423534ACB365989FE200CA375EB236191F6DD8932A8DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623610, "uuid": "743eee6a-870d-4016-bb65-6ccfe8079226", "value": "98304:Mr/OhinKhin6ShinRhinFhinrhinXSnVTG3qx+72YxPnw4c:QgCMC6kCfCTCFCXpg+Cmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706623610, "uuid": "62b50a35-f512-4c46-aaef-b10b524fae1e", "value": 4096056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706623610, "uuid": "ab1a3b6e-a49f-4c3d-a844-d245114e4b24", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623610, "uuid": "daee6200-8749-4d6f-9c87-0d9e3f80c2c6", "value": "71896aa37e39028680b628cb05080028.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae5464c-bfa2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706641345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641345, "uuid": "a8ebe3a5-21d2-4746-993f-e2b90ec521c7", "comment": "Malware payload", "value": "78e4409fa2332bb84949d178d6f34b27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641345, "uuid": "6df86eb2-b8d4-4e45-b744-83724a5ab63a", "comment": "Malware payload", "value": "9cd6bd7e4391a92c402118c4d4541c65a9ae4996ad2c37384967e620f2452dca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641345, "uuid": "168d799e-ed7c-4c0f-b9b3-aab17ad21df6", "comment": "Malware payload", "value": "8bd956fe4a9ebebe7ecea1d7d3d23ac1de76121a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641345, "uuid": "e2a632dd-99dc-4e61-8a81-eec4e9487b41", "comment": "Malware payload", "value": "7b2a2d6b7782b85072b4abcbce60921ef76f7eeb629f4bdbc9755734b7ee278b7a9d57a2985348881ae40e88fc83f8db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641345, "uuid": "08dda6e7-223b-4d2f-a299-8aec377e1eea", "value": "T18244D04767E800A6F4B5937089F202D31632BD91AB3982EF138AED5E1D336B0B635757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641345, "uuid": "f59fa25b-1a55-4fc0-9a09-9f6850a79878", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641345, "uuid": "7b43c00c-1b50-49af-9a43-596ac587220c", "value": "3072:KHlM7TYmySIQIvuxr5GWp1icKAArDZz4N9GhbkrNEk64Is6gk61ZRcTdmhlaSU63:Kz7kp0yN90QEqIs6gPZRsdiiTr1kMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706641345, "uuid": "d56bbb49-3cee-429a-b05e-f2840c8ea68d", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706641345, "uuid": "37e11675-a500-4bb3-8b7b-58980fd2e5ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641345, "uuid": "df6754b0-d8fe-47be-92dc-3770e02d48af", "value": "alexstar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f433e54-bf16-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706581384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706581384, "uuid": "078e8631-b2f2-4dfe-8913-c769f8b90f49", "comment": "Malware payload (RiseProStealer)", "value": "e2695d45520fe4058a6df4dff94b51e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706581384, "uuid": "568b65b1-8682-4ed8-9929-da1ba084bb74", "comment": "Malware payload (RiseProStealer)", "value": "9f51a2ea69977f334c9bc84a4b16a144b8480f978eb975a0e8027a4614c36e8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706581384, "uuid": "cd5464e5-b036-4cff-96fc-b49845e37483", "comment": "Malware payload (RiseProStealer)", "value": "d78899abd8d0cca04c062a9bc5a5a3758c77683d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706581384, "uuid": "af6e2167-0d45-4db5-92b7-6527932b87a1", "comment": "Malware payload (RiseProStealer)", "value": "b2e5eb17535b51128f83f64702d9bd685049a38cb8bc75643a74b72253abb2dc471ff5a6a649ba4e35f28f2c4026e842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706581384, "uuid": "19bfbae5-da7e-4a31-b44c-427737589878", "value": "T159558D71B652C075D19203F1316E6FE042ACBA3257A188CBB7C06E399A711E3757AF27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706581384, "uuid": "5aaa4078-2319-42b7-a2c2-ede132bf0a1a", "value": "30e61d50d6efffd7759aa76925b3b42f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706581384, "uuid": "78683b2b-e02f-4490-8cb6-6b4d798b013f", "value": "24576:96j6XB1RSG6qbKP2pdLwAhoZOe4F9LjKCTqCjZRtFTFfdB:3XRSGRjWOr9LGCTZZjNFfdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706581384, "uuid": "737d2b56-73c7-4156-9979-a50c527f3648", "value": 1306624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706581384, "uuid": "fdd1a77c-ad3a-454f-9f93-b890c5c66a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706581384, "uuid": "45e7406f-4e6e-4afe-9b02-fb7af871c7ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f7438d-bf70-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706619860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706619860, "uuid": "b7013ae3-d70b-41fa-9a9f-8a316fa24e96", "comment": "Malware payload", "value": "a8aec0d17f15c613dccad945fcf6f928", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706619860, "uuid": "ae9f007f-a917-42b4-b653-6e1ec0bb6c54", "comment": "Malware payload", "value": "9f74526ac2718f5bb1faaf77e09f40deca372433659fdc328962a3dfc68ceac9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706619860, "uuid": "40eb93ba-aca2-4e28-b83b-773f7e6ea98a", "comment": "Malware payload", "value": "fd5ba9ad64aad1da3b272d9056991a0ea0c6bbf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706619860, "uuid": "beb82a48-889b-4473-9563-42255d851951", "comment": "Malware payload", "value": "d1eb9b865205d572c1c4c3224b42da326bc3b7f787d5434bf7db620e4416d46f8659f0f5df9752edd42d609fde4c6324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706619860, "uuid": "6cb46443-44ed-4aa0-a156-06b2b662ea86", "value": "T1E574021472655E63FABC91B067316A9103F9392EA356E2CC4C99E9CF74D2F84304EA93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706619860, "uuid": "c12c5c1f-e6a4-4c76-ba67-5a5a6dabeafe", "value": "6144:c2btXaOTpTmDulCmhL9J0l68iG99WGS7UMfCrc+l7qwXR60dJ4I7u8FMWzs3t:cqXacTaulCSRO6iWnAMqQ+l7qwXR5ud3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706619860, "uuid": "2bd9b093-0191-434f-81d1-04d6df5cd2ee", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706619860, "uuid": "45c1dee2-f622-4068-b8c1-573fec4a5ef0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706619860, "uuid": "7fe497b4-e42e-4cbd-b257-d9fa2463d2ff", "value": "Stand.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9302d878-bf3e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1706598597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598597, "uuid": "27d85d97-2dba-4a69-9691-060776f842ab", "comment": "Malware payload (AveMariaRAT)", "value": "d372ad70b1aa9e46b21e2ebfcd71f9a0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598597, "uuid": "bb0b2fe8-7e6d-4a33-a345-91d686854b8e", "comment": "Malware payload (AveMariaRAT)", "value": "9fb885a66da2ed08983a46519b97dc55e002913f859dfa1e54917f63e4d7f8f4", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598597, "uuid": "759ec280-b679-48fb-a36b-8655903c6523", "comment": "Malware payload (AveMariaRAT)", "value": "a7c747634398db8043be97f6ccdf8c56b34c3f14", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598597, "uuid": "2485296b-b860-44c6-b0fc-d867febb06b7", "comment": "Malware payload (AveMariaRAT)", "value": "b3ca59fb81313f80b73c92f4b53c148fdb51d25a145970fa9fcc7d4ccec18085be36088f3e148f47e5308a38e940dceb", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598597, "uuid": "0b06cd84-22d2-4fde-b182-737612f6e77d", "value": "T1E054D001FE808616E455473549F78BAA5325FC429F934B0F329CB72E3DB43D46E2BA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598597, "uuid": "4e29535d-4a66-43ac-8ec4-8e5629370871", "value": "6144:vYunXY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVQUMIeXgj0QH1iXYDb9tTCd:vBa3bVQUMIeXgj0QH1d/9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706598597, "uuid": "2f96a19e-6e11-4416-944f-db77432239c8", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706598597, "uuid": "4e3e8d37-0b4b-4dee-aae9-6c1a49e7a0d0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598597, "uuid": "8c1cb87b-b81d-470b-81ba-111e45c39470", "value": "product list and specification.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56654c40-bf6a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706617393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706617393, "uuid": "cc149ebe-3814-4232-8f35-39336675de3c", "comment": "Malware payload", "value": "794b7a9ee52013c56ebd8c27b0465a71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706617393, "uuid": "3bd72046-9761-4636-aeb5-c165c7e1d243", "comment": "Malware payload", "value": "a00b76302c67e0fc8406b4f4714cfdb877a4f7781e282db4960a2968cdfb9c84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706617393, "uuid": "d3e7e157-733d-47d6-af46-52e059e7603e", "comment": "Malware payload", "value": "f95daec3efe635a7a33e1bc646503f3674eb570e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706617393, "uuid": "629e18c6-533c-4e39-b29b-e031be8d439a", "comment": "Malware payload", "value": "b3a3763a65a87e15f577ede3c3a8b7f67f3a8f7e25e2556ee851eed5ed38eb78aaa0de063bd692381c9696ed2553ad61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706617393, "uuid": "483363dd-213b-48c5-876d-50352b0a665d", "value": "T18BE733C062959847DFB7ADBAA809434C34CF72C63563A9F94C22BC8BD6173064FB96D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706617393, "uuid": "dae86dd2-8de1-41c1-9d2e-21dcbb3d3832", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706617393, "uuid": "c542c6e4-7e71-40af-9a0b-d3b61c80e91c", "value": "1572864:uyXoONw5lqrXHV3HC/7pkELI2qeTcig6EdIA7vdH3+3x/+1Tn13qUZ7:zXk5orX13Y9lLIT5ig6EG0V3+3lOp6a7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706617393, "uuid": "e61789bf-a01f-462c-8959-76da161d6682", "value": 69767504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706617393, "uuid": "1565ab99-463a-48f3-8c04-425c30b5f8d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706617393, "uuid": "fba254b3-c4a0-4cdd-a596-9579f72d0864", "value": "Mauqesbeta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6beb1685-bf9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706639333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639333, "uuid": "de31b82a-f95f-4650-8767-29f04f596d78", "comment": "Malware payload (RedLineStealer)", "value": "9aa8737202bac7dcc71ef4c77939f82b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639333, "uuid": "b2a0dffb-255f-47ce-a2e0-41d984955495", "comment": "Malware payload (RedLineStealer)", "value": "a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639333, "uuid": "135924f1-11e4-4062-9f9f-cc1756bbcb39", "comment": "Malware payload (RedLineStealer)", "value": "25b29b7274fb3ef7d16052f8400d24540621aff9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639333, "uuid": "d19a9b2c-2b5c-48d8-9d0c-fff8aa2bea30", "comment": "Malware payload (RedLineStealer)", "value": "55084fc22c6371f6058a80137c2bf375edaa492bcc9537c823b54c7edb3db5443d9e2b932daf7eff03f5012f2ee2f5a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639333, "uuid": "7c81bd51-d5e7-4b93-9a95-85ec69c3853a", "value": "T1CB645B1463EAE902E27E47B8A4A0D1715374DD12E503E7172DE42DBB3D63B44EB027BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639333, "uuid": "b08044a0-ed3d-4e11-8cac-fa3e67867eee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639333, "uuid": "88046f22-5cd8-406d-8a6a-4882ae0bf6ac", "value": "3072:UA0KubVwL+uacYOFq70W09SIg8DJn5MxfCpWLMRqfjDv/YheqiOL2bBO2:8Qpaw40r8IDYx64MRqfjD4jL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706639333, "uuid": "d61a4883-bd08-4f43-803e-6037c14fe614", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706639333, "uuid": "475a589a-d795-4aa2-8f8d-21b5d95d74aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639333, "uuid": "dc49d656-a5db-4281-8bbe-4f37d4e67eb6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542f4da5-bf95-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706635857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706635857, "uuid": "b588a8db-766f-4620-8c5a-6ee41b52f0c8", "comment": "Malware payload", "value": "a3c87ce12367c83104cda662ef76afb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706635857, "uuid": "6e81ca5f-6ab6-47e5-b06f-b4bff81708e4", "comment": "Malware payload", "value": "a24362e4ac45ec3e35f16b91d593b35976b1cb795a81d19e88ac5969d0cfb68f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706635857, "uuid": "41e070c2-783a-4860-81ba-5c0d1d4a035a", "comment": "Malware payload", "value": "6538657286bb504cbb3cddb6b97e06c39fa904d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706635857, "uuid": "8f2c362c-49b3-4863-bbaf-ed6c84fafde2", "comment": "Malware payload", "value": "577f0c1f6e12e8da70140b40bcab49d923125d3e10bce7a200e4b569a49fde3ebcde4bc48cc8edb9ca41c51e0f2839f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706635857, "uuid": "c8e89677-0819-459d-89e0-de78ca19575a", "value": "T1B126335867F3C4B9D90E573102EFB1AE04227B4B0C7DB20B276931A72CB5EA1DE4624D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706635857, "uuid": "ed7256ce-c8d7-4867-893a-4afb9714fe95", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706635857, "uuid": "7422fb0d-5ca2-4da3-8b69-b042305ab437", "value": "98304:ktv3TCmi5ov0BDwZwaIRTdGRaHcqpfiWRwwqy2tjXcP3EFSjia:ktvTL/0BEFIRBDHbpsptjXcP3EFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706635857, "uuid": "6f648dcc-ce5c-4c45-80de-22852baac545", "value": 4837816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706635857, "uuid": "1171dfc7-4756-4180-a345-ed71c6685e34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706635857, "uuid": "e2c01e42-b8ed-4044-a494-ebcfce9da5a9", "value": "a3c87ce12367c83104cda662ef76afb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f48629-bf3e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706598704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598704, "uuid": "f431408f-ae33-4cd8-80a9-6496aacfab70", "comment": "Malware payload", "value": "95ccb57ebca1d648059dda26c093a46c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598704, "uuid": "b3ad246b-619d-4c9f-8e74-755f0c24342f", "comment": "Malware payload", "value": "a2fc8e545a8761af4da3f431edbb521a4db6f8563b3f135b9444c843d567fb8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598704, "uuid": "3079ce3e-d861-4f54-8fb0-ab74ebfd539e", "comment": "Malware payload", "value": "67c4e19ad1dc2a8c4403edfe660706a80def2391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598704, "uuid": "5d294bec-8be3-493a-b9a0-2058a50c0b9f", "comment": "Malware payload", "value": "caa15bd30a81740ad39fce8b425609156c37a5e5a47d4ab481bc913265ef427ab20d2a91f885629366279b52b58133d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598704, "uuid": "b92eba4a-96af-46ef-8b43-e99143d58dfd", "value": "T144F4F110B6F08032E1F356314930F7B50E7BB8A2E639C9CF5B96167D1F35AD18A2179A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598704, "uuid": "906f3dd4-b9a5-4688-9868-ca305b7f538e", "value": "0f86209308d034305701c953de1bb53c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598704, "uuid": "c24a98b3-ef5b-40c3-9bef-5a8707e095db", "value": "12288:PjY3Rb0HevGyT7dS1aQZBaXl9dlsswSao+KqEEHYkoA7JfdHCpVefl2DKhnXG4:PIFQepAMQ6X3d2hG+KqEE4koA7/CCfl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706598704, "uuid": "266d1c1e-98cd-434e-b6f1-e543234c48d7", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706598704, "uuid": "b1777ebd-aefc-4252-bc89-0549954fd606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598704, "uuid": "ca63653d-34ac-441f-9aa1-252f8976310e", "value": "95ccb57ebca1d648059dda26c093a46c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24d2f7a-bf62-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706614111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706614111, "uuid": "2c405c61-2132-420a-a19f-11793115c4f7", "comment": "Malware payload (Formbook)", "value": "9219bf66fa90efe3d24dd4d913a99c6b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706614111, "uuid": "42fa667f-648a-4490-b83b-bd8d403203c1", "comment": "Malware payload (Formbook)", "value": "a364d4453ad71f51148c1d242cd654bbfe74fa8fd0b031a1e4a4b42ab89d24ec", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706614111, "uuid": "9d1015c1-14d2-4fda-8050-448a301970fa", "comment": "Malware payload (Formbook)", "value": "c0f3ecc2916200e3d773c36765335a422cd31bb9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706614111, "uuid": "ac7605ca-8869-4dfd-ac2e-f1cb15562d76", "comment": "Malware payload (Formbook)", "value": "bd9606771a90ecd780adb441e409a5901bd7d3768077db481346b039e75f29e2cc19cfc564947860940aa82b12b0232b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706614111, "uuid": "9c1eea25-7249-4eee-b168-56f55ffeedf1", "value": "T1A2E42330C22870695274A236CBA6DA6AF423780A242E70DC5A9D15FD77BF1BF5B5C131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706614111, "uuid": "b86627ef-2e1a-4eaf-82fc-90e5595b3ef8", "value": "12288:TB0/AWbc95brbArIC5prn8ltglZyvyPqdACfCdTTzC5MGth8MYhR95vkgg8pgRZP:TBEKIrjrn838EyWA1dXzC3CMYnfk4pgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706614111, "uuid": "2f77f107-2773-4ab4-b4a6-7e6c0f3fca41", "value": 666021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706614111, "uuid": "99d23381-fbf4-447b-8e0d-76d66862378c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706614111, "uuid": "de432893-2b67-44d7-bce2-ae9a1ef9f158", "value": "Angene Remit - 6300547 28.01.24.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18058460-bf84-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706628455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706628455, "uuid": "dfbe87dc-6b6e-4c62-b8eb-97516079d1e0", "comment": "Malware payload (RedLineStealer)", "value": "c1d1101f1b4094cd1752abce8d7253fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706628455, "uuid": "ddfa463e-6b77-4c7d-891c-53f3a6382041", "comment": "Malware payload (RedLineStealer)", "value": "a399bb565842055c7ac9baa50d8939c1d3327067b0fdd6f5bc417274ea0cf73c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706628455, "uuid": "2bd40905-9ba9-4f66-8dc3-985b5c64216c", "comment": "Malware payload (RedLineStealer)", "value": "cf792b58605afa0817a341903ced515815dd0600", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706628455, "uuid": "7eca60fd-9c54-4acf-b26c-af790d0ece9f", "comment": "Malware payload (RedLineStealer)", "value": "a3b3f390d096918b2d864b41aef004a816b0b83198e3d50f7e52a8f19347bd3ff7f89e2aed8586976109cdef9927494c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706628455, "uuid": "360624df-2188-49d2-a0c5-07d0c34e7d5d", "value": "T1C8A401257181C1B3C477003580D5DA36AB797062477AD9DBBADC27BA6F212E1E3362CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706628455, "uuid": "70450233-36c6-4145-9786-92b2927db418", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706628455, "uuid": "e0fc64c9-4a67-40ad-9a01-d23ce7f3605c", "value": "12288:fh1Fk70TnvjcQ/8g4g8o5albIq83+ithwN2:Vk70TrcsT4Zo5sMq8u8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706628455, "uuid": "722c6a5e-1233-4f11-8d15-1b28b35c2f7c", "value": 486400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706628455, "uuid": "b9ffe10d-1e95-410d-a611-6d7931484c27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706628455, "uuid": "9de9f848-92e2-4df8-9bc6-208922e048ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1aacc65-bfa2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1706641598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641598, "uuid": "41aa1781-6eae-4775-aa98-c437a2b3ec0c", "comment": "Malware payload (ArkeiStealer)", "value": "c925f16bbf87e187a1687772fc06d126", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641598, "uuid": "bda17b5b-6386-4676-a8d8-616c43e86b2d", "comment": "Malware payload (ArkeiStealer)", "value": "a4ad4a633bc912b7c80b37be15a18b5ea4d451694eb277dd867a9fc1b31825fd", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641598, "uuid": "c700eb67-b2d6-4d58-8520-450678b9e4c3", "comment": "Malware payload (ArkeiStealer)", "value": "545a107dcdb9f063e7d6ec57345e82b5bc8b0acf", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641598, "uuid": "42725c05-8985-4576-8966-cf8d791289ab", "comment": "Malware payload (ArkeiStealer)", "value": "b8b45856404937171df1ac256f7a1d20b1df7dbe1e1f90076d9a3acb2a45c6fdcc432598a763d0f13b57f82046a0cac7", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641598, "uuid": "231629c9-46e9-4f66-b59c-91f797f0d8a6", "value": "T1AFF633A733CD855FD9B664FBAAA301DA368BE7106535F3797C1C2BB166884F0041B98C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641598, "uuid": "04db8290-8dff-49aa-a788-0ae6f22057e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641598, "uuid": "9fa5260f-1ac6-48e7-98a0-dc8b70f82b84", "value": "393216:sjsKCVsNROxARxeTxfT3b1nCinULNFF+DG/Vhkr2z:sAKEsNgxo0xfDJVSvj+r2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706641598, "uuid": "5195ce52-cd17-461f-8db8-d3fa33932069", "value": 16340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706641598, "uuid": "c3a249aa-d1e5-453d-8cb2-1fd1f809d236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641598, "uuid": "728be36b-20f3-4502-863d-8db40e81babd", "value": "Bumble.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8fdc72-bf55-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1706608357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706608357, "uuid": "f0e9aef8-2c9d-4381-81f1-8a6c1aca5cbe", "comment": "Malware payload (DBatLoader)", "value": "c1f19928a06c01eca031edefe38b11d9", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706608357, "uuid": "a99980a2-d3db-47e0-8c74-aa365c64d6b4", "comment": "Malware payload (DBatLoader)", "value": "a4af4a7db0fccd57e0c447273c55abce7938127d6bf0e4320e47c262aa728851", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706608357, "uuid": "e0bb6361-fe8d-4812-a068-917444711b75", "comment": "Malware payload (DBatLoader)", "value": "5ab222d11a3a96a2c8cec5bac0aa077da0b57181", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706608357, "uuid": "d7e4843a-7cd2-43ff-8de6-cbcd2ee99c4a", "comment": "Malware payload (DBatLoader)", "value": "35058e13cc1cb0fa0aef860fb3fd82e3f4f666d7da7d6a1ff071d37b4b0d9d1eef654c1c22ed523691e7e09087a4b7a3", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706608357, "uuid": "53832f76-542d-4f65-b3cb-5ea7ad45f2db", "value": "T148A5D023A2D44432F132A57919977BA5EA1DBD202C267E9527D53D0CBF333407F28AA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706608357, "uuid": "c9a4aeaa-6539-4188-a3d8-f144f27e196e", "value": "49152:yqAodhXjnxf2hd7c7mvrq0gOP7aF5P0R:yqAo2hd7Ymu0gOeuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706608357, "uuid": "4013ce2c-028b-40b4-85fa-1e2f36169986", "value": 2099200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706608357, "uuid": "c4e197e6-b1c0-4b61-9e96-9292995da840", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706608357, "uuid": "3f292b66-3265-4556-b701-0294443817cb", "value": "INVOICE.XLS..tar.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56fe257-bf65-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706615485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615485, "uuid": "dd66e211-a702-4d63-97af-29f730e8d1d7", "comment": "Malware payload", "value": "b58d686f1c6c124ccd8d5fab08638ec8", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615485, "uuid": "6cb04efd-4b62-4104-8ee6-8e460bb83b78", "comment": "Malware payload", "value": "a5270b4e69f042fd7232b2bfc529c72416a8867b282b197f4aea1045fd327921", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615485, "uuid": "b7ab20aa-1275-4cad-a12a-0ac689332c2d", "comment": "Malware payload", "value": "c28ca1746b78796a985cbe5de9caf20a76be7784", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615485, "uuid": "b70d7777-a8b9-4146-95de-6b948b60c2be", "comment": "Malware payload", "value": "d3807047a370675f3fc78de5d96f341f4d4ffdee0638d83cf95f47488ed36b3ab8c5abbb3a5563eaf11e2de7ca6a6e6b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615485, "uuid": "c15a4687-b869-4d5c-b50e-9b04e196e73b", "value": "T197B41223DE970D151F245A3B83EFADD5087FDFAD68669DEE3E2262C6A16CB0700C1461", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615485, "uuid": "371195aa-d700-43e4-aa43-8b663c0948c0", "value": "12288:KDaAsTdzWTbUqh3uJ99G+N+uRFWHafn/anobHdziL35:KDaAspzrtG+UuXEan2G9OL35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706615485, "uuid": "3fc5b56c-3061-4f90-8047-eccf7fcbc6d7", "value": 536558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706615485, "uuid": "a60d1833-903a-4082-a6ea-880f35f728e2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615485, "uuid": "fe7d2e19-4493-4654-b129-f11114fc501c", "value": "ayaz.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe098cd-bf92-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1706634562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634562, "uuid": "9f782e41-f7c2-4c40-a14c-3ecc2f8c2031", "comment": "Malware payload (Socks5Systemz)", "value": "acb4baf7c527b40f70f55e00a3832494", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634562, "uuid": "29f46026-3820-4851-9883-04583c8c713f", "comment": "Malware payload (Socks5Systemz)", "value": "a5a64f3f3ce4f04c54c87c921be674aee5000ff51e4da41c0f475a365a2fa33f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634562, "uuid": "a5d94ea7-4bd8-4769-8cc4-872c2f7b2657", "comment": "Malware payload (Socks5Systemz)", "value": "86125485aab335435927f666a54cb6dc14e4bbaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634562, "uuid": "16c21a42-5466-4dd5-ba5c-8e48b644139f", "comment": "Malware payload (Socks5Systemz)", "value": "aea303d3a46ccb0021b37f1d24e7d100848ee366e62537c073f059bbd4517648565d26b2d4e9c4b446a8f59329fa38ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634562, "uuid": "66bd78a0-fcdb-46be-99cb-fee0dba0c96d", "value": "T1D36633A6E1C882B7E2932F38AA7CCE4C183BB75549615134B5AFB59F59337203B411F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634562, "uuid": "031bf3fa-309a-4c82-917e-a85408aac16a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634562, "uuid": "8d6cc701-1375-40fb-a617-e440e636742b", "value": "196608:KdpQQ14ZWhk7YxlmB2dmwQ8Rh5jCfsNWVipXmBGutpw:Ep5+ZWy7YlYGRQQh5/KqXrutpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706634562, "uuid": "35b8454d-dee7-4be5-b467-020e7656f675", "value": 6627305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706634562, "uuid": "ec4ae2cf-3877-448c-9f78-475375e2f60f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634562, "uuid": "015b351b-1774-419a-891d-103c1ec1cd76", "value": "acb4baf7c527b40f70f55e00a3832494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889747ba-bf96-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706636375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706636375, "uuid": "36696f5b-1d0f-4889-80ac-707abfbdf432", "comment": "Malware payload (RemcosRAT)", "value": "2df55fe3cc8f88d5f9330e7c507ab83e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706636375, "uuid": "09e77e41-e8ac-4222-9280-925e5105eecc", "comment": "Malware payload (RemcosRAT)", "value": "a93b22b0bd2cb4d7f22cdf8f33ec79bdb8ea7a3a8561a79ea24a4cca6bcc1c9d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706636375, "uuid": "aea63680-ae8c-490f-b869-98cee63eee2a", "comment": "Malware payload (RemcosRAT)", "value": "1d98956750c68f6a990cef79bceec62d315f051d", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706636375, "uuid": "653dd957-b5a1-4e03-9224-cb0c17f819b6", "comment": "Malware payload (RemcosRAT)", "value": "583eb9187de62022cad9e912465d9e2562e4766d5ced6b8734b10cda5707d99504ecacc4b37419b27b601bf00f5b3b44", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706636375, "uuid": "1951cf20-8a4a-4701-9ac6-20fe342b4eb5", "value": "T1262512A2727ACF85E56A4BF14875412407F3AD1E8C66E60C2DA639EF77B33020852E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706636375, "uuid": "6bf18528-ab74-4eaa-ab16-fd272cc36a35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706636375, "uuid": "452046fd-5b94-4d8f-a32f-e6476dec5dca", "value": "24576:BIAICr8Efpjif+Pw/qDZqQSJEXUivF073F03sMo9HgbPs2ch:BgEgf+PwBJEXUivF07G8HGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706636375, "uuid": "25e39694-3f7e-413b-ad81-0fd3a2bd06f0", "value": 1031168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706636375, "uuid": "8c7a87ba-725c-42d8-9865-6b990d2af472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706636375, "uuid": "020b4b6b-1746-4aaf-99bf-cab79cb191db", "value": "DHL - Ondemand Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29caa6b7-bf9b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706638363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706638363, "uuid": "bbcade4d-eea9-4d2f-86ab-8e2f1d8dd710", "comment": "Malware payload (RemcosRAT)", "value": "bb82c9dd407b34360ac77c8f6d676de8", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706638363, "uuid": "c1381d82-08a8-408a-957e-6baf14b7d36d", "comment": "Malware payload (RemcosRAT)", "value": "aad2763bc741b46616ba3bb283b7a5a513219a57b19f323d45aa5f9bc7557c52", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706638363, "uuid": "1ea64538-ebf4-40c6-95d0-8037aa099a7c", "comment": "Malware payload (RemcosRAT)", "value": "f65c4705338715b174163e16d7e6022931f928cc", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706638363, "uuid": "c9eb442a-c2cb-4d9e-b4fb-4a1996f5ef4a", "comment": "Malware payload (RemcosRAT)", "value": "1e4e4a4a712c0d23fc928853ba0fd9d764ca4345bca4a6a046fec3af3e262c8548a5acee83cec4c62cdd2d4a915a85de", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706638363, "uuid": "09141d26-0935-43c2-b5d3-82e295ccc1a2", "value": "T10AA5DF22A6D04432F132A5795B977AE5E92DBD202C257D9537E43D08BF333407F286AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706638363, "uuid": "9c912f5a-1c0c-4b75-9e81-f2840aa7ecbc", "value": "b849c32c8477f283a2e1a1b6798d89b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706638363, "uuid": "c4c68922-612f-4498-8711-401cc5a2a41f", "value": "49152:pqAodhXjnxf2hd7c7mvrq0gOP4aF5P0R:pqAo2hd7Ymu0gOJuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706638363, "uuid": "ee5997e3-d520-4a6c-9b89-9f778e471dfe", "value": 2091008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706638363, "uuid": "f0764e19-0bca-4e89-9364-1a0282e19983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706638363, "uuid": "84f1b506-f626-4c84-b63d-53d4eaaeb266", "value": "x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad28a3b9-bf50-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1706606371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606371, "uuid": "93c6c736-9937-4f8e-84a1-d871d263248a", "comment": "Malware payload (XWorm)", "value": "f4d7ddef27375f33a29ebadfe09f08c5", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606371, "uuid": "70b40e20-73df-46d7-b36b-4aa9595eddce", "comment": "Malware payload (XWorm)", "value": "ab348a1a351bec1f6d3218c5c75bf20b1f9a3ba57ef57324e73dcc874c584351", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606371, "uuid": "170e1ae9-30b7-41c1-a665-c755bbe5c90d", "comment": "Malware payload (XWorm)", "value": "aa6c4e98106028d7a782f263b3a8513a738b24b5", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606371, "uuid": "5156cd6b-e380-4a69-8018-19e658be6c65", "comment": "Malware payload (XWorm)", "value": "1310b4e5ce7913d1805daffb7b26e7263ad385dfe37e7109507efe241786df492712d82256013ccbe12e39868f27cfe5", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706606371, "uuid": "8fd0cb09-373f-4de0-b27d-264761bf5210", "value": "T138C433BA29978A5F45D4680BDA701E3B7727F0F274DE102644A4BC65CC4FD02B9EAD8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706606371, "uuid": "6ddfedcf-21f0-4502-b2b7-f0f9c0bfcff0", "value": "12288:67I6UCBi4UkNjRHYa3VZjVyZI2ME0VsIU6881o2YkFj1SSHN8/Yl+M:x69U4djF5VSU7v1SIX+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706606371, "uuid": "740d81b1-dee0-43cc-9d05-95ebaffbc756", "value": 591202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706606371, "uuid": "4844d434-c657-4c23-87bb-565250a9b093", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706606371, "uuid": "19985009-1da5-43a9-a43d-a3d7441b807b", "value": "PO NO 01 031723 24.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bcaeb3-bf50-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706606409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606409, "uuid": "cc08ec40-843e-4c52-8fc7-667a569b9398", "comment": "Malware payload (AgentTesla)", "value": "b8b8e8c0ec0acc69491f3948cd63f1ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606409, "uuid": "00246a54-5b31-437a-9cc4-3a477d562c20", "comment": "Malware payload (AgentTesla)", "value": "ab48bc3904e5c7bb945e11c380a9e235fff37325e68e32dc42bbd6dd11c36f1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606409, "uuid": "6f3e4985-cf6d-4ad8-bcef-b92223cff53d", "comment": "Malware payload (AgentTesla)", "value": "a510e256e067982a843308e78aac795e31127db4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606409, "uuid": "9d2dc29a-2b7c-4374-a55f-dbe0db2c289f", "comment": "Malware payload (AgentTesla)", "value": "1e4b741b98d16d41bbf5e92ad1d87a8cee98cf30026ad4d408900b714afd050f37ab6ff36267828af844161e8a8e920f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706606409, "uuid": "04c121d7-af92-4627-a444-f3505945cfe8", "value": "T18CF412197398599BDD9D0A75DE2081DC4772AE223D92E7CF3C88322E49F2F128796317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706606409, "uuid": "ef1a2513-efce-4634-a063-5e6629fdbd7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706606409, "uuid": "4f280b39-9f9a-4309-b514-e942ff570fca", "value": "12288:9ZxUj9SCF1Ov2U2u1InSrCDoOTrVDz/79U2Kc9OYNwlJgVK8AxFuj:9ZxUj9Z2ZGnuPOXVv/79U2BN6PIKAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706606409, "uuid": "c27dd5fe-3a72-430f-86e8-88977f186860", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706606409, "uuid": "1ef406b0-6cd1-4153-8daf-dc9821f20e84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706606409, "uuid": "398d356d-660d-433d-b849-63f8aeca56f3", "value": "RFQ_NEW ORDER INQUIRY.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e5853e-bf8b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706631503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706631503, "uuid": "70ecf58b-d603-45fb-805f-a0a3a526dde1", "comment": "Malware payload (RemcosRAT)", "value": "3644e9886531420d6480a2afb09f420b", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706631503, "uuid": "fa118d86-71e8-4155-938c-a8d2f8ec8f27", "comment": "Malware payload (RemcosRAT)", "value": "ab98a78665b6c28cd761be1c6b82017c3e0747285f272956397661383013e7e0", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706631503, "uuid": "15cb27d6-4466-4680-be71-e07e3e6074d1", "comment": "Malware payload (RemcosRAT)", "value": "9a54608a6a26aa6cf6797b0268e295714258dab8", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706631503, "uuid": "d2539aba-9b09-40f1-8328-4e078da557b0", "comment": "Malware payload (RemcosRAT)", "value": "00e0d7ed91cd759a3dd993c77e8c284be1f57527c9f0f6a89d62215dfa7bac524561a313d22c698fe848e6e1c6165734", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706631503, "uuid": "7854b990-9fc7-42bc-815e-ccf524aa3118", "value": "T1F10533EA2F427551D66333C46E9619F39FA034893DC47992E4A5CBD7FE27202B6081E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706631503, "uuid": "489f375b-2b64-43f0-9152-a8b5b86646dc", "value": "24576:dU677c+2YbciXCB6hC+H07yEuJ/DJeOOIWw:dZgziciXCB6hC+U7yE8MO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706631503, "uuid": "58750b67-696d-4f04-bd99-d80ba69a8739", "value": 856990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706631503, "uuid": "9d7eda81-ed5a-4b58-8888-4eaff0800aed", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706631503, "uuid": "ccd30b25-f07c-4bd9-b724-c2ca72067987", "value": "RFQ_NEW ORDER INQUIRY.ARJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8123f608-bf96-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706636362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706636362, "uuid": "13df48a9-427c-4f25-aa35-b9f5f016feea", "comment": "Malware payload (RemcosRAT)", "value": "84267aa538471fe236a7639e6d05f1cf", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706636362, "uuid": "3ad96637-1fc2-40ad-99e8-d06c736ab58a", "comment": "Malware payload (RemcosRAT)", "value": "ad61d0582ca1db7eb528c8201f1a0a62c5e5ad9c20a51794e6d1d191dbbf2b4e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706636362, "uuid": "b51bd571-e7a8-4a93-a7a0-94b680bd24f6", "comment": "Malware payload (RemcosRAT)", "value": "964a0ccc1b4a94df56224fffdd8ad81550556f6b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706636362, "uuid": "9d9a1eba-2b6d-4f75-b811-e4d9368839e1", "comment": "Malware payload (RemcosRAT)", "value": "e3a5b7acbc4b1d3989695eec7e9750ef0f86ee083b2502c5b7ab7a01eadbd82bcbcf1dae78dc346ea13a488e3f2d6d39", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706636362, "uuid": "ce2b5d36-e96d-4f5f-ac83-2f63657f007c", "value": "T16CA5DF22A6D04432F132A5795B977AE5E92DBD202C357D9536E43D08BF333407F286AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706636362, "uuid": "fc98b379-4b5d-4f79-af66-2792e734bba0", "value": "49152:kqk4tJrjDVfaxFjU7mrra0gOPY+ZNPIl:kqk0axFjgm60gOZOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706636362, "uuid": "8cde9237-78fa-4348-bdd0-6a0ff542f1ec", "value": 2091659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706636362, "uuid": "719a6150-e525-4952-9cd2-d08b09bfa3b9", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706636362, "uuid": "358b115c-edf7-43c4-bfeb-50bb9f88eeab", "value": "Invoice_00999382.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539afeea-bf5b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1706610946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706610946, "uuid": "1917173c-004f-447b-8d38-729d5d353dd3", "comment": "Malware payload (Cobalt Strike)", "value": "d6e603a61b015d7fa327a1691ad86824", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706610946, "uuid": "73737ea7-eca6-4a49-8dd6-e8466691f9a0", "comment": "Malware payload (Cobalt Strike)", "value": "ae760c09a3b29a41781d994d38b769baa2cf57b245b24465ef51f810eb318d95", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706610946, "uuid": "2e98c4a9-b3c7-421d-ab0c-f7d13e75e19a", "comment": "Malware payload (Cobalt Strike)", "value": "481a2bf998b9769b0ae8436392323fe46b3d5da9", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706610946, "uuid": "0a4b5218-94b5-49c3-8b7d-072cab8c33b0", "comment": "Malware payload (Cobalt Strike)", "value": "ee93853535544823303138f147a2757dad89b775eaad074983c47ee96c2ec4d71c7b1f3a35410566a10b69f309f448b7", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706610946, "uuid": "39758275-86b7-4995-9274-9d944f34eff6", "value": "T12B948B5E35217DAEE67683319D524E00B77EF47404A06B2E46192FA21FE77848EF872C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706610946, "uuid": "9442ce19-18b8-4ea3-b857-536583755a06", "value": "288f16b0b8f878f46d398ba21bf239d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706610946, "uuid": "1fca4186-8794-48e0-a544-1f791a094f5d", "value": "12288:ADfms1LlKhD6TVCwWjn5h3nGby8paQMdZ/I:++wlPEhz8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706610946, "uuid": "e1934332-6a3d-4ddf-8eb8-059ed1b4c5fe", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706610946, "uuid": "632bb330-8410-46c5-b58f-d72c6f6bf480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706610946, "uuid": "0df057d7-2e7a-4951-831f-ee35383e5cbf", "value": "jMnmopzu[1].dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f401f349-bf21-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Fabookie)", "timestamp": 1706586304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586304, "uuid": "6aba7b2f-3398-40cc-b562-9ff16228934b", "comment": "Malware payload (Fabookie)", "value": "67a7cd9f9fef32fc81696237166d8359", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586304, "uuid": "26d011d2-a253-4622-9e0d-beff606a5a5a", "comment": "Malware payload (Fabookie)", "value": "af96622e503cea942a82577fe25a1284111cb3614a29aaaefaf393c059409008", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586304, "uuid": "e99f2b2e-0129-4d7f-a716-7485f06b685c", "comment": "Malware payload (Fabookie)", "value": "28c8e9288ec2c3a84a48312c8bac4fec0623205a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586304, "uuid": "76588dc1-ee7a-4f8b-89e6-c784a0e314d8", "comment": "Malware payload (Fabookie)", "value": "b25b60db9cf75af7a4d5ba2e6a275969d2354081f61588e447083d6bdb7b8d243291df4036987325fa08785b499e23c3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586304, "uuid": "a870b784-4452-44ff-b7c1-294f8467ea41", "value": "T17DF41B56FBBD4272E051C135C9A6E7B5E6B27C855D30970B2345EB2E2F335118E3AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586304, "uuid": "c3aef782-194d-4767-bd23-1749d59dc2ae", "value": "f2fcd0efb031ebebeaa83cd4cd21090b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586304, "uuid": "6e496e04-e43a-4d7a-9adb-77f382f3de29", "value": "6144:nA01NdBRvxQWQSYYaE57iibdoaxQ7cUBmCUiJbc77ZvfuYuEdGxTC2oWf7xLUnwa:nd/5QWJGibiFShtdGxTC2o5JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706586304, "uuid": "fb4b8177-e5ed-4e1a-86c4-0d4727775b3d", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706586304, "uuid": "64998247-d618-41ba-9dec-e25760aaf6a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586304, "uuid": "a904d099-7ced-46e3-ba45-8468adc8892e", "value": "67a7cd9f9fef32fc81696237166d8359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d27380-bf78-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1706623599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623599, "uuid": "6db44036-53c5-4fb4-a8a7-807d0b949817", "comment": "Malware payload (IRATA)", "value": "63890a15099a0debd9ed2a3b2036c956", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623599, "uuid": "011176c0-f8dd-45d8-b9b1-28c541963e7b", "comment": "Malware payload (IRATA)", "value": "afa3c43141a5b6f2473d49cdfa0bce1bf0af235a40f3ec092299287291137841", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623599, "uuid": "15e64cce-c8c4-46e0-8a84-86b88ce30385", "comment": "Malware payload (IRATA)", "value": "d4cabb3e134a518c88e4856e63756806161d8e3b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623599, "uuid": "678d129a-f3e1-4fce-94c6-e26f48f6a7ea", "comment": "Malware payload (IRATA)", "value": "705d33b4841f971f55789990c343edb3ed187b3a0f0aacd0777f8235809f667d0717c3fea843de2e949c3727d4ae7966", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623599, "uuid": "eeb99633-78c7-44be-a5c2-4eace2835fd6", "value": "T15A2633E6F1B381CAFA9B4433D433560ADF3A098ABF20188674FB365155DB5DD431A8AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623599, "uuid": "283cf06a-3b8d-4251-ba45-5cbdcca32229", "value": "98304:Gr/9hinlhin6Vhinahinx1hin6hinshinUhinXqlfMBbzebtd+cGVqbCoP8p:KbCzC6DC8CxjCcCyCKCXqC4tdvCxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706623599, "uuid": "0f14d8bd-8a90-42e4-b0e3-11b310bdce95", "value": 4743350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706623599, "uuid": "ef6503c1-5223-4fb4-8cd5-cb90fb69df2b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623599, "uuid": "4b019ec6-9f7f-4f92-9617-cee24776ca27", "value": "63890a15099a0debd9ed2a3b2036c956.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832d3fb3-bf83-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706628205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706628205, "uuid": "b9545c36-c070-4ae7-aa31-c1f73e2b4789", "comment": "Malware payload", "value": "dda3d6669d1850767c8de38fbc4c3388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706628205, "uuid": "4cdaf4fc-9779-44e6-ada3-2f75a87c4087", "comment": "Malware payload", "value": "b020ca12d4c5f54e3de4928978ac9cce0de2c7c55118e6dfb1b02b85fe1834c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706628205, "uuid": "139f7e22-fdef-4381-9a92-dbc0b4c50e04", "comment": "Malware payload", "value": "60fce585ca969444ce513aa2ee7ab0998e5a14d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706628205, "uuid": "cbe54091-8aa4-46dd-bc19-79962d8fa2ce", "comment": "Malware payload", "value": "6b1df554da6526f4a14746a934f9203fb338e942b961748896cc4b11bb85c5273708fa6d91a8edd00f37ef6d7b4e0d31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706628205, "uuid": "915d6660-a169-4ccf-9f3c-237a624816de", "value": "T10A167C31B605C139F59141F1696DAFAA8C48B9371B2A00D3B3914F6968F07E37A79F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706628205, "uuid": "3fa17a54-0e82-47e4-a705-56ec7fa785bd", "value": "877552747aabf02f5f485a934187fa17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706628205, "uuid": "b32599ae-72db-4cc3-a159-a1e6b180377f", "value": "98304:VPCd3+mRYiz7MXjfsRwsFkEcGdGvouqr8:VPCd3oinMXwRwsFkUua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706628205, "uuid": "3004547e-175b-4a08-95c5-ec1278b237ef", "value": 4363808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706628205, "uuid": "6015287b-728c-41c2-b361-53792da398e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706628205, "uuid": "3b69ab8f-1dc0-4e35-bb97-c4db38201392", "value": "SecuriteInfo.com.Program.Unwanted.5365.23156.17280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922a13e4-bf3e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706598595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598595, "uuid": "3ab29be7-3474-4feb-b90c-5217a43535e8", "comment": "Malware payload (RemcosRAT)", "value": "36b46a0c885b105bd2fb0bbcdfc78803", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598595, "uuid": "06fd9c50-7304-4740-b749-93644458997d", "comment": "Malware payload (RemcosRAT)", "value": "b19d1bda55cc529c2a9aa0c958b123a06ba5f688db14bdb51298e4df09124e41", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598595, "uuid": "7046058a-ab0a-4938-8525-b6e6f8d258bd", "comment": "Malware payload (RemcosRAT)", "value": "5c5e2150418327f74907ca7654f2a5a0c267fe19", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598595, "uuid": "196b0540-db60-4f3d-bbc4-4696db3b1797", "comment": "Malware payload (RemcosRAT)", "value": "849763f29aa4f011d969399e5464dd011c466c77ceada9a471156c1728bf9e8265cf946dc252a02a4692eb1a28e7b8af", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598595, "uuid": "fbb6b440-e3aa-4fc0-8e67-20ac2c412ed7", "value": "T13C440219B6A9E45CC0B3983E5CC8D1DBA20EFC219F82E64B7540F79E09709C25753ADB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598595, "uuid": "b3dea977-6a76-445c-a1d0-8dba6e3fe3aa", "value": "6144:XkXunEZP8VN+XvTvPXKbXXxYJBm5PO4eOz:XkiO8VoXrvPXKDy/22XOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706598595, "uuid": "175f4eb2-be75-40ad-afaa-2b214fd21c02", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706598595, "uuid": "8b8ff344-20c7-46a3-a2e8-6ca79a813413", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598595, "uuid": "31b2a478-6395-4d48-861a-1799b64fe7b8", "value": "Purchase order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5701ceb-bfba-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706652019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652019, "uuid": "da9e1b91-ef74-4684-8523-323d60ce0949", "comment": "Malware payload", "value": "c2e0ea6b522a3a07d17e8083cf254187", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652019, "uuid": "ca1c09f6-010b-40ac-a105-5dedce92ca01", "comment": "Malware payload", "value": "b3f117e18778731b2a943b3871462ff9197d5f03e2733c25d60db1c376ac8ceb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652019, "uuid": "2536d30b-b6ed-4be0-9d03-50ef731d304b", "comment": "Malware payload", "value": "2cd08bfa592ae0bb99f06f4781cc8dc2a6526265", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652019, "uuid": "3e834868-a55d-4e8c-9304-e5f979864022", "comment": "Malware payload", "value": "752a7f1931ec8201f667654206402c0dab3414ab442f588fe882aade68efbb63ed9c4a8cbe3d7ef08ec5381a7687d031", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652019, "uuid": "c195bacc-68b8-4f91-87ea-19c49bb2c2ee", "value": "T1EC434A50F8819623C6D1127BF66E468D3B2213E8E2DFB3079D229F2137C686B0D67E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652019, "uuid": "a6b1512d-e0f1-4b17-92de-7c3a5b8e016e", "value": "1536:LH19uzlA/NeDAqH2ZppDg5hqRWkK0rf3PvRob:LH1RJIaRnKGPRob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706652019, "uuid": "e6125d42-ff0c-4811-a57b-d2c7753c39a0", "value": 59780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706652019, "uuid": "d5f7323f-2ec9-48a8-8a10-54d15a2b1e3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652019, "uuid": "06c7d6cd-5745-4152-9b25-d0af43942405", "value": "a.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada6d9d2-bf69-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706617110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706617110, "uuid": "6a267c70-155f-4f00-8e34-f9f7f9cc6b75", "comment": "Malware payload", "value": "511fdcc7fc2f4220353004cfb011f522", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706617110, "uuid": "5e18490c-24df-482f-b401-30c9dae6caae", "comment": "Malware payload", "value": "b457a493fad9212b369552df689d67b5e1feec656451cf586abcc5411cee6e00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706617110, "uuid": "3d6e7163-dd73-42b8-88eb-731dd88b3eb1", "comment": "Malware payload", "value": "93ef93aa71476734b1598037838cc6b9fc8b47f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706617110, "uuid": "66d31a02-6cb7-4a1e-8aca-6501b00f4e80", "comment": "Malware payload", "value": "e53acf2953404d519825fc58edc8d17f6de927889d720af375cabdab0d59e838a9b41684663bacdb50f668fbd40198ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706617110, "uuid": "f3fd018b-9681-4aef-9303-f3a42680264a", "value": "T17267332253226636D3F28CB767B9177629377B284832EFAFD24417748E18073AF64761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706617110, "uuid": "d189256c-5b96-4c5c-beb6-9030aa235376", "value": "e6f4169f2a5c3a8f93171d9f593bd22a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706617110, "uuid": "ab9935c8-2621-4eed-9ef5-1967d53abffb", "value": "786432:iiYxcIt7okKo+IWpppwOg1ok6n4kCn8d:iiY7tpKocpXge4kCn8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706617110, "uuid": "268d5e58-1526-48ba-aea6-aebaeefbc548", "value": 30540800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706617110, "uuid": "22d62005-9da7-46a0-ac39-8f104e80cc32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706617110, "uuid": "4a7c3180-4b8d-485f-be65-f1201d3cbc75", "value": "WKYC506 2389030007-00901003007010_777380775 \u00b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50f48e4-bfae-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706646757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646757, "uuid": "2e49de20-ce11-451c-9ac5-87e0c88df998", "comment": "Malware payload", "value": "4188f40aa41ceb4e95e17018dde49b30", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646757, "uuid": "74aad64d-d0e6-48a1-9e8d-ce58c5c54edd", "comment": "Malware payload", "value": "b4866825bfe28bd60688b9d3fbcfdff7fb2c3501c0c5449813bb2c98a3ca4a0b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646757, "uuid": "770b91fb-1221-46c6-8b5e-1198305d8850", "comment": "Malware payload", "value": "56ad8539c0e19b3798e9d75c312f135e06780c7c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646757, "uuid": "324a0e1f-0846-40ab-993d-5f9582996efb", "comment": "Malware payload", "value": "3f795dc9bdb3437d1b4c8538f0741f6152e83102c38147db55260fd4bbd74f67521af876a5c28b7be4dd970d6f09dd5a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646757, "uuid": "d8ef5335-1215-4faa-87c8-1d991b1ac948", "value": "T1B51301098FAA96C3C605EF7AA2BE60A584209F1677AC47DB8355ABD47E4CF00194D3D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646757, "uuid": "6ebf97c2-dc75-4190-9b03-3300175ac3c6", "value": "768:zcag8w7TRf4gAuWiXlRIHsTfnTB1Erevb/u+9ER3+pCfz3tSMnEY7XR0v:Mx47uzXcCLmAWwyBpZ5Rs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706646757, "uuid": "c3fe0367-2bfb-41a5-b52f-9b0051bcec60", "value": 44292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706646757, "uuid": "0d7f07bf-54ed-4405-9b16-5e5a13311672", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646757, "uuid": "c0571308-20df-49cd-b084-a379ed05b9e0", "value": "arm7-20240130-2032", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efc5f8f-bf60-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706613220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706613220, "uuid": "5b34db5b-5000-4c8b-91d4-d73b76db2d92", "comment": "Malware payload", "value": "4718c54459e3026c77a0dbafc1673d5d", "object_relation": "md5", "Tag": [ { "name": "BlendyBeta", "colour": "#0C8B1B", "exportable": true, "hide_tag": false }, { "name": "BlendyGame", "colour": "#909E9D", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706613220, "uuid": "108db836-858c-4287-94b3-c571f502411a", "comment": "Malware payload", "value": "b7e543257c4da159b1694c031fafa999a6813b68e37d7dcc5a9ac325f628803f", "object_relation": "sha256", "Tag": [ { "name": "BlendyBeta", "colour": "#0C8B1B", "exportable": true, "hide_tag": false }, { "name": "BlendyGame", "colour": "#909E9D", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706613220, "uuid": "83e793a8-121b-4f20-a328-efe162ec950d", "comment": "Malware payload", "value": "e4515a6b0a88bdd7295da248d2903f50a1f51d65", "object_relation": "sha1", "Tag": [ { "name": "BlendyBeta", "colour": "#0C8B1B", "exportable": true, "hide_tag": false }, { "name": "BlendyGame", "colour": "#909E9D", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706613220, "uuid": "24b1c17b-ef5e-473d-9d0a-a07c95f7b21f", "comment": "Malware payload", "value": "3661a00d6d49cdf4b0574313d5aaf6eca1001ac8f00160194458603d3c6575593ac6fcbacaf0895d67f8ac560ef64af1", "object_relation": "sha3-384", "Tag": [ { "name": "BlendyBeta", "colour": "#0C8B1B", "exportable": true, "hide_tag": false }, { "name": "BlendyGame", "colour": "#909E9D", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706613220, "uuid": "8a1c6605-f1c0-44c2-9dc0-3ac75e89443d", "value": "T109E733007AC3DC57DF032E7E1B406067F58B6AD97462AA19E5AEB344D51BAB06F2031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706613220, "uuid": "38f75bb4-9eb4-45ee-8f59-314ed2ecfd22", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706613220, "uuid": "9d9a0d7d-480c-4343-94e9-cb4d86ac8d96", "value": "1572864:4yXoONw5l6yEUNZ64Jcu6m/rQ9qcGx5wYweCmvUSRtYC7:FXk5wyEQZzJHXrIF9Yx/37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706613220, "uuid": "2280e4ee-c7a4-4e0a-a402-54aa8c38f213", "value": 69673042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706613220, "uuid": "beae4f46-850f-4224-9915-628aa4aae13c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706613220, "uuid": "2ad4e7b2-0529-41cb-a3c3-c8af9d35978a", "value": "BlendyBeta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8708296-bf79-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706624107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706624107, "uuid": "adeb8ea4-7986-4a08-bff7-d04a0b0202e1", "comment": "Malware payload (RemcosRAT)", "value": "a87ddd434b35cd14caf58ebefba2982a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706624107, "uuid": "23bd444f-585c-4eac-a459-bb16a4228f15", "comment": "Malware payload (RemcosRAT)", "value": "bb65b08e05845104045d1af1bda9a798391fee515b6bf5a21cc7bd9ce2117a01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706624107, "uuid": "244acb5e-e8d2-4200-ab3d-c34d3ec24122", "comment": "Malware payload (RemcosRAT)", "value": "0c8e99cf6d65569d34475fcae6cd409aca6bfc2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706624107, "uuid": "a7156cfc-776b-438e-b59c-7cbfaa1f4384", "comment": "Malware payload (RemcosRAT)", "value": "8fa4b9c712f8cf7d4babc3712864383e5e76f713035d329ece6b5561368b211778b603d90833204c9df591e7557ebd24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706624107, "uuid": "0b608eb6-03c8-42b8-94cf-a0e9d307bb1c", "value": "T1EEB49E01BAD1C072D57514300D3AF776EAB8BD2028364A7B73D61D5BFE31190B62AAB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706624107, "uuid": "f04e8e09-f117-462a-a20e-2b89638a128a", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706624107, "uuid": "d98b89f9-41e6-42bc-8272-5eaa1d789ac4", "value": "6144:cXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cN75Gv:cX7tPMK8ctGe4Dzl4h2QnuPs/Zsycv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706624107, "uuid": "9ea91683-05c7-4f83-85b0-425ada6b7d69", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706624107, "uuid": "327b10b7-578a-4cd5-ad39-a5fbba5e3d52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706624107, "uuid": "bae78b62-995f-4f71-ac98-a3176f5c2ffd", "value": "IRS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee80b25e-bf49-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706603474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603474, "uuid": "5eedc0ca-a1e3-4e5a-acb3-5779427885e8", "comment": "Malware payload", "value": "1c67976164f6fe0edb7db769002cfb1e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603474, "uuid": "6061a544-4362-4d60-9c41-7ceae79a48f7", "comment": "Malware payload", "value": "bc749286804a29df5514c290b009355eedf4541a6eb3c9043de87fc8cdba2644", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603474, "uuid": "a90fff3c-4aa8-4ed0-8def-61c5d617613e", "comment": "Malware payload", "value": "c5f090cb76bfcb39efd83b87ad68c6e2a085acb5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603474, "uuid": "ec06fe2c-2034-4814-abb8-a2d79ff1f71a", "comment": "Malware payload", "value": "80563bd54b1762ed9d158d0bf55ad68e41cdf9fe35ce610b05181cfeb0750514e05f0d71e792076dd69d4ed7bad574e8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603474, "uuid": "60ef8cbf-bb98-4aca-b312-b3870b676808", "value": "T147C523A1888201E9CE8057B59CFE4B5CBF724123E1E0EA42C7B2DE2DBDCA05D179DD65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603474, "uuid": "fd2fca0d-e64d-4483-9b3b-ab1c6cc02d19", "value": "49152:5nBceC3e0Ujb7Mp5VUdydudEZqBppw6R0RfCquTGJ26rqgxPb1GqF:5nBccb7MpFud6qBwfbB48YqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706603474, "uuid": "d1b64b74-3a4f-4d06-bed2-a5c4c52912ea", "value": 2567316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706603474, "uuid": "e044f409-d200-49c3-b48b-799e60acd684", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603474, "uuid": "c73c4f9f-b49f-4488-bdf6-57c7cce01bb5", "value": "1297FA-C5341282733937876.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417ec565-bf32-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1706593306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706593306, "uuid": "c1c5dbc7-1755-4fe9-ad16-f5c271dde4cb", "comment": "Malware payload (CobaltStrike)", "value": "f019a5bf101df67ebf633d6bbcee7a20", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT32", "colour": "#69891F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706593306, "uuid": "88879bd0-11e1-4123-8a12-cd0883961010", "comment": "Malware payload (CobaltStrike)", "value": "be2648d8ac9aca8c1fb338328dccdfa366b341e167dcb1f7c700eaf809a154f7", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT32", "colour": "#69891F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706593306, "uuid": "a6d7997c-c712-4dea-9a5f-e90061c445d6", "comment": "Malware payload (CobaltStrike)", "value": "e2667ad9c0e995ee869a48d2d8b9e6850e1cb368", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT32", "colour": "#69891F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706593306, "uuid": "23a044dc-2ced-4f4c-b448-60d8509ccd30", "comment": "Malware payload (CobaltStrike)", "value": "5346a4f73b93862bfb3a5b509f81e26edef785f727abd3090be758aec8f99ef11f29db7d7c953359501fcd0caffa0fe3", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT32", "colour": "#69891F", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706593306, "uuid": "f6039c34-656f-49e7-b96f-0498bce39b2d", "value": "T17544BE033B713CA9FE47E4348DDB2815AE252EE71B95DB2612E1041A9C8F789E9DCD13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706593306, "uuid": "3f1d647f-7815-46b8-ac1b-20fa59f227b1", "value": "6144:O+e8DWV/h9HWYp+KW4Oz2w1ASkH1ENDiOiBQ9:3/WFh9H70KW1z2w1ApH1ENliBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706593306, "uuid": "1a6d4b00-4fff-4296-a57f-c59610b13f00", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706593306, "uuid": "6bb8bf43-cf2b-4df1-9710-0588203cfdb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706593306, "uuid": "ff86404b-de59-42f6-95c9-10c8bf2de130", "value": "f019a5bf101df67ebf633d6bbcee7a20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307fbf02-bfc1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706654695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706654695, "uuid": "ad00923c-0f77-41b0-912e-0a970a71194a", "comment": "Malware payload", "value": "92d51a5764a937c9be70339d2b474b13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706654695, "uuid": "4c44a91c-decb-4e6b-9ccc-864abf1bad44", "comment": "Malware payload", "value": "be2fb0a69b257e8c2d6b56e4146cbc954a033e63919f470b320a7982bbb2d830", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706654695, "uuid": "7a1b1b63-4ecb-42ed-94d3-f8c5f3132503", "comment": "Malware payload", "value": "2856592d4a7e83b2d013bbdc5589b946709fbafb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706654695, "uuid": "64257461-f234-4c6e-b836-4bd1e188944c", "comment": "Malware payload", "value": "494f177d14324d0a50e24e0f69817a69094f4f2336a632b565e3dcdf11446f850c3c853301a03f1070185a91510add3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706654695, "uuid": "b698dfd2-5a62-43ae-bde5-e7f646f27ab5", "value": "T1A6531A9AF801CD7DF81BD77F4457490AB631B3D142831B3627A7BAA3BC721991D22E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706654695, "uuid": "cd0d77b1-9307-4eb5-b5f6-f98fea54f686", "value": "1536:bZ+LRR5OxwUUoG8ogEX+IWQWQ4rH0JfW2xBYTB:bMMxxUoQUIVW91gBYTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706654695, "uuid": "03accd25-8928-4762-9433-de696a57a10e", "value": 61856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706654695, "uuid": "07b81576-ffd5-43eb-b74c-a02d7ed15c6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706654695, "uuid": "5a22bbda-55af-464c-ac87-388d082f6761", "value": "92d51a5764a937c9be70339d2b474b13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fe26c0-bf87-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706629713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706629713, "uuid": "4f608db2-ccaa-48e5-9ab4-2092d7c07338", "comment": "Malware payload (RedLineStealer)", "value": "e192ed56e9f5156b30ac5b5764f1eea1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706629713, "uuid": "855e7116-4174-4c0f-8396-1645b907ed87", "comment": "Malware payload (RedLineStealer)", "value": "be82f5ae74b72c8e3c46ae70180f6ef917983ef9e009bcbf0453757b1d0735d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706629713, "uuid": "3915d6ec-8679-42b8-bd58-2e83ad4364fc", "comment": "Malware payload (RedLineStealer)", "value": "cecffa0e69c8dea9d5044d4e22d416ccaf8b29e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706629713, "uuid": "474faae5-1041-45e1-b20d-3df232ff758b", "comment": "Malware payload (RedLineStealer)", "value": "63812623b67f8ee851e2be4a6b9304ad566c6ca8e4ed55a7ff0424204ada1465853c39d595e5a4a2d53f32ffb02f56f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706629713, "uuid": "07da0516-620b-46cf-a7a3-c4e7234d9ce3", "value": "T1FB840206B7CB0331E688557481E7955103F977E31EF7F2093E8D16A82E93798EB4638A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706629713, "uuid": "5b9bfd0c-8204-4c1d-b594-1bc29724d8e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706629713, "uuid": "8b426e3d-fa16-4767-aa02-801338542423", "value": "6144:F5ChJroncP7EoU+tF45U9CuQcc3DEQ1UbZf+IMMNtTyK3SPeWew:FeJOAEb+s5UIpcuDv1UbZjM4jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706629713, "uuid": "e3c367e7-8c6d-4cd7-998e-426a3c450fa8", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706629713, "uuid": "a7415f38-2b39-43e2-945b-3376e51e8b93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706629713, "uuid": "1a32b11d-419e-4f93-adfa-91dadc07ed13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a80bcfd-bf60-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706613105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706613105, "uuid": "177c79f9-bd81-470e-8383-2a83207fd728", "comment": "Malware payload", "value": "0d40715a6b40b58b7171a64ab767db05", "object_relation": "md5", "Tag": [ { "name": "BlendyBeta", "colour": "#0C8B1B", "exportable": true, "hide_tag": false }, { "name": "BlendyGame", "colour": "#909E9D", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706613105, "uuid": "9a613044-b02a-4a77-8f81-722be62501c5", "comment": "Malware payload", "value": "beba8871317ef1e560164c10c5f3f40aac72b7b9f0e0f56fa85ed041eb69cd76", "object_relation": "sha256", "Tag": [ { "name": "BlendyBeta", "colour": "#0C8B1B", "exportable": true, "hide_tag": false }, { "name": "BlendyGame", "colour": "#909E9D", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706613105, "uuid": "6e61c190-e303-48e4-a04b-d99ed1829509", "comment": "Malware payload", "value": "4fa3f723c499ba536d7cc318ca4a230aaf472a3a", "object_relation": "sha1", "Tag": [ { "name": "BlendyBeta", "colour": "#0C8B1B", "exportable": true, "hide_tag": false }, { "name": "BlendyGame", "colour": "#909E9D", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706613105, "uuid": "1b659551-eff4-438d-82ae-2b8ebf6f0bdf", "comment": "Malware payload", "value": "db03b29ae625b5d7164371f2b7ac8084fd9cd4fe162694f205db987e9379839dd2056812a49f3971332961ca9c5fed27", "object_relation": "sha3-384", "Tag": [ { "name": "BlendyBeta", "colour": "#0C8B1B", "exportable": true, "hide_tag": false }, { "name": "BlendyGame", "colour": "#909E9D", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706613105, "uuid": "b6eac30b-7f1e-4d88-8b9e-c5ff0b142918", "value": "T1FEE733DAA261DED8E273E0C1E6915ACA5219EC191E2CE8B57B43C5C573AC730D9BCF10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706613105, "uuid": "70d79074-3626-4173-834d-e0e4ec3337d3", "value": "1572864:r+vG0nxcUJU7XbCDXMg1NGBRELyB7GA5YYDz:rH0xvwCDXxNGBf5GA5HX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706613105, "uuid": "06e1abb9-d79c-483c-a313-139e41aaaeb0", "value": 69780816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706613105, "uuid": "014693af-5275-4676-a5fd-470047a5e6de", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706613105, "uuid": "0f54f799-dce5-4b57-91ee-6b43651a06e8", "value": "BlendyBeta.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5cbbd7-bf79-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706623768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623768, "uuid": "78c0d1c0-2868-4831-be6d-cf94015f0471", "comment": "Malware payload (RemcosRAT)", "value": "94b4b68587a925e690000060282e03a5", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623768, "uuid": "559374fc-b4c2-48a0-8f65-213a33ac2f2f", "comment": "Malware payload (RemcosRAT)", "value": "bf64ba2c3bfd46bf5d509849cccf986ea31393e4050e9bcdb29ed2f15963e699", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623768, "uuid": "cf666763-c91d-4ff4-b0e6-6e1883c946a5", "comment": "Malware payload (RemcosRAT)", "value": "ed391955b7c88ce6e83fd5d52442e9d1195eec5e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623768, "uuid": "4071a142-4d77-434b-9719-99351026f7cf", "comment": "Malware payload (RemcosRAT)", "value": "4e4d05c52e3a3690336c557c4d90ba959c23b9aadacf71aff6e72a705ab7e1bf162548865fd716e1a2192f288c44e38a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623768, "uuid": "e580e110-be90-4a0f-b5fd-2b7660caa6b0", "value": "T151440208F291D48CC493AA7E0DD9D1C7A21DFC511E4AED8B3484BF1E29346C6572B7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623768, "uuid": "97672855-d4b8-4b3c-a927-b79b6d55b3ac", "value": "6144:qkhunTZP8VN+xtXaR8HYmgMBU4Abot7LsnIfF3Jd9JcRI:qkkZ8VExtXaR84sG4Ftn/fbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706623768, "uuid": "fc73c692-b374-4f23-99f5-955aeebab264", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706623768, "uuid": "87d14c5c-5abe-4d46-9e6d-f35149db5669", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623768, "uuid": "11dee7b7-c9e7-4eb6-9461-5d104dd2a803", "value": "Listelenen \u00dcr\u00fcn i\u00e7in Teklif...xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7c391c-bf92-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706634526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634526, "uuid": "fba656bc-f242-4281-b0cc-0757ca691db5", "comment": "Malware payload (Mirai)", "value": "b07771b71844561c0dec7805ccd82376", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634526, "uuid": "d2ec141b-ce68-42f3-b151-f287a83a55ab", "comment": "Malware payload (Mirai)", "value": "bf6b4e7f10240a4e38a355c71979d5bdb81c4692aaddc99bb6586c77d397b65c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634526, "uuid": "94ed3952-22a3-4c7a-9e8b-d426e69f3728", "comment": "Malware payload (Mirai)", "value": "e9b27d0df8e562b57d513fde951308585762f4d7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634526, "uuid": "9809c8b7-b23f-4290-af86-693ba158d139", "comment": "Malware payload (Mirai)", "value": "6bfa3482288d289e8832b5b0c024159baf181060abec216bac51b1a434dd6c6a887294bfb149dd8ef905519d1eb47e29", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634526, "uuid": "22c618f1-993d-4efd-b24e-aebbc777e3fb", "value": "T17004D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634526, "uuid": "5eb11cd3-8b05-4520-aa5e-503f2bc723c1", "value": "3072:ueEksFM+wX5OZaVR8H3NaMZOTTMJxt9U+7fKbUE:ueEnO+wXZVWdaMATwJHy+uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706634526, "uuid": "8bda03a3-c897-4f13-b5ab-5b3f6a8e5a81", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706634526, "uuid": "49b96234-2aa8-476b-9e64-4a1094cb6ab3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634526, "uuid": "4c864eda-38b0-4fef-a9b0-f365815adb71", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3b7302-bf8e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1706632999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632999, "uuid": "0c83e5fb-8102-420b-8919-81f798808b03", "comment": "Malware payload (Amadey)", "value": "26b0e1817c946b08d79bf5fa9463e09c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632999, "uuid": "40acdc5c-693d-489b-8945-3701340bbfcb", "comment": "Malware payload (Amadey)", "value": "c027c16cad90e9445faa2e1c0e220dac7adc8fe813f30fdc026ae90abcf7acd6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632999, "uuid": "bcae7af0-3214-48e6-89b4-6d6b67990b60", "comment": "Malware payload (Amadey)", "value": "fe1fe0eea55a567351cc00df77f4c814a0fb61bd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632999, "uuid": "61d74b8d-26e7-4b35-954d-a46956069c7e", "comment": "Malware payload (Amadey)", "value": "1cb255bad8c11df27a173be2287cf1aac422f119b571511d483401405c8844f9679f681e8ee1c73000c2614e05d482b3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632999, "uuid": "87596925-b7bc-4565-a6b5-b752fe706c93", "value": "T14B946C207813C032C65192B11E68FFF6949DB9249B710ADB77D40F3AAF211F66A35E36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632999, "uuid": "185924f2-a22d-48ed-b947-0fcdfea0620a", "value": "d093146790f601dbb1f305c708400eb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632999, "uuid": "c0dd3330-12d3-4eab-85e3-202656857823", "value": "12288:uHZmLqT5hF03XbK3zy5xy2cgSh2Hmfqup+q390Na:sT5hF03LK3zcbSMGj390Na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706632999, "uuid": "754f547b-5ecf-45db-95f5-078a7de58db3", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706632999, "uuid": "2053a730-37a2-4c69-8352-a18a580d5ce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632999, "uuid": "84717446-f759-43c2-bf57-bbaa140e3b4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78929a92-bf38-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706595975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706595975, "uuid": "d6039f3d-f1d3-4a5a-85e0-edbb7e6f162b", "comment": "Malware payload", "value": "b5baf956651f33f342f8ae9bbc10ca0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706595975, "uuid": "3da87544-3780-4678-a67c-feee4c0b537c", "comment": "Malware payload", "value": "c4044a656e80ab09f4226db314e2121a65014a531fd8b65ac066fc84e75a770f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706595975, "uuid": "70339916-2116-497c-b7a8-e4054902d2c4", "comment": "Malware payload", "value": "72f2d5e34f2a36ebd4ead2ddd454442f672fee2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706595975, "uuid": "d13f61a5-dbdb-4d39-9678-c6f553a6eb16", "comment": "Malware payload", "value": "4b3e2823c19c2c9fac860318e0eee535e01e0845c8bae7957eb1b123869547cc5c04e50ad9851dd66a4123a05eae4993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706595975, "uuid": "81aaf1fb-63ef-4da3-be92-83ca1556e940", "value": "T153732822A760843FE691407261558B7F85BD7532317C7057EBA89DF23C74AEAC10AECE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706595975, "uuid": "eab302ce-0949-4a3c-a8a7-0c6799be13d2", "value": "c4b8b0aba9f9c876ca624bdbda64d516", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706595975, "uuid": "24b395ce-99ba-4aff-a83a-2370cfdc32d9", "value": "768:ujxovAnvqLQ0TJTIJ4TxwU8X5P4OXeZwlAqZE+BWi+rX00pqB7iB9c14H7xHQzok:GxkAni0GTlyywlA/tX5AJ4bQok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706595975, "uuid": "bd5d264a-0123-4ae1-bfd4-44a21564454f", "value": 75378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706595975, "uuid": "569ddd43-1ba5-4717-910e-f0ba45194a09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706595975, "uuid": "0434c67b-8157-442a-b60a-c28db1a73480", "value": "SecuriteInfo.com.W32.PossibleThreat.19050.25421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e11fc5-bf49-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706603378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603378, "uuid": "4248e886-1705-4ae4-92bc-84780b9539d9", "comment": "Malware payload", "value": "daef292265a6adb5848ff1553d5d7364", "object_relation": "md5", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "Lumma Stealer", "colour": "#B4571F", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603378, "uuid": "dd3d16b3-adaa-4f76-ad30-aa6355a6103a", "comment": "Malware payload", "value": "c73de9036435ed3a51b4864af55b159901914ddc0e90b0ca7d954a6e500cf26f", "object_relation": "sha256", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "Lumma Stealer", "colour": "#B4571F", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603378, "uuid": "b04c7516-e032-4c25-be9a-30855cc6cc48", "comment": "Malware payload", "value": "b655138e73e5861d2bf7db8758561c4e4bf76e94", "object_relation": "sha1", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "Lumma Stealer", "colour": "#B4571F", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706603378, "uuid": "eac8b15b-4a6e-4008-9cbb-e905deaf0cb8", "comment": "Malware payload", "value": "071ba2272e5f4ec5df7e713e44fe34c3c2eb21583cd9ebd7cb6ae8c5c04948fe4c88e580dd54101a1ac1352a1ec29ad2", "object_relation": "sha3-384", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "Lumma Stealer", "colour": "#B4571F", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603378, "uuid": "82dfffc2-46cb-4f47-be42-e64215dc07db", "value": "T12BC08C228D0EC1F5060709A76AD4CCE8A8E3548D8C2ACCF8775B462F5FC560D5FCD081", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603378, "uuid": "fa6b3f1c-2f39-4ae5-9ab6-a94533c35c08", "value": "3:HRAbABGQEb4ovsFMcJXpwOVJYMQ6NDRfEH1lKImhGEbTMcjMcJXpwWAHWkAn:HRYFJblvsqewOVJRNDRfEVlKFQEbTWep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706603378, "uuid": "e4694e2b-4e73-4416-83ba-1292db5a1a4d", "value": 170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706603378, "uuid": "e5e0f42b-402a-490a-9fa0-66b6aad8c351", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706603378, "uuid": "1d4e55db-1003-4050-89a4-25385588993d", "value": "3_\u041e\u0444\u0456\u0446\u0456\u0439\u043d\u0438\u0439 \u0437\u0430\u043f\u0438\u0442.pdf.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e67cfa3-bf23-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1706586885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586885, "uuid": "f813c9b1-07b6-4c85-a688-6d82f76719ba", "comment": "Malware payload (PureLogStealer)", "value": "ac15ae1e49f4272e8d38b5fd5573ce35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586885, "uuid": "5b7e8368-7f9e-4272-86eb-d87b778361eb", "comment": "Malware payload (PureLogStealer)", "value": "c886e938dd26ca17bd29feea36d4c487483bb05d86b3c382e045b88925b27149", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586885, "uuid": "270c3d8d-10d1-4923-a866-6235b4b91023", "comment": "Malware payload (PureLogStealer)", "value": "93a70b449926995d458b9513b8b36e988f73dc8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586885, "uuid": "d40f0a68-36b4-41f5-b8ef-645633968b01", "comment": "Malware payload (PureLogStealer)", "value": "059528fe227e145d2d3766f5cc339a9f7a1c511cd58efaa54004486df3ed4eabb35b6382ad6aa440b1a78ffb042e0d3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586885, "uuid": "1cb4eb92-cd5d-4f01-b7dd-fbb7837a6d74", "value": "T144836C0CAB8DBB27C6AD0B7B90E2724247B885B2677BF35B68C4419548733E75493B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586885, "uuid": "83688640-5597-492f-8432-50f0a5c4dd99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586885, "uuid": "ef79ce8c-76d3-4558-acad-87b2790b818f", "value": "1536:D7Vs/tSdQLcSjAA0C0rEr2ofgNTX0g/+PmN/10BmglZqiqazVkP5tJCFPzRUR2lX:D5MmQLcxAarEDINTD/+Pmn0BmgnpzmcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706586885, "uuid": "30a536e8-4f33-43d3-804b-bbf69126531a", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706586885, "uuid": "8dfb55ca-acc1-4eae-b309-fd48a689eb67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586885, "uuid": "e4999b99-9c4c-461b-81a5-f46295fa0f3d", "value": "ac15ae1e49f4272e8d38b5fd5573ce35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f32abd2-bf9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706639312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639312, "uuid": "a74e4220-732e-4b20-a5e9-212c7973c7fc", "comment": "Malware payload", "value": "4a12de309e1b5d923d10cd49573a2e38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639312, "uuid": "ea2eab28-4c0a-4c93-9cb1-10db6190769c", "comment": "Malware payload", "value": "c9cfc6b8d5b88751eabeb8da88260278e7b541c64c928571a78bc07d33183bbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639312, "uuid": "2761cdc3-e552-4614-802f-0a178614898b", "comment": "Malware payload", "value": "b8b2ab9d6cbacf2f957c8c877888cff75254416d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639312, "uuid": "1841425e-9483-4828-bc0a-0491c632d745", "comment": "Malware payload", "value": "91770bdbc944afaccd771a13f30182d0cbecda368676a480c0d707626f160d06dbccc164cce9a6fdc1b3d548ee11ea40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639312, "uuid": "274694ce-22d0-4039-a373-a695aeb4252d", "value": "T1A5E54B02B288543AD0B71B3A4C2BD7946C3B7A642E258D6B7FBC498C0F39741AD35767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639312, "uuid": "aebb2547-7ccb-48f2-9e62-2d0a63f630e1", "value": "e838678e3bdbaf602160cf8ad444d13f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639312, "uuid": "60f850e7-79af-4678-a8dd-f6a0aab2b15e", "value": "49152:AyQt3RUSOZCUtcreplQcX52s40SHTXN/sXW:AyQfacMlQcX5230SU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706639312, "uuid": "b3033530-f11a-4879-8e2a-54b082ba62c8", "value": 3224576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706639312, "uuid": "26878fd2-1bc0-410e-b915-d8f05b65c037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639312, "uuid": "519e4b65-8fb9-4d0a-91f8-ba689870d40e", "value": "SecuriteInfo.com.Win32.Malware-gen.22753.9165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0d4032-bf7c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706625217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706625217, "uuid": "8680c3d6-c99a-4b63-b2a9-d6e50abf83ca", "comment": "Malware payload", "value": "ed119efa82b1fd7921709742dfe5dd3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706625217, "uuid": "f03a51a3-7c51-482d-908d-c1f64c4c4fe6", "comment": "Malware payload", "value": "ca31ef97491a4053f15dd97d9ec7a46356c3585714b42f94cbd43b7b7cb3028b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706625217, "uuid": "42371f59-fb8f-439f-99ae-add394470868", "comment": "Malware payload", "value": "804d30f05d727b5a63f5862021600a82bd202988", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706625217, "uuid": "8d8790f1-1bcf-45b8-9e91-cf795b4f298f", "comment": "Malware payload", "value": "f27874860d9823c2afabb118d355c2d9038ae214caf5f4e9387585ad74c87cfa3886800e267dc98ad3dbf2e22ff9c40a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706625217, "uuid": "bbbe3ade-e0cf-4d5a-b45d-9858e06cd2a8", "value": "T12FC53300D1A2091FE1BD663123B8E815C9B39046DDB1926FA32F238DDDB0758D6FBB59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706625217, "uuid": "65cf0390-85f2-4813-9225-e9e7eb741429", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706625217, "uuid": "7867cd29-5bcb-495f-921e-2f4f7cba9731", "value": "49152:NwMk91GNHRpM0fkch1T2th5YzfFfc2GullTWq28AlB0P1NoDeuTZpZ:Nw4NH8+m4zFcRu32LB0roCunZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706625217, "uuid": "f39b44cb-f0ce-44d5-91d3-9259051b91cc", "value": 2738144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706625217, "uuid": "ae9d7513-eb34-4f39-9299-93fbb96b0599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706625217, "uuid": "fd56c9dc-e163-4486-a99e-1a4126c575eb", "value": "SecuriteInfo.com.BScope.Trojan.Casdet.30937.15176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4049812c-bf8d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706632388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632388, "uuid": "3aa88fc3-d7c0-42d7-88b6-526c2a5d3d69", "comment": "Malware payload (AgentTesla)", "value": "2c095265f8a0c3cb3d4989b713997e6d", "object_relation": "md5", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632388, "uuid": "24e5c9e0-d07e-4f16-9201-290d942e5af3", "comment": "Malware payload (AgentTesla)", "value": "cafc8b67cf020bbb018d767e734555a294ae0778c798e1a32dbcee34e52ef753", "object_relation": "sha256", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632388, "uuid": "61c52e1e-5da9-49fb-9cd0-4b389c0e4484", "comment": "Malware payload (AgentTesla)", "value": "0c731fc1c0aabfd5f18ddf4f21033213cbb28820", "object_relation": "sha1", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632388, "uuid": "2067d0c2-de55-4611-b8a1-03c9a6a87ce0", "comment": "Malware payload (AgentTesla)", "value": "6f61d676b2ce82381eefaac49279e9112cae44d9e05458d3348e4e96d1a964fe650037e6f0d25292f0d3b8583e870045", "object_relation": "sha3-384", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632388, "uuid": "83e81fcd-e9d5-4ad2-8622-7b95f461b98f", "value": "T148D43324522EABDCF50E1C63130FEF64A1A74B8D7617186C9AF69EC2B72E1501BE131D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632388, "uuid": "255ba51e-8604-4d78-aca8-1244d0beba4a", "value": "12288:hnjWGXv9HXcUbIO+uyijYr+l3NdPfBeHnmNP/jxvX1COw:5jWCNXt2jCYiVNJ4H2X9Nvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706632388, "uuid": "59e0d0be-bec0-4ebc-8ce7-15e275386143", "value": 656342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706632388, "uuid": "026a20ad-d553-4f0f-8be7-84f21e3f2dfb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632388, "uuid": "34d74910-7f74-434a-ba2d-9381e57e0901", "value": "RFQV160T LIBERTY SUPPLY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa6376d-bf46-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706601946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706601946, "uuid": "d2ece592-575f-419b-96aa-adedb63a856f", "comment": "Malware payload (LummaStealer)", "value": "37953df0a83805f9a66369e1d8931773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706601946, "uuid": "64bca606-6818-45b7-ae4b-95feba41bc59", "comment": "Malware payload (LummaStealer)", "value": "cc47d0324b09a84924c41bf62b955e73688483645489ae8638164feac38192d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706601946, "uuid": "ebd7f4fe-7265-49b3-996f-def14e0b1c8d", "comment": "Malware payload (LummaStealer)", "value": "636a3b958e885c773b484e9dc26bf52d2f3349f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706601946, "uuid": "5cf85559-d998-4ff6-941b-99251bb358c3", "comment": "Malware payload (LummaStealer)", "value": "18226b06b918864c5ef02bb97f6e72386396a8136daba56abe7d52a6615d230ec166f5e8f559f606f81ad6e47995d256", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706601946, "uuid": "fd627fec-336b-4bf7-b421-567bf95b933e", "value": "T131B633ACB7D2B29DC8AF82BFD01DB1D19634B63550A0B3C7148F6DDC0192EB9A559C8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706601946, "uuid": "fd15d499-bcae-48d8-a55b-e9b31168cf7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706601946, "uuid": "36ec816a-60cb-48fc-aba7-d3417a704fcc", "value": "196608:eck02LlZyk/wYoG6+94CSeG4ZMb8smD2u3aC1O7hi3XgoXCx6aawfgHbiHWqVy:pk02JlZ4C44w8smKu3aCH3dXCMaawyTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706601946, "uuid": "cf1ecf17-4056-484d-bf83-e29caca9a047", "value": 11374080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706601946, "uuid": "ede5595c-25b5-4495-9e46-8d35ff96a27b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706601946, "uuid": "e5851c12-1013-4c0a-8659-0c82535aa1c7", "value": "4_lmncr2rs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225a2748-bf9a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706637921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637921, "uuid": "c6e11365-b308-4064-b73d-ee4cf0852fe2", "comment": "Malware payload (RemcosRAT)", "value": "43fcc42f93bf62caf19629e619edcb50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637921, "uuid": "fc1dafa3-cd45-4bb0-8b70-d139dec3eda8", "comment": "Malware payload (RemcosRAT)", "value": "cd575d9fc9f59f2f82247346131fa35a6e28354f33640c3379a14f4a76c023f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637921, "uuid": "db63968d-b40b-4d77-9a6d-b124b50cc970", "comment": "Malware payload (RemcosRAT)", "value": "0f77d39f9d1da24eb41457077e92456f39760030", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637921, "uuid": "013214a9-6ca5-4655-8414-c9d65fce879c", "comment": "Malware payload (RemcosRAT)", "value": "8f0431308f5297bd500992113e0913546f46ecb2c1b25eb1d976bfb8c34f1545b898a52f8a7392655e9aeb632b19a190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637921, "uuid": "4a1b4ee2-b428-4e2c-a95b-f604efe613cc", "value": "T11EA5D02266D15832F226A47959973AB5E92EBD202D357DD677D03C08BF333007F186AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637921, "uuid": "1985e0b1-0d03-49fd-9be5-af72ffff12a7", "value": "b849c32c8477f283a2e1a1b6798d89b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637921, "uuid": "d3fa5265-5850-403c-94f7-1a5914adedff", "value": "49152:pqAodhXjnxf2hd7c7mvrq0gOPOaF5P0R:pqAo2hd7Ymu0gOfuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706637921, "uuid": "430528b8-536f-469d-89aa-1a019dd5fa71", "value": 2091008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706637921, "uuid": "17dff6fc-c26f-43ea-9e1a-09fdf8f2d7b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637921, "uuid": "d4991f11-c256-429e-a4f0-8dca9ebfbfc3", "value": "TSPPaymentTT.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6529d8-bfb3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706648947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648947, "uuid": "8816d3de-bd9d-4257-bb84-1f5f63a80871", "comment": "Malware payload", "value": "eb64b1dbb38961bdb4c0f4b724b1ed3d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648947, "uuid": "0853a6e1-3a0d-416a-9d0b-6f045df63291", "comment": "Malware payload", "value": "cf5d6c68811f37d9ae1a9cc62abc1987fdd8900d271fdaa01d4a84853d7db10d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648947, "uuid": "0236cf50-0d29-4a14-8076-f2209db1abf7", "comment": "Malware payload", "value": "a375bc847388cdddc6cffd57dc7f0c3d6be72cdf", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706648947, "uuid": "d22afe5d-7186-4f00-868f-2572f54a5f2e", "comment": "Malware payload", "value": "35069ac456ea4a25fa96dd976286050d13f57cda1c076783feeb4f79eabba3f1b91a6d98f33ad34fff0a5605ec9a08b8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706648947, "uuid": "0943f866-4672-4a9c-8b5a-afe1306a917d", "value": "T14807334AFF82DEC2E96B51778D908669F57B3D0149850D092B91BB382CB33D8327F586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706648947, "uuid": "a68daedc-d1cb-4b7e-9753-95297f0058ec", "value": "393216:QnEbwdw5PBbXDqPiHNTS3ByWhGhz3iQw0FHufQMfh1GD6QGhNgqx9OPNQNI62vho:pbwdwnBtcFhG1w0MVZ1GD6QGhNpwsIne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706648947, "uuid": "21e8d786-0a53-4fb8-929b-603a5820b47b", "value": 17969152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706648947, "uuid": "774c68f6-9117-41e0-82fd-2c185efac92d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706648947, "uuid": "286fe4a0-0276-4aee-8d30-897d1e8f339b", "value": "ClipPlusCommunitySetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d351f4c-bf70-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1706620008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706620008, "uuid": "34d473ee-6a89-4baa-a358-268eb041e7a9", "comment": "Malware payload (DBatLoader)", "value": "c9f67b744e6a868306c2e30396e66530", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706620008, "uuid": "0d59e70c-23a2-4bda-b923-55eafcb45429", "comment": "Malware payload (DBatLoader)", "value": "cfbdc6c5bc677174b16caca90e7b37d2d6c11096c4e26173d7c28df25886aa64", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706620008, "uuid": "2949279d-2e3d-4faa-897b-41fbc430230a", "comment": "Malware payload (DBatLoader)", "value": "f3415437d93aac7566882e16daaa03a0769c68ff", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706620008, "uuid": "be4cbcc2-659e-455e-97be-6be30b3dee40", "comment": "Malware payload (DBatLoader)", "value": "33c2990f213a1e4ec8442dfe4a54aa5617c5261e922665bc76dff90f0899be52edaf48f985c30509572ac9ad433ac979", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706620008, "uuid": "b3a656f8-f6b6-47a0-9185-b8e32e63179e", "value": "T127A5D023A2D44432F132A57919977BA5EA1DBD202C267E9527D53D0CBF333407F28AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706620008, "uuid": "595f7feb-89fa-4197-99e3-370f447acee2", "value": "b849c32c8477f283a2e1a1b6798d89b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706620008, "uuid": "8a20392e-296b-4f88-b44b-6406cb1fe972", "value": "49152:pqAodhXjnxf2hd7c7mvrq0gOP7aF5P0R:pqAo2hd7Ymu0gOeuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706620008, "uuid": "344129a3-3ce2-4190-aaf5-eed6a9dc6f46", "value": 2091008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706620008, "uuid": "505cbd56-71a6-41be-8886-cf7d1a909b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706620008, "uuid": "69c000c3-212b-43df-96bd-4516c2dd09ce", "value": "SecuriteInfo.com.Win32.BackdoorX-gen.12391.21173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d6a170-bf24-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706587461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587461, "uuid": "466ee37d-6389-4299-b855-75f851521d82", "comment": "Malware payload (LummaStealer)", "value": "8aadb5a6c2d1e21db22a5c892e098855", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587461, "uuid": "a2a89979-c768-4532-bd70-45bb91bd8cab", "comment": "Malware payload (LummaStealer)", "value": "d11ef169ee5a3e4cccfcd1df397eff677e91f8117b33905371897580d3b8adc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587461, "uuid": "860c9c94-956e-4ded-9a57-c5a0c06fb26c", "comment": "Malware payload (LummaStealer)", "value": "85bd510afe96d7b8dac4df6c6cf2dd817d48af1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587461, "uuid": "f6bebb7a-3981-4a98-8b9e-93d0df21f4dc", "comment": "Malware payload (LummaStealer)", "value": "738cae985fc2c21e1b11a982f1834a4fdf46285cc98ff642df15c589a64959cbe9bfc0c086627da2fe94d7cd6e45fde2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587461, "uuid": "adaa202f-e1fb-416c-8b35-76a515e84ff1", "value": "T1B6252342BBEA587AE1F21B72297566214AB5FA251F0146DF039021062E70FC6DB3D3F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587461, "uuid": "c1471135-7a37-4926-8cef-e7e82928e19a", "value": "40e5756c30e8a97a052538422b8f4b5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587461, "uuid": "060c43e5-1ff6-422a-967b-65b75cf94e24", "value": "24576:BMwH2UVBYYd+cNQekvg+d7tuPiOK2615ybHlr:BMwHnBX+IQC+JEKOK21R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706587461, "uuid": "66376970-02dc-43f7-a457-44bcb42c4589", "value": 970501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706587461, "uuid": "d1323b57-5ef1-4c8b-91c7-3c7ae80fb2cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587461, "uuid": "622db22c-cf3a-4984-b1db-3ef97289edef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd53d21-bfc4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706656167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706656167, "uuid": "15f69bd5-f160-486d-98e1-161ab20c860c", "comment": "Malware payload", "value": "485def7433b510c341f7ea03b021a9d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706656167, "uuid": "245646b1-9f2d-4f46-a61b-451ae2abd7b2", "comment": "Malware payload", "value": "d3739ebdf6b72dd96ab0bb62b45fb08748154c40f0ab3e64e23645ab85426326", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706656167, "uuid": "1e2dc0f7-5b30-497f-8496-23f2a9a7851b", "comment": "Malware payload", "value": "0b7cae05d6981668946b29cadf54cf55766fcdea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706656167, "uuid": "3c4b6f3a-b35b-4576-a45b-54d190dafafc", "comment": "Malware payload", "value": "843b7a5e68eb788ec078c32de532ecd435071f0f55ca13a38aafd7cc2a1dc2e1732f122b847834823d6c59724eb00fd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706656167, "uuid": "9612aebc-29a4-45e6-aba6-5c729366dbe3", "value": "T1B8763391A2640CF5EBB6C13E8655C82AF371BA222354D6A727E8E2473F672435F3D701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706656167, "uuid": "1397d348-8070-432c-9953-c74db078555f", "value": "bae3d3e8262d7ce7e9ee69cc1b630d3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706656167, "uuid": "ab7b7e86-5478-4f0d-8f9c-e21128860461", "value": "196608:Z/uY1W903eV4QxoMToEuGxgh858F0ibfUxgABbbk9At8:PW+eGQxoMTozGxu8C0ibftl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706656167, "uuid": "ea57a363-b8ff-4980-940b-14eb0bed4a45", "value": 7486531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706656167, "uuid": "709477fd-7c21-4547-95ce-dad602d60652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706656167, "uuid": "adb90ff6-c758-4b3c-b864-28baa288da5c", "value": "token-logger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a281dea-bf73-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706621372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621372, "uuid": "2252b02c-1887-4455-aff1-3d7b9657165a", "comment": "Malware payload (Formbook)", "value": "a464fa61a47ab34200042e4e3c026acd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621372, "uuid": "6ded6e31-8c86-4663-b816-ff98cf9dbcb5", "comment": "Malware payload (Formbook)", "value": "d58c6fee983f0750aff8aa614888ea36c5955f87f88010fc506dbe93daf736e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621372, "uuid": "26baafd4-cb1d-4dcc-86b9-0eb20bedb5e2", "comment": "Malware payload (Formbook)", "value": "fd2883b7c7aa669bcb53639a1c9dd2e0e14423a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621372, "uuid": "e700bdce-fdb1-49d3-abd6-1f68d541432c", "comment": "Malware payload (Formbook)", "value": "eb34789e1192d3ba92b924e77b3ece93c992b92c0b7e87b224089a866961f7b17d314f579c542fce4f8435206829b359", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621372, "uuid": "9764fd7a-3989-4e82-b1bf-9d8cca5192b2", "value": "T1F8E4124137FCA713D9BF47F11672019047B97A0378A2E3AD0E8561EE1D76B805652F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621372, "uuid": "90ae4771-96e5-468b-8baf-60c5acc361a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621372, "uuid": "2b27f53d-1490-4ea0-be5a-1dc9f4967ba2", "value": "12288:xhcAoIFFHgeg/civPzG8i7e5WFxyu3K4tZLXVeDofYT9IjV+BK:xhcAXFxCPz2zFtVeEfYT+jV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706621372, "uuid": "97a1782e-a64a-40ab-9ae6-f3e6fb210d0d", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706621372, "uuid": "1c2ce01c-bf90-4164-9433-450d675726be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621372, "uuid": "2981648f-78c8-4716-8044-5d67a3c9b46a", "value": "z16REQUISITODECOTA\u00c7\u00c3Opdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd28221-bf89-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706630718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706630718, "uuid": "eb4394e0-f328-4d50-ad27-3da97462c243", "comment": "Malware payload (njrat)", "value": "0a7d2bbbe2960ff24b9273036fc472da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706630718, "uuid": "b406aa58-4629-4ba1-9e08-576d87332c50", "comment": "Malware payload (njrat)", "value": "d812b05b85a25ab0ec4258f8a4e9adda4a84d2df5b07fed42b84de539dfcabc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706630718, "uuid": "d76c1fe4-5203-4a44-b6c8-2ffe8eef8790", "comment": "Malware payload (njrat)", "value": "3b0fbb910651427a6a103327a0630e96acb8649c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706630718, "uuid": "a948d6b2-133e-484a-8d46-27c05b5efbab", "comment": "Malware payload (njrat)", "value": "a16b63fc1661a037c91f2befc47f176893d31f91955b60c5ef0272771851570ccdf21f2af6322523899b0009bc5d1d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706630718, "uuid": "2ee7fd79-6fc9-4001-a38d-ef4bd5d883a3", "value": "T16D032A4D7FE18168C5FD467B05B2D41207BBE04B6E23D90E8EF564AA37636C18B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706630718, "uuid": "528eb06e-f846-418c-9b26-333c5e165c55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706630718, "uuid": "7ee96454-f049-4712-b750-d09305b551e6", "value": "384:jstKUiDtblmJEpRGyEf7JfJuQCY6iXQrAF+rMRTyN/0L+EcoinblneHQM3epzX48:YtiHpR9Ef7JsQCFiArM+rMRa8NuqUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706630718, "uuid": "565a958e-5fd3-4b18-9bfe-4e192010349e", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706630718, "uuid": "03abb829-0aba-4233-8cca-cfb038ce7886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706630718, "uuid": "f4ead2ee-b805-4b50-9ee0-b2216faa9b52", "value": "0A7D2BBBE2960FF24B9273036FC472DA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acaab54f-bf24-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706587473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587473, "uuid": "1d691991-bb7a-4e0b-bb48-b6886ab47e6d", "comment": "Malware payload", "value": "65ea5410c5869dd9aa8511bdbeaab5bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587473, "uuid": "2508cec1-ae79-4e15-b73c-d3aa3841c88a", "comment": "Malware payload", "value": "d87d9fc0475f77301abc81d105c1603e74e6f03210694418fc20c7c8c6f1b393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587473, "uuid": "d27d52fe-97c2-4c00-a271-c62b8a318b8c", "comment": "Malware payload", "value": "cdd0d5e4bfae2d9d5e8f9b300c1e7bf6050196da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587473, "uuid": "97704735-946e-42d8-aec1-efef58ea5b89", "comment": "Malware payload", "value": "73efeb0c6638c3d7cb17b99d5d0b206c8991ac30f50dc8c5fb631adb80fbe4f8934092dfb950a1765039752f4d891db1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587473, "uuid": "9c0fb880-8f8d-4d0b-a541-b1a7b23f0482", "value": "T11B734B43B9D2D871E9721D311860C6A19E3FB9210E659E6B2344167E0F30AD1ED3AF7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587473, "uuid": "11f82d0e-116e-4120-9387-597041107ba6", "value": "67b092a69844bee71741beabb06b1afb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587473, "uuid": "513d2929-70fe-4c9d-b259-488e6f1ac8e6", "value": "1536:g1VAm1xLdXrKW2QbawQbulpjCDRGczgWSob+DHGZksW3cdP2Ck8Y:c1Trn2QbawJCDRGczgWS1GRP2Ck8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706587473, "uuid": "3d983ce1-e197-4c13-bf28-cff95c8edde4", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706587473, "uuid": "eb0642c7-7bb5-4baa-a832-8188deccba39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587473, "uuid": "44f1f66d-5e69-454b-8f91-406c5dc3538e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93b1fc6-bf70-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706620162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706620162, "uuid": "5be81240-d616-4065-97ea-05f9956a0e34", "comment": "Malware payload (Formbook)", "value": "82b7aa86cfef6b60df375ba59fb42793", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706620162, "uuid": "deb253dd-6961-49fc-844b-05f9f29203ee", "comment": "Malware payload (Formbook)", "value": "d90dd100eb8d2c639e9615f0657073e840f080f8a9a7a75f8f978fd13145fe0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706620162, "uuid": "2b8868bc-5e92-412d-b469-1239823fb20c", "comment": "Malware payload (Formbook)", "value": "9e3da3d1ee87e261d16216f33d2e183a1f3afe41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706620162, "uuid": "9bf1aec2-05a2-4b11-a0b2-3c4f564b90b7", "comment": "Malware payload (Formbook)", "value": "0b7c45f4811cc13dfd22a944e35e6e67bfa0e1d962914792a6f1f1cdd5b4d7117cb6f526cd2a177856e3f231c0500903", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706620162, "uuid": "7e97ffef-e2a6-448f-a2c3-cf7d6b364978", "value": "T137E412403BE85B56CA3B8BF02975906053B6792736B2E75D4EC2B0CE1E73F054661B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706620162, "uuid": "0ed90420-d5c9-476d-9ea7-3804242c2565", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706620162, "uuid": "1d37c118-b93e-4a36-974e-76bc33a77c2a", "value": "12288:hAoIFFHgeg/c8ePeNXyZ4/xcJPUk4uHWCnwmCXG4K3jvfev+q4qTifsYH:hAXFx8egXQUxcJPUk1HmWz3jvfe7ifL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706620162, "uuid": "19c1a519-9c4a-4c8b-933d-5beee7ca8c36", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706620162, "uuid": "723a9e62-66cf-4feb-86ef-a482e75a1659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706620162, "uuid": "cdd5c07d-24bb-43c0-95b0-a95b8eb20f86", "value": "r45075USD(MT103)_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d177cb0a-bf52-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1706607291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706607291, "uuid": "1d0d275b-e0c7-40f3-beee-1e22b4c28faf", "comment": "Malware payload (XWorm)", "value": "438049e9b58e9fddcce6299d7c7810f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706607291, "uuid": "ee7a818a-1f6f-4a67-a016-0ee5236f4e4e", "comment": "Malware payload (XWorm)", "value": "db84ea5000bfa4073cdcd8a3f8b9ba46a5e982293a3a8589b8072bd9884d45c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706607291, "uuid": "4499b5c2-22c0-409a-884e-2373088c726d", "comment": "Malware payload (XWorm)", "value": "a675c41da52d32ee4f8e00ee49872138024384bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706607291, "uuid": "440b4683-8d5a-4338-9f09-dea225061f12", "comment": "Malware payload (XWorm)", "value": "2d4834af9e62d7292583286d0a169abdfc8ce4e9e68ee3b795a5b15a1cca7a078f1cd6a60b4a3d772fab6e46bed34e07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706607291, "uuid": "093d94b1-cf95-47a9-8b18-fa80d9487ece", "value": "T14B25AD02B3D6D036FFAB92739B65B2055ABD7D290123852F13982EB9BD701B1173D263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706607291, "uuid": "257ed509-74fc-4e2e-94b0-105bf9ae8ab9", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706607291, "uuid": "73730af5-4117-4c04-bcef-143642af5445", "value": "24576:2AHnh+eWsN3skA4RV1Hom2KXMmHacJZ0XRSxG5:Rh+ZkldoPK8YacT07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706607291, "uuid": "2986a80c-9af4-4903-815b-bcae204a4013", "value": 1039872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706607291, "uuid": "25c9651c-9565-49cd-b73a-35081f2cfd90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706607291, "uuid": "de2a33ab-ea8d-44dd-bcd9-1b432c5df2e4", "value": "SecuriteInfo.com.FileRepMalware.17559.3908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fc2fe4-bf78-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706623323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623323, "uuid": "e2810d85-691e-448d-a33b-e4278f56e43d", "comment": "Malware payload (Mirai)", "value": "d0b3e5064db54b773a78dc955f0f957a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623323, "uuid": "a826971b-b9a3-4b8e-b4b0-aa7b1e60b344", "comment": "Malware payload (Mirai)", "value": "dbb3a8fc5e49c8b9c61269d7f64ee9b9894e787428bab6e0d22bc672edf0471e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623323, "uuid": "b453cf04-67a2-4cb6-b2e1-ea00be102377", "comment": "Malware payload (Mirai)", "value": "0a7c5bd743e4aabc64e5609f9e3586191caeca5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623323, "uuid": "95d41a01-1684-4c52-bb3b-b4e456206139", "comment": "Malware payload (Mirai)", "value": "61c515ac05d1ab11d068dcee68a4bbdfd95611909e2e0cdf3c639f0aeaa8fc06fb78890dea134aa6a7d136a244f23184", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623323, "uuid": "68951c38-25ac-4f05-b361-b68ad6f0d477", "value": "T105732A96B8819B21C6C5127EFA2E018E3313177CE3DE73129D24AF24778796B0E7B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623323, "uuid": "484cdd28-b768-436b-98bb-4746b3acafa4", "value": "1536:QAnxPk6QHJztYLwVJpXaUYW4opSLIyiMCi8dtY5RYi:CHXYAJpXaU8CjdtY3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706623323, "uuid": "7c8fc02d-d627-4c2e-b487-b55c5ccbbc56", "value": 75308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706623323, "uuid": "19475d00-7d8b-4bc9-86a4-353260bf6727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623323, "uuid": "52e787c8-92bd-410d-9ea1-7ddbed305400", "value": "d0b3e5064db54b773a78dc955f0f957a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4589b085-bf23-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1706586870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586870, "uuid": "c955e71b-20b9-49b0-a5de-f4ff62fcffdf", "comment": "Malware payload (PureLogStealer)", "value": "bc6d085a203913266fde3530393ebba7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586870, "uuid": "4e95936c-c490-478f-8ebc-43104a144c72", "comment": "Malware payload (PureLogStealer)", "value": "dc306a538c10c8e4ded86db7b1c4648191db7581b76c506bcf9ad511a5120aa8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586870, "uuid": "e7732538-f650-483e-8d75-6578cbec8893", "comment": "Malware payload (PureLogStealer)", "value": "9c79e454b2be4586651c0dffdcc3d9069c4aa6a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586870, "uuid": "63665755-586b-4cc4-8239-eb2652aed8e6", "comment": "Malware payload (PureLogStealer)", "value": "0291d70a229eccca9a39a78ddb7befea8182a4d7feca26fd630b6801b224bf46e8c5a957eb7390885198202998751b6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586870, "uuid": "603f0997-86a3-4e7a-a9fd-44108cf4d425", "value": "T1CA83D717FA5A98F3C2545FFBC59B408003ACD683F6A3E70E798E639619037EA9D4054B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586870, "uuid": "83ff6fcf-eb8f-4057-8401-b2efe0c13c38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586870, "uuid": "b894e3d7-8e17-4992-aac3-3685248f49d8", "value": "1536:LMYZLSz9QxNU84ybdvXiglUOQShjWSRsUYAhVdPu//FbnSjB:YYZLSJodkMsZAvdPg/FbnS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706586870, "uuid": "288667e5-f5bd-4e82-a434-ac0a169008d1", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706586870, "uuid": "2bcf2fe2-9788-48dc-83e0-ba148c10ecb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586870, "uuid": "0ec7d213-1fed-46ec-89f0-a1b1e839db5e", "value": "bc6d085a203913266fde3530393ebba7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915f4e45-bf3e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706598594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598594, "uuid": "3223ba44-aec1-4982-b5ef-e23a0c1ae1da", "comment": "Malware payload (AgentTesla)", "value": "273fb4773cbdafd32ac1cbb47650b5f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598594, "uuid": "4d4ee177-273b-45ba-9dd8-e4bae6baaf50", "comment": "Malware payload (AgentTesla)", "value": "dfa584d8bd26b3c499f21913ff031a7039006bc6eb978325825d0e33521e5758", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598594, "uuid": "5133f617-52b9-4af3-88f5-0ea683166e92", "comment": "Malware payload (AgentTesla)", "value": "b944cc4fd1b954adb557113c1a634881fb3d1d71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706598594, "uuid": "f7603d9b-2869-42d6-be5f-8461479cfcfe", "comment": "Malware payload (AgentTesla)", "value": "da430b75e3724ed97fabe87508e7c58a44590080d60169fd2b4bfe1f104d4e0a0fcce1042ffe78142f697aa65b3f3883", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598594, "uuid": "0085d997-060d-4930-a9f3-08190a6e5ee1", "value": "T12624BE1471ADA88FC2415AF55A9FB88E711CBC32FAC64B06365CF70E07342ABA61715F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598594, "uuid": "d3ed94ca-552b-470b-90cd-facf286c430d", "value": "6144:ckXunnT/qGeX/kPabxjIXZ41oeXOMdao5WhDPM:ckiT/uX8Pabxuu1o9k5IDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706598594, "uuid": "50111877-063e-4286-b6fd-c9c029b29893", "value": 218112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706598594, "uuid": "d5bc8193-20be-470b-8f96-2cd5bca2c79a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706598594, "uuid": "1750eaee-cd23-452a-9ef9-7bd08e738222", "value": "012024.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6263a335-bf4e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706605387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706605387, "uuid": "c55e6166-5a6e-4b0f-8246-32a6cf3a0f39", "comment": "Malware payload (LummaStealer)", "value": "dcf9cf022781f00c04594b92f0997fe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706605387, "uuid": "dae20d45-b599-4265-916c-111453b68709", "comment": "Malware payload (LummaStealer)", "value": "dfd80794ff8c069f103102973dca681d18609a2d95128662ea1ebbdb521cfcda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706605387, "uuid": "6f385759-df4b-4c02-81ae-97dfe350c735", "comment": "Malware payload (LummaStealer)", "value": "4b05308409b0038bebc5b23a1791976eee0e2cb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706605387, "uuid": "5a826874-d766-4126-b9ea-bb6ddf091584", "comment": "Malware payload (LummaStealer)", "value": "b404da4ba3d87ba5e54630a545e793987f6ea26a4a15b3d4c279c5c0a48b8e648a31648a1e483bf1c15af707dbd83eae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706605387, "uuid": "f8818017-e3d1-42e7-9c12-4ad0b92e5980", "value": "T1E7E47D6B8638C4A3EEFBECB5DD6491D6A42740B2199CC08D36CD0D4DB932E265E9D01F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706605387, "uuid": "36c62753-9333-415a-97f9-b31764a4f61b", "value": "2b7b16ea6305513a3787fed6f5a40b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706605387, "uuid": "cc24af70-6974-4030-97a2-e770906948bf", "value": "12288:mQ+4xp9+KR+G6p9wKvIAHDhCwQipJjYcUAwAQKufD6t+T6/:z9T+R5LDYGbQr85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706605387, "uuid": "e30e68c5-9ce8-4c00-984e-c7d289ca94bc", "value": 680601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706605387, "uuid": "77e19622-903c-4372-b8f3-5789b039d688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706605387, "uuid": "95282e2f-e51b-4618-a900-b624f947a790", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab0b630-bfa2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PovertyStealer)", "timestamp": 1706641640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641640, "uuid": "7186bb74-e5b1-48e2-bea3-baca6131052f", "comment": "Malware payload (PovertyStealer)", "value": "0b01ec2c4b4faac5d7591c9b17d75d2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641640, "uuid": "547e67b1-37e8-4c50-b122-73d909b3aa08", "comment": "Malware payload (PovertyStealer)", "value": "e2342e90d6baeda675e92025124c05266e4b99f251d967ff6a49ac65fa385060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641640, "uuid": "68211446-ef35-46eb-9b7b-1e99e7ffa0c9", "comment": "Malware payload (PovertyStealer)", "value": "a28a8431348d751709887d1293c80237782ab6b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641640, "uuid": "4a2ba028-00e9-4c19-b727-9f543d223074", "comment": "Malware payload (PovertyStealer)", "value": "dabb70af0af617b7990fe9c0cae1b292c9d68f39f0567bfda4ca4dcc3f071c6b9031b582950c4cb011f5f0f0f7af3e30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641640, "uuid": "22aac2bf-c518-48ce-bba0-d51d3751bba9", "value": "T1464633EE37CD2A64DD1209B8589EE3F857CEF3B71BA4FB0A56EA9D24931364007502D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641640, "uuid": "d3f54dc8-a087-43fa-ad0f-ef1fab66c660", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641640, "uuid": "3a7b0573-af9c-4435-92f3-d9b40d17f534", "value": "98304:PKMBJC+aOomVZs3/H+ub898uncF7IsMZJ7ANoQbz5MYverP6JU+B59yO4SO:Ph++zg3/Hbb8GunsmJgMijJUnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706641640, "uuid": "faa0c664-7090-4902-816a-6c1b7dbc0e63", "value": 5587456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706641640, "uuid": "3b5c9e76-d1e4-498b-b89f-86b426d2f2c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641640, "uuid": "c284d658-328d-47a1-9ad4-0f79b7127d44", "value": "Meow.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7138e2c-bf78-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1706623622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623622, "uuid": "c48dd308-5d04-4857-acb9-4cb2678e4fa8", "comment": "Malware payload (IRATA)", "value": "0596663c542e7cfb4473c8c8ef86eee5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623622, "uuid": "a135694c-6767-485b-9c0c-7af6b803c659", "comment": "Malware payload (IRATA)", "value": "e82b0023abcc4bdb549f319389620c4cbd8ffabe8648168db31db62fd84a6904", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623622, "uuid": "7079e81a-bb4a-4200-8cb8-9c071f70ae1b", "comment": "Malware payload (IRATA)", "value": "c618582a61402ca8ea8169178bbf31f1a0be770a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623622, "uuid": "31d3ce46-c342-43f9-a83f-895999dfb0c0", "comment": "Malware payload (IRATA)", "value": "97cc06135b248cbc3b310501091b56cbd9fc2c1324f7214a1b41cdab780a88e3e3483f0a8d501126a5e43cdd76111b91", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623622, "uuid": "3a7515ff-fb0f-40b9-93f8-bacc7bc0e534", "value": "T17D2633E6F1A3C187F6AB4073E423430ADB3A0D86BE501C5A64F7326155E7DE993198EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623622, "uuid": "bb3cabe3-b72f-4a3f-b3c8-86278f6e550d", "value": "98304:n9hinlhin6Vhinahinx1hin6hinshinUhin0YnXHqWEaObj8X7GpslOzS/W7:nbCzC6DC8CxjCcCyCKC0Y3qWKgX7WWQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706623622, "uuid": "b61eaf72-0af5-4e50-92e3-95d049de97d8", "value": 4706486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706623622, "uuid": "50d22e48-98ae-4d52-9b31-dc67d068a87c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623622, "uuid": "52f9800e-f1d0-4a8c-8bf0-42354155a853", "value": "CaixaSignNueva.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f6780f-bf64-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706614699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706614699, "uuid": "a415f8bb-3b6e-4083-ad3b-8d754c199f14", "comment": "Malware payload", "value": "a0ad541b6b14f43ba14405684a97f3a8", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706614699, "uuid": "267c25ef-2ab5-4fa6-ae1a-d7fbc94b1340", "comment": "Malware payload", "value": "e85e398c21acb2f705b03f05e8c4cf1c4273ed9fb2f214a4985c774638172358", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706614699, "uuid": "efb9949c-5f43-4f36-8dec-9f405386705d", "comment": "Malware payload", "value": "7a352063bec2ac40c9a65d28d441a115d75c1e4e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706614699, "uuid": "d4270015-0f96-42ff-adb8-93550b14a86d", "comment": "Malware payload", "value": "b246494cac70433dc90233b03821a049f1c4b6a0d2420a62d2593856022ad924031cba7af3f7c6708b2a3436c9336774", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706614699, "uuid": "58c3bb69-7ba2-4f7b-9acb-8afcbfc0dc71", "value": "T14DF57B86BC9040E5C4AEE33688669896BB31BC480F3077D73A50BE7D2E367D59E75348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706614699, "uuid": "0f188e0b-b4dd-4b53-9c93-8bf5c4f6c5e8", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706614699, "uuid": "bd2f84c6-6b59-46a8-a19f-f2819ecfeff3", "value": "49152:KwOPFjAT3iDTcjn0OlNBR69zxySJDc9MQy:KPBUQiSzxye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706614699, "uuid": "78a32cf7-51df-4286-90b7-618eee4d984c", "value": 3327488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706614699, "uuid": "1e97388a-1574-47b9-9f34-14931a135cf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706614699, "uuid": "049f068f-5fb0-48ea-b5fc-74fd8d48ebb7", "value": "a0ad541b6b14f43ba14405684a97f3a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9520208-bfba-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706652026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652026, "uuid": "1b46d538-e836-45ae-ad88-0c7919f8295e", "comment": "Malware payload", "value": "1790c53b0fb4fb472321bb88f8088924", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652026, "uuid": "8b91dda7-bbd4-47b0-af48-cfbde117eddb", "comment": "Malware payload", "value": "e9b414de446cd7571dd087894b11fbb8469b13f0b586f9be7900b39ebab7df3b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652026, "uuid": "c691457b-3141-4122-a75a-0a28d89373b3", "comment": "Malware payload", "value": "4c4ea2e225047e4144eaf407e185ad377ab8a149", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706652026, "uuid": "b54dcb2a-ebce-4fbf-a190-bfec76bd26c4", "comment": "Malware payload", "value": "dd0bcf611dbe4f4234131294896c5a0c225d953212775f12e5c9173fff5d7ecf587f379b40b2eb97d49fae8eb9b93317", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652026, "uuid": "2975c679-11d9-4b57-a02e-031a9399188a", "value": "T1CF631956F8814B22C5C5027AF92E128E332357FCE3DEB2129E116F2077C696B0E76D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652026, "uuid": "b5bc446f-f3b3-4dbb-8fdf-7e575eb31b89", "value": "1536:dpnFPmBzPrkdYRezXK1GDvOIv4Pa+Y8zgI7iKjbf5AAnrK5gYoo2:wzjkd60waojbf5AAnrKeBo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706652026, "uuid": "0e05a903-715e-486e-82a8-fb7a1add7f94", "value": 70964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706652026, "uuid": "9bedcb96-7b68-4753-b77e-f7c4a0039c7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706652026, "uuid": "c380667a-022f-472f-93dd-bfa7b86cc774", "value": "a6.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12fd55ad-bf8d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706632312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632312, "uuid": "b18545f9-af35-4bca-9946-7ac69c149f58", "comment": "Malware payload", "value": "a99b542eb4f7cd4224053c8b5fb34d1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632312, "uuid": "090bcffe-9668-4648-a570-854d8ae7538b", "comment": "Malware payload", "value": "ecab88e67dc943b41d9dd5702cfb7709ca5f5577529eaa9a4461f6b670879c1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632312, "uuid": "43124528-4dc0-4379-b54e-3a13c437b44c", "comment": "Malware payload", "value": "a6a836d2475e351bb65dc1bac6aa4c6d510e6a27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706632312, "uuid": "eb3d9a5e-6f15-4f85-b783-5633744835d5", "comment": "Malware payload", "value": "0d38b0e51ffe7a397ce784b18f8ef990665c6e414c36bca4bf226bf12dc3abe0f9a0b44c408e7e2c0fe15998f34f38d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632312, "uuid": "babf4c4f-b52f-4323-b20a-b1210e6053ac", "value": "T1B07512C2987858F1CE5A4F7674F30E790B134E527DB49A1D522972E80BB32C73922D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632312, "uuid": "c22edd88-d712-4fcd-bf9d-e57eea459b67", "value": "ea8d1a525ba3ade140d9729c35596691", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632312, "uuid": "b33c6087-f370-46e9-8e17-fd94771ee1d4", "value": "49152:bz3HjKNKI0B6YBI/ZpOWa6EauRpk31JtzSOLE:bzpB6YULOlvRpIJtzxLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706632312, "uuid": "c3654b91-351c-4b9c-a406-53b14bdd2193", "value": 1669784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706632312, "uuid": "1b98d67b-e7b8-466e-958b-561d4e2344ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706632312, "uuid": "cde39738-85d2-4e46-92f5-1a321eb799bf", "value": "SecuriteInfo.com.BScope.TrojanPSW.Maria.3264.29337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c2fc82-bf99-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706637714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637714, "uuid": "1eadfde2-40ee-4293-86cc-c51e8b837f89", "comment": "Malware payload (Mirai)", "value": "7f685010e922774cb70236f380ebc80d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637714, "uuid": "eedfd004-7654-4aaa-854c-8e50a47bd1f9", "comment": "Malware payload (Mirai)", "value": "ed853752c150291a2b44679857da6acacf251f2a4e72204bc9d689d15dc76b44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637714, "uuid": "764460aa-de37-4711-bcea-6a84d29e9517", "comment": "Malware payload (Mirai)", "value": "2c11984b1bda5ed1c668ef2a2e900851cd609503", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637714, "uuid": "04831e61-25e0-4299-8f18-d33b7586b7d1", "comment": "Malware payload (Mirai)", "value": "5f983a1612674955af2e4c0d6742c1af8b3eae3b450e4534a5af734b281b0325c6730c03b0ef1a4e6ca61625e356ced8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637714, "uuid": "e77e5c79-5264-4c5a-80ff-de4d551dd06b", "value": "T1C1D32A06B30C0A47D2632EF43A3F67D093EF9AC121E4F640356FAA899171E365545EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637714, "uuid": "94755fa1-f2bf-49b0-9792-a8cfda44851b", "value": "1536:a0nwryWv6n/qZIycSH98z+xpnvTnNoIRF9Ugg97PMXgvAtId0DD2h/qvI8kpd/zR:BWv6ocy8z+x57ndngpPMVtUpdbZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706637714, "uuid": "14be63f4-b604-47a2-86c9-2f6f4de3d378", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706637714, "uuid": "c9d95eab-95eb-4398-9fe5-b8809edd0c37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637714, "uuid": "e96063be-2d89-44d6-ad3a-bbf87c25a36e", "value": "7f685010e922774cb70236f380ebc80d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c484e22-bf92-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706634529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634529, "uuid": "40dc26be-7fa2-41af-b7b1-e727bc3d853d", "comment": "Malware payload (Mirai)", "value": "fc2ee84da0e7f7fba8087b4d2d7164a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634529, "uuid": "d71ccadf-e2cc-446a-a4c6-e63c1ea272af", "comment": "Malware payload (Mirai)", "value": "ee0f977893bbcebf9bba002fc62ce429960976e4777e73f9f4c6937593871ff2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634529, "uuid": "44aee4a2-3b0c-47f3-ba17-87a69a696a6d", "comment": "Malware payload (Mirai)", "value": "566cbe278695d4b036e583ea77c1a7880fa76e29", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634529, "uuid": "68baeb6e-daab-4add-9249-09a58ce962ca", "comment": "Malware payload (Mirai)", "value": "d4c0a8c02f9f2484c4d8752516cf62d18ffc28a2447436d67f3a8bd923cdce67eb4a66f059fda0d14536c995d6127798", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634529, "uuid": "87bf9630-f4d5-4057-91b8-753e79b84bfa", "value": "T1C404885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634529, "uuid": "79ee9397-0fde-4753-bcae-a3400a668a81", "value": "1536:Cl2JvnXPvLBQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/zwt/Y:Cgv/NcwZsCK9VRhAX+bShFSP0HbbwlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706634529, "uuid": "6c035fda-6383-47c2-9687-2bd8beee0591", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706634529, "uuid": "b4f11c1f-c28e-4d99-9048-3322e7b340dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634529, "uuid": "8d8ebe9d-470d-4107-9ee4-911140390618", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3736d428-bf92-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706634520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634520, "uuid": "e74bb0ba-d44a-43d9-8888-098dde3882d9", "comment": "Malware payload (Mirai)", "value": "dbae8490c69737aeef4aaa9ac961071d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634520, "uuid": "eb487e63-922d-4082-b92c-d11298231235", "comment": "Malware payload (Mirai)", "value": "ee2dfe0e1f568b17046a87423e784d2f22ba6b7e9b5d868b18ecf64542c1ab1f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634520, "uuid": "dba6d6c4-7d25-464a-b271-19917cf9dfab", "comment": "Malware payload (Mirai)", "value": "edc84095d215c1e70f2bcce49ae87615142575ce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634520, "uuid": "fa46278c-58d4-4129-a4e8-c2b4d9c74e74", "comment": "Malware payload (Mirai)", "value": "00a84e824a2fde8ebd3992d8bc2a985adbd1496ebaf2fd40775bbb24c192a52e5ee9dfe86a628f6657c9a004ddde10db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634520, "uuid": "a28b0b36-c2bd-4514-908a-0e4fd9d8d107", "value": "T1A7C31945FC415B17C6C212B7FB5E428D3B2A17A8D3EE72039D216F61378B95B0E36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634520, "uuid": "d0e59cec-e6ad-4961-916b-2bbfc5a8432f", "value": "3072:kDwLYhQPi019jc4r2/Z5pxqwlbuPV2b3:kDwzJnjc4r0Z5pxBoPV2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706634520, "uuid": "fa335efc-2dac-45fd-8944-2441334fc50a", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706634520, "uuid": "4f8f80fa-0fc5-4253-b9e9-2f8dcf12ec15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634520, "uuid": "49810266-295f-4936-a8db-47fcdf49b895", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5b3853-bf23-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706586908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586908, "uuid": "91651a16-a5db-466e-b43b-ec16589a8306", "comment": "Malware payload (RiseProStealer)", "value": "6afdc4faaa530cadbee94a853e82bc75", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586908, "uuid": "972c33bf-90c4-4a68-9791-3a185f3fb3fd", "comment": "Malware payload (RiseProStealer)", "value": "ee8decf1e8e5a927e3a6c10e88093bb4b7708c3fd542d98d43f1a882c6b0198e", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586908, "uuid": "96183087-33a1-4b62-98d7-bafad262d4fd", "comment": "Malware payload (RiseProStealer)", "value": "a503d31919ab5f7eb01d4a398b07cf0f76a844d2", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706586908, "uuid": "b97f9997-259d-4815-99e7-cd0f495b2648", "comment": "Malware payload (RiseProStealer)", "value": "1c1e6acc38fa45a97e1c896f946370f361a42d64af5e49c430f7d8eb1ab789ceb1275c8aade531085dd941bd6fbc9ad7", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586908, "uuid": "2a243448-f7bf-4d97-917d-e0bd28ec542c", "value": "T11805999D765071DFC86BC972CEA82C64FA6074BB931B9207901315EDAE0D99BDF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586908, "uuid": "85fbb1a4-5232-4b4d-9f5a-213b6645ca17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586908, "uuid": "41802280-6dc0-4a66-87af-674961a093a0", "value": "12288:vKtrEjLmF/l8oBimvYPD1FlsAYtLJp3tPBU3QEQWJ9Ts4HaSv4MehIPViF2cMFqe:ytruAl8oBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706586908, "uuid": "f85e5ffe-e73d-4d10-9461-6e4e2894dd9d", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706586908, "uuid": "3ff16322-2f48-46a8-b70e-6dd6bbc11635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706586908, "uuid": "84a8ff9a-fa97-432c-91e2-bce4c9d6f91a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "395d7d12-bfa2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706641396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641396, "uuid": "e6c935d1-def6-43b3-aa73-effa69e974b9", "comment": "Malware payload (LummaStealer)", "value": "562dd59a2224721861440b4fbd08ba15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641396, "uuid": "b91c30bb-6ca7-4478-9dcd-83218897ac6f", "comment": "Malware payload (LummaStealer)", "value": "efa2f3a45664c73d2283d5acc094013466de47753b795193dd37f2e54a13b34a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641396, "uuid": "b848fbf5-225c-4cf5-8812-2829d704f05a", "comment": "Malware payload (LummaStealer)", "value": "8713b757e5215fec310bdd28c0794dd1db1e6bf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641396, "uuid": "5667199b-9fb0-4d2a-99f5-09bf7150e2fb", "comment": "Malware payload (LummaStealer)", "value": "e02bff07a6c8a88d909d583bbe5d26dd1b86cd1d9857d68005852510ef483572e86edbebd1412ebb62a600ca9f0ab612", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641396, "uuid": "a7d38266-c12e-4e52-834c-d263c5b0fb56", "value": "T10536BE02FAA6CE22E15A6737D5E5441893F3E885A722E70B33D073791D833EF4C5568A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641396, "uuid": "ad7f2cd1-abc5-470e-ac1d-ed21f3b20b06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641396, "uuid": "7d80bdb1-5d5f-496a-9fd9-1cea1c90815c", "value": "98304:lssbgHa1PWUzVqMH5hWCmk+tVx6IakRZYxUBjBX:lssbgHa1P9x9hh+1HRZYxmVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706641396, "uuid": "f62796f3-340a-4dfe-8043-bd5a2792177e", "value": 5199952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706641396, "uuid": "2bfefd0c-6cb7-4267-af28-483fc3b98b01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641396, "uuid": "61a0f139-4566-436d-a1d2-d47a6743bdf1", "value": "Datacenter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d473d4-bf65-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706615303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615303, "uuid": "19234352-1a02-4fd6-bab4-ad294c399b24", "comment": "Malware payload", "value": "f2bc317ce04727cc99cfb6225e2a2802", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615303, "uuid": "458d5ceb-68f1-42de-a890-4aec10c7488d", "comment": "Malware payload", "value": "f080eec275f07aec6b7a617e215d034e67e011184e1de5b2e71e441a6dd8027f", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615303, "uuid": "3cc54a3d-4958-4d65-9030-7f0f80c3f28f", "comment": "Malware payload", "value": "5900581607148eebab9bb10e7540220a30d73376", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706615303, "uuid": "da8ea2ed-dcdf-4907-a226-332e647bd106", "comment": "Malware payload", "value": "8d84865335e4e9851e7afd9b6c2c1cfe61112c17ac0ba324efa0a251d7bd6c144472b62c58452298d070b29003c367b3", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615303, "uuid": "b3aa2472-396c-4335-ad2b-9436615332e1", "value": "T19DF31254ECD52E11E77866B9D2DF6DD81D6E3F2F18B249E76B0C23C8E32500296C256C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615303, "uuid": "6e2395b8-b7c4-4057-aaf6-e6c243a8cb25", "value": "3072:5ERHrnbwNNfUeC6KUc4UuKsEqc+kRfx77RfElDj/hfnU8GLS+af4BK:K9bwNN5aUcJuFTF019fQj5/U8GLS+1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706615303, "uuid": "55f4a9a6-3d88-45ec-9c74-f611a6cefa4c", "value": 165171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706615303, "uuid": "1aa670da-4c1a-4d3c-8be5-4026861e8ba4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706615303, "uuid": "be128d60-b217-46c1-a617-bd7b7e3dfc5e", "value": "Offer.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524233dd-bf9e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1706639720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639720, "uuid": "4fa0b2a0-55e9-4a0b-b6b4-06db701c5518", "comment": "Malware payload (Amadey)", "value": "b5ee067743155c953eb9b6426ede5062", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639720, "uuid": "e7750f87-85c9-42e1-a404-90164c8f25ff", "comment": "Malware payload (Amadey)", "value": "f0f556c5c015b66dae84e587e1c2735c532d4b1702e694838f7a66557be58ac4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639720, "uuid": "b8e1a50f-6db0-47e9-8d94-37a4952cb3de", "comment": "Malware payload (Amadey)", "value": "0725e7b508a48778c10a06c446845b0571480716", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706639720, "uuid": "2ff39ec6-081e-4097-8f56-6f1146fe6638", "comment": "Malware payload (Amadey)", "value": "e525c590185b061d5b3d025a24442c95421bbec857cfcd9473dcba8831760b81ea221887a97f457d782dd9bda60c9aa1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639720, "uuid": "e4fe44a1-ced6-43a5-b1e6-26adea9de447", "value": "T1120523B827EADA01C392387230CC858A9B346ADFB448EE68166F54071D359EF5717EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639720, "uuid": "c84a49b9-95a2-4adc-aeae-05e271c4724d", "value": "7515ecf8c0dfa4d230ad835fe0acb57f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639720, "uuid": "bc202b16-4a81-40c1-a9f0-c60dc9f6e7c9", "value": "24576:nG12J/IT4nTwQo6icoEC2fWnDxeCym1+RY:+30nTlfoEjOnNQmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706639720, "uuid": "938847b3-2d27-41b4-a549-fc18331aa616", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706639720, "uuid": "68423246-b9fa-4ee8-b990-cf0251e292f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706639720, "uuid": "78b39360-10dc-489b-a01d-a7016278bc5f", "value": "b5ee067743155c953eb9b6426ede5062.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b059bd0-bf78-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706623333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623333, "uuid": "147adda9-9f88-4f7d-ab4a-382c163623ba", "comment": "Malware payload (Mirai)", "value": "6afeef17a2939c5303f9be765b82ce29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623333, "uuid": "5bf8c23c-6382-4b13-a142-d8798fe0a84f", "comment": "Malware payload (Mirai)", "value": "f35955603791f1858167e609fcddc618ebcb0eae6fa57074dacc5ecb9b08f20f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623333, "uuid": "b98aedb8-a159-4b4b-9646-b80095c7ba6d", "comment": "Malware payload (Mirai)", "value": "f3a57bf8f76d8f8eb12eb9242a917d31d2859f3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623333, "uuid": "ae5ec5c3-b98a-4b6a-9e90-0874e7a3447c", "comment": "Malware payload (Mirai)", "value": "ac53dcbedba238a80b5fca5ccbf86c9d88ea5102ddc5bf116d60681e3b120a2f6df50d71af3c93dae9d9fa854e829d74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623333, "uuid": "a5becaad-3f84-4fb5-8345-486aaabda908", "value": "T1AB634B41BC819623C6D4227BFB6E428D372613A8E2DF7317DE216F1137C296B0D6B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623333, "uuid": "52c8c55f-9f4c-45e7-92d5-dee4808c22c9", "value": "1536:SnSWOXDKyKdPDn++vSPaO1Xf9KZQD17/v9:Snf++6P9Ht9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706623333, "uuid": "3e321ca7-cdb7-47fa-8c8a-4b3944e633ef", "value": 67112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706623333, "uuid": "3a7b46d1-4dab-4ddf-bb9e-3bcc9a228660", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623333, "uuid": "a67bca78-54a1-4c16-b8ce-877eb4ea1ff0", "value": "6afeef17a2939c5303f9be765b82ce29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1245175-bf68-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706616793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706616793, "uuid": "b798b1e4-cede-4fe7-bb56-9c5fe0f24768", "comment": "Malware payload (RiseProStealer)", "value": "4b80093eaa66e09865dc945dc0c2d976", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706616793, "uuid": "90c56ae0-f26f-48ce-b6b6-404537ac0c3d", "comment": "Malware payload (RiseProStealer)", "value": "f3acbdad7ceea5a08d839e6c4a0f248b6322ae4a892b02f8f6b13e571eaefe53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706616793, "uuid": "c38c3a23-c8a5-449b-b989-f1aa95af6862", "comment": "Malware payload (RiseProStealer)", "value": "99f5e473cdf643011de0e68632de6c60b5e01b20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706616793, "uuid": "abf1da9e-d5d1-4c2e-9cf7-10766c032124", "comment": "Malware payload (RiseProStealer)", "value": "2367a137881db256ae0f92be537874bc76a2687fd9fcfbd6bb95272879476666beb776e39df61ac678e3cccca33f6aef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706616793, "uuid": "637ba8a9-9c90-47dd-9bf6-a3ecefc6077e", "value": "T18F4633167E87558FD4C922B94B06F6ACB9F52EF82122482E6099BFEBDCF75D00974103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706616793, "uuid": "e97ddfb5-62f3-4693-9661-4d800701bb19", "value": "af383538cf77f09392da52a9c3442bda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706616793, "uuid": "a7896549-2191-447a-b7c5-aafb13955af9", "value": "98304:6LG6YHM10/QFEYuwZVHgOzHEk8AutvEuHCPSarbQsC83HqdfXHfVvvZZL56nCtUO:Opv10/QFkw7dluPBar0+Kd/9vvbV6nCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706616793, "uuid": "0620c5b7-165d-4560-8449-949109160de3", "value": 5645824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706616793, "uuid": "11f54f4e-b9cd-403a-91d2-df2874d83a0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706616793, "uuid": "5b74c419-c181-41be-a7b9-2476293611a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d58f7ea-bfa0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706640597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706640597, "uuid": "0703181b-41f1-43ce-a9b9-b2f55f1d4bb9", "comment": "Malware payload", "value": "4f59ca0bc42171562d3c320e88bb35d5", "object_relation": "md5", "Tag": [ { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706640597, "uuid": "4e7baef5-ba87-42e6-926e-2755d1789753", "comment": "Malware payload", "value": "f405f9208141f0e709810da86801f4f5c894eb3f655683deaf01e40983e6dd3a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706640597, "uuid": "0c477701-22a7-4f84-abd7-e1899200f834", "comment": "Malware payload", "value": "dc998dd19d42bee767abd37eefa4e754a7294829", "object_relation": "sha1", "Tag": [ { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706640597, "uuid": "86b8ec20-3e6e-4f93-9487-17a9488f8b65", "comment": "Malware payload", "value": "de9b9aab1f00dc1038ffc9231c642c451caf27793b5b94c642b1179dcb53720d5cf199a7d360e74455da2eabfc3e8fb2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706640597, "uuid": "edb67412-2e74-4e65-befa-7bcd6f5e474a", "value": "T1AA7633D621780DF5BBB5C93427789EA9F572E352710D25727A28F38B90DC10B4E39A0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706640597, "uuid": "0d14aea8-3593-4cd0-a250-80bf978854ab", "value": "98304:mQrSBZRY2fkxWgHALOeb88Q4wGTPGH9ptZ1+gfMuolP5sguK0iaPv04tKUyBPGAr:mQGi2fkxYaewaG7oHP5HG04ikZkT01Kr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706640597, "uuid": "f0a135be-e7f0-4b43-8226-4f2ba9173db6", "value": 7473569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706640597, "uuid": "19dd6ae4-5997-44ce-aa97-42332b9fb270", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706640597, "uuid": "bb7be2a4-4087-4f08-8fff-3cfc14fe84c0", "value": "southafrica.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2c63c0-bfaf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1706646960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646960, "uuid": "876c77e4-1440-49c9-a6ce-494cd863d6fc", "comment": "Malware payload (Amadey)", "value": "df35f19c7d7e1539ca17e4d839b20a04", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646960, "uuid": "cbb8383f-b919-40b8-8a5c-d84efd7ae846", "comment": "Malware payload (Amadey)", "value": "f50c34273870841df335fa73d1cd9c2acb9de70e4ed77dabfcc9eb98dcff9b54", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646960, "uuid": "a1cc5ded-96d8-412b-ba37-4c94a8bee30b", "comment": "Malware payload (Amadey)", "value": "7dab9f9d3ff0c6f4ee4d7f33ab81ac7118afe193", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706646960, "uuid": "c0d7817e-8109-4e45-913e-33ddbee1a0a6", "comment": "Malware payload (Amadey)", "value": "cd1a9287e633d8e0c1786d5dcd48839d7a7bfc9a397c45520fabdf9bd715684a08d070b1de5311891bbe8430acac0743", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646960, "uuid": "c2b47a1d-b693-4011-9ec2-d18dde703808", "value": "T11F946C61B916C032C65192711E68FFBAC5ADB9349F7006D737C40E7E9E211E26A31F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646960, "uuid": "83b9f05b-f50f-4e25-9b8f-32bb58413a94", "value": "7cb9aa2297e5fe3e1ffa772b481cce9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646960, "uuid": "edc2ee06-c561-4a2f-b571-97e580e59936", "value": "6144:uOdRAuQwnBqt1aNbaQH2weEc55EoRvDDoeAWOd9lPinZnPmx6u5+xH2/fUp14unr:Bdjn7NWEAvoe3O5Pipmx6u5+xMcHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706646960, "uuid": "01b7942f-e907-4f4e-82d7-3be6d7938e39", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706646960, "uuid": "fb8b7d67-9bae-4acf-a86f-65f7b22d4a10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706646960, "uuid": "c12964b6-54f3-42d6-978a-5710f9e5494d", "value": "SecuriteInfo.com.Win32.BotX-gen.27212.21808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fbdfcf8-bfa2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706641460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641460, "uuid": "b02d08c0-89cf-4dea-88f3-ad9118b45677", "comment": "Malware payload", "value": "75ff3413e3bf74b7cefe8ab14e43ca96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641460, "uuid": "87f59528-494c-48e1-86a2-18e4df22e95f", "comment": "Malware payload", "value": "f58add586ed2fd30ffc10eff51f55f859eff1e7870743d46a5cfdc7b76a5e308", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641460, "uuid": "13156447-2bb1-4804-8354-b044a2e58090", "comment": "Malware payload", "value": "e79114b68b6dd6e3708d01940b0f675e11e2f0be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641460, "uuid": "54680a8b-80bd-4f9c-9ccd-993c9b946e07", "comment": "Malware payload", "value": "0ddcf036758584d62009928be602957d10e9df0f44b40dd3c8f07bf34f9a40c92e356d85e1505166a7eb33c3945787fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641460, "uuid": "7b746b02-f270-4cc6-a43f-07007db47050", "value": "T1A5D6330A3720C506E10C0A3488A46795D77AAE47E653DBC52BBDF564D8FB3BD18CA2F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641460, "uuid": "5354b186-c3ab-40fb-8dda-614fcd10448c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641460, "uuid": "c92cdc73-b54f-46cd-841f-50ac17cbe8df", "value": "393216:xn4iEBs1/wAfRBP+nN2ILForm+BJH1Dc8X:xn4WVUnNl0c8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706641460, "uuid": "80806b59-76a0-4e8d-8201-c57c73ec524f", "value": 12944384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706641460, "uuid": "87c110e8-d47c-4596-898c-ff8bef830627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641460, "uuid": "d0933ca5-fe58-4bbf-ae86-2ef738c108c6", "value": "rspro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72f1c77-bf24-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706587463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587463, "uuid": "b27dd995-fb7a-417e-9908-c4e5ceec610a", "comment": "Malware payload (Formbook)", "value": "c51050da2c94bbb62c6d2c51862b15dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587463, "uuid": "882679fa-d67d-4b09-baea-9f8588f4f0bf", "comment": "Malware payload (Formbook)", "value": "f62de2f1a6d9798f4278ab073890c06f8a1027c216d3c02dbc4c84ff84c4ee72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587463, "uuid": "e5b6050a-79e2-4a96-93d3-cee9a72e9d7d", "comment": "Malware payload (Formbook)", "value": "84489f41759b69be75fa13430ba2f78143a857a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587463, "uuid": "cb1601cd-2d72-453a-b0ee-494ece840bee", "comment": "Malware payload (Formbook)", "value": "6b61223f8c7c82625aed2260fae63bf9706b2a3c12762d7d00dabe44e0640cedc1ce71d93fe886c86c6fd49db67882f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587463, "uuid": "4e1ac1b5-e4ba-4332-8507-68402c84fb98", "value": "T13D1512503F74D11EEAB56E322DB4E97C5E79AE050824EA037315B7CDB971B890B08ED8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587463, "uuid": "3154ed77-a65c-4c8a-8f2e-2b62585a3563", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587463, "uuid": "45299820-3212-4877-abd5-17f4e4552303", "value": "24576:nJzp/ZBD1bJJReGhyAynCXbwZ4pHzZhrh0Fy1:JVTD1Xhyn0bwZSnh0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706587463, "uuid": "0c39ff26-6713-4ac7-acd5-1293c663c943", "value": 937944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706587463, "uuid": "171ee9a5-99f2-481f-baaf-85f5fb6d4c33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587463, "uuid": "3b23ef59-906c-4618-bf36-92d2666a8dc6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7539ec3e-bf74-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706621739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621739, "uuid": "17cc4a9c-7112-4711-8cec-f220568a8fbf", "comment": "Malware payload (Formbook)", "value": "a5b1dbace43c93181e6d241aa73a9085", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621739, "uuid": "b2f6c83e-6e74-4165-b3f0-b137921eb9a5", "comment": "Malware payload (Formbook)", "value": "f7895628490fded13ba354471ddd6fd02d80b2ff28832ffd124d0e6b02bc412d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621739, "uuid": "d62b9395-7ed8-4b75-8b06-340b718bf0dd", "comment": "Malware payload (Formbook)", "value": "1d7a25eaec904829d1619b800789f9726c6c52a9", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706621739, "uuid": "795b38cf-2837-4636-9104-b6a0f48c3872", "comment": "Malware payload (Formbook)", "value": "301bbdf6231039d921b047083938785d0673d0b5002b4be9bf0ec270e7743fb93ef372687d5ffd7e9444023c6dc7f394", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621739, "uuid": "17629855-e84e-4c45-9970-6e19135b4a9a", "value": "T146D4233E2A5D89F7097B2497B9648281873CEA59B09E70F3A65C07F2279314EE8540DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621739, "uuid": "2676e9a4-916c-481c-8a2e-ab593195a845", "value": "12288:7AqZMpSDpsOJaj3Cmv1tGKNnJYdEwbrfHKCjn74ANHDRSei3i/eBhVO0sd7eEVlR:7AppSDrOCm9tG2Nw/ywUANHDRSeDCh4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706621739, "uuid": "84f33241-e91f-4016-87e5-3044ae65d239", "value": 601983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706621739, "uuid": "ccbe0e44-e071-4b50-84b6-686e0cc75e5a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706621739, "uuid": "a4e27c61-19aa-4dd0-b6b0-177f832abcdb", "value": "Product_List_2024__PDF_exe_7z.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4b91d8-bf94-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1706635519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706635519, "uuid": "4f322c01-34e2-4a28-a03a-695039933f95", "comment": "Malware payload (Amadey)", "value": "fe5aa71a9083e8e8afe13394c10f01df", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706635519, "uuid": "4173aa9d-b7c8-4dbc-8312-4837f75265d7", "comment": "Malware payload (Amadey)", "value": "f85208dafa53821b234f115339f4c2dfd60a59bf51e3b60753e8790df688e19e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706635519, "uuid": "6ccabd68-b5f9-4916-b334-fa6f7dedae70", "comment": "Malware payload (Amadey)", "value": "62111b0428acfc13dd5f8d6b23c14c56f7c20e06", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706635519, "uuid": "875ab3d2-f1a9-4610-9e24-7e28e64c428c", "comment": "Malware payload (Amadey)", "value": "fb4e10bf28a278d8d819d7d9de2370036877341db5c482d861b6147b762bcf3196f4c731751d8b5ec34d377dadb82e07", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706635519, "uuid": "6d29a1a4-a272-4d22-9e0f-d43f395a8dd1", "value": "T15A05232F4E6A6A19C310B3B30951AB497D76FB43AB455E243B77EE620C191FE4703C0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706635519, "uuid": "5234f9b5-3ff2-4f5d-94f0-33e0d0098cd2", "value": "7515ecf8c0dfa4d230ad835fe0acb57f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706635519, "uuid": "76e40a45-0873-4934-9d0f-278c6383e481", "value": "12288:QcjlmwpPa5yDBonlo7YNQGGnBaWn1sPDqWOF4GoBMePb0lvznThMlDWH2h:QomwpPa55nmwQjBaWn1CqAXBMDHhMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706635519, "uuid": "fc23b1d1-b6b8-48a4-ac27-87a43b64ede8", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706635519, "uuid": "d878fc30-3dd9-4936-b230-66a9d5066dab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706635519, "uuid": "5a517acc-a5fd-428f-bcb7-cfa8bda77d4a", "value": "fe5aa71a9083e8e8afe13394c10f01df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec164a9-bf50-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706606401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606401, "uuid": "826168d3-b85d-4562-bd7b-527db3d14848", "comment": "Malware payload (AgentTesla)", "value": "d459d0f7dcec91cc738fe3106aa4eefa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606401, "uuid": "281f85de-1ea9-49c0-a803-bfb45abf0d2f", "comment": "Malware payload (AgentTesla)", "value": "f9f837ad8007c947e999a258b8397ad371042e27eda4102e61b742b01d1845f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606401, "uuid": "c448bf95-5486-4dad-9def-76a85ca33551", "comment": "Malware payload (AgentTesla)", "value": "69ab254a227796af11266acd8f9dad9fdcd26f81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706606401, "uuid": "0b52aca9-6099-4ed0-bb9d-e772a20e2b07", "comment": "Malware payload (AgentTesla)", "value": "961cb22111388e523cb9eb77cf495e607473d893ad0fdb5ed0ddc98dad5348c203ff541243df9f0ff393f6cd751f27fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706606401, "uuid": "cd5f830a-64b3-44e3-b32b-4db8fc5e1c91", "value": "T131E4331FF69039238617F0126EF9C446523FC1E949A281AAC2852FBF371395A4DF5B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706606401, "uuid": "9efa0505-69a8-4af0-9898-79be83b28e30", "value": "12288:h9yVFX+r/uWu0irAtrmpOCsjGtLQqcYxVV3hReI7VDnHtYVs34pA6f5Nj5FJ:6Vl+zu9AFmsCMGBPccJ+uVDHGG34pA6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706606401, "uuid": "9fe4a8d6-5f9f-46ae-92d7-dcaf1b21581f", "value": 679356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706606401, "uuid": "f7122d4a-ee53-4400-b388-a577d5fa546b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706606401, "uuid": "576e52ef-6b6f-4f5c-af80-126c184ea702", "value": "RFQ_NEW ORDER INQUIRY.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3218342a-bf92-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706634512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634512, "uuid": "263e001c-54ac-4b15-8688-8deaca5365a0", "comment": "Malware payload (Mirai)", "value": "73a31c204c319b0a81ea8c30d247a1bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634512, "uuid": "467ef92c-e5b2-4edb-a2e1-9936234edf8e", "comment": "Malware payload (Mirai)", "value": "fa14faa16aca4fbf557f41922c7cb3de70efc1ea95bb60302f86b83b46844039", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634512, "uuid": "0a9c586d-01f0-4541-b922-0874c124403b", "comment": "Malware payload (Mirai)", "value": "bd6f7d79c53fc84ad23d751f8a1a6f3a4f199ab0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634512, "uuid": "ebb194a0-2229-47ef-85c9-7e35755b7e54", "comment": "Malware payload (Mirai)", "value": "29f38a8584556e14700858a8ea9f73fae82e563d9dc5a70267c08912edae4f631dcd48982beae7b70a97fd6068a39c41", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634512, "uuid": "ee7cdd9b-d3c1-4459-920d-4609ac3f9e28", "value": "T15D936CC5F683D4F5E89304B1613AEB339B33F0B52019EA43D7799932ECA1511EA16B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634512, "uuid": "878dc4a6-9da8-4b0a-af72-31407d03be7a", "value": "1536:xpmWc2AcighsZ82fJxfcIHH1mSsM8y6Q+gBQ9TnkISGtAd80xZ:xpmX2riED2frfPHVmL1Q1Q9kVT80x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706634512, "uuid": "8c09e41d-0487-48c7-b2f0-56d97a52fd8c", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706634512, "uuid": "48e98b2e-8914-47f2-be05-2a358a60d159", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634512, "uuid": "67802966-685e-4723-81dc-686f3c9ac9e7", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f05342f-bf24-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1706587289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587289, "uuid": "44993b4b-bf85-4c18-8fa9-f4998ac729c8", "comment": "Malware payload (Stealc)", "value": "c310ac6a7b8f06439364ce1e2e9d5453", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587289, "uuid": "21181e88-e858-40c7-b594-3dfc0552bd92", "comment": "Malware payload (Stealc)", "value": "fb2b3cee6ed4ce327e57f631befe82f24499a9a227371f351586daa9d92640ca", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587289, "uuid": "d09ee07a-b937-4850-b230-e5a5b920bc2e", "comment": "Malware payload (Stealc)", "value": "cae022f0f97d0603b19f03b20051fa1c965e5955", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706587289, "uuid": "0bf29117-5cba-4cde-aa59-9f552b704f5e", "comment": "Malware payload (Stealc)", "value": "0b0cb2c95fb6552a0208ce82c967c4d0466829c040f938b72ca5beca2fc1e201ffcf372009bb6191ed415b9ff344f3f0", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587289, "uuid": "e4b9cda0-ac8f-4fb6-a7c6-37a4c80ebdb5", "value": "T19B729D907B4C2266D9DA4B754CD3A5224EB2B2D24C408D1F3EE881CD2D43FD42F956BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587289, "uuid": "4d564a36-0677-41f4-bfa7-7059477d32c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587289, "uuid": "0c3dcaff-f683-480e-8a99-e2eef167a1dc", "value": "384:TKx+LTKhjVBCe9DRJopPGoGCJEF8ZpHtB:TKMCNnxnyEFiRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706587289, "uuid": "339ebb13-59ab-4206-9d8a-60bbddaf6c5c", "value": 16752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706587289, "uuid": "b08b7b66-701d-42d9-a5d2-677d24c40d0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706587289, "uuid": "520acbf3-6046-44cb-a6c5-1f186f831347", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3528b5d8-bf92-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706634517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634517, "uuid": "2f074108-a64d-4abc-aab6-0565e108191a", "comment": "Malware payload (Mirai)", "value": "eaea7ca564341cf3c413209db92464aa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634517, "uuid": "f8e1632a-e1c4-4a02-8700-1cd96b821ea8", "comment": "Malware payload (Mirai)", "value": "fc652855277069cfccd854f2ce0b9cce4493e9ce6d4db37b82f96e7817cbf4be", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634517, "uuid": "9972b4a7-a248-4f0d-b742-8eb2dbe605b7", "comment": "Malware payload (Mirai)", "value": "1977f5dce0adedae33022c273ba2b2fd0038f2c3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706634517, "uuid": "c4a737b0-4e1f-425c-9ce6-1ea6084a7ac2", "comment": "Malware payload (Mirai)", "value": "dd49c4ddcda97e845548147a13fd65db8d455a34d2a0e03dcd41758e574e85eb55fdaa939bd987102842bec9273ade1d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634517, "uuid": "61d0e755-c320-4827-8710-68ed845be247", "value": "T1E2E30A56F8819B12D5C111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634517, "uuid": "b860abfa-56a6-4ad3-9a5e-0fcdec13dc7c", "value": "3072:pUkePvCU2u9hRXR8ExDY6aMGk8TaeCO3w1RpQ:pUHClIRXeUDnayeH3w1R+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706634517, "uuid": "d559a79f-57d2-409c-9e37-5c9611064f3b", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706634517, "uuid": "7ea87cfc-f2de-4cff-8298-5be890e095dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706634517, "uuid": "1465c08b-b480-4f32-8f4d-f3a2148096f1", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22e96fd-bfa2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706641625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641625, "uuid": "e220b1db-847a-46d7-95a4-f6d385494979", "comment": "Malware payload", "value": "b28d81f43e552872ca5bb72b95a40e70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641625, "uuid": "97288c5e-3880-4e33-a38a-4f68d0b018ef", "comment": "Malware payload", "value": "fd31c8cd7252b5af2160123e699d8e2f20aea6c07e8f39b241ec0b092581e329", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641625, "uuid": "95065435-fe96-49f2-9bc1-2e83f548afd4", "comment": "Malware payload", "value": "6b6e787385f33fd9f8a27cb85d77ff5f5f075016", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706641625, "uuid": "81bf8fbb-6331-4f79-b93b-471dcb5fc5aa", "comment": "Malware payload", "value": "f1fd770c45db337b5f3de95c5ee0bdbc2724bfc50c047a22585f34ebffb36eb1c4bc265f2b2e51f6db8dbf268a0836c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641625, "uuid": "3593b143-68a5-4c12-9503-1c0de44717b4", "value": "T10EE4234F5625AD7AD00187F30D527358A12EBF3992E48C0BF70C6F1D77AAA82E249717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641625, "uuid": "f53bfe7d-5c2a-4ddd-81df-62d231d34d93", "value": "7d5c9bc3b53760a6f75e85d654cb2b75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641625, "uuid": "a4107456-c680-4683-9a33-3d66d7a2fba6", "value": "12288:yUs9rDJBnYwPzIFb4Hkslb58JJToePbRpz+QSHOipEy/XURJ66CPoMl/DKZDjz:Ls9rN9YwPzIFbDslb50xVXipZ/U76Ho/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706641625, "uuid": "4770ea7a-3934-4c0a-904b-29811454d39c", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706641625, "uuid": "bac8f42f-b73f-4364-bfe4-8ad6820364b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706641625, "uuid": "e3bd0ddd-ee85-40e8-a033-a50057c41687", "value": "information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97708a85-bf86-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706629528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706629528, "uuid": "5bd67976-9eb3-4816-88e0-7a6bdae8ff5c", "comment": "Malware payload (Mirai)", "value": "804cb3fd68dab7aa8e3397e6d727a7bb", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706629528, "uuid": "b9b09eb8-b0ed-48ac-b9fa-a39548091caa", "comment": "Malware payload (Mirai)", "value": "fdb8897c038814e224ca325174acb2ca906a2638955882904762db194d7b4f9d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706629528, "uuid": "2c36b945-4e90-4d0a-a6c5-bddd248228cb", "comment": "Malware payload (Mirai)", "value": "67a314151295ee69a98e38aad4d4e997fc4620a2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706629528, "uuid": "d721687e-89cf-409f-9e7e-043a1e0e6c1a", "comment": "Malware payload (Mirai)", "value": "0031938d52de6a348c59788e8fe793afb9ed26a88add0c6bba32bd8fdb391339ac1126e7bed144cc2d7abb7501b750f4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706629528, "uuid": "b7f37618-62d7-40c7-80ca-bb9790177681", "value": "T17F43191BF581C1FDC09AC174466ABA3EAD3371FD0238F2A677E4EA222D96E215D1DC44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706629528, "uuid": "26865acc-d8ed-488e-8892-5f595221ff3b", "value": "1536:fzYOpW1Jq+n5BKforamopVEHYa8f66YfuTeDR7CYy:7YQW1JqyPKgra5lPrY6eDR7CYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706629528, "uuid": "0807fb3f-8012-4515-98d2-a9ed2be93ef9", "value": 59200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706629528, "uuid": "8c091f97-b655-4ee2-a186-f083f4a26494", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706629528, "uuid": "1ae4e58c-a858-46d9-8bad-24c33d35831b", "value": "804cb3fd68dab7aa8e3397e6d727a7bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67dbcf59-bf5d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1706611839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611839, "uuid": "5f448b52-44e2-4865-ba44-e32988c1f474", "comment": "Malware payload (Arechclient2)", "value": "81a6bfaaad389aa059b0b1f59a7018f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611839, "uuid": "e0844a2e-ac1a-49d4-92af-62a4c5bfac78", "comment": "Malware payload (Arechclient2)", "value": "fdc232f395a64331881a5ef09b607da91c0a2cce0b0ebced9aaf94e3a57ceff2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611839, "uuid": "5ad5bc64-16ff-4548-ade7-ddfeecb123b3", "comment": "Malware payload (Arechclient2)", "value": "993ea40ffd41a3e138c3c126c82e9229791d69cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706611839, "uuid": "364144ac-98a1-4172-9367-1c8b003b457e", "comment": "Malware payload (Arechclient2)", "value": "9375e3c84ee1fca5e288dfc96a3c3225c590f5df7bfab557d3c139e1b9edcd7c0fcce02ce466d1cfa2016aa367424a67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611839, "uuid": "ccada1c0-1056-4f40-9e59-c0b6700dfedc", "value": "T16216E011FD889D9CD69A6A39C4DB931097FCB4D21BA2EF076A5D626C0243306FC8D5EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611839, "uuid": "0a19d96f-1525-4f18-b645-3b276b05d498", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611839, "uuid": "86fff6ee-cfb4-4321-b116-e3356bdc8776", "value": "98304:W0vwXjuJmr5/JkCpoP2GtFd92whlaoTyp7:W0Por5SP/tFisTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706611839, "uuid": "e5cf02bd-5b10-4c62-8671-84fb6c8a21f1", "value": 4095600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706611839, "uuid": "9bcdcb12-66fb-4f3f-b16b-d346989a2a8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706611839, "uuid": "bf619b39-af01-41b0-98a0-ad171adaeeae", "value": "81a6bfaaad389aa059b0b1f59a7018f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a09b34e-bf99-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706637639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637639, "uuid": "508b5507-4be1-4883-8285-be4131ab4926", "comment": "Malware payload", "value": "65d8ba2504cf970adb7ac87a42703e16", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637639, "uuid": "f3cf0ac2-d989-4ef0-b1a5-657fe5d5a083", "comment": "Malware payload", "value": "feab413f86532812efc606c3b3224b7c7080ae4aa167836d7233c262985f888c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637639, "uuid": "3fff8054-1e1a-4f9a-bdfa-cbadc3ef443a", "comment": "Malware payload", "value": "fc40b6963f59d6fdf3fba174f2db451a1e43725b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706637639, "uuid": "73829a80-3b18-4452-b5c5-1b158d00b407", "comment": "Malware payload", "value": "8459e200276964516bfc4c5743c828435547ec2907a1c850aae8283ce4a52359e6f07b098653e6d0d6822c4ebcd4f8fa", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637639, "uuid": "05b2dd8a-f397-4733-be75-4d8a8a76af45", "value": "T145D097023714ED92E49188D1978C2C054806DA446910719432AC04588C98832AA201F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637639, "uuid": "a6711b02-0036-435a-b6c9-7226d73821f1", "value": "3:mKDDU8XHorXZj4I5xXALBFgatcRhsJpBGEXqNxhavDUYJgm5hsJpuwuIg8fLqpW/:hIjt5RAPIHsBGMwhGpt/suwuIac3tN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706637639, "uuid": "73f770a9-d3ef-4ade-a893-2102adcd2fa9", "value": 224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706637639, "uuid": "7cb40295-d6cb-4084-8f45-17f48b2d0143", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706637639, "uuid": "008db835-7245-4205-a172-e72dc4ac05a2", "value": "SD.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316a4cd2-bf78-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706623344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623344, "uuid": "1a68a8c3-830b-4079-ad2e-8b280b70b56e", "comment": "Malware payload (Mirai)", "value": "b9b807269e42f7dfe7a06695ff7235b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623344, "uuid": "12539c73-b79d-4d3f-a805-b56bc60fdec5", "comment": "Malware payload (Mirai)", "value": "ffafe81bca268894404b9f4ce6907f75aea4af8305df8848d16e606b1fda562f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623344, "uuid": "05054bfb-d707-4605-94c2-e252ad1d565e", "comment": "Malware payload (Mirai)", "value": "75144ce8fa5774ec2e438fcab162360e6535d296", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706623344, "uuid": "53030133-6ab4-4cc4-b73f-c88221821ea7", "comment": "Malware payload (Mirai)", "value": "152e3d928a52947343055ed966cacce57dd0fc7bc0908b7e5ad750aa53f31b79698552725664bebd916dd1dcd923feb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623344, "uuid": "f0d74b55-398a-4e1b-8360-5c7800a8518e", "value": "T1B2534B02721C0E47C1B35A743A3F27E083BFEA9121E4F684651F9B869675E3A5186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623344, "uuid": "49e26060-e544-41eb-b9ff-853420a815ab", "value": "768:8txlH4RsYEqRcqERkrL6pGyIus2CH9BZdwoosUsaJBoEHNE/NF5otfKyDIdA2:8MrEc69XmBvwohU7oSS/ZolpwA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706623344, "uuid": "86745c20-ac1a-465f-bbc0-af653d9f9e10", "value": 63112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706623344, "uuid": "554b5671-8f23-4564-b0b6-6cf9b52169f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706623344, "uuid": "da5e13d8-0bb1-4a90-9c17-55c776a5b2fa", "value": "b9b807269e42f7dfe7a06695ff7235b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }